Azure secure score user risk policy

SenservaPro_CL
| where ControlName_s == 'AzureSecureScoreUserRiskPolicy'

severity: Medium
relevantTechniques:
- T1529
queryFrequency: 6h
kind: Scheduled
version: 1.0.0
name: Azure secure score user risk policy
triggerOperator: gt
description: |
  'This query searches for an active Azure Premium P2 license is required to use and edit this policy. 
   You will be required to have setup the MFA Policy before activating this policy'  
queryPeriod: 6h
query: |
  SenservaPro_CL
  | where ControlName_s == 'AzureSecureScoreUserRiskPolicy'  
entityMappings:
- entityType: Account
  fieldMappings:
  - columnName: ControlName_s
    identifier: Name
  - columnName: TenantId
    identifier: AadTenantId
  - columnName: TenantDisplayName_s
    identifier: DisplayName
- entityType: SecurityGroup
  fieldMappings:
  - columnName: Group_s
    identifier: DistinguishedName
- entityType: AzureResource
  fieldMappings:
  - columnName: SourceSystem
    identifier: ResourceId
tactics:
- Impact
status: Available
triggerThreshold: 0
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/SenservaPro/Analytic Rules/UserRiskPolicy.yaml
id: 1C07A4CB-E31B-4917-BD2A-3572E42F602C
requiredDataConnectors:
- dataTypes:
  - SenservaPro_CL
  connectorId: SenservaPro

{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "workspace": {
      "type": "String"
    }
  },
  "resources": [
    {
      "apiVersion": "2023-02-01-preview",
      "id": "[concat(resourceId('Microsoft.OperationalInsights/workspaces/providers', parameters('workspace'), 'Microsoft.SecurityInsights'),'/alertRules/1C07A4CB-E31B-4917-BD2A-3572E42F602C')]",
      "kind": "Scheduled",
      "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/1C07A4CB-E31B-4917-BD2A-3572E42F602C')]",
      "properties": {
        "alertRuleTemplateName": "1C07A4CB-E31B-4917-BD2A-3572E42F602C",
        "customDetails": null,
        "description": "'This query searches for an active Azure Premium P2 license is required to use and edit this policy. \n You will be required to have setup the MFA Policy before activating this policy'\n",
        "displayName": "Azure secure score user risk policy",
        "enabled": true,
        "entityMappings": [
          {
            "entityType": "Account",
            "fieldMappings": [
              {
                "columnName": "ControlName_s",
                "identifier": "Name"
              },
              {
                "columnName": "TenantId",
                "identifier": "AadTenantId"
              },
              {
                "columnName": "TenantDisplayName_s",
                "identifier": "DisplayName"
              }
            ]
          },
          {
            "entityType": "SecurityGroup",
            "fieldMappings": [
              {
                "columnName": "Group_s",
                "identifier": "DistinguishedName"
              }
            ]
          },
          {
            "entityType": "AzureResource",
            "fieldMappings": [
              {
                "columnName": "SourceSystem",
                "identifier": "ResourceId"
              }
            ]
          }
        ],
        "OriginalUri": "https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/SenservaPro/Analytic Rules/UserRiskPolicy.yaml",
        "query": "SenservaPro_CL\n| where ControlName_s == 'AzureSecureScoreUserRiskPolicy'\n",
        "queryFrequency": "PT6H",
        "queryPeriod": "PT6H",
        "severity": "Medium",
        "status": "Available",
        "suppressionDuration": "PT1H",
        "suppressionEnabled": false,
        "tactics": [
          "Impact"
        ],
        "techniques": [
          "T1529"
        ],
        "templateVersion": "1.0.0",
        "triggerOperator": "GreaterThan",
        "triggerThreshold": 0
      },
      "type": "Microsoft.OperationalInsights/workspaces/providers/alertRules"
    }
  ]
}