Microsoft Sentinel Analytic Rules
cloudbrothers.infoAzure Sentinel RepoToggle Dark/Light/Auto modeToggle Dark/Light/Auto modeToggle Dark/Light/Auto modeBack to homepage

OracleDBAudit - Connection to database from external IP

Back
Id54aa2c17-acfd-4e3a-a1c4-99c88cf34ebe
RulenameOracleDBAudit - Connection to database from external IP
DescriptionDetects when connection to database is from external IP source.
SeverityMedium
TacticsInitialAccess
Collection
Exfiltration
TechniquesT1190
T1133
T1078
T1119
T1029
Required data connectorsSyslogAma
KindScheduled
Query frequency30m
Query period30m
Trigger threshold0
Trigger operatorgt
Source Urihttps://github.com/Azure/Azure-Sentinel/blob/master/Solutions/OracleDatabaseAudit/Analytic Rules/OracleDBAuditConnectFromExternalIp.yaml
Version1.0.2
Arm template54aa2c17-acfd-4e3a-a1c4-99c88cf34ebe.json
Deploy To Azure
OracleDatabaseAuditEvent
| where isnotempty(SrcIpAddr)
| where isnotempty(Action)
| where DbAction =~ 'connect'
| where ipv4_is_private(SrcIpAddr) == 'false'
| extend AccountCustomEntity = DstUserName
| extend IPCustomEntity = SrcIpAddr
requiredDataConnectors:
- datatypes:
  - Syslog
  connectorId: SyslogAma
triggerThreshold: 0
relevantTechniques:
- T1190
- T1133
- T1078
- T1119
- T1029
queryPeriod: 30m
version: 1.0.2
id: 54aa2c17-acfd-4e3a-a1c4-99c88cf34ebe
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/OracleDatabaseAudit/Analytic Rules/OracleDBAuditConnectFromExternalIp.yaml
query: |
  OracleDatabaseAuditEvent
  | where isnotempty(SrcIpAddr)
  | where isnotempty(Action)
  | where DbAction =~ 'connect'
  | where ipv4_is_private(SrcIpAddr) == 'false'
  | extend AccountCustomEntity = DstUserName
  | extend IPCustomEntity = SrcIpAddr  
status: Available
entityMappings:
- fieldMappings:
  - identifier: FullName
    columnName: AccountCustomEntity
  entityType: Account
- fieldMappings:
  - identifier: Address
    columnName: IPCustomEntity
  entityType: IP
tactics:
- InitialAccess
- Collection
- Exfiltration
severity: Medium
name: OracleDBAudit - Connection to database from external IP
queryFrequency: 30m
triggerOperator: gt
kind: Scheduled
description: |
    'Detects when connection to database is from external IP source.'
{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "workspace": {
      "type": "String"
    }
  },
  "resources": [
    {
      "apiVersion": "2024-01-01-preview",
      "id": "[concat(resourceId('Microsoft.OperationalInsights/workspaces/providers', parameters('workspace'), 'Microsoft.SecurityInsights'),'/alertRules/54aa2c17-acfd-4e3a-a1c4-99c88cf34ebe')]",
      "kind": "Scheduled",
      "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/54aa2c17-acfd-4e3a-a1c4-99c88cf34ebe')]",
      "properties": {
        "alertRuleTemplateName": "54aa2c17-acfd-4e3a-a1c4-99c88cf34ebe",
        "customDetails": null,
        "description": "'Detects when connection to database is from external IP source.'\n",
        "displayName": "OracleDBAudit - Connection to database from external IP",
        "enabled": true,
        "entityMappings": [
          {
            "entityType": "Account",
            "fieldMappings": [
              {
                "columnName": "AccountCustomEntity",
                "identifier": "FullName"
              }
            ]
          },
          {
            "entityType": "IP",
            "fieldMappings": [
              {
                "columnName": "IPCustomEntity",
                "identifier": "Address"
              }
            ]
          }
        ],
        "OriginalUri": "https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/OracleDatabaseAudit/Analytic Rules/OracleDBAuditConnectFromExternalIp.yaml",
        "query": "OracleDatabaseAuditEvent\n| where isnotempty(SrcIpAddr)\n| where isnotempty(Action)\n| where DbAction =~ 'connect'\n| where ipv4_is_private(SrcIpAddr) == 'false'\n| extend AccountCustomEntity = DstUserName\n| extend IPCustomEntity = SrcIpAddr\n",
        "queryFrequency": "PT30M",
        "queryPeriod": "PT30M",
        "severity": "Medium",
        "status": "Available",
        "subTechniques": [],
        "suppressionDuration": "PT1H",
        "suppressionEnabled": false,
        "tactics": [
          "Collection",
          "Exfiltration",
          "InitialAccess"
        ],
        "techniques": [
          "T1029",
          "T1078",
          "T1119",
          "T1133",
          "T1190"
        ],
        "templateVersion": "1.0.2",
        "triggerOperator": "GreaterThan",
        "triggerThreshold": 0
      },
      "type": "Microsoft.OperationalInsights/workspaces/providers/alertRules"
    }
  ]
}