SailPointIdentityNowAlertForTriggers

Back


Id	08330c3d-487e-4f5e-a539-1e7d06dea786
Rulename	SailPointIdentityNowAlertForTriggers
Description	Create alerts for SailPoint IdentityNow Event Trigger Service.
Severity	Informational
Tactics	InitialAccess Collection
Techniques	T1133 T1005
Required data connectors	SailPointIdentityNow
Kind	Scheduled
Query frequency	1d
Query period	14d
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/SailPointIdentityNow/Analytic Rules/SailPointIdentityNowAlertsForTriggers.yaml
Version	1.0.0
Arm template	08330c3d-487e-4f5e-a539-1e7d06dea786.json

KQL

declare query_parameters(lbperiod:timespan = 14d, triggerId:string = "idn:aggregation-accounts-collected");
  SailPointIDN_Triggers_CL
  | where TimeGenerated > ago(lbperiod)
  | where Metadata_triggerId_s == triggerId

YAML

OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/SailPointIdentityNow/Analytic Rules/SailPointIdentityNowAlertsForTriggers.yaml
queryPeriod: 14d
kind: Scheduled
name: SailPointIdentityNowAlertForTriggers
status: Available
entityMappings:
- fieldMappings:
  - columnName: Metadata_triggertId_s
    identifier: Name
  entityType: Account
tactics:
- InitialAccess
- Collection
description: |
    'Create alerts for SailPoint IdentityNow Event Trigger Service.'
severity: Informational
requiredDataConnectors:
- connectorId: SailPointIdentityNow
  dataTypes:
  - SailPointIDN_Events_CL
queryFrequency: 1d
triggerThreshold: 0
version: 1.0.0
query: |
  declare query_parameters(lbperiod:timespan = 14d, triggerId:string = "idn:aggregation-accounts-collected");
    SailPointIDN_Triggers_CL
    | where TimeGenerated > ago(lbperiod)
    | where Metadata_triggerId_s == triggerId  
relevantTechniques:
- T1133
- T1005
id: 08330c3d-487e-4f5e-a539-1e7d06dea786
triggerOperator: gt

ARM