Microsoft Sentinel Analytic Rules
cloudbrothers.infoAzure Sentinel RepoToggle Dark/Light/Auto modeToggle Dark/Light/Auto modeToggle Dark/Light/Auto modeBack to homepage

OracleDBAudit - Connection to database from external IP

Back
Id54aa2c17-acfd-4e3a-a1c4-99c88cf34ebe
RulenameOracleDBAudit - Connection to database from external IP
DescriptionDetects when connection to database is from external IP source.
SeverityMedium
TacticsInitialAccess
Collection
Exfiltration
TechniquesT1190
T1133
T1078
T1119
T1029
Required data connectorsSyslogAma
KindScheduled
Query frequency30m
Query period30m
Trigger threshold0
Trigger operatorgt
Source Urihttps://github.com/Azure/Azure-Sentinel/blob/master/Solutions/OracleDatabaseAudit/Analytic Rules/OracleDBAuditConnectFromExternalIp.yaml
Version1.0.2
Arm template54aa2c17-acfd-4e3a-a1c4-99c88cf34ebe.json
Deploy To Azure
OracleDatabaseAuditEvent
| where isnotempty(SrcIpAddr)
| where isnotempty(Action)
| where DbAction =~ 'connect'
| where ipv4_is_private(SrcIpAddr) == 'false'
| extend AccountCustomEntity = DstUserName
| extend IPCustomEntity = SrcIpAddr
triggerOperator: gt
triggerThreshold: 0
kind: Scheduled
id: 54aa2c17-acfd-4e3a-a1c4-99c88cf34ebe
relevantTechniques:
- T1190
- T1133
- T1078
- T1119
- T1029
query: |
  OracleDatabaseAuditEvent
  | where isnotempty(SrcIpAddr)
  | where isnotempty(Action)
  | where DbAction =~ 'connect'
  | where ipv4_is_private(SrcIpAddr) == 'false'
  | extend AccountCustomEntity = DstUserName
  | extend IPCustomEntity = SrcIpAddr  
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/OracleDatabaseAudit/Analytic Rules/OracleDBAuditConnectFromExternalIp.yaml
queryPeriod: 30m
requiredDataConnectors:
- datatypes:
  - Syslog
  connectorId: SyslogAma
description: |
    'Detects when connection to database is from external IP source.'
entityMappings:
- entityType: Account
  fieldMappings:
  - columnName: AccountCustomEntity
    identifier: FullName
- entityType: IP
  fieldMappings:
  - columnName: IPCustomEntity
    identifier: Address
status: Available
name: OracleDBAudit - Connection to database from external IP
severity: Medium
version: 1.0.2
tactics:
- InitialAccess
- Collection
- Exfiltration
queryFrequency: 30m
{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "workspace": {
      "type": "String"
    }
  },
  "resources": [
    {
      "apiVersion": "2024-01-01-preview",
      "id": "[concat(resourceId('Microsoft.OperationalInsights/workspaces/providers', parameters('workspace'), 'Microsoft.SecurityInsights'),'/alertRules/54aa2c17-acfd-4e3a-a1c4-99c88cf34ebe')]",
      "kind": "Scheduled",
      "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/54aa2c17-acfd-4e3a-a1c4-99c88cf34ebe')]",
      "properties": {
        "alertRuleTemplateName": "54aa2c17-acfd-4e3a-a1c4-99c88cf34ebe",
        "customDetails": null,
        "description": "'Detects when connection to database is from external IP source.'\n",
        "displayName": "OracleDBAudit - Connection to database from external IP",
        "enabled": true,
        "entityMappings": [
          {
            "entityType": "Account",
            "fieldMappings": [
              {
                "columnName": "AccountCustomEntity",
                "identifier": "FullName"
              }
            ]
          },
          {
            "entityType": "IP",
            "fieldMappings": [
              {
                "columnName": "IPCustomEntity",
                "identifier": "Address"
              }
            ]
          }
        ],
        "OriginalUri": "https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/OracleDatabaseAudit/Analytic Rules/OracleDBAuditConnectFromExternalIp.yaml",
        "query": "OracleDatabaseAuditEvent\n| where isnotempty(SrcIpAddr)\n| where isnotempty(Action)\n| where DbAction =~ 'connect'\n| where ipv4_is_private(SrcIpAddr) == 'false'\n| extend AccountCustomEntity = DstUserName\n| extend IPCustomEntity = SrcIpAddr\n",
        "queryFrequency": "PT30M",
        "queryPeriod": "PT30M",
        "severity": "Medium",
        "status": "Available",
        "subTechniques": [],
        "suppressionDuration": "PT1H",
        "suppressionEnabled": false,
        "tactics": [
          "Collection",
          "Exfiltration",
          "InitialAccess"
        ],
        "techniques": [
          "T1029",
          "T1078",
          "T1119",
          "T1133",
          "T1190"
        ],
        "templateVersion": "1.0.2",
        "triggerOperator": "GreaterThan",
        "triggerThreshold": 0
      },
      "type": "Microsoft.OperationalInsights/workspaces/providers/alertRules"
    }
  ]
}