Power Platform - DLP policy updated or removed

Back


Id	1b2e6172-85c5-417a-90c3-7cc80cb787f5
Rulename	Power Platform - DLP policy updated or removed
Description	Identifies changes to DLP policy, specifically policies which are updated or removed.
Severity	Low
Tactics	DefenseEvasion
Techniques	T1480
Required data connectors	PowerPlatformAdmin
Kind	Scheduled
Query frequency	1h
Query period	1d
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Microsoft Business Applications/Analytic Rules/Power Platform - DLP policy updated or removed.yaml
Version	3.2.0
Arm template	1b2e6172-85c5-417a-90c3-7cc80cb787f5.json

KQL

let create_policy_ignore_time_window = 10m;
let query_frequency = 1h;
let dlp_policy_events = PowerPlatformAdminActivity
    | where TimeGenerated >= ago(query_frequency)
    | where EventOriginalType == "GovernanceApiPolicyOperation"
    | where PropertyCollection has_any ("DeleteDlpPolicy", "UpdateDlpPolicy", "CreateDlpPolicy")
    | mv-expand PropertyCollection
    | extend
        Name = tostring(PropertyCollection.Name),
        Value = tostring(PropertyCollection.Value)
    | summarize Properties = make_bag(bag_pack(Name, Value))
        by
        TimeGenerated,
        EventOriginalUid
    | extend
        PolicyName = tostring(Properties['powerplatform.analytics.resource.display_name']),
        EventType = tostring(Properties['powerplatform.analytics.resource.tenant.governance.api_policy.operation_name']),
        ActorName = tostring(Properties['enduser.principal_name']),
        PolicyId = tostring(Properties['powerplatform.analytics.resource.id']),
        AdditionalInfo = Properties['powerplatform.analytics.resource.tenant.governance.api_policy.additional_resources'];
let delete_events = dlp_policy_events
    | where EventType == "DeleteDlpPolicy";
let update_events = dlp_policy_events
    | where EventType == "UpdateDlpPolicy";
let create_events = dlp_policy_events
    | where EventType == "CreateDlpPolicy"
    | extend ignore_time = TimeGenerated + create_policy_ignore_time_window;
union
    delete_events,
    (update_events
    | join kind=leftouter (
        create_events
        | project-away TimeGenerated
        )
        on PolicyId
    | where isempty(ignore_time) or TimeGenerated > ignore_time
    | project-away ignore_time)
| where TimeGenerated >= ago(query_frequency)
| extend
    AccountName = tostring(split(ActorName, "@")[0]),
    UPNSuffix = tostring(split(ActorName, "@")[1])
| project
    TimeGenerated,
    ActorName,
    EventType,
    PolicyName,
    PolicyId,
    AccountName,
    UPNSuffix,
    AdditionalInfo

YAML

customDetails:
  Policy: PolicyId
  PolicyName: PolicyName
queryPeriod: 1d
id: 1b2e6172-85c5-417a-90c3-7cc80cb787f5
relevantTechniques:
- T1480
triggerOperator: gt
entityMappings:
- fieldMappings:
  - columnName: AccountName
    identifier: Name
  - columnName: UPNSuffix
    identifier: UPNSuffix
  entityType: Account
query: |
  let create_policy_ignore_time_window = 10m;
  let query_frequency = 1h;
  let dlp_policy_events = PowerPlatformAdminActivity
      | where TimeGenerated >= ago(query_frequency)
      | where EventOriginalType == "GovernanceApiPolicyOperation"
      | where PropertyCollection has_any ("DeleteDlpPolicy", "UpdateDlpPolicy", "CreateDlpPolicy")
      | mv-expand PropertyCollection
      | extend
          Name = tostring(PropertyCollection.Name),
          Value = tostring(PropertyCollection.Value)
      | summarize Properties = make_bag(bag_pack(Name, Value))
          by
          TimeGenerated,
          EventOriginalUid
      | extend
          PolicyName = tostring(Properties['powerplatform.analytics.resource.display_name']),
          EventType = tostring(Properties['powerplatform.analytics.resource.tenant.governance.api_policy.operation_name']),
          ActorName = tostring(Properties['enduser.principal_name']),
          PolicyId = tostring(Properties['powerplatform.analytics.resource.id']),
          AdditionalInfo = Properties['powerplatform.analytics.resource.tenant.governance.api_policy.additional_resources'];
  let delete_events = dlp_policy_events
      | where EventType == "DeleteDlpPolicy";
  let update_events = dlp_policy_events
      | where EventType == "UpdateDlpPolicy";
  let create_events = dlp_policy_events
      | where EventType == "CreateDlpPolicy"
      | extend ignore_time = TimeGenerated + create_policy_ignore_time_window;
  union
      delete_events,
      (update_events
      | join kind=leftouter (
          create_events
          | project-away TimeGenerated
          )
          on PolicyId
      | where isempty(ignore_time) or TimeGenerated > ignore_time
      | project-away ignore_time)
  | where TimeGenerated >= ago(query_frequency)
  | extend
      AccountName = tostring(split(ActorName, "@")[0]),
      UPNSuffix = tostring(split(ActorName, "@")[1])
  | project
      TimeGenerated,
      ActorName,
      EventType,
      PolicyName,
      PolicyId,
      AccountName,
      UPNSuffix,
      AdditionalInfo  
kind: Scheduled
triggerThreshold: 0
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Microsoft Business Applications/Analytic Rules/Power Platform - DLP policy updated or removed.yaml
queryFrequency: 1h
requiredDataConnectors:
- dataTypes:
  - PowerPlatformAdminActivity
  connectorId: PowerPlatformAdmin
eventGroupingSettings:
  aggregationKind: SingleAlert
name: Power Platform - DLP policy updated or removed
version: 3.2.0
description: Identifies changes to DLP policy, specifically policies which are updated or removed.
alertDetailsOverride:
  alertDisplayNameFormat: PowerPlatform - DLP policy {{EventType}} event detected.
  alertDescriptionFormat: A DLP policy {{PolicyName}} was as modfiied or deleted. Event type {{EventType}}
tactics:
- DefenseEvasion
severity: Low
status: Available

ARM

{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "workspace": {
      "type": "String"
    }
  },
  "resources": [
    {
      "apiVersion": "2024-01-01-preview",
      "id": "[concat(resourceId('Microsoft.OperationalInsights/workspaces/providers', parameters('workspace'), 'Microsoft.SecurityInsights'),'/alertRules/1b2e6172-85c5-417a-90c3-7cc80cb787f5')]",
      "kind": "Scheduled",
      "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/1b2e6172-85c5-417a-90c3-7cc80cb787f5')]",
      "properties": {
        "alertDetailsOverride": {
          "alertDescriptionFormat": "A DLP policy {{PolicyName}} was as modfiied or deleted. Event type {{EventType}}",
          "alertDisplayNameFormat": "PowerPlatform - DLP policy {{EventType}} event detected."
        },
        "alertRuleTemplateName": "1b2e6172-85c5-417a-90c3-7cc80cb787f5",
        "customDetails": {
          "Policy": "PolicyId",
          "PolicyName": "PolicyName"
        },
        "description": "Identifies changes to DLP policy, specifically policies which are updated or removed.",
        "displayName": "Power Platform - DLP policy updated or removed",
        "enabled": true,
        "entityMappings": [
          {
            "entityType": "Account",
            "fieldMappings": [
              {
                "columnName": "AccountName",
                "identifier": "Name"
              },
              {
                "columnName": "UPNSuffix",
                "identifier": "UPNSuffix"
              }
            ]
          }
        ],
        "eventGroupingSettings": {
          "aggregationKind": "SingleAlert"
        },
        "OriginalUri": "https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Microsoft Business Applications/Analytic Rules/Power Platform - DLP policy updated or removed.yaml",
        "query": "let create_policy_ignore_time_window = 10m;\nlet query_frequency = 1h;\nlet dlp_policy_events = PowerPlatformAdminActivity\n    | where TimeGenerated >= ago(query_frequency)\n    | where EventOriginalType == \"GovernanceApiPolicyOperation\"\n    | where PropertyCollection has_any (\"DeleteDlpPolicy\", \"UpdateDlpPolicy\", \"CreateDlpPolicy\")\n    | mv-expand PropertyCollection\n    | extend\n        Name = tostring(PropertyCollection.Name),\n        Value = tostring(PropertyCollection.Value)\n    | summarize Properties = make_bag(bag_pack(Name, Value))\n        by\n        TimeGenerated,\n        EventOriginalUid\n    | extend\n        PolicyName = tostring(Properties['powerplatform.analytics.resource.display_name']),\n        EventType = tostring(Properties['powerplatform.analytics.resource.tenant.governance.api_policy.operation_name']),\n        ActorName = tostring(Properties['enduser.principal_name']),\n        PolicyId = tostring(Properties['powerplatform.analytics.resource.id']),\n        AdditionalInfo = Properties['powerplatform.analytics.resource.tenant.governance.api_policy.additional_resources'];\nlet delete_events = dlp_policy_events\n    | where EventType == \"DeleteDlpPolicy\";\nlet update_events = dlp_policy_events\n    | where EventType == \"UpdateDlpPolicy\";\nlet create_events = dlp_policy_events\n    | where EventType == \"CreateDlpPolicy\"\n    | extend ignore_time = TimeGenerated + create_policy_ignore_time_window;\nunion\n    delete_events,\n    (update_events\n    | join kind=leftouter (\n        create_events\n        | project-away TimeGenerated\n        )\n        on PolicyId\n    | where isempty(ignore_time) or TimeGenerated > ignore_time\n    | project-away ignore_time)\n| where TimeGenerated >= ago(query_frequency)\n| extend\n    AccountName = tostring(split(ActorName, \"@\")[0]),\n    UPNSuffix = tostring(split(ActorName, \"@\")[1])\n| project\n    TimeGenerated,\n    ActorName,\n    EventType,\n    PolicyName,\n    PolicyId,\n    AccountName,\n    UPNSuffix,\n    AdditionalInfo\n",
        "queryFrequency": "PT1H",
        "queryPeriod": "P1D",
        "severity": "Low",
        "status": "Available",
        "subTechniques": [],
        "suppressionDuration": "PT1H",
        "suppressionEnabled": false,
        "tactics": [
          "DefenseEvasion"
        ],
        "techniques": [
          "T1480"
        ],
        "templateVersion": "3.2.0",
        "triggerOperator": "GreaterThan",
        "triggerThreshold": 0
      },
      "type": "Microsoft.OperationalInsights/workspaces/providers/alertRules"
    }
  ]
}