Microsoft Sentinel Analytic Rules
cloudbrothers.infoAzure Sentinel RepoToggle Dark/Light/Auto modeToggle Dark/Light/Auto modeToggle Dark/Light/Auto modeBack to homepage

OracleDBAudit - Connection to database from external IP

Back
Id54aa2c17-acfd-4e3a-a1c4-99c88cf34ebe
RulenameOracleDBAudit - Connection to database from external IP
DescriptionDetects when connection to database is from external IP source.
SeverityMedium
TacticsInitialAccess
Collection
Exfiltration
TechniquesT1190
T1133
T1078
T1119
T1029
Required data connectorsSyslogAma
KindScheduled
Query frequency30m
Query period30m
Trigger threshold0
Trigger operatorgt
Source Urihttps://github.com/Azure/Azure-Sentinel/blob/master/Solutions/OracleDatabaseAudit/Analytic Rules/OracleDBAuditConnectFromExternalIp.yaml
Version1.0.2
Arm template54aa2c17-acfd-4e3a-a1c4-99c88cf34ebe.json
Deploy To Azure
OracleDatabaseAuditEvent
| where isnotempty(SrcIpAddr)
| where isnotempty(Action)
| where DbAction =~ 'connect'
| where ipv4_is_private(SrcIpAddr) == 'false'
| extend AccountCustomEntity = DstUserName
| extend IPCustomEntity = SrcIpAddr
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/OracleDatabaseAudit/Analytic Rules/OracleDBAuditConnectFromExternalIp.yaml
query: |
  OracleDatabaseAuditEvent
  | where isnotempty(SrcIpAddr)
  | where isnotempty(Action)
  | where DbAction =~ 'connect'
  | where ipv4_is_private(SrcIpAddr) == 'false'
  | extend AccountCustomEntity = DstUserName
  | extend IPCustomEntity = SrcIpAddr  
description: |
    'Detects when connection to database is from external IP source.'
severity: Medium
requiredDataConnectors:
- datatypes:
  - Syslog
  connectorId: SyslogAma
name: OracleDBAudit - Connection to database from external IP
triggerThreshold: 0
tactics:
- InitialAccess
- Collection
- Exfiltration
version: 1.0.2
relevantTechniques:
- T1190
- T1133
- T1078
- T1119
- T1029
triggerOperator: gt
entityMappings:
- entityType: Account
  fieldMappings:
  - columnName: AccountCustomEntity
    identifier: FullName
- entityType: IP
  fieldMappings:
  - columnName: IPCustomEntity
    identifier: Address
id: 54aa2c17-acfd-4e3a-a1c4-99c88cf34ebe
status: Available
kind: Scheduled
queryFrequency: 30m
queryPeriod: 30m
{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "workspace": {
      "type": "String"
    }
  },
  "resources": [
    {
      "apiVersion": "2024-01-01-preview",
      "id": "[concat(resourceId('Microsoft.OperationalInsights/workspaces/providers', parameters('workspace'), 'Microsoft.SecurityInsights'),'/alertRules/54aa2c17-acfd-4e3a-a1c4-99c88cf34ebe')]",
      "kind": "Scheduled",
      "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/54aa2c17-acfd-4e3a-a1c4-99c88cf34ebe')]",
      "properties": {
        "alertRuleTemplateName": "54aa2c17-acfd-4e3a-a1c4-99c88cf34ebe",
        "customDetails": null,
        "description": "'Detects when connection to database is from external IP source.'\n",
        "displayName": "OracleDBAudit - Connection to database from external IP",
        "enabled": true,
        "entityMappings": [
          {
            "entityType": "Account",
            "fieldMappings": [
              {
                "columnName": "AccountCustomEntity",
                "identifier": "FullName"
              }
            ]
          },
          {
            "entityType": "IP",
            "fieldMappings": [
              {
                "columnName": "IPCustomEntity",
                "identifier": "Address"
              }
            ]
          }
        ],
        "OriginalUri": "https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/OracleDatabaseAudit/Analytic Rules/OracleDBAuditConnectFromExternalIp.yaml",
        "query": "OracleDatabaseAuditEvent\n| where isnotempty(SrcIpAddr)\n| where isnotempty(Action)\n| where DbAction =~ 'connect'\n| where ipv4_is_private(SrcIpAddr) == 'false'\n| extend AccountCustomEntity = DstUserName\n| extend IPCustomEntity = SrcIpAddr\n",
        "queryFrequency": "PT30M",
        "queryPeriod": "PT30M",
        "severity": "Medium",
        "status": "Available",
        "subTechniques": [],
        "suppressionDuration": "PT1H",
        "suppressionEnabled": false,
        "tactics": [
          "Collection",
          "Exfiltration",
          "InitialAccess"
        ],
        "techniques": [
          "T1029",
          "T1078",
          "T1119",
          "T1133",
          "T1190"
        ],
        "templateVersion": "1.0.2",
        "triggerOperator": "GreaterThan",
        "triggerThreshold": 0
      },
      "type": "Microsoft.OperationalInsights/workspaces/providers/alertRules"
    }
  ]
}