SailPointIdentityNowAlertForTriggers

Back


Id	08330c3d-487e-4f5e-a539-1e7d06dea786
Rulename	SailPointIdentityNowAlertForTriggers
Description	Create alerts for SailPoint IdentityNow Event Trigger Service.
Severity	Informational
Tactics	InitialAccess Collection
Techniques	T1133 T1005
Required data connectors	SailPointIdentityNow
Kind	Scheduled
Query frequency	1d
Query period	14d
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/SailPointIdentityNow/Analytic Rules/SailPointIdentityNowAlertsForTriggers.yaml
Version	1.0.0
Arm template	08330c3d-487e-4f5e-a539-1e7d06dea786.json

KQL

declare query_parameters(lbperiod:timespan = 14d, triggerId:string = "idn:aggregation-accounts-collected");
  SailPointIDN_Triggers_CL
  | where TimeGenerated > ago(lbperiod)
  | where Metadata_triggerId_s == triggerId

YAML

description: |
    'Create alerts for SailPoint IdentityNow Event Trigger Service.'
version: 1.0.0
triggerThreshold: 0
tactics:
- InitialAccess
- Collection
queryPeriod: 14d
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/SailPointIdentityNow/Analytic Rules/SailPointIdentityNowAlertsForTriggers.yaml
triggerOperator: gt
status: Available
id: 08330c3d-487e-4f5e-a539-1e7d06dea786
name: SailPointIdentityNowAlertForTriggers
queryFrequency: 1d
severity: Informational
kind: Scheduled
entityMappings:
- fieldMappings:
  - columnName: Metadata_triggertId_s
    identifier: Name
  entityType: Account
relevantTechniques:
- T1133
- T1005
query: |
  declare query_parameters(lbperiod:timespan = 14d, triggerId:string = "idn:aggregation-accounts-collected");
    SailPointIDN_Triggers_CL
    | where TimeGenerated > ago(lbperiod)
    | where Metadata_triggerId_s == triggerId  
requiredDataConnectors:
- dataTypes:
  - SailPointIDN_Events_CL
  connectorId: SailPointIdentityNow

ARM