Microsoft Sentinel Analytic Rules
cloudbrothers.infoAzure Sentinel RepoToggle Dark/Light/Auto modeToggle Dark/Light/Auto modeToggle Dark/Light/Auto modeBack to homepage

SlackAudit - Unknown User Agent

Back
Id3b11f06e-4afd-4ae6-8477-c61136619ac8
RulenameSlackAudit - Unknown User Agent
DescriptionThis query helps to detect who trying to connect to the Slack Workspace with unknown User Agent.
SeverityLow
TacticsPersistence
Required data connectorsSlackAuditAPI
KindScheduled
Query frequency24h
Query period14d
Trigger threshold0
Trigger operatorgt
Source Urihttps://github.com/Azure/Azure-Sentinel/blob/master/Solutions/SlackAudit/Analytic Rules/SlackAuditUnknownUA.yaml
Version1.0.0
Arm template3b11f06e-4afd-4ae6-8477-c61136619ac8.json
Deploy To Azure
let lbperiod = 14d;
let known_UAs = SlackAudit
| where TimeGenerated > ago(lbperiod)
| where isnotempty(UserAgentOriginal)
| summarize makeset(UserAgentOriginal);
SlackAudit
| where UserAgentOriginal !in (known_UAs)
| extend AccountCustomEntity = SrcUserName
triggerOperator: gt
requiredDataConnectors:
- dataTypes:
  - SlackAudit_CL
  connectorId: SlackAuditAPI
queryPeriod: 14d
status: Available
kind: Scheduled
query: |
  let lbperiod = 14d;
  let known_UAs = SlackAudit
  | where TimeGenerated > ago(lbperiod)
  | where isnotempty(UserAgentOriginal)
  | summarize makeset(UserAgentOriginal);
  SlackAudit
  | where UserAgentOriginal !in (known_UAs)
  | extend AccountCustomEntity = SrcUserName  
description: |
    'This query helps to detect who trying to connect to the Slack Workspace with unknown User Agent.'
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/SlackAudit/Analytic Rules/SlackAuditUnknownUA.yaml
severity: Low
triggerThreshold: 0
name: SlackAudit - Unknown User Agent
tactics:
- Persistence
version: 1.0.0
entityMappings:
- entityType: Account
  fieldMappings:
  - identifier: FullName
    columnName: AccountCustomEntity
id: 3b11f06e-4afd-4ae6-8477-c61136619ac8
queryFrequency: 24h
{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "workspace": {
      "type": "String"
    }
  },
  "resources": [
    {
      "apiVersion": "2023-02-01-preview",
      "id": "[concat(resourceId('Microsoft.OperationalInsights/workspaces/providers', parameters('workspace'), 'Microsoft.SecurityInsights'),'/alertRules/3b11f06e-4afd-4ae6-8477-c61136619ac8')]",
      "kind": "Scheduled",
      "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/3b11f06e-4afd-4ae6-8477-c61136619ac8')]",
      "properties": {
        "alertRuleTemplateName": "3b11f06e-4afd-4ae6-8477-c61136619ac8",
        "customDetails": null,
        "description": "'This query helps to detect who trying to connect to the Slack Workspace with unknown User Agent.'\n",
        "displayName": "SlackAudit - Unknown User Agent",
        "enabled": true,
        "entityMappings": [
          {
            "entityType": "Account",
            "fieldMappings": [
              {
                "columnName": "AccountCustomEntity",
                "identifier": "FullName"
              }
            ]
          }
        ],
        "OriginalUri": "https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/SlackAudit/Analytic Rules/SlackAuditUnknownUA.yaml",
        "query": "let lbperiod = 14d;\nlet known_UAs = SlackAudit\n| where TimeGenerated > ago(lbperiod)\n| where isnotempty(UserAgentOriginal)\n| summarize makeset(UserAgentOriginal);\nSlackAudit\n| where UserAgentOriginal !in (known_UAs)\n| extend AccountCustomEntity = SrcUserName\n",
        "queryFrequency": "PT24H",
        "queryPeriod": "P14D",
        "severity": "Low",
        "status": "Available",
        "suppressionDuration": "PT1H",
        "suppressionEnabled": false,
        "tactics": [
          "Persistence"
        ],
        "templateVersion": "1.0.0",
        "triggerOperator": "GreaterThan",
        "triggerThreshold": 0
      },
      "type": "Microsoft.OperationalInsights/workspaces/providers/alertRules"
    }
  ]
}