Power Platform - DLP policy updated or removed | Microsoft Sentinel Analytic Rules

Back


Id	1b2e6172-85c5-417a-90c3-7cc80cb787f5
Rulename	Power Platform - DLP policy updated or removed
Description	Identifies changes to DLP policy, specifically policies which are updated or removed.
Severity	Low
Tactics	DefenseEvasion
Techniques	T1480
Required data connectors	PowerPlatformAdmin
Kind	Scheduled
Query frequency	1h
Query period	1d
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Microsoft%20Business%20Applications/Analytic%20Rules/Power%20Platform%20-%20DLP%20policy%20updated%20or%20removed.yaml
Version	3.2.0
Arm template	1b2e6172-85c5-417a-90c3-7cc80cb787f5.json

KQL

let create_policy_ignore_time_window = 10m;
let query_frequency = 1h;
let dlp_policy_events = PowerPlatformAdminActivity
    | where TimeGenerated >= ago(query_frequency)
    | where EventOriginalType == "GovernanceApiPolicyOperation"
    | where PropertyCollection has_any ("DeleteDlpPolicy", "UpdateDlpPolicy", "CreateDlpPolicy")
    | mv-expand PropertyCollection
    | extend
        Name = tostring(PropertyCollection.Name),
        Value = tostring(PropertyCollection.Value)
    | summarize Properties = make_bag(bag_pack(Name, Value))
        by
        TimeGenerated,
        EventOriginalUid
    | extend
        PolicyName = tostring(Properties['powerplatform.analytics.resource.display_name']),
        EventType = tostring(Properties['powerplatform.analytics.resource.tenant.governance.api_policy.operation_name']),
        ActorName = tostring(Properties['enduser.principal_name']),
        PolicyId = tostring(Properties['powerplatform.analytics.resource.id']),
        AdditionalInfo = Properties['powerplatform.analytics.resource.tenant.governance.api_policy.additional_resources'];
let delete_events = dlp_policy_events
    | where EventType == "DeleteDlpPolicy";
let update_events = dlp_policy_events
    | where EventType == "UpdateDlpPolicy";
let create_events = dlp_policy_events
    | where EventType == "CreateDlpPolicy"
    | extend ignore_time = TimeGenerated + create_policy_ignore_time_window;
union
    delete_events,
    (update_events
    | join kind=leftouter (
        create_events
        | project-away TimeGenerated
        )
        on PolicyId
    | where isempty(ignore_time) or TimeGenerated > ignore_time
    | project-away ignore_time)
| where TimeGenerated >= ago(query_frequency)
| extend
    AccountName = tostring(split(ActorName, "@")[0]),
    UPNSuffix = tostring(split(ActorName, "@")[1])
| project
    TimeGenerated,
    ActorName,
    EventType,
    PolicyName,
    PolicyId,
    AccountName,
    UPNSuffix,
    AdditionalInfo

YAML

relevantTechniques:
- T1480
queryPeriod: 1d
queryFrequency: 1h
query: |
  let create_policy_ignore_time_window = 10m;
  let query_frequency = 1h;
  let dlp_policy_events = PowerPlatformAdminActivity
      | where TimeGenerated >= ago(query_frequency)
      | where EventOriginalType == "GovernanceApiPolicyOperation"
      | where PropertyCollection has_any ("DeleteDlpPolicy", "UpdateDlpPolicy", "CreateDlpPolicy")
      | mv-expand PropertyCollection
      | extend
          Name = tostring(PropertyCollection.Name),
          Value = tostring(PropertyCollection.Value)
      | summarize Properties = make_bag(bag_pack(Name, Value))
          by
          TimeGenerated,
          EventOriginalUid
      | extend
          PolicyName = tostring(Properties['powerplatform.analytics.resource.display_name']),
          EventType = tostring(Properties['powerplatform.analytics.resource.tenant.governance.api_policy.operation_name']),
          ActorName = tostring(Properties['enduser.principal_name']),
          PolicyId = tostring(Properties['powerplatform.analytics.resource.id']),
          AdditionalInfo = Properties['powerplatform.analytics.resource.tenant.governance.api_policy.additional_resources'];
  let delete_events = dlp_policy_events
      | where EventType == "DeleteDlpPolicy";
  let update_events = dlp_policy_events
      | where EventType == "UpdateDlpPolicy";
  let create_events = dlp_policy_events
      | where EventType == "CreateDlpPolicy"
      | extend ignore_time = TimeGenerated + create_policy_ignore_time_window;
  union
      delete_events,
      (update_events
      | join kind=leftouter (
          create_events
          | project-away TimeGenerated
          )
          on PolicyId
      | where isempty(ignore_time) or TimeGenerated > ignore_time
      | project-away ignore_time)
  | where TimeGenerated >= ago(query_frequency)
  | extend
      AccountName = tostring(split(ActorName, "@")[0]),
      UPNSuffix = tostring(split(ActorName, "@")[1])
  | project
      TimeGenerated,
      ActorName,
      EventType,
      PolicyName,
      PolicyId,
      AccountName,
      UPNSuffix,
      AdditionalInfo
name: Power Platform - DLP policy updated or removed
kind: Scheduled
entityMappings:
- fieldMappings:
  - columnName: AccountName
    identifier: Name
  - columnName: UPNSuffix
    identifier: UPNSuffix
  entityType: Account
customDetails:
  Policy: PolicyId
  PolicyName: PolicyName
triggerOperator: gt
severity: Low
alertDetailsOverride:
  alertDescriptionFormat: A DLP policy {{PolicyName}} was as modfiied or deleted. Event type {{EventType}}
  alertDisplayNameFormat: PowerPlatform - DLP policy {{EventType}} event detected.
status: Available
eventGroupingSettings:
  aggregationKind: SingleAlert
description: Identifies changes to DLP policy, specifically policies which are updated or removed.
requiredDataConnectors:
- dataTypes:
  - PowerPlatformAdminActivity
  connectorId: PowerPlatformAdmin
tactics:
- DefenseEvasion
version: 3.2.0
id: 1b2e6172-85c5-417a-90c3-7cc80cb787f5
triggerThreshold: 0
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Microsoft%20Business%20Applications/Analytic%20Rules/Power%20Platform%20-%20DLP%20policy%20updated%20or%20removed.yaml

ARM

{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "workspace": {
      "type": "String"
    }
  },
  "resources": [
    {
      "apiVersion": "2024-01-01-preview",
      "id": "[concat(resourceId('Microsoft.OperationalInsights/workspaces/providers', parameters('workspace'), 'Microsoft.SecurityInsights'),'/alertRules/1b2e6172-85c5-417a-90c3-7cc80cb787f5')]",
      "kind": "Scheduled",
      "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/1b2e6172-85c5-417a-90c3-7cc80cb787f5')]",
      "properties": {
        "alertDetailsOverride": {
          "alertDescriptionFormat": "A DLP policy {{PolicyName}} was as modfiied or deleted. Event type {{EventType}}",
          "alertDisplayNameFormat": "PowerPlatform - DLP policy {{EventType}} event detected."
        },
        "alertRuleTemplateName": "1b2e6172-85c5-417a-90c3-7cc80cb787f5",
        "customDetails": {
          "Policy": "PolicyId",
          "PolicyName": "PolicyName"
        },
        "description": "Identifies changes to DLP policy, specifically policies which are updated or removed.",
        "displayName": "Power Platform - DLP policy updated or removed",
        "enabled": true,
        "entityMappings": [
          {
            "entityType": "Account",
            "fieldMappings": [
              {
                "columnName": "AccountName",
                "identifier": "Name"
              },
              {
                "columnName": "UPNSuffix",
                "identifier": "UPNSuffix"
              }
            ]
          }
        ],
        "eventGroupingSettings": {
          "aggregationKind": "SingleAlert"
        },
        "OriginalUri": "https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Microsoft%20Business%20Applications/Analytic%20Rules/Power%20Platform%20-%20DLP%20policy%20updated%20or%20removed.yaml",
        "query": "let create_policy_ignore_time_window = 10m;\nlet query_frequency = 1h;\nlet dlp_policy_events = PowerPlatformAdminActivity\n    | where TimeGenerated >= ago(query_frequency)\n    | where EventOriginalType == \"GovernanceApiPolicyOperation\"\n    | where PropertyCollection has_any (\"DeleteDlpPolicy\", \"UpdateDlpPolicy\", \"CreateDlpPolicy\")\n    | mv-expand PropertyCollection\n    | extend\n        Name = tostring(PropertyCollection.Name),\n        Value = tostring(PropertyCollection.Value)\n    | summarize Properties = make_bag(bag_pack(Name, Value))\n        by\n        TimeGenerated,\n        EventOriginalUid\n    | extend\n        PolicyName = tostring(Properties['powerplatform.analytics.resource.display_name']),\n        EventType = tostring(Properties['powerplatform.analytics.resource.tenant.governance.api_policy.operation_name']),\n        ActorName = tostring(Properties['enduser.principal_name']),\n        PolicyId = tostring(Properties['powerplatform.analytics.resource.id']),\n        AdditionalInfo = Properties['powerplatform.analytics.resource.tenant.governance.api_policy.additional_resources'];\nlet delete_events = dlp_policy_events\n    | where EventType == \"DeleteDlpPolicy\";\nlet update_events = dlp_policy_events\n    | where EventType == \"UpdateDlpPolicy\";\nlet create_events = dlp_policy_events\n    | where EventType == \"CreateDlpPolicy\"\n    | extend ignore_time = TimeGenerated + create_policy_ignore_time_window;\nunion\n    delete_events,\n    (update_events\n    | join kind=leftouter (\n        create_events\n        | project-away TimeGenerated\n        )\n        on PolicyId\n    | where isempty(ignore_time) or TimeGenerated > ignore_time\n    | project-away ignore_time)\n| where TimeGenerated >= ago(query_frequency)\n| extend\n    AccountName = tostring(split(ActorName, \"@\")[0]),\n    UPNSuffix = tostring(split(ActorName, \"@\")[1])\n| project\n    TimeGenerated,\n    ActorName,\n    EventType,\n    PolicyName,\n    PolicyId,\n    AccountName,\n    UPNSuffix,\n    AdditionalInfo\n",
        "queryFrequency": "PT1H",
        "queryPeriod": "P1D",
        "severity": "Low",
        "status": "Available",
        "subTechniques": [],
        "suppressionDuration": "PT1H",
        "suppressionEnabled": false,
        "tactics": [
          "DefenseEvasion"
        ],
        "techniques": [
          "T1480"
        ],
        "templateVersion": "3.2.0",
        "triggerOperator": "GreaterThan",
        "triggerThreshold": 0
      },
      "type": "Microsoft.OperationalInsights/workspaces/providers/alertRules"
    }
  ]
}