Lumen TI IPAddress in SigninLogs

Back


Id	1425aea5-a9e5-4288-886e-934b90664a91
Rulename	Lumen TI IPAddress in SigninLogs
Description	This query maps Lumen IP indicators of compromise (IOCs) from threat intelligence (TI), by searching for matches in SigninLogs.
Severity	Medium
Tactics	CommandAndControl
Techniques	T1071
Required data connectors	AzureActiveDirectory LumenThreatFeedConnector ThreatIntelligenceUploadIndicatorsAPI
Kind	Scheduled
Query frequency	4h
Query period	14d
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Lumen Defender Threat Feed/Analytic Rules/Lumen_IPEntity_SigninLogs.yaml
Version	1.0.0
Arm template	1425aea5-a9e5-4288-886e-934b90664a91.json

KQL

let dt_lookBack = 1d;  // Data lookback for SigninLogs
let ioc_lookBack = 14d; // TI lookback
let IP_Indicators = ThreatIntelIndicators
  | where TimeGenerated >= ago(ioc_lookBack)
  | where IsActive == true and ValidUntil > now()
  | summarize LatestIndicatorTime = arg_max(TimeGenerated, *) by Id
  | where SourceSystem == 'Lumen'
  | where ObservableKey == 'ipv4-addr:value'
  | extend TI_ipEntity = ObservableValue
  | where ipv4_is_private(TI_ipEntity) == false and TI_ipEntity !startswith 'fe80' and TI_ipEntity !startswith '::' and TI_ipEntity !startswith '127.';
IP_Indicators
| join kind=innerunique (
    SigninLogs
    | where TimeGenerated >= ago(dt_lookBack)
    | extend SL_ipEntity = IPAddress
    | extend SigninLogs_TimeGenerated = TimeGenerated
  ) on $left.TI_ipEntity == $right.SL_ipEntity
| where SigninLogs_TimeGenerated < ValidUntil
| summarize arg_max(SigninLogs_TimeGenerated, *), StartTime = min(SigninLogs_TimeGenerated), EndTime = max(SigninLogs_TimeGenerated) by Id, SL_ipEntity
| project timestamp = EndTime, StartTime, EndTime, UserPrincipalName, IPAddress, ResultType, AppDisplayName, Id, Tags, ValidUntil, Confidence, TI_ipEntity, SL_ipEntity, Type

YAML

suppressionEnabled: true
relevantTechniques:
- T1071
suppressionDuration: 5h
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Lumen Defender Threat Feed/Analytic Rules/Lumen_IPEntity_SigninLogs.yaml
entityMappings:
- fieldMappings:
  - identifier: Address
    columnName: SL_ipEntity
  entityType: IP
requiredDataConnectors:
- dataTypes:
  - ThreatIntelligenceIndicator
  connectorId: LumenThreatFeedConnector
- dataTypes:
  - ThreatIntelligenceIndicator
  connectorId: ThreatIntelligenceUploadIndicatorsAPI
- dataTypes:
  - SigninLogs
  connectorId: AzureActiveDirectory
triggerOperator: gt
queryFrequency: 4h
queryPeriod: 14d
triggerThreshold: 0
query: |
  let dt_lookBack = 1d;  // Data lookback for SigninLogs
  let ioc_lookBack = 14d; // TI lookback
  let IP_Indicators = ThreatIntelIndicators
    | where TimeGenerated >= ago(ioc_lookBack)
    | where IsActive == true and ValidUntil > now()
    | summarize LatestIndicatorTime = arg_max(TimeGenerated, *) by Id
    | where SourceSystem == 'Lumen'
    | where ObservableKey == 'ipv4-addr:value'
    | extend TI_ipEntity = ObservableValue
    | where ipv4_is_private(TI_ipEntity) == false and TI_ipEntity !startswith 'fe80' and TI_ipEntity !startswith '::' and TI_ipEntity !startswith '127.';
  IP_Indicators
  | join kind=innerunique (
      SigninLogs
      | where TimeGenerated >= ago(dt_lookBack)
      | extend SL_ipEntity = IPAddress
      | extend SigninLogs_TimeGenerated = TimeGenerated
    ) on $left.TI_ipEntity == $right.SL_ipEntity
  | where SigninLogs_TimeGenerated < ValidUntil
  | summarize arg_max(SigninLogs_TimeGenerated, *), StartTime = min(SigninLogs_TimeGenerated), EndTime = max(SigninLogs_TimeGenerated) by Id, SL_ipEntity
  | project timestamp = EndTime, StartTime, EndTime, UserPrincipalName, IPAddress, ResultType, AppDisplayName, Id, Tags, ValidUntil, Confidence, TI_ipEntity, SL_ipEntity, Type  
name: Lumen TI IPAddress in SigninLogs
kind: Scheduled
description: |
    This query maps Lumen IP indicators of compromise (IOCs) from threat intelligence (TI), by searching for matches in SigninLogs.
severity: Medium
id: 1425aea5-a9e5-4288-886e-934b90664a91
tactics:
- CommandAndControl
version: 1.0.0
displayName: Lumen TI IPAddress in SigninLogs

ARM