Ping Federate - Authentication from new IP

Back


Id	30583ed4-d13c-43b8-baf2-d75fbe727210
Rulename	Ping Federate - Authentication from new IP.
Description	Detects authentication requests from new IP address.
Severity	Low
Tactics	InitialAccess
Techniques	T1078
Required data connectors	CefAma
Kind	Scheduled
Query frequency	1h
Query period	14d
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/PingFederate/Analytic Rules/PingFederateAuthFromNewSource.yaml
Version	1.0.3
Arm template	30583ed4-d13c-43b8-baf2-d75fbe727210.json

KQL

let known_src = 
PingFederateEvent
| where TimeGenerated between (ago(14d) .. (1d))
| where EventType in~ ('AUTHN_ATTEMPT', 'SSO')
| where isnotempty(SrcIpAddr)
| summarize makeset(SrcIpAddr);
PingFederateEvent
| where EventType in~ ('AUTHN_ATTEMPT', 'SSO')
| where isnotempty(SrcIpAddr)
| where SrcIpAddr !in (known_src)
| extend AccountCustomEntity = DstUserName
| extend IpCustomEntity = SrcIpAddr

YAML

triggerThreshold: 0
entityMappings:
- entityType: Account
  fieldMappings:
  - identifier: Name
    columnName: AccountCustomEntity
- entityType: IP
  fieldMappings:
  - identifier: Address
    columnName: IpCustomEntity
requiredDataConnectors:
- dataTypes:
  - CommonSecurityLog
  connectorId: CefAma
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/PingFederate/Analytic Rules/PingFederateAuthFromNewSource.yaml
name: Ping Federate - Authentication from new IP.
relevantTechniques:
- T1078
status: Available
version: 1.0.3
queryPeriod: 14d
kind: Scheduled
id: 30583ed4-d13c-43b8-baf2-d75fbe727210
query: |
  let known_src = 
  PingFederateEvent
  | where TimeGenerated between (ago(14d) .. (1d))
  | where EventType in~ ('AUTHN_ATTEMPT', 'SSO')
  | where isnotempty(SrcIpAddr)
  | summarize makeset(SrcIpAddr);
  PingFederateEvent
  | where EventType in~ ('AUTHN_ATTEMPT', 'SSO')
  | where isnotempty(SrcIpAddr)
  | where SrcIpAddr !in (known_src)
  | extend AccountCustomEntity = DstUserName
  | extend IpCustomEntity = SrcIpAddr  
description: |
    'Detects authentication requests from new IP address.'
queryFrequency: 1h
severity: Low
triggerOperator: gt
tactics:
- InitialAccess

ARM