SailPointIdentityNowAlertForTriggers

Back


Id	08330c3d-487e-4f5e-a539-1e7d06dea786
Rulename	SailPointIdentityNowAlertForTriggers
Description	Create alerts for SailPoint IdentityNow Event Trigger Service.
Severity	Informational
Tactics	InitialAccess Collection
Techniques	T1133 T1005
Required data connectors	SailPointIdentityNow
Kind	Scheduled
Query frequency	1d
Query period	14d
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/SailPointIdentityNow/Analytic Rules/SailPointIdentityNowAlertsForTriggers.yaml
Version	1.0.0
Arm template	08330c3d-487e-4f5e-a539-1e7d06dea786.json

KQL

declare query_parameters(lbperiod:timespan = 14d, triggerId:string = "idn:aggregation-accounts-collected");
  SailPointIDN_Triggers_CL
  | where TimeGenerated > ago(lbperiod)
  | where Metadata_triggerId_s == triggerId

YAML

triggerThreshold: 0
entityMappings:
- entityType: Account
  fieldMappings:
  - identifier: Name
    columnName: Metadata_triggertId_s
requiredDataConnectors:
- dataTypes:
  - SailPointIDN_Events_CL
  connectorId: SailPointIdentityNow
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/SailPointIdentityNow/Analytic Rules/SailPointIdentityNowAlertsForTriggers.yaml
name: SailPointIdentityNowAlertForTriggers
relevantTechniques:
- T1133
- T1005
status: Available
version: 1.0.0
queryPeriod: 14d
kind: Scheduled
id: 08330c3d-487e-4f5e-a539-1e7d06dea786
query: |
  declare query_parameters(lbperiod:timespan = 14d, triggerId:string = "idn:aggregation-accounts-collected");
    SailPointIDN_Triggers_CL
    | where TimeGenerated > ago(lbperiod)
    | where Metadata_triggerId_s == triggerId  
description: |
    'Create alerts for SailPoint IdentityNow Event Trigger Service.'
queryFrequency: 1d
severity: Informational
triggerOperator: gt
tactics:
- InitialAccess
- Collection

ARM