RSA ID Plus - Locked Administrator Account Detected

Back


Id	488c759d-a82e-44cd-91bb-d766573918d7
Rulename	RSA ID Plus - Locked Administrator Account Detected
Description	Raises an alert when an admin account is locked out of the Admin console (RSAIDPlus Admin Events).
Severity	Medium
Tactics	Impact CredentialAccess
Required data connectors	RSAIDPlus_AdminLogs_Connector
Kind	Scheduled
Query frequency	30m
Query period	1d
Trigger threshold	0
Trigger operator	GreaterThan
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/RSAIDPlus_AdminLogs_Connector/Analytic Rules/RSAIDPlus_AdminLockoutAlert.yaml
Version	1.0.0
Arm template	488c759d-a82e-44cd-91bb-d766573918d7.json

KQL

RSAIDPlus_AdminLogs_CL
|where activityKey == 'LOCKED_ADMIN_ACCOUNT'
|project TimeGenerated, customerName, adminUserName, adminUserRole, activityKey, sourceIPAddress

YAML

name: RSA ID Plus - Locked Administrator Account Detected
alertDetailsOverride:
  alertDisplayNameFormat: RSA ID Plus Administrator - {{{adminUserName}} is locked out.
  alertDescriptionFormat: 'Administrator - {{{adminUserName}} with Role - {{{adminUserRole}} got locked out of Admin Console at: {{{TimeGenerated}}'
id: 488c759d-a82e-44cd-91bb-d766573918d7
description: |
    'Raises an alert when an admin account is locked out of the Admin console (RSAIDPlus Admin Events).'
triggerThreshold: 0
entityMappings:
- fieldMappings:
  - columnName: sourceIPAddress
    identifier: Address
  entityType: IP
- fieldMappings:
  - columnName: adminUserName
    identifier: Name
  entityType: Account
- fieldMappings:
  - columnName: customerName
    identifier: HostName
  entityType: Host
version: 1.0.0
triggerOperator: GreaterThan
query: |
  RSAIDPlus_AdminLogs_CL
  |where activityKey == 'LOCKED_ADMIN_ACCOUNT'
  |project TimeGenerated, customerName, adminUserName, adminUserRole, activityKey, sourceIPAddress  
tactics:
- Impact
- CredentialAccess
kind: Scheduled
queryFrequency: 30m
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/RSAIDPlus_AdminLogs_Connector/Analytic Rules/RSAIDPlus_AdminLockoutAlert.yaml
severity: Medium
incidentConfiguration:
  createIncident: true
  groupingConfiguration:
    lookbackDuration: 2h
    reopenClosedIncident: false
    matchingMethod: AllEntities
    enabled: true
queryPeriod: 1d
requiredDataConnectors:
- dataTypes:
  - RSAIDPlus_AdminLogs_CL
  connectorId: RSAIDPlus_AdminLogs_Connector
status: Available
customDetails:
  Customer_Name: customerName
  Activity: activityKey
  Administrator: adminUserName
  Administrator_Type: adminUserRole
eventGroupingSettings:
  aggregationKind: SingleAlert
relevantTechniques: []

ARM