Microsoft Sentinel Analytic Rules
cloudbrothers.infoAzure Sentinel RepoToggle Dark/Light/Auto modeToggle Dark/Light/Auto modeToggle Dark/Light/Auto modeBack to homepage

OracleDBAudit - Connection to database from external IP

Back
Id54aa2c17-acfd-4e3a-a1c4-99c88cf34ebe
RulenameOracleDBAudit - Connection to database from external IP
DescriptionDetects when connection to database is from external IP source.
SeverityMedium
TacticsInitialAccess
Collection
Exfiltration
TechniquesT1190
T1133
T1078
T1119
T1029
Required data connectorsSyslogAma
KindScheduled
Query frequency30m
Query period30m
Trigger threshold0
Trigger operatorgt
Source Urihttps://github.com/Azure/Azure-Sentinel/blob/master/Solutions/OracleDatabaseAudit/Analytic Rules/OracleDBAuditConnectFromExternalIp.yaml
Version1.0.2
Arm template54aa2c17-acfd-4e3a-a1c4-99c88cf34ebe.json
Deploy To Azure
OracleDatabaseAuditEvent
| where isnotempty(SrcIpAddr)
| where isnotempty(Action)
| where DbAction =~ 'connect'
| where ipv4_is_private(SrcIpAddr) == 'false'
| extend AccountCustomEntity = DstUserName
| extend IPCustomEntity = SrcIpAddr
query: |
  OracleDatabaseAuditEvent
  | where isnotempty(SrcIpAddr)
  | where isnotempty(Action)
  | where DbAction =~ 'connect'
  | where ipv4_is_private(SrcIpAddr) == 'false'
  | extend AccountCustomEntity = DstUserName
  | extend IPCustomEntity = SrcIpAddr  
description: |
    'Detects when connection to database is from external IP source.'
triggerThreshold: 0
requiredDataConnectors:
- datatypes:
  - Syslog
  connectorId: SyslogAma
name: OracleDBAudit - Connection to database from external IP
relevantTechniques:
- T1190
- T1133
- T1078
- T1119
- T1029
queryPeriod: 30m
severity: Medium
triggerOperator: gt
version: 1.0.2
queryFrequency: 30m
entityMappings:
- entityType: Account
  fieldMappings:
  - identifier: FullName
    columnName: AccountCustomEntity
- entityType: IP
  fieldMappings:
  - identifier: Address
    columnName: IPCustomEntity
kind: Scheduled
status: Available
tactics:
- InitialAccess
- Collection
- Exfiltration
id: 54aa2c17-acfd-4e3a-a1c4-99c88cf34ebe
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/OracleDatabaseAudit/Analytic Rules/OracleDBAuditConnectFromExternalIp.yaml
{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "workspace": {
      "type": "String"
    }
  },
  "resources": [
    {
      "apiVersion": "2024-01-01-preview",
      "id": "[concat(resourceId('Microsoft.OperationalInsights/workspaces/providers', parameters('workspace'), 'Microsoft.SecurityInsights'),'/alertRules/54aa2c17-acfd-4e3a-a1c4-99c88cf34ebe')]",
      "kind": "Scheduled",
      "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/54aa2c17-acfd-4e3a-a1c4-99c88cf34ebe')]",
      "properties": {
        "alertRuleTemplateName": "54aa2c17-acfd-4e3a-a1c4-99c88cf34ebe",
        "customDetails": null,
        "description": "'Detects when connection to database is from external IP source.'\n",
        "displayName": "OracleDBAudit - Connection to database from external IP",
        "enabled": true,
        "entityMappings": [
          {
            "entityType": "Account",
            "fieldMappings": [
              {
                "columnName": "AccountCustomEntity",
                "identifier": "FullName"
              }
            ]
          },
          {
            "entityType": "IP",
            "fieldMappings": [
              {
                "columnName": "IPCustomEntity",
                "identifier": "Address"
              }
            ]
          }
        ],
        "OriginalUri": "https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/OracleDatabaseAudit/Analytic Rules/OracleDBAuditConnectFromExternalIp.yaml",
        "query": "OracleDatabaseAuditEvent\n| where isnotempty(SrcIpAddr)\n| where isnotempty(Action)\n| where DbAction =~ 'connect'\n| where ipv4_is_private(SrcIpAddr) == 'false'\n| extend AccountCustomEntity = DstUserName\n| extend IPCustomEntity = SrcIpAddr\n",
        "queryFrequency": "PT30M",
        "queryPeriod": "PT30M",
        "severity": "Medium",
        "status": "Available",
        "subTechniques": [],
        "suppressionDuration": "PT1H",
        "suppressionEnabled": false,
        "tactics": [
          "Collection",
          "Exfiltration",
          "InitialAccess"
        ],
        "techniques": [
          "T1029",
          "T1078",
          "T1119",
          "T1133",
          "T1190"
        ],
        "templateVersion": "1.0.2",
        "triggerOperator": "GreaterThan",
        "triggerThreshold": 0
      },
      "type": "Microsoft.OperationalInsights/workspaces/providers/alertRules"
    }
  ]
}