↳ GitHub sourceAnalytics ruleHigh

GTI - CISA Known Exploited Vulnerability Detected

Description

Detects vulnerabilities ingested from Google Threat Intelligence that are in the CISA Known Exploited Vulnerabilities (KEV) catalog, meaning CISA has confirmed active exploitation and mandated remediation for federal agencies. Uses the explicit CisaKnownExploited field from the GTIVulnerabilities parser, with Tags-based fallback for coverage.

Rule type: Scheduled
Version: 1.0.0
Declared status: Available
Query frequency: 10m
Query period: 10m
Trigger: gt 0

Declared MITRE coverage

Declared sources

Metadata from the source file. No dependencies inferred from KQL.

Connectors

GTIVulnerabilitiesConnector

Data types

GTI_Vulnerabilities_CL

KQL query

Original query, unchanged.

GTIVulnerabilities
| where isnotempty(CisaKnownExploited)
    or isnotempty(CisaKnownExploitedDueDate)
    or isnotempty(CisaKnownExploitedAddedDate)
    or isnotempty(CisaKnownExploitedRansomwareUse)
    or (isnotempty(Tags) and tolower(tostring(Tags)) has_any ("cisa-kev", "cisa exploited", "cisa_exploited"))
| extend Cvssv3Score = coalesce(Cvssv3xBaseScore, Cvssv3xTranslatedBaseScore)
| extend
    CisaKnownExploitedAddedDate = iif(isnotempty(CisaKnownExploitedAddedDate), datetime_add('second', toint(todouble(CisaKnownExploitedAddedDate)), datetime(1970-01-01)), datetime(null)),
    CisaKnownExploitedDueDate   = iif(isnotempty(CisaKnownExploitedDueDate),   datetime_add('second', toint(todouble(CisaKnownExploitedDueDate)),   datetime(1970-01-01)), datetime(null))
| extend
    Vendor       = tostring(Cpes[0].start_cpe.vendor),
    Product      = tostring(Cpes[0].start_cpe.product),
    CpeVersion   = tostring(Cpes[0].start_cpe.version),
    VendorFixUrl = coalesce(tostring(VendorFixReferences[0].url), tostring(VendorFixReferences[0]))
| mv-apply _c = Cpes on (
    where isnotnull(_c.start_cpe)
    | summarize AffectedVendors  = make_set(tostring(_c.start_cpe.vendor)),
                AffectedProducts = make_set(tostring(_c.start_cpe.product))
  )
| project
    TimeGenerated,
    CveId,
    VulnName,
    RiskRating,
    Priority,
    ExploitationState,
    ExploitationConsequence,
    Cvssv3Score,
    Cvssv4xScore,
    EpssScore,
    EpssPercentile,
    CisaKnownExploitedAddedDate,
    CisaKnownExploitedDueDate,
    CisaKnownExploitedRansomwareUse,
    Vendor,
    Product,
    CpeVersion,
    AffectedVendors,
    AffectedProducts,
    Description,
    VendorFixUrl,
    VendorFixReferences,
    Tags,
    Type

Declared entities

URL

Source provenance

GitHub

Displayed values come from files in Azure/Azure-Sentinel. They describe the published template, not your workspace configuration.

File: Solutions/Google Threat Intelligence/Analytic Rules/Vulnerabilities/GTI_CISAKnownExploitedVulnerability.yaml ↗
Commit: 9800e51 ↗
Source identifier: 650429cd-afc6-41a5-90e7-6e4a85b2335d

Additional source files 2

Solutions/Google Threat Intelligence/Analytic Rules/Vulnerabilities/GTI_CISAKnownExploitedVulnerability.yamlsource ↗Solutions/Google Threat Intelligence/Data/Solution_GoogleThreatIntelligence.jsonsolution-membership ↗

GSTEP / CATALOG TRACKING

Added to catalog : 16 Sept 2026 · 05:49 UTC
Last change observed : 16 Sept 2026 · 05:49 UTC

GSTEP sync dates, separate from the source content’s publication dates.