Insider Risk_Risky User Access By Application
Id | 15386bba-dc70-463f-a09f-d392e7731c63 |
Rulename | Insider Risk_Risky User Access By Application |
Description | This alert evaluates Azure Active Directory Sign in risk via Machine Learning correlations in the basket operator. The basket threshold is adjustable, and the default is set to .01. There is an optional configuration to configure the percentage rates. The correlations are designed to leverage machine learning to identify patterns of risky user application access. There is an option for configuration of correlations against Microsoft Sentinel watchlists. For more information, see Tutorial: Use risk detections for user sign-ins to trigger Azure AD Multi-Factor Authentication or password changes |
Severity | Medium |
Tactics | Execution |
Techniques | T1204 |
Required data connectors | AzureActiveDirectory |
Kind | Scheduled |
Query frequency | 6h |
Query period | 6h |
Trigger threshold | 0 |
Trigger operator | gt |
Source Uri | https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/MicrosoftPurviewInsiderRiskManagement/Analytic Rules/InsiderRiskyAccessByApplication.yaml |
Version | 1.1.1 |
Arm template | 15386bba-dc70-463f-a09f-d392e7731c63.json |
SigninLogs
| where RiskState == "atRisk"
| project UserPrincipalName, Location, AppDisplayName, RiskState
| evaluate basket(0.01) // Adjust & Tune Thresholds within Organzational Requirements
// | where Percent > 50 // Adjust & Tune Thresholds within Organzational Requirements
| where UserPrincipalName <> ""
| where AppDisplayName <> ""
| project Percent, UserPrincipalName, Location, AppDisplayName, RiskState
// | lookup kind=inner _GetWatchlist('<Your Watchlist Name>') on $left.UserPrincipalName == $right.SearchKey
| sort by Percent desc
| extend AccountCustomEntity = UserPrincipalName
requiredDataConnectors:
- connectorId: AzureActiveDirectory
dataTypes:
- SigninLogs
triggerOperator: gt
queryFrequency: 6h
name: Insider Risk_Risky User Access By Application
queryPeriod: 6h
id: 15386bba-dc70-463f-a09f-d392e7731c63
description: |
'This alert evaluates Azure Active Directory Sign in risk via Machine Learning correlations in the basket operator. The basket threshold is adjustable, and the default is set to .01. There is an optional configuration to configure the percentage rates. The correlations are designed to leverage machine learning to identify patterns of risky user application access. There is an option for configuration of correlations against Microsoft Sentinel watchlists. For more information, see [Tutorial: Use risk detections for user sign-ins to trigger Azure AD Multi-Factor Authentication or password changes](https://docs.microsoft.com/azure/active-directory/authentication/tutorial-risk-based-sspr-mfa)'
version: 1.1.1
severity: Medium
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/MicrosoftPurviewInsiderRiskManagement/Analytic Rules/InsiderRiskyAccessByApplication.yaml
query: |
SigninLogs
| where RiskState == "atRisk"
| project UserPrincipalName, Location, AppDisplayName, RiskState
| evaluate basket(0.01) // Adjust & Tune Thresholds within Organzational Requirements
// | where Percent > 50 // Adjust & Tune Thresholds within Organzational Requirements
| where UserPrincipalName <> ""
| where AppDisplayName <> ""
| project Percent, UserPrincipalName, Location, AppDisplayName, RiskState
// | lookup kind=inner _GetWatchlist('<Your Watchlist Name>') on $left.UserPrincipalName == $right.SearchKey
| sort by Percent desc
| extend AccountCustomEntity = UserPrincipalName
incidentConfiguration:
groupingConfiguration:
matchingMethod: Selected
reopenClosedIncident: true
groupByEntities:
- Account
enabled: true
lookbackDuration: 3d
createIncident: true
kind: Scheduled
eventGroupingSettings:
aggregationKind: SingleAlert
entityMappings:
- entityType: Account
fieldMappings:
- identifier: FullName
columnName: AccountCustomEntity
relevantTechniques:
- T1204
tactics:
- Execution
triggerThreshold: 0
{
"$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
"contentVersion": "1.0.0.0",
"parameters": {
"workspace": {
"type": "String"
}
},
"resources": [
{
"id": "[concat(resourceId('Microsoft.OperationalInsights/workspaces/providers', parameters('workspace'), 'Microsoft.SecurityInsights'),'/alertRules/15386bba-dc70-463f-a09f-d392e7731c63')]",
"name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/15386bba-dc70-463f-a09f-d392e7731c63')]",
"type": "Microsoft.OperationalInsights/workspaces/providers/alertRules",
"kind": "Scheduled",
"apiVersion": "2022-11-01-preview",
"properties": {
"displayName": "Insider Risk_Risky User Access By Application",
"description": "'This alert evaluates Azure Active Directory Sign in risk via Machine Learning correlations in the basket operator. The basket threshold is adjustable, and the default is set to .01. There is an optional configuration to configure the percentage rates. The correlations are designed to leverage machine learning to identify patterns of risky user application access. There is an option for configuration of correlations against Microsoft Sentinel watchlists. For more information, see [Tutorial: Use risk detections for user sign-ins to trigger Azure AD Multi-Factor Authentication or password changes](https://docs.microsoft.com/azure/active-directory/authentication/tutorial-risk-based-sspr-mfa)'\n",
"severity": "Medium",
"enabled": true,
"query": "SigninLogs\n| where RiskState == \"atRisk\"\n| project UserPrincipalName, Location, AppDisplayName, RiskState\n| evaluate basket(0.01) // Adjust & Tune Thresholds within Organzational Requirements\n// | where Percent > 50 // Adjust & Tune Thresholds within Organzational Requirements\n| where UserPrincipalName <> \"\"\n| where AppDisplayName <> \"\"\n| project Percent, UserPrincipalName, Location, AppDisplayName, RiskState\n// | lookup kind=inner _GetWatchlist('<Your Watchlist Name>') on $left.UserPrincipalName == $right.SearchKey\n| sort by Percent desc\n| extend AccountCustomEntity = UserPrincipalName\n",
"queryFrequency": "PT6H",
"queryPeriod": "PT6H",
"triggerOperator": "GreaterThan",
"triggerThreshold": 0,
"suppressionDuration": "PT1H",
"suppressionEnabled": false,
"tactics": [
"Execution"
],
"techniques": [
"T1204"
],
"alertRuleTemplateName": "15386bba-dc70-463f-a09f-d392e7731c63",
"incidentConfiguration": {
"createIncident": true,
"groupingConfiguration": {
"enabled": true,
"reopenClosedIncident": true,
"lookbackDuration": "P3D",
"groupByEntities": [
"Account"
],
"matchingMethod": "Selected"
}
},
"eventGroupingSettings": {
"aggregationKind": "SingleAlert"
},
"customDetails": null,
"entityMappings": [
{
"fieldMappings": [
{
"identifier": "FullName",
"columnName": "AccountCustomEntity"
}
],
"entityType": "Account"
}
],
"OriginalUri": "https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/MicrosoftPurviewInsiderRiskManagement/Analytic Rules/InsiderRiskyAccessByApplication.yaml",
"templateVersion": "1.1.1"
}
}
]
}