GitLab - SSO - Sign-Ins Burst

Back


Id	57b1634b-531d-4eab-a456-8b855887428f
Rulename	GitLab - SSO - Sign-Ins Burst
Description	This query relies on Microsoft Entra ID sign-in activity when Microsoft Entra ID is used for SSO with GitLab to highlights GitLab accounts associated with multiple authentications from different geographical locations in a short space of time.
Severity	Medium
Tactics	CredentialAccess
Techniques	T1110
Required data connectors	AzureActiveDirectory
Kind	Scheduled
Query frequency	1h
Query period	1d
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/GitLab/Analytic Rules/GitLab_SignInBurst.yaml
Version	1.0.1
Arm template	57b1634b-531d-4eab-a456-8b855887428f.json

KQL

let locationCountMin = 1;
let appRegistrationName = "GitLab";
SigninLogs
| where AppDisplayName == appRegistrationName
| where ResultType == 0
| where Location != ""
| summarize CountOfLocations = dcount(Location), Locations = make_set(Location) by User = Identity
| where CountOfLocations > locationCountMin

YAML

triggerThreshold: 0
entityMappings:
- entityType: Account
  fieldMappings:
  - identifier: FullName
    columnName: User
requiredDataConnectors:
- dataTypes:
  - SigninLogs
  connectorId: AzureActiveDirectory
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/GitLab/Analytic Rules/GitLab_SignInBurst.yaml
name: GitLab - SSO - Sign-Ins Burst
relevantTechniques:
- T1110
status: Available
version: 1.0.1
queryPeriod: 1d
kind: Scheduled
id: 57b1634b-531d-4eab-a456-8b855887428f
query: |
  let locationCountMin = 1;
  let appRegistrationName = "GitLab";
  SigninLogs
  | where AppDisplayName == appRegistrationName
  | where ResultType == 0
  | where Location != ""
  | summarize CountOfLocations = dcount(Location), Locations = make_set(Location) by User = Identity
  | where CountOfLocations > locationCountMin  
description: |
    'This query relies on Microsoft Entra ID sign-in activity when Microsoft Entra ID is used for SSO with GitLab to highlights GitLab accounts associated with multiple authentications from different geographical locations in a short space of time.'
queryFrequency: 1h
severity: Medium
triggerOperator: gt
tactics:
- CredentialAccess

ARM