Sunturai
Back to results
HighMicrosoft Sentinel analytics

GTI - CISA Known Exploited Vulnerability Detected

Detects vulnerabilities ingested from Google Threat Intelligence that are in the CISA Known Exploited Vulnerabilities (KEV) catalog, meaning CISA has confirmed active exploitation and mandated remediation for federal…

Description

Detects vulnerabilities ingested from Google Threat Intelligence that are in the CISA Known Exploited Vulnerabilities (KEV) catalog, meaning CISA has confirmed active exploitation and mandated remediation for federal agencies. Uses the explicit CisaKnownExploited field from the GTIVulnerabilities parser, with Tags-based fallback for coverage.

Detection logic

Detection requirements

Platform
ContainersESXiIaaSLinuxmacOSNetwork DevicesWindows

The rule states no platform. This is derived from the 2 ATT&CK techniques it maps to.

Log source product
gtivulnerabilitiesconnector
Log source service
gti_vulnerabilities_cl

Detections can measure how the public catalogue is used — which detections people look for, and which pages bring them here. It sets a cookie that recognises this browser for 180 days. It is never linked to an account and never follows you to other sites. Privacy notice