{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "workspace": {
      "type": "String"
    }
  },
  "resources": [
    {
      "apiVersion": "2024-01-01-preview",
      "id": "[concat(resourceId('Microsoft.OperationalInsights/workspaces/providers', parameters('workspace'), 'Microsoft.SecurityInsights'),'/alertRules/042f2801-a375-4cfd-bd29-041fc7ed88a0')]",
      "kind": "Scheduled",
      "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/042f2801-a375-4cfd-bd29-041fc7ed88a0')]",
      "properties": {
        "alertRuleTemplateName": "042f2801-a375-4cfd-bd29-041fc7ed88a0",
        "customDetails": null,
        "description": "'This content is utilized to identify instances of successful login by risky users, who have been observed engaging in potentially suspicious network activity on non-Microsoft network devices.'\n",
        "displayName": "Risky user signin observed in non-Microsoft network device",
        "enabled": true,
        "entityMappings": [
          {
            "entityType": "Account",
            "fieldMappings": [
              {
                "columnName": "UserPrincipalName",
                "identifier": "FullName"
              },
              {
                "columnName": "Name",
                "identifier": "Name"
              },
              {
                "columnName": "UPNSuffix",
                "identifier": "UPNSuffix"
              }
            ]
          },
          {
            "entityType": "IP",
            "fieldMappings": [
              {
                "columnName": "DestinationIP",
                "identifier": "Address"
              }
            ]
          },
          {
            "entityType": "DNS",
            "fieldMappings": [
              {
                "columnName": "DestinationHostName",
                "identifier": "DomainName"
              }
            ]
          }
        ],
        "OriginalUri": "https://github.com/Azure/Azure-Sentinel/blob/master/Detections/MultipleDataSources/RiskyUserIn3Pnetworkactivity.yaml",
        "query": "SigninLogs\n//Find risky Signin\n| where RiskState == \"atRisk\" and ResultType == 0\n| extend Signin_Time = TimeGenerated\n| summarize\n    AppDisplayName=make_set(AppDisplayName),\n    ClientAppUsed=make_set(ClientAppUsed),\n    UserAgent=make_set(UserAgent),\n    CorrelationId=make_set(CorrelationId),\n    Signin_Time= min(Signin_Time),\n    RiskEventTypes=make_set(RiskEventTypes)\n    by\n    ConditionalAccessStatus,\n    IPAddress,\n    IsRisky,\n    ResourceDisplayName,\n    RiskDetail,\n    ResultType,\n    RiskLevelAggregated,\n    RiskLevelDuringSignIn,\n    RiskState,\n    UserPrincipalName=tostring(tolower(UserPrincipalName)),\n    SourceSystem\n| join kind=inner (\n    CommonSecurityLog\n    | where DeviceVendor has_any  (\"Palo Alto Networks\", \"Fortinet\", \"Check Point\", \"Zscaler\")\n    | where DeviceProduct startswith \"FortiGate\" or DeviceProduct startswith  \"PAN\" or DeviceProduct startswith  \"VPN\" or DeviceProduct startswith \"FireWall\" or DeviceProduct startswith  \"NSSWeblog\" or DeviceProduct startswith \"URL\"\n    | where DeviceAction != \"Block\"\n    | where isnotempty(RequestURL)\n    | where isnotempty(SourceUserName)\n    | extend SourceUserName = tolower(SourceUserName)\n    | summarize\n        min(TimeGenerated),\n        max(TimeGenerated),\n        Activity=make_set(Activity)\n        by DestinationHostName, DestinationIP, RequestURL, SourceUserName=tostring(tolower(SourceUserName)),DeviceVendor,DeviceProduct\n    | extend 3p_observed_Time= min_TimeGenerated,Name = tostring(split(SourceUserName,\"@\")[0]),UPNSuffix =tostring(split(SourceUserName,\"@\")[1]))\n    on $left.IPAddress == $right.DestinationIP and $left.UserPrincipalName == $right.SourceUserName\n| extend Timediff = datetime_diff('day', 3p_observed_Time, Signin_Time)\n| where Timediff <= 1 and Timediff >= 0\n",
        "queryFrequency": "P1D",
        "queryPeriod": "P1D",
        "severity": "Medium",
        "subTechniques": [],
        "suppressionDuration": "PT1H",
        "suppressionEnabled": false,
        "tactics": [
          "CommandAndControl"
        ],
        "techniques": [
          "T1071"
        ],
        "templateVersion": "1.0.6",
        "triggerOperator": "GreaterThan",
        "triggerThreshold": 0
      },
      "type": "Microsoft.OperationalInsights/workspaces/providers/alertRules"
    }
  ]
}