Get in touch
← Sentinel Explorer
↳ GitHub sourceAnalytics ruleInformational

CyberBlindSpot - Any Issue Detected

View on GitHub ↗Original file ↗

Description

Generic alert that triggers when ANY CyberBlindSpot issue/incident is detected in the logs. Extracts nested metadata from RawPayload.
Rule type
Scheduled
Version
1.0.0
Declared status
Available
Query frequency
5m
Query period
5m
Trigger
GreaterThan 0

Declared MITRE coverage

ReconnaissanceDiscoveryResourceDevelopmentInitialAccessT1592T1598T1566

Declared sources

Metadata from the source file. No dependencies inferred from KQL.

Connectors

CTM360CBSConnectorDefinition

Data types

CBS_MalwareLogs_AzureV2_CLCBS_BreachedCredentials_AzureV2_CLCBS_CompromisedCards_AzureV2_CLCBS_DomainInfringement_AzureV2_CLCBS_SubdomainInfringement_AzureV2_CLCBSLog_AzureV2_CL

KQL query

Original query, unchanged.

CBSLog
| project TimeGenerated, IncidentId, Subject, Severity, IncidentType, Status, Class, ExternalLink, Brand, FirstSeen, LastSeen, Remarks

Declared entities

URL

Related content

Links established from declared identifiers and solution manifests.

Solutions1
Connectors1

Source provenance

GitHub

Displayed values come from files in Azure/Azure-Sentinel. They describe the published template, not your workspace configuration.

Source identifier
abe1a662-d00d-482e-aa68-9394622ae02e
Additional source files 2Solutions/CTM360/Analytic Rules/CBSAnyIssueDetected.yamlsource ↗Solutions/CTM360/Data/CTM360.jsonsolution-membership ↗
GSTEP / CATALOG TRACKING

Added to catalog : 16 Sept 2026 · 05:49 UTC
Last change observed : 16 Sept 2026 · 05:49 UTC

GSTEP sync dates, separate from the source content’s publication dates.