CyberArk - Sensitive SafePermissionEntitlement Changes with customData

let indicators = dynamic(["SafeMember","Permission","Access","ACL","Owner","Role","Entitlement","Policy"]);
let changeVerbs = dynamic(["grant","revoke","assign","elevate","enable","disable","remove","delete","update"]);
let actions = dynamic(["policy-add", "policy-change"]);
CyberArk_AuditEvents_CL
| extend cd = parse_json(tostring(customData))
| extend cd_changeType = tolower(tostring(cd.changeType)),
         cd_role       = tostring(cd.role),
         cd_perm       = tostring(cd.permission),
         cd_policy     = tostring(cd.policy),
         cd_entitle    = tostring(cd.entitlement),
         cd_description= tostring(cd.description),
         cd_action     = tostring(cd.action)
| where 
    action has_any(actions) and
    (auditType has_any (indicators)
    or message has_any (indicators)
    or cd_description has_any (indicators)
    or cd_action has_any (indicators)
    or cd_role !~ "" or cd_perm !~ "" or cd_policy !~ "" or cd_entitle !~ ""
    or cd_changeType in (changeVerbs))
| project TimeGenerated, CyberArkTenantId, serviceName, username, userId, safe,
          action, actionType, auditType,
          cd_action, cd_description, cd_changeType, cd_role, cd_perm, cd_policy, cd_entitle,
          target, message

id: 30938118-8812-4b5f-afa4-a8d4ba2b5d86
entityMappings:
- entityType: Account
  fieldMappings:
  - identifier: FullName
    columnName: username
- entityType: Host
  fieldMappings:
  - identifier: HostName
    columnName: target
name: CyberArk - Sensitive Safe/Permission/Entitlement Changes (with customData)
queryFrequency: 10M
triggerOperator: GreaterThan
suppressionEnabled: false
queryPeriod: 1D
tactics:
- PrivilegeEscalation
description: |
  Alerts on control-plane modifications: safes, permissions, roles, entitlements, policy changes. Leverages customData fields such as changeType/role/permission/policy/entitlement to reduce misses.
severity: Low
kind: Scheduled
triggerThreshold: 0
query: |
  let indicators = dynamic(["SafeMember","Permission","Access","ACL","Owner","Role","Entitlement","Policy"]);
  let changeVerbs = dynamic(["grant","revoke","assign","elevate","enable","disable","remove","delete","update"]);
  let actions = dynamic(["policy-add", "policy-change"]);
  CyberArk_AuditEvents_CL
  | extend cd = parse_json(tostring(customData))
  | extend cd_changeType = tolower(tostring(cd.changeType)),
           cd_role       = tostring(cd.role),
           cd_perm       = tostring(cd.permission),
           cd_policy     = tostring(cd.policy),
           cd_entitle    = tostring(cd.entitlement),
           cd_description= tostring(cd.description),
           cd_action     = tostring(cd.action)
  | where 
      action has_any(actions) and
      (auditType has_any (indicators)
      or message has_any (indicators)
      or cd_description has_any (indicators)
      or cd_action has_any (indicators)
      or cd_role !~ "" or cd_perm !~ "" or cd_policy !~ "" or cd_entitle !~ ""
      or cd_changeType in (changeVerbs))
  | project TimeGenerated, CyberArkTenantId, serviceName, username, userId, safe,
            action, actionType, auditType,
            cd_action, cd_description, cd_changeType, cd_role, cd_perm, cd_policy, cd_entitle,
            target, message
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/CyberArkAudit/Analytics%20Rules/CyberArkAuditSensitiveChanges.yaml
version: 1.0.0

{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "workspace": {
      "type": "String"
    }
  },
  "resources": [
    {
      "apiVersion": "2024-01-01-preview",
      "id": "[concat(resourceId('Microsoft.OperationalInsights/workspaces/providers', parameters('workspace'), 'Microsoft.SecurityInsights'),'/alertRules/30938118-8812-4b5f-afa4-a8d4ba2b5d86')]",
      "kind": "Scheduled",
      "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/30938118-8812-4b5f-afa4-a8d4ba2b5d86')]",
      "properties": {
        "alertRuleTemplateName": "30938118-8812-4b5f-afa4-a8d4ba2b5d86",
        "customDetails": null,
        "description": "Alerts on control-plane modifications: safes, permissions, roles, entitlements, policy changes. Leverages customData fields such as changeType/role/permission/policy/entitlement to reduce misses.\n",
        "displayName": "CyberArk - Sensitive Safe/Permission/Entitlement Changes (with customData)",
        "enabled": true,
        "entityMappings": [
          {
            "entityType": "Account",
            "fieldMappings": [
              {
                "columnName": "username",
                "identifier": "FullName"
              }
            ]
          },
          {
            "entityType": "Host",
            "fieldMappings": [
              {
                "columnName": "target",
                "identifier": "HostName"
              }
            ]
          }
        ],
        "OriginalUri": "https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/CyberArkAudit/Analytics%20Rules/CyberArkAuditSensitiveChanges.yaml",
        "query": "let indicators = dynamic([\"SafeMember\",\"Permission\",\"Access\",\"ACL\",\"Owner\",\"Role\",\"Entitlement\",\"Policy\"]);\nlet changeVerbs = dynamic([\"grant\",\"revoke\",\"assign\",\"elevate\",\"enable\",\"disable\",\"remove\",\"delete\",\"update\"]);\nlet actions = dynamic([\"policy-add\", \"policy-change\"]);\nCyberArk_AuditEvents_CL\n| extend cd = parse_json(tostring(customData))\n| extend cd_changeType = tolower(tostring(cd.changeType)),\n         cd_role       = tostring(cd.role),\n         cd_perm       = tostring(cd.permission),\n         cd_policy     = tostring(cd.policy),\n         cd_entitle    = tostring(cd.entitlement),\n         cd_description= tostring(cd.description),\n         cd_action     = tostring(cd.action)\n| where \n    action has_any(actions) and\n    (auditType has_any (indicators)\n    or message has_any (indicators)\n    or cd_description has_any (indicators)\n    or cd_action has_any (indicators)\n    or cd_role !~ \"\" or cd_perm !~ \"\" or cd_policy !~ \"\" or cd_entitle !~ \"\"\n    or cd_changeType in (changeVerbs))\n| project TimeGenerated, CyberArkTenantId, serviceName, username, userId, safe,\n          action, actionType, auditType,\n          cd_action, cd_description, cd_changeType, cd_role, cd_perm, cd_policy, cd_entitle,\n          target, message\n",
        "queryFrequency": "PT10M",
        "queryPeriod": "P1D",
        "severity": "Low",
        "subTechniques": [],
        "suppressionDuration": "PT1H",
        "suppressionEnabled": false,
        "tactics": [
          "PrivilegeEscalation"
        ],
        "templateVersion": "1.0.0",
        "triggerOperator": "GreaterThan",
        "triggerThreshold": 0
      },
      "type": "Microsoft.OperationalInsights/workspaces/providers/alertRules"
    }
  ]
}