Claroty - Multiple failed logins by user

let threshold = 5;
ClarotyEvent
| where EventType has 'Login to SRA'
| where EventType !has 'succeeded'
| extend SrcUsername = trim(' ', tostring(extract(@'User\s(.*?)\sfailed', 1, EventMessage)))
| where isnotempty(SrcUsername)
| summarize FailedLogins = count() by SrcUsername, bin(TimeGenerated, 5m)
| where FailedLogins > threshold
| extend AccountCustomEntity = SrcUsername

severity: High
tactics:
- CredentialAccess
- InitialAccess
queryFrequency: 1h
id: 4b5bb3fc-c690-4f54-9a74-016213d699b4
query: |
  let threshold = 5;
  ClarotyEvent
  | where EventType has 'Login to SRA'
  | where EventType !has 'succeeded'
  | extend SrcUsername = trim(' ', tostring(extract(@'User\s(.*?)\sfailed', 1, EventMessage)))
  | where isnotempty(SrcUsername)
  | summarize FailedLogins = count() by SrcUsername, bin(TimeGenerated, 5m)
  | where FailedLogins > threshold
  | extend AccountCustomEntity = SrcUsername
entityMappings:
- fieldMappings:
  - identifier: Name
    columnName: AccountCustomEntity
  entityType: Account
kind: Scheduled
triggerOperator: gt
name: Claroty - Multiple failed logins by user
version: 1.0.4
status: Available
requiredDataConnectors:
- dataTypes:
  - CommonSecurityLog
  connectorId: CefAma
description: Detects multiple failed logins by the same user in Claroty SRA event logs. The rule looks for failed Login to SRA events, extracts the source username from the event message, and alerts when a user exceeds 5 failed logins within 5 minutes.
relevantTechniques:
- T1110
- T1190
- T1133
queryPeriod: 1h
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Claroty/Analytic%20Rules/ClarotyMultipleFailedLogin.yaml
triggerThreshold: 0
alertDetailsOverride:
  alertDisplayNameFormat: Claroty multiple failed logins for {{SrcUsername}}
  alertDescriptionFormat: '{{FailedLogins}} failed logins for user {{SrcUsername}} exceeded the threshold in 5 minutes.'

{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "workspace": {
      "type": "String"
    }
  },
  "resources": [
    {
      "apiVersion": "2024-01-01-preview",
      "id": "[concat(resourceId('Microsoft.OperationalInsights/workspaces/providers', parameters('workspace'), 'Microsoft.SecurityInsights'),'/alertRules/4b5bb3fc-c690-4f54-9a74-016213d699b4')]",
      "kind": "Scheduled",
      "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/4b5bb3fc-c690-4f54-9a74-016213d699b4')]",
      "properties": {
        "alertDetailsOverride": {
          "alertDescriptionFormat": "{{FailedLogins}} failed logins for user {{SrcUsername}} exceeded the threshold in 5 minutes.",
          "alertDisplayNameFormat": "Claroty multiple failed logins for {{SrcUsername}}"
        },
        "alertRuleTemplateName": "4b5bb3fc-c690-4f54-9a74-016213d699b4",
        "customDetails": null,
        "description": "Detects multiple failed logins by the same user in Claroty SRA event logs. The rule looks for failed Login to SRA events, extracts the source username from the event message, and alerts when a user exceeds 5 failed logins within 5 minutes.",
        "displayName": "Claroty - Multiple failed logins by user",
        "enabled": true,
        "entityMappings": [
          {
            "entityType": "Account",
            "fieldMappings": [
              {
                "columnName": "AccountCustomEntity",
                "identifier": "Name"
              }
            ]
          }
        ],
        "OriginalUri": "https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Claroty/Analytic%20Rules/ClarotyMultipleFailedLogin.yaml",
        "query": "let threshold = 5;\nClarotyEvent\n| where EventType has 'Login to SRA'\n| where EventType !has 'succeeded'\n| extend SrcUsername = trim(' ', tostring(extract(@'User\\s(.*?)\\sfailed', 1, EventMessage)))\n| where isnotempty(SrcUsername)\n| summarize FailedLogins = count() by SrcUsername, bin(TimeGenerated, 5m)\n| where FailedLogins > threshold\n| extend AccountCustomEntity = SrcUsername\n",
        "queryFrequency": "PT1H",
        "queryPeriod": "PT1H",
        "severity": "High",
        "status": "Available",
        "subTechniques": [],
        "suppressionDuration": "PT1H",
        "suppressionEnabled": false,
        "tactics": [
          "CredentialAccess",
          "InitialAccess"
        ],
        "techniques": [
          "T1110",
          "T1133",
          "T1190"
        ],
        "templateVersion": "1.0.4",
        "triggerOperator": "GreaterThan",
        "triggerThreshold": 0
      },
      "type": "Microsoft.OperationalInsights/workspaces/providers/alertRules"
    }
  ]
}