Microsoft Sentinel Analytic Rules
cloudbrothers.infoAzure Sentinel RepoToggle Dark/Light/Auto modeToggle Dark/Light/Auto modeToggle Dark/Light/Auto modeBack to homepage

RSA ID Plus - Locked Administrator Account Detected

Back
Id488c759d-a82e-44cd-91bb-d766573918d7
RulenameRSA ID Plus - Locked Administrator Account Detected
DescriptionRaises an alert when an admin account is locked out of the Admin console (RSAIDPlus Admin Events).
SeverityMedium
TacticsImpact
CredentialAccess
Required data connectorsRSAIDPlus_AdminLogs_Connector
KindScheduled
Query frequency30m
Query period1d
Trigger threshold0
Trigger operatorGreaterThan
Source Urihttps://github.com/Azure/Azure-Sentinel/blob/master/Solutions/RSAIDPlus_AdminLogs_Connector/Analytic Rules/RSAIDPlus_AdminLockoutAlert.yaml
Version1.0.0
Arm template488c759d-a82e-44cd-91bb-d766573918d7.json
Deploy To Azure
RSAIDPlus_AdminLogs_CL
|where activityKey == 'LOCKED_ADMIN_ACCOUNT'
|project TimeGenerated, customerName, adminUserName, adminUserRole, activityKey, sourceIPAddress
status: Available
queryFrequency: 30m
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/RSAIDPlus_AdminLogs_Connector/Analytic Rules/RSAIDPlus_AdminLockoutAlert.yaml
eventGroupingSettings:
  aggregationKind: SingleAlert
incidentConfiguration:
  groupingConfiguration:
    lookbackDuration: 2h
    reopenClosedIncident: false
    matchingMethod: AllEntities
    enabled: true
  createIncident: true
description: |
    'Raises an alert when an admin account is locked out of the Admin console (RSAIDPlus Admin Events).'
triggerOperator: GreaterThan
customDetails:
  Activity: activityKey
  Administrator: adminUserName
  Customer_Name: customerName
  Administrator_Type: adminUserRole
tactics:
- Impact
- CredentialAccess
alertDetailsOverride:
  alertDescriptionFormat: 'Administrator - {{{adminUserName}} with Role - {{{adminUserRole}} got locked out of Admin Console at: {{{TimeGenerated}}'
  alertDisplayNameFormat: RSA ID Plus Administrator - {{{adminUserName}} is locked out.
queryPeriod: 1d
triggerThreshold: 0
id: 488c759d-a82e-44cd-91bb-d766573918d7
severity: Medium
requiredDataConnectors:
- connectorId: RSAIDPlus_AdminLogs_Connector
  dataTypes:
  - RSAIDPlus_AdminLogs_CL
version: 1.0.0
query: |
  RSAIDPlus_AdminLogs_CL
  |where activityKey == 'LOCKED_ADMIN_ACCOUNT'
  |project TimeGenerated, customerName, adminUserName, adminUserRole, activityKey, sourceIPAddress  
entityMappings:
- fieldMappings:
  - identifier: Address
    columnName: sourceIPAddress
  entityType: IP
- fieldMappings:
  - identifier: Name
    columnName: adminUserName
  entityType: Account
- fieldMappings:
  - identifier: HostName
    columnName: customerName
  entityType: Host
name: RSA ID Plus - Locked Administrator Account Detected
relevantTechniques: []
kind: Scheduled