⚠️ Cybereinforce

⚠️ Unpublished: This item is from a solution that is not yet published on Azure Marketplace or not installed in Content Hub.

Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · Logic Apps · 📊

↑ Back to Solutions Index

Attribute	Value
Publisher	Cybereinforce Support
Support Tier	Partner
Support Link	https://cybereinforce.com/support.html
Categories	Security - Threat Intelligence
Version	3.0.0
Author	Cybeurope - support@cybeurope.com
First Published	2026-08-11
Last Updated	2026-08-12
Solution Folder	Cybereinforce

The Cybereinforce Threat Enforcement solution for Microsoft Sentinel ingests browser-level URL blocking, threat-intelligence match, and audit/administration events via a scheduled Logic App and the Azure Monitor Logs Ingestion API. It includes a data connector with deployment instructions, a workbook for SOC operational visibility, and analytics rules covering URL enforcement, threat-intel matches, device risk patterns, and license/capacity health.

Data Connectors
Tables Used
Content Items
Additional Documentation

Data Connectors

This solution provides 1 data connector(s):

Cybereinforce Threat Enforcement (CTE)

Tables Used

This solution uses 1 table(s):

Table	Used By Connectors	Used By Content
`CybereinforceCTE_CL`	Cybereinforce Threat Enforcement (CTE)	Analytics, Workbooks

Content Items

This solution includes 20 content item(s) (19 in solution, 1 discovered 🔍):

Content Type	Total	In Solution	Discovered
Analytic Rules	18	18	-
Workbooks	2	1	1

Analytic Rules

Name	Severity	Tactics	Tables Used
CTE - Admin Login Detected	Informational	InitialAccess	`CybereinforceCTE_CL`
CTE - Blocked URL Attempted	Low	InitialAccess	`CybereinforceCTE_CL`
CTE - CTI Blocked URL Attempted	Medium	InitialAccess, CommandAndControl	`CybereinforceCTE_CL`
CTE - Compromised Device Suspected (High-Volume IOC Blocks)	High	CommandAndControl, Exfiltration	`CybereinforceCTE_CL`
CTE - Device Enrolled but On Hold	Low	-	`CybereinforceCTE_CL`
CTE - Device License Capacity Critical (99%)	High	-	`CybereinforceCTE_CL`
CTE - Device License Capacity High (95%)	Medium	-	`CybereinforceCTE_CL`
CTE - Device Repeatedly Blocked Across Multiple Days	Medium	InitialAccess	`CybereinforceCTE_CL`
CTE - Enrollment Token Generated	Informational	Persistence	`CybereinforceCTE_CL`
CTE - License Expiring Critically (7 Days)	High	-	`CybereinforceCTE_CL`
CTE - License Expiring Soon (30 Days)	Medium	-	`CybereinforceCTE_CL`
CTE - Possible Company-Wide C2 Campaign (Multiple Devices, Same Destination)	High	CommandAndControl, LateralMovement	`CybereinforceCTE_CL`
CTE - Risky Device (Multiple IOC URL Hits)	Medium	InitialAccess, CommandAndControl	`CybereinforceCTE_CL`
CTE - Rule Capacity Critical (95%)	High	-	`CybereinforceCTE_CL`
CTE - Rule Capacity High (90%)	Medium	-	`CybereinforceCTE_CL`
CTE - Security Rule Changed (Created/Updated/Deleted)	Medium	DefenseEvasion	`CybereinforceCTE_CL`
CTE - Stale Device (No Heartbeat in 30 Days)	Medium	DefenseEvasion	`CybereinforceCTE_CL`
CTE - Sudden Block Spike Detected	High	InitialAccess	`CybereinforceCTE_CL`

Workbooks

Name	Tables Used
CybereinforceCTE	`CybereinforceCTE_CL`
WorkbooksMetadata ⚠️	-

⚠️ Items marked with ⚠️ are not listed in the Solution JSON file. They were discovered by scanning the solution folder and may be legacy items, under development, or excluded from the official solution package.

Additional Documentation

📄 Source: Cybereinforce/README.md

Cybereinforce Threat Enforcement (CTE) for Microsoft Sentinel

Cybereinforce Threat Enforcement enforces Microsoft Defender threat intelligence directly at the browser (Chrome, Firefox, Safari) on enrolled endpoints, blocking access to known-malicious and policy-restricted URLs before they load.

This solution brings Cybereinforce's enforcement and audit activity into Microsoft Sentinel for SOC investigation, hunting, and alerting.

Data Connectors: 1 - scheduled Logic App that polls the Cybereinforce API and ingests events into the CybereinforceCTE_CL custom table via the Azure Monitor Logs Ingestion API.
Workbooks: 1 - ingestion health, URL blocks, audit activity, and IOC synchronization.
Analytic Rules: 18 - covering URL enforcement, threat-intelligence matches, device risk patterns (repeated/spiking blocks, suspected compromise, company-wide campaigns), administrative/audit activity, and license/rule capacity health.

Prerequisites

An active Cybereinforce Threat Enforcement subscription.
A Microsoft Sentinel workspace.
Admin access to the Cybereinforce Admin portal to generate a MicrosoftToken (see the data connector's in-product deployment instructions).

Support

See SolutionMetadata.json for support contact details, or visit cybereinforce.com/support.html.

See ReleaseNotes.md for version history.

Release Notes

Version	Date Modified (DD-MM-YYYY)	Change History
3.0.0	14-08-2026	Corrected solution package structure (content package registration), registered custom table schema for KQL validation, added MITRE ATT&CK tactics and techniques to the 11 attack-detection rules (the remaining 7 rules are operational/capacity alerts - license expiry, device/rule quota, enrollment on-hold - with no corresponding adversary technique, so left unmapped by design), added workbook preview images and logo.