OracleDBAudit - Connection to database from external IP

Back


Id	54aa2c17-acfd-4e3a-a1c4-99c88cf34ebe
Rulename	OracleDBAudit - Connection to database from external IP
Description	Detects when connection to database is from external IP source.
Severity	Medium
Tactics	InitialAccess Collection Exfiltration
Techniques	T1190 T1133 T1078 T1119 T1029
Required data connectors	SyslogAma
Kind	Scheduled
Query frequency	30m
Query period	30m
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/OracleDatabaseAudit/Analytic Rules/OracleDBAuditConnectFromExternalIp.yaml
Version	1.0.2
Arm template	54aa2c17-acfd-4e3a-a1c4-99c88cf34ebe.json

KQL

OracleDatabaseAuditEvent
| where isnotempty(SrcIpAddr)
| where isnotempty(Action)
| where DbAction =~ 'connect'
| where ipv4_is_private(SrcIpAddr) == 'false'
| extend AccountCustomEntity = DstUserName
| extend IPCustomEntity = SrcIpAddr

YAML

name: OracleDBAudit - Connection to database from external IP
query: |
  OracleDatabaseAuditEvent
  | where isnotempty(SrcIpAddr)
  | where isnotempty(Action)
  | where DbAction =~ 'connect'
  | where ipv4_is_private(SrcIpAddr) == 'false'
  | extend AccountCustomEntity = DstUserName
  | extend IPCustomEntity = SrcIpAddr  
queryFrequency: 30m
triggerOperator: gt
requiredDataConnectors:
- datatypes:
  - Syslog
  connectorId: SyslogAma
status: Available
entityMappings:
- entityType: Account
  fieldMappings:
  - identifier: FullName
    columnName: AccountCustomEntity
- entityType: IP
  fieldMappings:
  - identifier: Address
    columnName: IPCustomEntity
triggerThreshold: 0
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/OracleDatabaseAudit/Analytic Rules/OracleDBAuditConnectFromExternalIp.yaml
description: |
    'Detects when connection to database is from external IP source.'
version: 1.0.2
id: 54aa2c17-acfd-4e3a-a1c4-99c88cf34ebe
kind: Scheduled
relevantTechniques:
- T1190
- T1133
- T1078
- T1119
- T1029
severity: Medium
tactics:
- InitialAccess
- Collection
- Exfiltration
queryPeriod: 30m

ARM