↳ GitHub sourceAnalytics ruleHigh
CTE - Device License Capacity Critical (99%)
Description
Device license capacity has reached 99% - new and existing unmanaged devices may go unprotected. Emitted once when usage newly crosses this threshold by the daily tenant health-check job (api/src/functions/tenantHealthChecks.js); resets and can re-fire if usage later drops back below 95% and crosses again.
- Rule type
- Scheduled
- Version
- 1.0.0
- Query frequency
- 24h
- Query period
- 2d
- Trigger
- gt 0
Declared sources
Metadata from the source file. No dependencies inferred from KQL.
Connectors
Data types
KQL query
Original query, unchanged.
CybereinforceCTE_CL
| where EventType == "license.capacity_critical"
| extend d = parse_json(Details)
| extend AppName = "Cybereinforce", ActiveDevices = toint(d.activeDevices), LicensedDevices = toint(d.licensedDevices), UsedPct = todouble(d.usedPct)
| project TimeGenerated, TenantId, AppName, ActiveDevices, LicensedDevices, UsedPct, Severity, Category, Source
Declared entities
Related content
Links established from declared identifiers and solution manifests.
Source provenance
GitHubDisplayed values come from files in Azure/Azure-Sentinel. They describe the published template, not your workspace configuration.
- Commit
9800e51↗- Source identifier
7f4af730-5c89-4f7a-aa7a-933b6e9309b5
GSTEP / CATALOG TRACKING
Added to catalog : 16 Sept 2026 · 05:49 UTC
Last change observed : 16 Sept 2026 · 05:49 UTC