Microsoft Sentinel Analytic Rules
cloudbrothers.infoAzure Sentinel RepoToggle Dark/Light/Auto modeToggle Dark/Light/Auto modeToggle Dark/Light/Auto modeBack to homepage

SenservaPro AD Applications Not Using Client Credentials

Back
Id56910d7b-aae7-452c-a3ed-89f72ef59234
RulenameSenservaPro AD Applications Not Using Client Credentials
DescriptionSearches for logs of AD Applications without Client Credentials (Key or Secret)
SeverityMedium
TacticsImpact
TechniquesT1529
T1485
Required data connectorsSenservaPro
KindScheduled
Query frequency6h
Query period6h
Trigger threshold0
Trigger operatorgt
Source Urihttps://github.com/Azure/Azure-Sentinel/blob/master/Solutions/SenservaPro/Analytic Rules/AppsNoClientCredentials.yaml
Version1.0.0
Arm template56910d7b-aae7-452c-a3ed-89f72ef59234.json
Deploy To Azure
SenservaPro_CL
| where ControlName_s == 'ApplicationNotUsingClientCredentials'
version: 1.0.0
status: Available
queryFrequency: 6h
requiredDataConnectors:
- connectorId: SenservaPro
  dataTypes:
  - SenservaPro_CL
entityMappings:
- fieldMappings:
  - columnName: ControlName_s
    identifier: Name
  - columnName: TenantId
    identifier: AadTenantId
  - columnName: TenantDisplayName_s
    identifier: DisplayName
  entityType: Account
- fieldMappings:
  - columnName: Group_s
    identifier: DistinguishedName
  entityType: SecurityGroup
- fieldMappings:
  - columnName: SourceSystem
    identifier: ResourceId
  entityType: AzureResource
kind: Scheduled
queryPeriod: 6h
severity: Medium
query: |
  SenservaPro_CL
  | where ControlName_s == 'ApplicationNotUsingClientCredentials'  
triggerOperator: gt
id: 56910d7b-aae7-452c-a3ed-89f72ef59234
description: |
    'Searches for logs of AD Applications without Client Credentials (Key or Secret)'
triggerThreshold: 0
name: SenservaPro AD Applications Not Using Client Credentials
relevantTechniques:
- T1529
- T1485
tactics:
- Impact
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/SenservaPro/Analytic Rules/AppsNoClientCredentials.yaml
{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "workspace": {
      "type": "String"
    }
  },
  "resources": [
    {
      "id": "[concat(resourceId('Microsoft.OperationalInsights/workspaces/providers', parameters('workspace'), 'Microsoft.SecurityInsights'),'/alertRules/56910d7b-aae7-452c-a3ed-89f72ef59234')]",
      "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/56910d7b-aae7-452c-a3ed-89f72ef59234')]",
      "type": "Microsoft.OperationalInsights/workspaces/providers/alertRules",
      "kind": "Scheduled",
      "apiVersion": "2022-11-01",
      "properties": {
        "displayName": "SenservaPro AD Applications Not Using Client Credentials",
        "description": "'Searches for logs of AD Applications without Client Credentials (Key or Secret)'\n",
        "severity": "Medium",
        "enabled": true,
        "query": "SenservaPro_CL\n| where ControlName_s == 'ApplicationNotUsingClientCredentials'\n",
        "queryFrequency": "PT6H",
        "queryPeriod": "PT6H",
        "triggerOperator": "GreaterThan",
        "triggerThreshold": 0,
        "suppressionDuration": "PT1H",
        "suppressionEnabled": false,
        "tactics": [
          "Impact"
        ],
        "techniques": [
          "T1529",
          "T1485"
        ],
        "alertRuleTemplateName": "56910d7b-aae7-452c-a3ed-89f72ef59234",
        "customDetails": null,
        "entityMappings": [
          {
            "entityType": "Account",
            "fieldMappings": [
              {
                "identifier": "Name",
                "columnName": "ControlName_s"
              },
              {
                "identifier": "AadTenantId",
                "columnName": "TenantId"
              },
              {
                "identifier": "DisplayName",
                "columnName": "TenantDisplayName_s"
              }
            ]
          },
          {
            "entityType": "SecurityGroup",
            "fieldMappings": [
              {
                "identifier": "DistinguishedName",
                "columnName": "Group_s"
              }
            ]
          },
          {
            "entityType": "AzureResource",
            "fieldMappings": [
              {
                "identifier": "ResourceId",
                "columnName": "SourceSystem"
              }
            ]
          }
        ],
        "status": "Available",
        "OriginalUri": "https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/SenservaPro/Analytic Rules/AppsNoClientCredentials.yaml",
        "templateVersion": "1.0.0"
      }
    }
  ]
}