↳ GitHub sourceAnalytics ruleHigh

CYFIRMA - Data Breach and Web Monitoring - Dark Web High Rule

Description

"Detects critical alerts from CYFIRMA related to sensitive data or credentials leaked on dark web forums. These events often indicate unauthorized access or compromise of enterprise systems, cloud environments, or identity platforms. Immediate investigation is required to assess breach scope and initiate mitigation, including credential resets, access reviews, and threat actor tracking."

Rule type: Scheduled
Version: 1.0.1
Declared status: Available
Query frequency: 5m
Query period: 5m
Trigger: gt 0

Declared MITRE coverage

Declared sources

Metadata from the source file. No dependencies inferred from KQL.

Connectors

CyfirmaDigitalRiskAlertsConnector

Data types

CyfirmaDBWMDarkWebAlerts_CL

KQL query

Original query, unchanged.

// High severity - Data Breach and Web Monitoring - Dark Web
let timeFrame = 5m;
CyfirmaDBWMDarkWebAlerts_CL
| where severity == 'Critical' and TimeGenerated between (ago(timeFrame) .. now())
| extend
    Description=description,
    FirstSeen=first_seen,
    LastSeen=last_seen,
    RiskScore=risk_score,
    AlertUID=alert_uid,
    UID=uid,
    AssetType=asset_type,
    AssetValue=signature,
    Impact=impact,
    Recommendation='',
    ProviderName='CYFIRMA',
    ProductName='DeCYFIR/DeTCT',
    AlertTitle=Alert_title
| project
    TimeGenerated,
    Description,
    RiskScore,
    FirstSeen,
    LastSeen,
    AlertUID,
    UID,
    AssetType,
    AssetValue,
    Impact,
    ProductName,
    ProviderName,
    AlertTitle

Source provenance

GitHub

Displayed values come from files in Azure/Azure-Sentinel. They describe the published template, not your workspace configuration.

File: Solutions/Cyfirma Digital Risk/Analytic Rules/DBWMDarkWebHighRule.yaml ↗
Commit: 9800e51 ↗
Source identifier: c3f1f55b-7e54-4416-8afc-7d7876b29b0f

Additional source files 2

Solutions/Cyfirma Digital Risk/Analytic Rules/DBWMDarkWebHighRule.yamlsource ↗Solutions/Cyfirma Digital Risk/Data/Solution_CyfirmaDigitalRiskAlerts.jsonsolution-membership ↗

GSTEP / CATALOG TRACKING

Added to catalog : 16 Sept 2026 · 05:49 UTC
Last change observed : 16 Sept 2026 · 05:49 UTC

GSTEP sync dates, separate from the source content’s publication dates.