Authomize_v2_CL
| where ingestion_time() >= ago(30m)
| extend EventID = id_s, Policy = policy_name_s, Severity = severity_s,Description = description_s,Recommendation = recommendation_s,URL = url_s,Tactics = tactics_s
| where Policy has "New service account gained access to IaaS resource"
| project EventID, Policy, Severity, Description, Recommendation, URL, Category, Tactics
suppressionDuration: 5h
suppressionEnabled: false
query: |-
Authomize_v2_CL
| where ingestion_time() >= ago(30m)
| extend EventID = id_s, Policy = policy_name_s, Severity = severity_s,Description = description_s,Recommendation = recommendation_s,URL = url_s,Tactics = tactics_s
| where Policy has "New service account gained access to IaaS resource"
| project EventID, Policy, Severity, Description, Recommendation, URL, Category, Tactics
entityMappings:
- entityType: URL
fieldMappings:
- identifier: Url
columnName: URL
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Authomize/Analytic Rules/New_service_account_gained_access_to_IaaS_resource.yaml
severity: Informational
tactics:
- InitialAccess
eventGroupingSettings:
aggregationKind: SingleAlert
triggerThreshold: 0
relevantTechniques:
- T1078
name: New service account gained access to IaaS resource
triggerOperator: gt
customDetails:
EventRecommendation: Recommendation
EventName: Policy
AuthomizeEventID: EventID
ReferencedURL: URL
EventDescription: Description
requiredDataConnectors:
- dataTypes:
- Authomize_v2_CL
connectorId: Authomize
queryFrequency: 30m
alertDetailsOverride:
alertDescriptionFormat: New service account gained access to IaaS resource. This policy detects when an application or service account gained new access to your assets. This policy is defined by Authomize and can be edited to change the configuration.
alertDynamicProperties:
- value: URL
alertProperty: AlertLink
alertTactics: Tactics
alertnameFormat: Alert from Authomize - New service account gained access to IaaS resource
alertSeverity: Severity
kind: Scheduled
version: 1.0.3
status: Available
queryPeriod: 30m
id: 6c17f270-cd56-48cc-9196-1728ffea6538
description: This policy detects when an application or service account gained new access to your assets. This policy is defined by Authomize and can be edited to change the configuration.
incidentConfiguration:
createIncident: true
groupingConfiguration:
groupByAlertDetails: []
groupByCustomDetails: []
matchingMethod: AnyAlert
reopenClosedIncident: false
lookbackDuration: 5h
groupByEntities: []
enabled: true
