SailPointIdentityNowFailedEventsBasedOnTime

Back


Id	175b79ef-0fc3-4b27-b92a-89b2db6c85c2
Rulename	SailPointIdentityNowFailedEventsBasedOnTime
Description	Detects failed events based on created time.
Severity	High
Tactics	InitialAccess
Techniques	T1133
Required data connectors	SailPointIdentityNow SailPointIdentityNowConnector
Kind	Scheduled
Query frequency	1d
Query period	14d
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/SailPointIdentityNow/Analytic Rules/SailPointIdentityNowFailedEventsBasedOnTime.yaml
Version	1.1.0
Arm template	175b79ef-0fc3-4b27-b92a-89b2db6c85c2.json

KQL

declare query_parameters(lbperiod:timespan = 14d, createdTime:string = "2020-08-19T20:34:38.676Z");
  SailPointIDN_Events
  | where TimeGenerated > ago(lbperiod)
  | where Status == "FAILED"
  | where Created >= todatetime(createdTime)
  | sort by Created

YAML

entityMappings:
- fieldMappings:
  - columnName: TechnicalName
    identifier: Name
  entityType: Account
triggerOperator: gt
tactics:
- InitialAccess
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/SailPointIdentityNow/Analytic Rules/SailPointIdentityNowFailedEventsBasedOnTime.yaml
version: 1.1.0
query: |
  declare query_parameters(lbperiod:timespan = 14d, createdTime:string = "2020-08-19T20:34:38.676Z");
    SailPointIDN_Events
    | where TimeGenerated > ago(lbperiod)
    | where Status == "FAILED"
    | where Created >= todatetime(createdTime)
    | sort by Created  
triggerThreshold: 0
relevantTechniques:
- T1133
queryPeriod: 14d
status: Available
severity: High
kind: Scheduled
name: SailPointIdentityNowFailedEventsBasedOnTime
queryFrequency: 1d
id: 175b79ef-0fc3-4b27-b92a-89b2db6c85c2
description: |
    'Detects failed events based on created time.'
requiredDataConnectors:
- dataTypes:
  - SailPointIDN_Events
  connectorId: SailPointIdentityNow
- dataTypes:
  - SailPointIDN_Events
  connectorId: SailPointIdentityNowConnector

ARM