CTE - Risky Device (Multiple IOC URL Hits)

Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · Logic Apps · 📊

↑ Back to Content Index

---

A single device has repeatedly hit known-malicious (threat-intel-matched) URLs, indicating persistent compromise risk or repeated user exposure.

Attribute	Value
Type	Analytic Rule
Solution	Cybereinforce
ID	e1c0f32d-a57b-42ae-8038-b869bca54fef
Severity	Medium
Kind	Scheduled
Tactics	InitialAccess, CommandAndControl
Techniques	T1189, T1071
Required Connectors	cybereinforce_cte
Source	View on GitHub

Tables Used

This content item queries data from the following tables:

Table	Selection Criteria	Transformations	Ingestion API	Lake-Only
CybereinforceCTE_CL		?	✓	?

---

Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · Logic Apps · 📊

↑ Back to Analytic Rules · Back to Cybereinforce