{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "workspace": {
      "type": "String"
    }
  },
  "resources": [
    {
      "apiVersion": "2024-01-01-preview",
      "id": "[concat(resourceId('Microsoft.OperationalInsights/workspaces/providers', parameters('workspace'), 'Microsoft.SecurityInsights'),'/alertRules/3f4bd2a1-7c58-4a83-9c2e-6d1f0a8b5c31')]",
      "kind": "Scheduled",
      "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/3f4bd2a1-7c58-4a83-9c2e-6d1f0a8b5c31')]",
      "properties": {
        "alertDetailsOverride": {
          "alertDescriptionFormat": "{{ActorName}} performed {{ActivityType}} on {{TargetResourceName}}. Member email, old and new roles are in the alert custom details.",
          "alertDisplayNameFormat": "ContraForce access change: {{ActivityType}} on {{TargetResourceName}}"
        },
        "alertRuleTemplateName": "3f4bd2a1-7c58-4a83-9c2e-6d1f0a8b5c31",
        "customDetails": {
          "ActorEmail": "ActorEmail",
          "CfWorkspaceId": "CfWorkspaceId",
          "EventId": "EventId",
          "FromRole": "FromRole",
          "MemberEmail": "MemberEmail",
          "ToRole": "ToRole"
        },
        "description": "'Identifies administrative access changes made in the ContraForce workspace: workspace role\nassignments, changes and removals, organization role changes, member additions and removals,\nand service provider (MSP) access grants or revocations. Review each change to confirm it was\nexpected and authorized. The affected member and the old and new roles are carried in the\nevent metadata.'\n",
        "displayName": "ContraForce - Privileged access change",
        "enabled": true,
        "entityMappings": null,
        "eventGroupingSettings": {
          "aggregationKind": "AlertPerResult"
        },
        "incidentConfiguration": {
          "createIncident": true,
          "groupingConfiguration": {
            "enabled": true,
            "groupByCustomDetails": [
              "EventId"
            ],
            "lookbackDuration": "PT2H",
            "matchingMethod": "Selected",
            "reopenClosedIncident": false
          }
        },
        "OriginalUri": "https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/ContraForce/Analytic%20Rules/ContraForcePrivilegedAccessChange.yaml",
        "query": "ContraForceEvents_CL\n| where ingestion_time() > ago(5m)\n| where ActivityType in (\"WorkspaceRoleAssigned\", \"WorkspaceRoleChanged\", \"WorkspaceRoleRemoved\", \"OrganizationalRoleChanged\", \"MemberAdded\", \"MemberRemoved\", \"ServiceProviderAdded\", \"ServiceProviderRemoved\")\n| extend Meta = parse_json(Metadata)\n| extend MemberEmail = tostring(Meta.MemberEmail),\n         MemberType = tostring(Meta.MemberType),\n         FromRole = tostring(Meta.FromRole),\n         ToRole = tostring(Meta.ToRole),\n         Members = tostring(Meta.Members)\n| project TimeGenerated, EventId, CfWorkspaceId, ActivityType, ActivityAction,\n          ActorName, ActorEmail, TargetResourceType, TargetResourceId, TargetResourceName,\n          MemberEmail, MemberType, FromRole, ToRole, Members\n",
        "queryFrequency": "PT5M",
        "queryPeriod": "P1D",
        "severity": "Medium",
        "status": "Available",
        "subTechniques": [],
        "suppressionDuration": "PT1H",
        "suppressionEnabled": false,
        "tactics": [
          "Persistence",
          "PrivilegeEscalation"
        ],
        "techniques": [
          "T1078",
          "T1098"
        ],
        "templateVersion": "1.0.0",
        "triggerOperator": "GreaterThan",
        "triggerThreshold": 0
      },
      "type": "Microsoft.OperationalInsights/workspaces/providers/alertRules"
    }
  ]
}