Microsoft Sentinel Analytic Rules
cloudbrothers.infoAzure Sentinel RepoToggle Dark/Light/Auto modeToggle Dark/Light/Auto modeToggle Dark/Light/Auto modeBack to homepage

Claroty - Multiple failed logins to same destinations

Back
Id1c2310ef-19bf-4caf-b2b0-a4c983932fa5
RulenameClaroty - Multiple failed logins to same destinations
DescriptionDetects multiple failed logins to same destinations.
SeverityHigh
TacticsInitialAccess
TechniquesT1190
T1133
Required data connectorsClaroty
KindScheduled
Query frequency1h
Query period1h
Trigger threshold0
Trigger operatorgt
Source Urihttps://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Claroty/Analytic Rules/ClarotyMultipleFailedLoginsSameDst.yaml
Version1.0.0
Arm template1c2310ef-19bf-4caf-b2b0-a4c983932fa5.json
Deploy To Azure
let threshold = 10;
ClarotyEvent
| where EventType has 'Login to SRA'
| where EventType !has 'succeeded'
| extend Site = column_ifexists("site_name","")
| where isnotempty(Site)
| extend SrcUsername = extract(@'User\s(.*?)\sfailed', 1, EventMessage)
| summarize count() by Site, bin(TimeGenerated, 5m)
| where count_ > threshold
| extend SGCustomEntity = Site
triggerOperator: gt
id: 1c2310ef-19bf-4caf-b2b0-a4c983932fa5
queryFrequency: 1h
entityMappings:
- entityType: SecurityGroup
  fieldMappings:
  - columnName: SGCustomEntity
    identifier: DistinguishedName
requiredDataConnectors:
- dataTypes:
  - ClarotyEvent
  connectorId: Claroty
severity: High
triggerThreshold: 0
kind: Scheduled
status: Available
queryPeriod: 1h
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Claroty/Analytic Rules/ClarotyMultipleFailedLoginsSameDst.yaml
query: |
  let threshold = 10;
  ClarotyEvent
  | where EventType has 'Login to SRA'
  | where EventType !has 'succeeded'
  | extend Site = column_ifexists("site_name","")
  | where isnotempty(Site)
  | extend SrcUsername = extract(@'User\s(.*?)\sfailed', 1, EventMessage)
  | summarize count() by Site, bin(TimeGenerated, 5m)
  | where count_ > threshold
  | extend SGCustomEntity = Site  
description: |
    'Detects multiple failed logins to same destinations.'
name: Claroty - Multiple failed logins to same destinations
relevantTechniques:
- T1190
- T1133
tactics:
- InitialAccess
version: 1.0.0
{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "workspace": {
      "type": "String"
    }
  },
  "resources": [
    {
      "id": "[concat(resourceId('Microsoft.OperationalInsights/workspaces/providers', parameters('workspace'), 'Microsoft.SecurityInsights'),'/alertRules/1c2310ef-19bf-4caf-b2b0-a4c983932fa5')]",
      "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/1c2310ef-19bf-4caf-b2b0-a4c983932fa5')]",
      "type": "Microsoft.OperationalInsights/workspaces/providers/alertRules",
      "kind": "Scheduled",
      "apiVersion": "2022-11-01",
      "properties": {
        "displayName": "Claroty - Multiple failed logins to same destinations",
        "description": "'Detects multiple failed logins to same destinations.'\n",
        "severity": "High",
        "enabled": true,
        "query": "let threshold = 10;\nClarotyEvent\n| where EventType has 'Login to SRA'\n| where EventType !has 'succeeded'\n| extend Site = column_ifexists(\"site_name\",\"\")\n| where isnotempty(Site)\n| extend SrcUsername = extract(@'User\\s(.*?)\\sfailed', 1, EventMessage)\n| summarize count() by Site, bin(TimeGenerated, 5m)\n| where count_ > threshold\n| extend SGCustomEntity = Site\n",
        "queryFrequency": "PT1H",
        "queryPeriod": "PT1H",
        "triggerOperator": "GreaterThan",
        "triggerThreshold": 0,
        "suppressionDuration": "PT1H",
        "suppressionEnabled": false,
        "tactics": [
          "InitialAccess"
        ],
        "techniques": [
          "T1190",
          "T1133"
        ],
        "alertRuleTemplateName": "1c2310ef-19bf-4caf-b2b0-a4c983932fa5",
        "customDetails": null,
        "entityMappings": [
          {
            "fieldMappings": [
              {
                "identifier": "DistinguishedName",
                "columnName": "SGCustomEntity"
              }
            ],
            "entityType": "SecurityGroup"
          }
        ],
        "OriginalUri": "https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Claroty/Analytic Rules/ClarotyMultipleFailedLoginsSameDst.yaml",
        "templateVersion": "1.0.0",
        "status": "Available"
      }
    }
  ]
}