Microsoft Sentinel Analytic Rules
cloudbrothers.infoAzure Sentinel RepoToggle Dark/Light/Auto modeToggle Dark/Light/Auto modeToggle Dark/Light/Auto modeBack to homepage

Azure Secure Score Self Service Password Reset

Back
Id114120B2-AAA0-4C4E-BDF1-2EE178465047
RulenameAzure Secure Score Self Service Password Reset
DescriptionThis query searches for requires you to setup Microsoft Entra ID Connect.

Microsoft Entra ID Connect is free with all Azure Subscriptions
SeverityHigh
TacticsImpact
TechniquesT1529
Required data connectorsSenservaPro
KindScheduled
Query frequency6h
Query period6h
Trigger threshold0
Trigger operatorgt
Source Urihttps://github.com/Azure/Azure-Sentinel/blob/master/Solutions/SenservaPro/Analytic Rules/SelfServicePasswordReset.yaml
Version1.0.1
Arm template114120B2-AAA0-4C4E-BDF1-2EE178465047.json
Deploy To Azure
SenservaPro_CL
| where ControlName_s == 'AzureSecureScoreSelfServicePasswordReset'
query: |
  SenservaPro_CL
  | where ControlName_s == 'AzureSecureScoreSelfServicePasswordReset'  
description: |
  'This query searches for requires you to setup Microsoft Entra ID Connect. 
   Microsoft Entra ID Connect is free with all Azure Subscriptions'  
triggerThreshold: 0
requiredDataConnectors:
- dataTypes:
  - SenservaPro_CL
  connectorId: SenservaPro
name: Azure Secure Score Self Service Password Reset
relevantTechniques:
- T1529
queryPeriod: 6h
severity: High
triggerOperator: gt
version: 1.0.1
queryFrequency: 6h
entityMappings:
- entityType: Account
  fieldMappings:
  - identifier: Name
    columnName: ControlName_s
  - identifier: AadTenantId
    columnName: TenantId
  - identifier: DisplayName
    columnName: TenantDisplayName_s
- entityType: SecurityGroup
  fieldMappings:
  - identifier: DistinguishedName
    columnName: Group_s
- entityType: AzureResource
  fieldMappings:
  - identifier: ResourceId
    columnName: SourceSystem
kind: Scheduled
status: Available
tactics:
- Impact
id: 114120B2-AAA0-4C4E-BDF1-2EE178465047
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/SenservaPro/Analytic Rules/SelfServicePasswordReset.yaml
{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "workspace": {
      "type": "String"
    }
  },
  "resources": [
    {
      "apiVersion": "2024-01-01-preview",
      "id": "[concat(resourceId('Microsoft.OperationalInsights/workspaces/providers', parameters('workspace'), 'Microsoft.SecurityInsights'),'/alertRules/114120B2-AAA0-4C4E-BDF1-2EE178465047')]",
      "kind": "Scheduled",
      "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/114120B2-AAA0-4C4E-BDF1-2EE178465047')]",
      "properties": {
        "alertRuleTemplateName": "114120B2-AAA0-4C4E-BDF1-2EE178465047",
        "customDetails": null,
        "description": "'This query searches for requires you to setup Microsoft Entra ID Connect. \n Microsoft Entra ID Connect is free with all Azure Subscriptions'\n",
        "displayName": "Azure Secure Score Self Service Password Reset",
        "enabled": true,
        "entityMappings": [
          {
            "entityType": "Account",
            "fieldMappings": [
              {
                "columnName": "ControlName_s",
                "identifier": "Name"
              },
              {
                "columnName": "TenantId",
                "identifier": "AadTenantId"
              },
              {
                "columnName": "TenantDisplayName_s",
                "identifier": "DisplayName"
              }
            ]
          },
          {
            "entityType": "SecurityGroup",
            "fieldMappings": [
              {
                "columnName": "Group_s",
                "identifier": "DistinguishedName"
              }
            ]
          },
          {
            "entityType": "AzureResource",
            "fieldMappings": [
              {
                "columnName": "SourceSystem",
                "identifier": "ResourceId"
              }
            ]
          }
        ],
        "OriginalUri": "https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/SenservaPro/Analytic Rules/SelfServicePasswordReset.yaml",
        "query": "SenservaPro_CL\n| where ControlName_s == 'AzureSecureScoreSelfServicePasswordReset'\n",
        "queryFrequency": "PT6H",
        "queryPeriod": "PT6H",
        "severity": "High",
        "status": "Available",
        "subTechniques": [],
        "suppressionDuration": "PT1H",
        "suppressionEnabled": false,
        "tactics": [
          "Impact"
        ],
        "techniques": [
          "T1529"
        ],
        "templateVersion": "1.0.1",
        "triggerOperator": "GreaterThan",
        "triggerThreshold": 0
      },
      "type": "Microsoft.OperationalInsights/workspaces/providers/alertRules"
    }
  ]
}