Microsoft Sentinel Analytic Rules
cloudbrothers.infoAzure Sentinel RepoToggle Dark/Light/Auto modeToggle Dark/Light/Auto modeToggle Dark/Light/Auto modeBack to homepage

Azure secure score sign in risk policy

Back
Id5231D757-A5B5-4CA7-A91B-AA3702970E02
RulenameAzure secure score sign in risk policy
DescriptionThis query searches for an active Azure Premium P2 license is required to use and edit this policy.

You will be required to have setup the MFA Policy before activating this policy
SeverityMedium
TacticsImpact
TechniquesT1529
Required data connectorsSenservaPro
KindScheduled
Query frequency6h
Query period6h
Trigger threshold0
Trigger operatorgt
Source Urihttps://github.com/Azure/Azure-Sentinel/blob/master/Solutions/SenservaPro/Analytic Rules/SignInRiskPolicy.yaml
Version1.0.0
Arm template5231D757-A5B5-4CA7-A91B-AA3702970E02.json
Deploy To Azure
SenservaPro_CL
| where ControlName_s == 'AzureSecureScoreSignInRiskPolicy'
triggerOperator: gt
version: 1.0.0
query: |
  SenservaPro_CL
  | where ControlName_s == 'AzureSecureScoreSignInRiskPolicy'  
status: Available
entityMappings:
- entityType: Account
  fieldMappings:
  - columnName: ControlName_s
    identifier: Name
  - columnName: TenantId
    identifier: AadTenantId
  - columnName: TenantDisplayName_s
    identifier: DisplayName
- entityType: SecurityGroup
  fieldMappings:
  - columnName: Group_s
    identifier: DistinguishedName
- entityType: AzureResource
  fieldMappings:
  - columnName: SourceSystem
    identifier: ResourceId
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/SenservaPro/Analytic Rules/SignInRiskPolicy.yaml
queryFrequency: 6h
requiredDataConnectors:
- connectorId: SenservaPro
  dataTypes:
  - SenservaPro_CL
name: Azure secure score sign in risk policy
queryPeriod: 6h
severity: Medium
kind: Scheduled
tactics:
- Impact
id: 5231D757-A5B5-4CA7-A91B-AA3702970E02
description: |
  'This query searches for an active Azure Premium P2 license is required to use and edit this policy. 
   You will be required to have setup the MFA Policy before activating this policy'  
relevantTechniques:
- T1529
triggerThreshold: 0
{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "workspace": {
      "type": "String"
    }
  },
  "resources": [
    {
      "id": "[concat(resourceId('Microsoft.OperationalInsights/workspaces/providers', parameters('workspace'), 'Microsoft.SecurityInsights'),'/alertRules/5231D757-A5B5-4CA7-A91B-AA3702970E02')]",
      "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/5231D757-A5B5-4CA7-A91B-AA3702970E02')]",
      "type": "Microsoft.OperationalInsights/workspaces/providers/alertRules",
      "kind": "Scheduled",
      "apiVersion": "2022-11-01-preview",
      "properties": {
        "displayName": "Azure secure score sign in risk policy",
        "description": "'This query searches for an active Azure Premium P2 license is required to use and edit this policy. \n You will be required to have setup the MFA Policy before activating this policy'\n",
        "severity": "Medium",
        "enabled": true,
        "query": "SenservaPro_CL\n| where ControlName_s == 'AzureSecureScoreSignInRiskPolicy'\n",
        "queryFrequency": "PT6H",
        "queryPeriod": "PT6H",
        "triggerOperator": "GreaterThan",
        "triggerThreshold": 0,
        "suppressionDuration": "PT1H",
        "suppressionEnabled": false,
        "tactics": [
          "Impact"
        ],
        "techniques": [
          "T1529"
        ],
        "alertRuleTemplateName": "5231D757-A5B5-4CA7-A91B-AA3702970E02",
        "customDetails": null,
        "entityMappings": [
          {
            "fieldMappings": [
              {
                "columnName": "ControlName_s",
                "identifier": "Name"
              },
              {
                "columnName": "TenantId",
                "identifier": "AadTenantId"
              },
              {
                "columnName": "TenantDisplayName_s",
                "identifier": "DisplayName"
              }
            ],
            "entityType": "Account"
          },
          {
            "fieldMappings": [
              {
                "columnName": "Group_s",
                "identifier": "DistinguishedName"
              }
            ],
            "entityType": "SecurityGroup"
          },
          {
            "fieldMappings": [
              {
                "columnName": "SourceSystem",
                "identifier": "ResourceId"
              }
            ],
            "entityType": "AzureResource"
          }
        ],
        "OriginalUri": "https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/SenservaPro/Analytic Rules/SignInRiskPolicy.yaml",
        "status": "Available",
        "templateVersion": "1.0.0"
      }
    }
  ]
}