TI map IP entity to LastPass data

Back


Id	2a723664-22c2-4d3e-bbec-5843b90166f3
Rulename	TI map IP entity to LastPass data
Description	Identifies a match in LastPass table from any IP IOC from TI
Severity	Medium
Tactics	Impact
Techniques	T1485
Required data connectors	LastPass ThreatIntelligence
Kind	Scheduled
Query frequency	1h
Query period	14d
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/LastPass/Analytic Rules/TIMapIPEntityToLastPass.yaml
Version	1.0.1
Arm template	2a723664-22c2-4d3e-bbec-5843b90166f3.json

KQL

let dt_lookBack = 1h;
let ioc_lookBack = 14d;
ThreatIntelligenceIndicator
| where TimeGenerated >= ago(ioc_lookBack) and ExpirationDateTime > now()
| where Active == true
// Picking up only IOC's that contain the entities we want
| where isnotempty(NetworkIP) or isnotempty(EmailSourceIpAddress) or isnotempty(NetworkDestinationIP) or isnotempty(NetworkSourceIP)
// As there is potentially more than 1 indicator type for matching IP, taking Network IP first, then others if that is empty.
// Taking the first non-empty value based on potential IOC match availability
| extend TI_ipEntity = iff(isnotempty(NetworkIP), NetworkIP, NetworkDestinationIP)
| extend TI_ipEntity = iff(isempty(TI_ipEntity) and isnotempty(NetworkSourceIP), NetworkSourceIP, TI_ipEntity)
| extend TI_ipEntity = iff(isempty(TI_ipEntity) and isnotempty(EmailSourceIpAddress), EmailSourceIpAddress, TI_ipEntity)
| join (
    LastPassNativePoller_CL | where todatetime(Time_s) >= ago(dt_lookBack)
    | where Action_s != "Reporting"
    // renaming time column so it is clear the log this came from
    | extend LastPass_TimeGenerated = todatetime(Time_s)
)
on $left.TI_ipEntity == $right.IP_Address_s
| summarize LatestIndicatorTime = arg_max(TimeGenerated, *) by IndicatorId
| project LatestIndicatorTime, Description, ActivityGroupNames, IndicatorId, ThreatType, Url, ExpirationDateTime, ConfidenceScore, LastPass_TimeGenerated, 
TI_ipEntity, IP_Address_s, Username_s, Action_s, Data_s, NetworkIP, NetworkDestinationIP, NetworkSourceIP, EmailSourceIpAddress

YAML

name: TI map IP entity to LastPass data
id: 2a723664-22c2-4d3e-bbec-5843b90166f3
description: |
    'Identifies a match in LastPass table from any IP IOC from TI'
triggerThreshold: 0
entityMappings:
- fieldMappings:
  - columnName: Username_s
    identifier: Name
  entityType: Account
- fieldMappings:
  - columnName: IP_Address_s
    identifier: Address
  entityType: IP
- fieldMappings:
  - columnName: Url
    identifier: Url
  entityType: URL
version: 1.0.1
triggerOperator: gt
query: |
  let dt_lookBack = 1h;
  let ioc_lookBack = 14d;
  ThreatIntelligenceIndicator
  | where TimeGenerated >= ago(ioc_lookBack) and ExpirationDateTime > now()
  | where Active == true
  // Picking up only IOC's that contain the entities we want
  | where isnotempty(NetworkIP) or isnotempty(EmailSourceIpAddress) or isnotempty(NetworkDestinationIP) or isnotempty(NetworkSourceIP)
  // As there is potentially more than 1 indicator type for matching IP, taking Network IP first, then others if that is empty.
  // Taking the first non-empty value based on potential IOC match availability
  | extend TI_ipEntity = iff(isnotempty(NetworkIP), NetworkIP, NetworkDestinationIP)
  | extend TI_ipEntity = iff(isempty(TI_ipEntity) and isnotempty(NetworkSourceIP), NetworkSourceIP, TI_ipEntity)
  | extend TI_ipEntity = iff(isempty(TI_ipEntity) and isnotempty(EmailSourceIpAddress), EmailSourceIpAddress, TI_ipEntity)
  | join (
      LastPassNativePoller_CL | where todatetime(Time_s) >= ago(dt_lookBack)
      | where Action_s != "Reporting"
      // renaming time column so it is clear the log this came from
      | extend LastPass_TimeGenerated = todatetime(Time_s)
  )
  on $left.TI_ipEntity == $right.IP_Address_s
  | summarize LatestIndicatorTime = arg_max(TimeGenerated, *) by IndicatorId
  | project LatestIndicatorTime, Description, ActivityGroupNames, IndicatorId, ThreatType, Url, ExpirationDateTime, ConfidenceScore, LastPass_TimeGenerated, 
  TI_ipEntity, IP_Address_s, Username_s, Action_s, Data_s, NetworkIP, NetworkDestinationIP, NetworkSourceIP, EmailSourceIpAddress  
tactics:
- Impact
kind: Scheduled
queryFrequency: 1h
severity: Medium
queryPeriod: 14d
requiredDataConnectors:
- dataTypes:
  - LastPassNativePoller_CL
  connectorId: LastPass
- dataTypes:
  - ThreatIntelligenceIndicator
  connectorId: ThreatIntelligence
status: Available
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/LastPass/Analytic Rules/TIMapIPEntityToLastPass.yaml
eventGroupingSettings:
  aggregationKind: AlertPerResult
relevantTechniques:
- T1485

ARM