Insider Risk_Risky User Access By Application

Back


Id	15386bba-dc70-463f-a09f-d392e7731c63
Rulename	Insider Risk_Risky User Access By Application
Description	This alert evaluates Microsoft Entra ID Sign in risk via Machine Learning correlations in the basket operator. The basket threshold is adjustable, and the default is set to .01. There is an optional configuration to configure the percentage rates. The correlations are designed to leverage machine learning to identify patterns of risky user application access. There is an option for configuration of correlations against Microsoft Sentinel watchlists. For more information, see Tutorial: Use risk detections for user sign-ins to trigger Microsoft Entra ID Multi-Factor Authentication or password changes
Severity	Medium
Tactics	Execution
Techniques	T1204
Required data connectors	AzureActiveDirectory
Kind	Scheduled
Query frequency	6h
Query period	6h
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/MicrosoftPurviewInsiderRiskManagement/Analytic Rules/InsiderRiskyAccessByApplication.yaml
Version	1.1.4
Arm template	15386bba-dc70-463f-a09f-d392e7731c63.json

KQL

SigninLogs
| where RiskState == "atRisk"
| project UserPrincipalName, Location, AppDisplayName, RiskState
| evaluate basket(0.01) // Adjust & Tune Thresholds within Organzational Requirements
// | where Percent > 50 // Adjust & Tune Thresholds within Organzational Requirements
| where UserPrincipalName <> ""
| where AppDisplayName <> ""
| project Percent, UserPrincipalName, Location, AppDisplayName, RiskState
// | lookup kind=inner _GetWatchlist('<Your Watchlist Name>') on $left.UserPrincipalName == $right.SearchKey
| sort by Percent desc
| extend AccountName = tostring(split(UserPrincipalName, "@")[0]), AccountUPNSuffix = tostring(split(UserPrincipalName, "@")[1])

YAML

name: Insider Risk_Risky User Access By Application
id: 15386bba-dc70-463f-a09f-d392e7731c63
description: |
    'This alert evaluates Microsoft Entra ID Sign in risk via Machine Learning correlations in the basket operator. The basket threshold is adjustable, and the default is set to .01. There is an optional configuration to configure the percentage rates. The correlations are designed to leverage machine learning to identify patterns of risky user application access. There is an option for configuration of correlations against Microsoft Sentinel watchlists. For more information, see [Tutorial: Use risk detections for user sign-ins to trigger Microsoft Entra ID Multi-Factor Authentication or password changes](https://docs.microsoft.com/azure/active-directory/authentication/tutorial-risk-based-sspr-mfa)'
triggerThreshold: 0
entityMappings:
- fieldMappings:
  - columnName: UserPrincipalName
    identifier: FullName
  - columnName: AccountName
    identifier: Name
  - columnName: AccountUPNSuffix
    identifier: UPNSuffix
  entityType: Account
version: 1.1.4
triggerOperator: gt
query: |
  SigninLogs
  | where RiskState == "atRisk"
  | project UserPrincipalName, Location, AppDisplayName, RiskState
  | evaluate basket(0.01) // Adjust & Tune Thresholds within Organzational Requirements
  // | where Percent > 50 // Adjust & Tune Thresholds within Organzational Requirements
  | where UserPrincipalName <> ""
  | where AppDisplayName <> ""
  | project Percent, UserPrincipalName, Location, AppDisplayName, RiskState
  // | lookup kind=inner _GetWatchlist('<Your Watchlist Name>') on $left.UserPrincipalName == $right.SearchKey
  | sort by Percent desc
  | extend AccountName = tostring(split(UserPrincipalName, "@")[0]), AccountUPNSuffix = tostring(split(UserPrincipalName, "@")[1])  
tactics:
- Execution
kind: Scheduled
queryFrequency: 6h
severity: Medium
incidentConfiguration:
  createIncident: true
  groupingConfiguration:
    lookbackDuration: 3d
    enabled: true
    reopenClosedIncident: true
    groupByEntities:
    - Account
    matchingMethod: Selected
queryPeriod: 6h
requiredDataConnectors:
- dataTypes:
  - SigninLogs
  connectorId: AzureActiveDirectory
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/MicrosoftPurviewInsiderRiskManagement/Analytic Rules/InsiderRiskyAccessByApplication.yaml
eventGroupingSettings:
  aggregationKind: SingleAlert
relevantTechniques:
- T1204

ARM