↳ GitHub sourceAnalytics ruleMedium
CTE - License Expiring Soon (30 Days)
Description
A paid Cybereinforce license is expiring within 30 days - a reminder to plan renewal before it lapses. Emitted once per license term by the daily tenant health-check job (api/src/functions/tenantHealthChecks.js); re-arms automatically on renewal. Trial licenses do not get this 30-day reminder, only the 7-day critical one below.
- Rule type
- Scheduled
- Version
- 1.0.0
- Query frequency
- 24h
- Query period
- 2d
- Trigger
- gt 0
Declared sources
Metadata from the source file. No dependencies inferred from KQL.
Connectors
Data types
KQL query
Original query, unchanged.
CybereinforceCTE_CL
| where EventType == "license.expiring_soon"
| extend d = parse_json(Details)
| extend DaysRemaining = toint(d.daysRemaining), EndAt = tostring(d.endAt), Plan = tostring(d.plan), AppName = "Cybereinforce"
| project TimeGenerated, TenantId, DaysRemaining, EndAt, Plan, AppName, Severity, Category, Source
Declared entities
Related content
Links established from declared identifiers and solution manifests.
Source provenance
GitHubDisplayed values come from files in Azure/Azure-Sentinel. They describe the published template, not your workspace configuration.
- Commit
9800e51↗- Source identifier
ec305a18-2520-443d-9f54-18dea3637a15
GSTEP / CATALOG TRACKING
Added to catalog : 16 Sept 2026 · 05:49 UTC
Last change observed : 16 Sept 2026 · 05:49 UTC