CiscoDuo
| where EventType =~ 'authentication'
| where EventResult =~ 'success'
| where isnotempty(AuthDeviceCountry)
| summarize src_c = makeset(AuthDeviceCountry) by SrcIpAddr
| join (CiscoDuo
| where EventType =~ 'authentication'
| where EventResult =~ 'success') on SrcIpAddr
| where src_c !has AuthDeviceCountry
| extend IPCustomEntity = SrcIpAddr, AccountCustomEntity = DstUserName
relevantTechniques:
- T1078
entityMappings:
- fieldMappings:
- columnName: IPCustomEntity
identifier: Address
entityType: IP
- fieldMappings:
- columnName: AccountCustomEntity
identifier: Name
entityType: Account
triggerThreshold: 0
description: |
'Detects new location of authentication device.'
requiredDataConnectors:
- connectorId: CiscoDuoSecurity
dataTypes:
- CiscoDuo
triggerOperator: gt
version: 1.0.0
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/CiscoDuoSecurity/Analytic Rules/CiscoDuoNewAuthDeviceLocation.yaml
id: 01df3abe-3dc7-40e2-8aa7-f00b402df6f0
queryFrequency: 1h
query: |
CiscoDuo
| where EventType =~ 'authentication'
| where EventResult =~ 'success'
| where isnotempty(AuthDeviceCountry)
| summarize src_c = makeset(AuthDeviceCountry) by SrcIpAddr
| join (CiscoDuo
| where EventType =~ 'authentication'
| where EventResult =~ 'success') on SrcIpAddr
| where src_c !has AuthDeviceCountry
| extend IPCustomEntity = SrcIpAddr, AccountCustomEntity = DstUserName
severity: Medium
status: Available
queryPeriod: 14d
name: Cisco Duo - Authentication device new location
tactics:
- InitialAccess
kind: Scheduled
