SailPointIdentityNowFailedEventsBasedOnTime

Back


Id	175b79ef-0fc3-4b27-b92a-89b2db6c85c2
Rulename	SailPointIdentityNowFailedEventsBasedOnTime
Description	Detects failed events based on created time.
Severity	High
Tactics	InitialAccess
Techniques	T1133
Required data connectors	SailPointIdentityNow
Kind	Scheduled
Query frequency	1d
Query period	14d
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/SailPointIdentityNow/Analytic Rules/SailPointIdentityNowFailedEventsBasedOnTime.yaml
Version	1.0.0
Arm template	175b79ef-0fc3-4b27-b92a-89b2db6c85c2.json

KQL

declare query_parameters(lbperiod:timespan = 14d, createdTime:string = "2020-08-19T20:34:38.676Z");
  SailPointIDN_Events_CL
  | where TimeGenerated > ago(lbperiod)
  | where status_s == "FAILED"
  | where created_t >= created_t
  | sort by created_t

YAML

query: |
  declare query_parameters(lbperiod:timespan = 14d, createdTime:string = "2020-08-19T20:34:38.676Z");
    SailPointIDN_Events_CL
    | where TimeGenerated > ago(lbperiod)
    | where status_s == "FAILED"
    | where created_t >= created_t
    | sort by created_t  
entityMappings:
- fieldMappings:
  - identifier: Name
    columnName: technicalName_s
  entityType: Account
triggerOperator: gt
description: |
    'Detects failed events based on created time.'
tactics:
- InitialAccess
severity: High
queryFrequency: 1d
kind: Scheduled
name: SailPointIdentityNowFailedEventsBasedOnTime
triggerThreshold: 0
status: Available
id: 175b79ef-0fc3-4b27-b92a-89b2db6c85c2
requiredDataConnectors:
- connectorId: SailPointIdentityNow
  dataTypes:
  - SailPointIDN_Events_CL
relevantTechniques:
- T1133
version: 1.0.0
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/SailPointIdentityNow/Analytic Rules/SailPointIdentityNowFailedEventsBasedOnTime.yaml
queryPeriod: 14d

ARM