Bitglass
| where EventType =~ 'access'
| where EventMessage =~ 'Login'
| summarize g_loc = makeset(SrcGeoLocation) by User
| join (Bitglass
| where EventType =~ 'access'
| where EventMessage =~ 'Login') on User
| where g_loc !contains SrcGeoLocation
| extend AccountCustomEntity = User, FileCustomEntity = SrcFileName
triggerThreshold: 0
query: |
Bitglass
| where EventType =~ 'access'
| where EventMessage =~ 'Login'
| summarize g_loc = makeset(SrcGeoLocation) by User
| join (Bitglass
| where EventType =~ 'access'
| where EventMessage =~ 'Login') on User
| where g_loc !contains SrcGeoLocation
| extend AccountCustomEntity = User, FileCustomEntity = SrcFileName
requiredDataConnectors:
- connectorId: Bitglass
dataTypes:
- Bitglass
id: 34401e66-9fe9-476b-a443-3a3f89e4f3b0
entityMappings:
- entityType: Account
fieldMappings:
- identifier: Name
columnName: AccountCustomEntity
- entityType: File
fieldMappings:
- identifier: Name
columnName: FileCustomEntity
queryPeriod: 14d
severity: Medium
queryFrequency: 1h
triggerOperator: gt
name: Bitglass - User login from new geo location
relevantTechniques:
- T1078
tactics:
- InitialAccess
description: |
'Detects user login from new geo location.'
kind: Scheduled
status: Available
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Bitglass/Analytic Rules/BitglassUserLoginNewGeoLocation.yaml
version: 1.0.0
