Microsoft Sentinel Analytic Rules
cloudbrothers.infoAzure Sentinel RepoToggle Dark/Light/Auto modeToggle Dark/Light/Auto modeToggle Dark/Light/Auto modeBack to homepage

UserAccountDisabled

Back
Id24E0132F-61D1-41BD-9393-06136D1039C7
RulenameUserAccountDisabled
DescriptionThis query searches for account is Disabled. Does not effect score as its easily enabled.
SeverityMedium
TacticsInitialAccess
TechniquesT1078
Required data connectorsSenservaPro
KindScheduled
Query frequency6h
Query period6h
Trigger threshold0
Trigger operatorgt
Source Urihttps://github.com/Azure/Azure-Sentinel/blob/master/Solutions/SenservaPro/Analytic Rules/UserAccountDisabled.yaml
Version1.0.0
Arm template24E0132F-61D1-41BD-9393-06136D1039C7.json
Deploy To Azure
SenservaPro_CL
| where ControlName_s == 'UserDisabled'
tactics:
- InitialAccess
name: UserAccountDisabled
id: 24E0132F-61D1-41BD-9393-06136D1039C7
requiredDataConnectors:
- connectorId: SenservaPro
  dataTypes:
  - SenservaPro_CL
query: |
  SenservaPro_CL
  | where ControlName_s == 'UserDisabled'  
relevantTechniques:
- T1078
description: |
    'This query searches for account is Disabled. Does not effect score as its easily enabled.'
triggerOperator: gt
queryPeriod: 6h
severity: Medium
entityMappings:
- fieldMappings:
  - identifier: Name
    columnName: ControlName_s
  - identifier: AadTenantId
    columnName: TenantId
  - identifier: DisplayName
    columnName: TenantDisplayName_s
  entityType: Account
- fieldMappings:
  - identifier: DistinguishedName
    columnName: Group_s
  entityType: SecurityGroup
- fieldMappings:
  - identifier: ResourceId
    columnName: SourceSystem
  entityType: AzureResource
version: 1.0.0
triggerThreshold: 0
kind: Scheduled
queryFrequency: 6h
status: Available
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/SenservaPro/Analytic Rules/UserAccountDisabled.yaml
{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "workspace": {
      "type": "String"
    }
  },
  "resources": [
    {
      "apiVersion": "2024-01-01-preview",
      "id": "[concat(resourceId('Microsoft.OperationalInsights/workspaces/providers', parameters('workspace'), 'Microsoft.SecurityInsights'),'/alertRules/24E0132F-61D1-41BD-9393-06136D1039C7')]",
      "kind": "Scheduled",
      "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/24E0132F-61D1-41BD-9393-06136D1039C7')]",
      "properties": {
        "alertRuleTemplateName": "24E0132F-61D1-41BD-9393-06136D1039C7",
        "customDetails": null,
        "description": "'This query searches for account is Disabled. Does not effect score as its easily enabled.'\n",
        "displayName": "UserAccountDisabled",
        "enabled": true,
        "entityMappings": [
          {
            "entityType": "Account",
            "fieldMappings": [
              {
                "columnName": "ControlName_s",
                "identifier": "Name"
              },
              {
                "columnName": "TenantId",
                "identifier": "AadTenantId"
              },
              {
                "columnName": "TenantDisplayName_s",
                "identifier": "DisplayName"
              }
            ]
          },
          {
            "entityType": "SecurityGroup",
            "fieldMappings": [
              {
                "columnName": "Group_s",
                "identifier": "DistinguishedName"
              }
            ]
          },
          {
            "entityType": "AzureResource",
            "fieldMappings": [
              {
                "columnName": "SourceSystem",
                "identifier": "ResourceId"
              }
            ]
          }
        ],
        "OriginalUri": "https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/SenservaPro/Analytic Rules/UserAccountDisabled.yaml",
        "query": "SenservaPro_CL\n| where ControlName_s == 'UserDisabled'\n",
        "queryFrequency": "PT6H",
        "queryPeriod": "PT6H",
        "severity": "Medium",
        "status": "Available",
        "subTechniques": [],
        "suppressionDuration": "PT1H",
        "suppressionEnabled": false,
        "tactics": [
          "InitialAccess"
        ],
        "techniques": [
          "T1078"
        ],
        "templateVersion": "1.0.0",
        "triggerOperator": "GreaterThan",
        "triggerThreshold": 0
      },
      "type": "Microsoft.OperationalInsights/workspaces/providers/alertRules"
    }
  ]
}