Box - Abmormal user activity

Back


Id	1139230c-cf10-45db-b616-fed0d1415c05
Rulename	Box - Abmormal user activity
Description	Detects spikes (deviations from avarage) in user activity.
Severity	Medium
Tactics	Collection
Techniques	T1530
Required data connectors	BoxDataConnector
Kind	Scheduled
Query frequency	1h
Query period	14d
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Box/Analytic Rules/BoxAbnormalUserActivity.yaml
Version	1.0.1
Arm template	1139230c-cf10-45db-b616-fed0d1415c05.json

KQL

let lbperiod_start = 14d;
let lbperiod_end = 24h;
let user_actions_1 = BoxEvents
| where EventEndTime between (ago(lbperiod_start) .. ago(lbperiod_end))
| summarize TotalEvents = count() by SourceName
| project TotalEvents, User = SourceName;
let user_actions_2 = BoxEvents
| where EventEndTime between (ago(lbperiod_start) .. ago(lbperiod_end))
| summarize TotalEvents = count() by SrcUserName
| project TotalEvents, User = SrcUserName;
let TotalActions = (union user_actions_1, user_actions_2)
| summarize TotalEvents = count() by User
| extend EventsPerDay = TotalEvents / 29
| extend k = 1;
let actions1_last_h = BoxEvents
| summarize TotalEventsH = count() by SourceName
| project TotalEventsH, User = SourceName;
let actions2_last_h = BoxEvents
| summarize TotalEventsH = count() by SourceName
| project TotalEventsH, User = SourceName;
let TotalActionsLastHour = (union actions1_last_h, actions2_last_h)
| summarize TotalEventsH = sum(TotalEventsH) by User
| extend k = 1;
TotalActions
| join (TotalActionsLastHour) on k
| where EventsPerDay > TotalEventsH
| project User
| extend AccountCustomEntity = User

YAML

description: |
    'Detects spikes (deviations from avarage) in user activity.'
kind: Scheduled
tactics:
- Collection
requiredDataConnectors:
- connectorId: BoxDataConnector
  dataTypes:
  - BoxEvents_CL
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Box/Analytic Rules/BoxAbnormalUserActivity.yaml
severity: Medium
name: Box - Abmormal user activity
triggerThreshold: 0
queryPeriod: 14d
query: |
  let lbperiod_start = 14d;
  let lbperiod_end = 24h;
  let user_actions_1 = BoxEvents
  | where EventEndTime between (ago(lbperiod_start) .. ago(lbperiod_end))
  | summarize TotalEvents = count() by SourceName
  | project TotalEvents, User = SourceName;
  let user_actions_2 = BoxEvents
  | where EventEndTime between (ago(lbperiod_start) .. ago(lbperiod_end))
  | summarize TotalEvents = count() by SrcUserName
  | project TotalEvents, User = SrcUserName;
  let TotalActions = (union user_actions_1, user_actions_2)
  | summarize TotalEvents = count() by User
  | extend EventsPerDay = TotalEvents / 29
  | extend k = 1;
  let actions1_last_h = BoxEvents
  | summarize TotalEventsH = count() by SourceName
  | project TotalEventsH, User = SourceName;
  let actions2_last_h = BoxEvents
  | summarize TotalEventsH = count() by SourceName
  | project TotalEventsH, User = SourceName;
  let TotalActionsLastHour = (union actions1_last_h, actions2_last_h)
  | summarize TotalEventsH = sum(TotalEventsH) by User
  | extend k = 1;
  TotalActions
  | join (TotalActionsLastHour) on k
  | where EventsPerDay > TotalEventsH
  | project User
  | extend AccountCustomEntity = User  
relevantTechniques:
- T1530
id: 1139230c-cf10-45db-b616-fed0d1415c05
queryFrequency: 1h
status: Available
triggerOperator: gt
version: 1.0.1
entityMappings:
- entityType: Account
  fieldMappings:
  - columnName: AccountCustomEntity
    identifier: FullName

ARM