↳ GitHub sourceAnalytics ruleHigh
CTE - License Expiring Critically (7 Days)
Description
A Cybereinforce license - paid or trial - is expiring within 7 days. Urgent renewal action is needed to avoid a lapse in protection. Emitted once per license term by the daily tenant health-check job (api/src/functions/tenantHealthChecks.js); re-arms automatically on renewal.
- Rule type
- Scheduled
- Version
- 1.0.0
- Query frequency
- 24h
- Query period
- 2d
- Trigger
- gt 0
Declared sources
Metadata from the source file. No dependencies inferred from KQL.
Connectors
Data types
KQL query
Original query, unchanged.
CybereinforceCTE_CL
| where EventType == "license.expiring_critical"
| extend d = parse_json(Details)
| extend DaysRemaining = toint(d.daysRemaining), EndAt = tostring(d.endAt), Plan = tostring(d.plan), AppName = "Cybereinforce"
| project TimeGenerated, TenantId, DaysRemaining, EndAt, Plan, AppName, Severity, Category, Source
Declared entities
Related content
Links established from declared identifiers and solution manifests.
Source provenance
GitHubDisplayed values come from files in Azure/Azure-Sentinel. They describe the published template, not your workspace configuration.
- Commit
9800e51↗- Source identifier
c32e5873-00b7-45fc-9a7e-43e9d0018978
GSTEP / CATALOG TRACKING
Added to catalog : 16 Sept 2026 · 05:49 UTC
Last change observed : 16 Sept 2026 · 05:49 UTC