Microsoft Sentinel Analytic Rules
cloudbrothers.infoAzure Sentinel RepoToggle Dark/Light/Auto modeToggle Dark/Light/Auto modeToggle Dark/Light/Auto modeBack to homepage
  1. Microsoft Sentinel Analytics Rules
  2. /
  3. Analytic Rules
  4. /
  5. Leaked Credential Medium

Leaked Credential Medium

Back
Id51546727-6467-439e-8799-4cf0232394eb
RulenameLeaked Credential (Medium)
DescriptionNew Leaked Credential with severity Medium found
SeverityMedium
TacticsCredentialAccess
TechniquesT1555
Required data connectorsCBSPollingIDAzureFunctions
KindScheduled
Query frequency5m
Query period5m
Trigger threshold0
Trigger operatorgt
Source Urihttps://github.com/Azure/Azure-Sentinel/blob/master/Solutions/CTM360/Analytic Rules/leaked_credential_medium.yaml
Version1.0.0
Arm template51546727-6467-439e-8799-4cf0232394eb.json
Deploy To Azure
CBSLog_Azure_1_CL | where severity_s == "Medium" | where type_s == "Leaked Credential" | where status_s != "Closed" or status_s != "Resolved"

relevantTechniques:
- T1555
incidentConfiguration:
  groupingConfiguration:
    matchingMethod: AllEntities
    lookbackDuration: PT5H
    reopenClosedIncident: false
    enabled: false
  createIncident: true
eventGroupingSettings:
  aggregationKind: SingleAlert
query: CBSLog_Azure_1_CL | where severity_s == "Medium" | where type_s == "Leaked Credential" | where status_s != "Closed" or status_s != "Resolved"
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/CTM360/Analytic Rules/leaked_credential_medium.yaml
description: New Leaked Credential with severity Medium found
requiredDataConnectors:
- connectorId: CBSPollingIDAzureFunctions
  dataTypes:
  - CBSLog_Azure_1_CL
triggerOperator: gt
kind: Scheduled
name: Leaked Credential (Medium)
suppressionEnabled: false
queryPeriod: 5m
triggerThreshold: 0
id: 51546727-6467-439e-8799-4cf0232394eb
status: Available
suppressionDuration: 5h
severity: Medium
queryFrequency: 5m
tactics:
- CredentialAccess
version: 1.0.0