Microsoft Sentinel Analytic Rules
cloudbrothers.infoAzure Sentinel RepoToggle Dark/Light/Auto modeToggle Dark/Light/Auto modeToggle Dark/Light/Auto modeBack to homepage

User Sign in from different countries

Back
Id3094e036-e5ae-4d6e-8626-b0f86ebc71f2
RulenameUser Sign in from different countries
DescriptionThis query searches for successful user logins from different countries within 30min.
SeverityMedium
TacticsInitialAccess
TechniquesT1078
Required data connectorsSalesforceServiceCloud
KindScheduled
Query frequency30m
Query period30m
Trigger threshold0
Trigger operatorgt
Source Urihttps://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Salesforce Service Cloud/Analytic Rules/Salesforce-SigninsMultipleCountries.yaml
Version1.0.1
Arm template3094e036-e5ae-4d6e-8626-b0f86ebc71f2.json
Deploy To Azure
let threshold = 2;
let Countrydb = externaldata(Network:string, geoname_id:string, continent_code:string, continent_name:string, country_iso_code:string, country_name:string)
[@"https://raw.githubusercontent.com/datasets/geoip2-ipv4/master/data/geoip2-ipv4.csv"];
let UsersLocation = SalesforceServiceCloud
| where EventType =~ 'Login' and LoginStatus=~'LOGIN_NO_ERROR'
| project TimeGenerated, ClientIp, UserId, User, UserType ;
UsersLocation
| extend Dummy=1
| summarize count() by Hour=bin(TimeGenerated,30m), ClientIp,User, Dummy
| partition by Hour(
                lookup (Countrydb|extend Dummy=1) on Dummy
              | where ipv4_is_match(ClientIp, Network)
              )
| summarize NumOfCountries = dcount(country_name) by User, Hour
| where NumOfCountries >= threshold
kind: Scheduled
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Salesforce Service Cloud/Analytic Rules/Salesforce-SigninsMultipleCountries.yaml
severity: Medium
name: User Sign in from different countries
entityMappings:
- entityType: Account
  fieldMappings:
  - columnName: User
    identifier: AadUserId
relevantTechniques:
- T1078
queryFrequency: 30m
triggerThreshold: 0
queryPeriod: 30m
description: |
    'This query searches for successful user logins from different countries within 30min.'
id: 3094e036-e5ae-4d6e-8626-b0f86ebc71f2
version: 1.0.1
tactics:
- InitialAccess
query: |
  let threshold = 2;
  let Countrydb = externaldata(Network:string, geoname_id:string, continent_code:string, continent_name:string, country_iso_code:string, country_name:string)
  [@"https://raw.githubusercontent.com/datasets/geoip2-ipv4/master/data/geoip2-ipv4.csv"];
  let UsersLocation = SalesforceServiceCloud
  | where EventType =~ 'Login' and LoginStatus=~'LOGIN_NO_ERROR'
  | project TimeGenerated, ClientIp, UserId, User, UserType ;
  UsersLocation
  | extend Dummy=1
  | summarize count() by Hour=bin(TimeGenerated,30m), ClientIp,User, Dummy
  | partition by Hour(
                  lookup (Countrydb|extend Dummy=1) on Dummy
                | where ipv4_is_match(ClientIp, Network)
                )
  | summarize NumOfCountries = dcount(country_name) by User, Hour
  | where NumOfCountries >= threshold  
status: Available
requiredDataConnectors:
- dataTypes:
  - SalesforceServiceCloud
  connectorId: SalesforceServiceCloud
triggerOperator: gt
{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "workspace": {
      "type": "String"
    }
  },
  "resources": [
    {
      "id": "[concat(resourceId('Microsoft.OperationalInsights/workspaces/providers', parameters('workspace'), 'Microsoft.SecurityInsights'),'/alertRules/3094e036-e5ae-4d6e-8626-b0f86ebc71f2')]",
      "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/3094e036-e5ae-4d6e-8626-b0f86ebc71f2')]",
      "type": "Microsoft.OperationalInsights/workspaces/providers/alertRules",
      "kind": "Scheduled",
      "apiVersion": "2022-11-01-preview",
      "properties": {
        "displayName": "User Sign in from different countries",
        "description": "'This query searches for successful user logins from different countries within 30min.'\n",
        "severity": "Medium",
        "enabled": true,
        "query": "let threshold = 2;\nlet Countrydb = externaldata(Network:string, geoname_id:string, continent_code:string, continent_name:string, country_iso_code:string, country_name:string)\n[@\"https://raw.githubusercontent.com/datasets/geoip2-ipv4/master/data/geoip2-ipv4.csv\"];\nlet UsersLocation = SalesforceServiceCloud\n| where EventType =~ 'Login' and LoginStatus=~'LOGIN_NO_ERROR'\n| project TimeGenerated, ClientIp, UserId, User, UserType ;\nUsersLocation\n| extend Dummy=1\n| summarize count() by Hour=bin(TimeGenerated,30m), ClientIp,User, Dummy\n| partition by Hour(\n                lookup (Countrydb|extend Dummy=1) on Dummy\n              | where ipv4_is_match(ClientIp, Network)\n              )\n| summarize NumOfCountries = dcount(country_name) by User, Hour\n| where NumOfCountries >= threshold\n",
        "queryFrequency": "PT30M",
        "queryPeriod": "PT30M",
        "triggerOperator": "GreaterThan",
        "triggerThreshold": 0,
        "suppressionDuration": "PT1H",
        "suppressionEnabled": false,
        "tactics": [
          "InitialAccess"
        ],
        "techniques": [
          "T1078"
        ],
        "alertRuleTemplateName": "3094e036-e5ae-4d6e-8626-b0f86ebc71f2",
        "customDetails": null,
        "entityMappings": [
          {
            "entityType": "Account",
            "fieldMappings": [
              {
                "identifier": "AadUserId",
                "columnName": "User"
              }
            ]
          }
        ],
        "OriginalUri": "https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Salesforce Service Cloud/Analytic Rules/Salesforce-SigninsMultipleCountries.yaml",
        "status": "Available",
        "templateVersion": "1.0.1"
      }
    }
  ]
}