Box - Abmormal user activity

Back


Id	1139230c-cf10-45db-b616-fed0d1415c05
Rulename	Box - Abmormal user activity
Description	Detects spikes (deviations from avarage) in user activity.
Severity	Medium
Tactics	Collection
Techniques	T1530
Required data connectors	BoxDataConnector
Kind	Scheduled
Query frequency	1h
Query period	14d
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Box/Analytic Rules/BoxAbnormalUserActivity.yaml
Version	1.0.1
Arm template	1139230c-cf10-45db-b616-fed0d1415c05.json

KQL

let lbperiod_start = 14d;
let lbperiod_end = 24h;
let user_actions_1 = BoxEvents
| where EventEndTime between (ago(lbperiod_start) .. ago(lbperiod_end))
| summarize TotalEvents = count() by SourceName
| project TotalEvents, User = SourceName;
let user_actions_2 = BoxEvents
| where EventEndTime between (ago(lbperiod_start) .. ago(lbperiod_end))
| summarize TotalEvents = count() by SrcUserName
| project TotalEvents, User = SrcUserName;
let TotalActions = (union user_actions_1, user_actions_2)
| summarize TotalEvents = count() by User
| extend EventsPerDay = TotalEvents / 29
| extend k = 1;
let actions1_last_h = BoxEvents
| summarize TotalEventsH = count() by SourceName
| project TotalEventsH, User = SourceName;
let actions2_last_h = BoxEvents
| summarize TotalEventsH = count() by SourceName
| project TotalEventsH, User = SourceName;
let TotalActionsLastHour = (union actions1_last_h, actions2_last_h)
| summarize TotalEventsH = sum(TotalEventsH) by User
| extend k = 1;
TotalActions
| join (TotalActionsLastHour) on k
| where EventsPerDay > TotalEventsH
| project User
| extend AccountCustomEntity = User

YAML

relevantTechniques:
- T1530
entityMappings:
- fieldMappings:
  - columnName: AccountCustomEntity
    identifier: FullName
  entityType: Account
triggerThreshold: 0
description: |
    'Detects spikes (deviations from avarage) in user activity.'
requiredDataConnectors:
- connectorId: BoxDataConnector
  dataTypes:
  - BoxEvents_CL
triggerOperator: gt
version: 1.0.1
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Box/Analytic Rules/BoxAbnormalUserActivity.yaml
id: 1139230c-cf10-45db-b616-fed0d1415c05
queryFrequency: 1h
query: |
  let lbperiod_start = 14d;
  let lbperiod_end = 24h;
  let user_actions_1 = BoxEvents
  | where EventEndTime between (ago(lbperiod_start) .. ago(lbperiod_end))
  | summarize TotalEvents = count() by SourceName
  | project TotalEvents, User = SourceName;
  let user_actions_2 = BoxEvents
  | where EventEndTime between (ago(lbperiod_start) .. ago(lbperiod_end))
  | summarize TotalEvents = count() by SrcUserName
  | project TotalEvents, User = SrcUserName;
  let TotalActions = (union user_actions_1, user_actions_2)
  | summarize TotalEvents = count() by User
  | extend EventsPerDay = TotalEvents / 29
  | extend k = 1;
  let actions1_last_h = BoxEvents
  | summarize TotalEventsH = count() by SourceName
  | project TotalEventsH, User = SourceName;
  let actions2_last_h = BoxEvents
  | summarize TotalEventsH = count() by SourceName
  | project TotalEventsH, User = SourceName;
  let TotalActionsLastHour = (union actions1_last_h, actions2_last_h)
  | summarize TotalEventsH = sum(TotalEventsH) by User
  | extend k = 1;
  TotalActions
  | join (TotalActionsLastHour) on k
  | where EventsPerDay > TotalEventsH
  | project User
  | extend AccountCustomEntity = User  
severity: Medium
status: Available
queryPeriod: 14d
name: Box - Abmormal user activity
tactics:
- Collection
kind: Scheduled

ARM