↳ GitHub sourceAnalytics ruleInformational

HackerView - Any Issue Detected

Description

Generic alert that triggers when ANY HackerView issue/incident is detected in the logs. Extracts nested metadata from RawPayload.

Rule type: Scheduled
Version: 1.0.0
Declared status: Available
Query frequency: 5m
Query period: 5m
Trigger: GreaterThan 0

Declared MITRE coverage

Declared sources

Metadata from the source file. No dependencies inferred from KQL.

Connectors

CTM360HackerViewConnectorDefinition

Data types

HackerViewLog_AzureV2_CL

KQL query

Original query, unchanged.

HackerViewLog
| extend RawPayloadDyn = todynamic(RawPayload)
| extend 
  AssetName = coalesce(AssetName, tostring(RawPayloadDyn.meta.asset), tostring(RawPayloadDyn.meta.host)),
  AssetType = coalesce(AssetType, tostring(RawPayloadDyn.meta.asset_type)),
  IpAddress = coalesce(IpAddress, tostring(RawPayloadDyn.meta.resolved_ip)),
  ExternalLink = coalesce(ExternalLink, tostring(RawPayloadDyn.hackerview_link))
| project TimeGenerated, Title, Severity, AssetName, AssetType, IpAddress, ExternalLink

Declared entities

HostIP

Source provenance

GitHub

Displayed values come from files in Azure/Azure-Sentinel. They describe the published template, not your workspace configuration.

File: Solutions/CTM360/Analytic Rules/HackerViewAnyIssueDetected.yaml ↗
Commit: 9800e51 ↗
Source identifier: abe1a663-d00d-482e-aa68-9394622ae03e

Additional source files 2

Solutions/CTM360/Analytic Rules/HackerViewAnyIssueDetected.yamlsource ↗Solutions/CTM360/Data/CTM360.jsonsolution-membership ↗

GSTEP / CATALOG TRACKING

Added to catalog : 16 Sept 2026 · 05:49 UTC
Last change observed : 16 Sept 2026 · 05:49 UTC

GSTEP sync dates, separate from the source content’s publication dates.