TI map IP entity to LastPass data

Back


Id	2a723664-22c2-4d3e-bbec-5843b90166f3
Rulename	TI map IP entity to LastPass data
Description	Identifies a match in LastPass table from any IP IOC from TI
Severity	Medium
Tactics	Impact
Techniques	T1485
Required data connectors	LastPass ThreatIntelligence
Kind	Scheduled
Query frequency	1h
Query period	14d
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/LastPass/Analytic Rules/TIMapIPEntityToLastPass.yaml
Version	1.0.1
Arm template	2a723664-22c2-4d3e-bbec-5843b90166f3.json

KQL

let dt_lookBack = 1h;
let ioc_lookBack = 14d;
ThreatIntelligenceIndicator
| where TimeGenerated >= ago(ioc_lookBack) and ExpirationDateTime > now()
| where Active == true
// Picking up only IOC's that contain the entities we want
| where isnotempty(NetworkIP) or isnotempty(EmailSourceIpAddress) or isnotempty(NetworkDestinationIP) or isnotempty(NetworkSourceIP)
// As there is potentially more than 1 indicator type for matching IP, taking Network IP first, then others if that is empty.
// Taking the first non-empty value based on potential IOC match availability
| extend TI_ipEntity = iff(isnotempty(NetworkIP), NetworkIP, NetworkDestinationIP)
| extend TI_ipEntity = iff(isempty(TI_ipEntity) and isnotempty(NetworkSourceIP), NetworkSourceIP, TI_ipEntity)
| extend TI_ipEntity = iff(isempty(TI_ipEntity) and isnotempty(EmailSourceIpAddress), EmailSourceIpAddress, TI_ipEntity)
| join (
    LastPassNativePoller_CL | where todatetime(Time_s) >= ago(dt_lookBack)
    | where Action_s != "Reporting"
    // renaming time column so it is clear the log this came from
    | extend LastPass_TimeGenerated = todatetime(Time_s)
)
on $left.TI_ipEntity == $right.IP_Address_s
| summarize LatestIndicatorTime = arg_max(TimeGenerated, *) by IndicatorId
| project LatestIndicatorTime, Description, ActivityGroupNames, IndicatorId, ThreatType, Url, ExpirationDateTime, ConfidenceScore, LastPass_TimeGenerated, 
TI_ipEntity, IP_Address_s, Username_s, Action_s, Data_s, NetworkIP, NetworkDestinationIP, NetworkSourceIP, EmailSourceIpAddress

YAML

queryPeriod: 14d
query: |
  let dt_lookBack = 1h;
  let ioc_lookBack = 14d;
  ThreatIntelligenceIndicator
  | where TimeGenerated >= ago(ioc_lookBack) and ExpirationDateTime > now()
  | where Active == true
  // Picking up only IOC's that contain the entities we want
  | where isnotempty(NetworkIP) or isnotempty(EmailSourceIpAddress) or isnotempty(NetworkDestinationIP) or isnotempty(NetworkSourceIP)
  // As there is potentially more than 1 indicator type for matching IP, taking Network IP first, then others if that is empty.
  // Taking the first non-empty value based on potential IOC match availability
  | extend TI_ipEntity = iff(isnotempty(NetworkIP), NetworkIP, NetworkDestinationIP)
  | extend TI_ipEntity = iff(isempty(TI_ipEntity) and isnotempty(NetworkSourceIP), NetworkSourceIP, TI_ipEntity)
  | extend TI_ipEntity = iff(isempty(TI_ipEntity) and isnotempty(EmailSourceIpAddress), EmailSourceIpAddress, TI_ipEntity)
  | join (
      LastPassNativePoller_CL | where todatetime(Time_s) >= ago(dt_lookBack)
      | where Action_s != "Reporting"
      // renaming time column so it is clear the log this came from
      | extend LastPass_TimeGenerated = todatetime(Time_s)
  )
  on $left.TI_ipEntity == $right.IP_Address_s
  | summarize LatestIndicatorTime = arg_max(TimeGenerated, *) by IndicatorId
  | project LatestIndicatorTime, Description, ActivityGroupNames, IndicatorId, ThreatType, Url, ExpirationDateTime, ConfidenceScore, LastPass_TimeGenerated, 
  TI_ipEntity, IP_Address_s, Username_s, Action_s, Data_s, NetworkIP, NetworkDestinationIP, NetworkSourceIP, EmailSourceIpAddress  
name: TI map IP entity to LastPass data
entityMappings:
- fieldMappings:
  - columnName: Username_s
    identifier: Name
  entityType: Account
- fieldMappings:
  - columnName: IP_Address_s
    identifier: Address
  entityType: IP
- fieldMappings:
  - columnName: Url
    identifier: Url
  entityType: URL
eventGroupingSettings:
  aggregationKind: AlertPerResult
queryFrequency: 1h
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/LastPass/Analytic Rules/TIMapIPEntityToLastPass.yaml
description: |
    'Identifies a match in LastPass table from any IP IOC from TI'
kind: Scheduled
version: 1.0.1
status: Available
severity: Medium
requiredDataConnectors:
- connectorId: LastPass
  dataTypes:
  - LastPassNativePoller_CL
- connectorId: ThreatIntelligence
  dataTypes:
  - ThreatIntelligenceIndicator
triggerOperator: gt
triggerThreshold: 0
tactics:
- Impact
id: 2a723664-22c2-4d3e-bbec-5843b90166f3
relevantTechniques:
- T1485

ARM