Microsoft Sentinel Analytic Rules
cloudbrothers.infoAzure Sentinel RepoToggle Dark/Light/Auto modeToggle Dark/Light/Auto modeToggle Dark/Light/Auto modeBack to homepage

SlackAudit - Empty User Agent

Back
Id04528635-a5f1-438b-ab74-21ca7bc3aa32
RulenameSlackAudit - Empty User Agent
DescriptionThis query shows connections to the Slack Workspace with empty User Agent.
SeverityLow
TacticsInitialAccess
TechniquesT1133
Required data connectorsSlackAuditAPI
KindScheduled
Query frequency1d
Query period1d
Trigger threshold0
Trigger operatorgt
Source Urihttps://github.com/Azure/Azure-Sentinel/blob/master/Solutions/SlackAudit/Analytic Rules/SlackAuditEmptyUA.yaml
Version1.0.0
Arm template04528635-a5f1-438b-ab74-21ca7bc3aa32.json
Deploy To Azure
SlackAudit
| where isempty(UserAgentOriginal)
| extend AccountCustomEntity = SrcUserName
name: SlackAudit - Empty User Agent
query: |
  SlackAudit
  | where isempty(UserAgentOriginal)
  | extend AccountCustomEntity = SrcUserName  
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/SlackAudit/Analytic Rules/SlackAuditEmptyUA.yaml
queryFrequency: 1d
triggerThreshold: 0
requiredDataConnectors:
- dataTypes:
  - SlackAudit_CL
  connectorId: SlackAuditAPI
version: 1.0.0
status: Available
queryPeriod: 1d
id: 04528635-a5f1-438b-ab74-21ca7bc3aa32
triggerOperator: gt
entityMappings:
- fieldMappings:
  - identifier: FullName
    columnName: AccountCustomEntity
  entityType: Account
relevantTechniques:
- T1133
severity: Low
description: |
    'This query shows connections to the Slack Workspace with empty User Agent.'
kind: Scheduled
tactics:
- InitialAccess
{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "workspace": {
      "type": "String"
    }
  },
  "resources": [
    {
      "id": "[concat(resourceId('Microsoft.OperationalInsights/workspaces/providers', parameters('workspace'), 'Microsoft.SecurityInsights'),'/alertRules/04528635-a5f1-438b-ab74-21ca7bc3aa32')]",
      "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/04528635-a5f1-438b-ab74-21ca7bc3aa32')]",
      "type": "Microsoft.OperationalInsights/workspaces/providers/alertRules",
      "kind": "Scheduled",
      "apiVersion": "2022-11-01",
      "properties": {
        "displayName": "SlackAudit - Empty User Agent",
        "description": "'This query shows connections to the Slack Workspace with empty User Agent.'\n",
        "severity": "Low",
        "enabled": true,
        "query": "SlackAudit\n| where isempty(UserAgentOriginal)\n| extend AccountCustomEntity = SrcUserName\n",
        "queryFrequency": "P1D",
        "queryPeriod": "P1D",
        "triggerOperator": "GreaterThan",
        "triggerThreshold": 0,
        "suppressionDuration": "PT1H",
        "suppressionEnabled": false,
        "tactics": [
          "InitialAccess"
        ],
        "techniques": [
          "T1133"
        ],
        "alertRuleTemplateName": "04528635-a5f1-438b-ab74-21ca7bc3aa32",
        "customDetails": null,
        "entityMappings": [
          {
            "fieldMappings": [
              {
                "identifier": "FullName",
                "columnName": "AccountCustomEntity"
              }
            ],
            "entityType": "Account"
          }
        ],
        "status": "Available",
        "templateVersion": "1.0.0",
        "OriginalUri": "https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/SlackAudit/Analytic Rules/SlackAuditEmptyUA.yaml"
      }
    }
  ]
}