1Password - User account MFA settings changed

OnePasswordEventLogs_CL
| where log_source == "auditevents"
| where action has_any("enblmfa", "updatmfa", "disblmfa")
| where object_type == "user"
| extend
    ActorUsername = actor_details.email
    , SrcIpAddr = session.ip

incidentConfiguration:
  createIncident: true
  groupingConfiguration:
    lookbackDuration: 1h
    reopenClosedIncident: false
    enabled: true
    matchingMethod: AllEntities
id: 3c8140eb-e946-4bf2-8c61-03e4df56d400
tactics:
- Persistence
- DefenseEvasion
queryPeriod: 30m
eventGroupingSettings:
  aggregationKind: SingleAlert
triggerThreshold: 0
name: 1Password - User account MFA settings changed
query: |-
  OnePasswordEventLogs_CL
  | where log_source == "auditevents"
  | where action has_any("enblmfa", "updatmfa", "disblmfa")
  | where object_type == "user"
  | extend
      ActorUsername = actor_details.email
      , SrcIpAddr = session.ip  
severity: Medium
triggerOperator: gt
kind: Scheduled
suppressionDuration: 5h
relevantTechniques:
- T1556
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/1Password/Analytics Rules/1Password - User account MFA settings changed.yaml
queryFrequency: 30m
requiredDataConnectors:
- connectorId: 1Password
  dataTypes:
  - OnePasswordEventLogs_CL
description: |-
  This will alert when a user creates, updates, or disables the user account MFA settings. Once this analytics rule is triggered it will group all related future alerts for upto an hour when all related entities are the same.

  Ref: https://1password.com/
  Ref: https://github.com/securehats/  
suppressionEnabled: false
version: 1.0.0
entityMappings:
- fieldMappings:
  - columnName: ActorUsername
    identifier: FullName
  entityType: Account
- fieldMappings:
  - columnName: SrcIpAddr
    identifier: Address
  entityType: IP

{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "workspace": {
      "type": "String"
    }
  },
  "resources": [
    {
      "apiVersion": "2024-01-01-preview",
      "id": "[concat(resourceId('Microsoft.OperationalInsights/workspaces/providers', parameters('workspace'), 'Microsoft.SecurityInsights'),'/alertRules/3c8140eb-e946-4bf2-8c61-03e4df56d400')]",
      "kind": "Scheduled",
      "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/3c8140eb-e946-4bf2-8c61-03e4df56d400')]",
      "properties": {
        "alertRuleTemplateName": "3c8140eb-e946-4bf2-8c61-03e4df56d400",
        "customDetails": null,
        "description": "This will alert when a user creates, updates, or disables the user account MFA settings. Once this analytics rule is triggered it will group all related future alerts for upto an hour when all related entities are the same.\n\nRef: https://1password.com/\nRef: https://github.com/securehats/",
        "displayName": "1Password - User account MFA settings changed",
        "enabled": true,
        "entityMappings": [
          {
            "entityType": "Account",
            "fieldMappings": [
              {
                "columnName": "ActorUsername",
                "identifier": "FullName"
              }
            ]
          },
          {
            "entityType": "IP",
            "fieldMappings": [
              {
                "columnName": "SrcIpAddr",
                "identifier": "Address"
              }
            ]
          }
        ],
        "eventGroupingSettings": {
          "aggregationKind": "SingleAlert"
        },
        "incidentConfiguration": {
          "createIncident": true,
          "groupingConfiguration": {
            "enabled": true,
            "lookbackDuration": "PT1H",
            "matchingMethod": "AllEntities",
            "reopenClosedIncident": false
          }
        },
        "OriginalUri": "https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/1Password/Analytics Rules/1Password - User account MFA settings changed.yaml",
        "query": "OnePasswordEventLogs_CL\n| where log_source == \"auditevents\"\n| where action has_any(\"enblmfa\", \"updatmfa\", \"disblmfa\")\n| where object_type == \"user\"\n| extend\n    ActorUsername = actor_details.email\n    , SrcIpAddr = session.ip",
        "queryFrequency": "PT30M",
        "queryPeriod": "PT30M",
        "severity": "Medium",
        "subTechniques": [],
        "suppressionDuration": "PT5H",
        "suppressionEnabled": false,
        "tactics": [
          "DefenseEvasion",
          "Persistence"
        ],
        "techniques": [
          "T1556"
        ],
        "templateVersion": "1.0.0",
        "triggerOperator": "GreaterThan",
        "triggerThreshold": 0
      },
      "type": "Microsoft.OperationalInsights/workspaces/providers/alertRules"
    }
  ]
}