RSA ID Plus - Locked Administrator Account Detected

Back


Id	488c759d-a82e-44cd-91bb-d766573918d7
Rulename	RSA ID Plus - Locked Administrator Account Detected
Description	Raises an alert when an admin account is locked out of the Admin console (RSAIDPlus Admin Events).
Severity	Medium
Tactics	Impact CredentialAccess
Required data connectors	RSAIDPlus_AdminLogs_Connector
Kind	Scheduled
Query frequency	30m
Query period	1d
Trigger threshold	0
Trigger operator	GreaterThan
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/RSAIDPlus_AdminLogs_Connector/Analytic Rules/RSAIDPlus_AdminLockoutAlert.yaml
Version	1.0.0
Arm template	488c759d-a82e-44cd-91bb-d766573918d7.json

KQL

RSAIDPlus_AdminLogs_CL
|where activityKey == 'LOCKED_ADMIN_ACCOUNT'
|project TimeGenerated, customerName, adminUserName, adminUserRole, activityKey, sourceIPAddress

YAML

status: Available
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/RSAIDPlus_AdminLogs_Connector/Analytic Rules/RSAIDPlus_AdminLockoutAlert.yaml
version: 1.0.0
queryPeriod: 1d
query: |
  RSAIDPlus_AdminLogs_CL
  |where activityKey == 'LOCKED_ADMIN_ACCOUNT'
  |project TimeGenerated, customerName, adminUserName, adminUserRole, activityKey, sourceIPAddress  
kind: Scheduled
name: RSA ID Plus - Locked Administrator Account Detected
triggerOperator: GreaterThan
severity: Medium
eventGroupingSettings:
  aggregationKind: SingleAlert
id: 488c759d-a82e-44cd-91bb-d766573918d7
triggerThreshold: 0
entityMappings:
- entityType: IP
  fieldMappings:
  - identifier: Address
    columnName: sourceIPAddress
- entityType: Account
  fieldMappings:
  - identifier: Name
    columnName: adminUserName
- entityType: Host
  fieldMappings:
  - identifier: HostName
    columnName: customerName
queryFrequency: 30m
alertDetailsOverride:
  alertDescriptionFormat: 'Administrator - {{{adminUserName}} with Role - {{{adminUserRole}} got locked out of Admin Console at: {{{TimeGenerated}}'
  alertDisplayNameFormat: RSA ID Plus Administrator - {{{adminUserName}} is locked out.
description: |
    'Raises an alert when an admin account is locked out of the Admin console (RSAIDPlus Admin Events).'
requiredDataConnectors:
- connectorId: RSAIDPlus_AdminLogs_Connector
  dataTypes:
  - RSAIDPlus_AdminLogs_CL
incidentConfiguration:
  createIncident: true
  groupingConfiguration:
    enabled: true
    lookbackDuration: 2h
    reopenClosedIncident: false
    matchingMethod: AllEntities
customDetails:
  Administrator_Type: adminUserRole
  Activity: activityKey
  Administrator: adminUserName
  Customer_Name: customerName
relevantTechniques: []
tactics:
- Impact
- CredentialAccess

ARM