FO - Mass update or deletion of user records

// Set threshold for number of updated or deleted records
let update_detection_threshold = 50;
let deleted_detection_threshold = 10;
FinanceOperationsActivity_CL
| where TableName == "UserInfo" and LogType in ("Update", "Delete")
| summarize
    TotalEvents = count(),
    StartTime = min(LogCreatedDateTime),
    EndTime = max(LogCreatedDateTime)
    by TableName, Username, LogType
| where (LogType == "Update" and TotalEvents > update_detection_threshold) or (LogType == "Delete" and TotalEvents > deleted_detection_threshold)
| extend FinOpsAppId = 32780
| project StartTime, EndTime, Username, LogType, TableName, TotalEvents, FinOpsAppId

kind: Scheduled
eventGroupingSettings:
  aggregationKind: SingleAlert
alertDetailsOverride:
  alertDisplayNameFormat: F&O - many user account records deleted
  alertDescriptionFormat: '{{TotalEvents}} user records deleted in F&O by user {{Username}}'
entityMappings:
- entityType: Account
  fieldMappings:
  - columnName: Username
    identifier: FullName
- entityType: CloudApplication
  fieldMappings:
  - columnName: FinOpsAppId
    identifier: AppId
description: Identifies large delete or update operations on Finance & Operations user records based on predefined thresholds.
severity: Medium
queryFrequency: 1h
triggerThreshold: 0
relevantTechniques:
- T1485
- T1565
- T1491
status: Available
tactics:
- Impact
name: F&O - Mass update or deletion of user records
id: 5ab00fbb-ba2c-44dc-b02e-f119639b9a11
query: |
  // Set threshold for number of updated or deleted records
  let update_detection_threshold = 50;
  let deleted_detection_threshold = 10;
  FinanceOperationsActivity_CL
  | where TableName == "UserInfo" and LogType in ("Update", "Delete")
  | summarize
      TotalEvents = count(),
      StartTime = min(LogCreatedDateTime),
      EndTime = max(LogCreatedDateTime)
      by TableName, Username, LogType
  | where (LogType == "Update" and TotalEvents > update_detection_threshold) or (LogType == "Delete" and TotalEvents > deleted_detection_threshold)
  | extend FinOpsAppId = 32780
  | project StartTime, EndTime, Username, LogType, TableName, TotalEvents, FinOpsAppId  
requiredDataConnectors:
- dataTypes:
  - FinanceOperationsActivity_CL
  connectorId: Dynamics365Finance
version: 3.2.0
triggerOperator: gt
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Microsoft Business Applications/Analytic Rules/F&O - Mass update or deletion of user records.yaml
queryPeriod: 1h

{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "workspace": {
      "type": "String"
    }
  },
  "resources": [
    {
      "apiVersion": "2024-01-01-preview",
      "id": "[concat(resourceId('Microsoft.OperationalInsights/workspaces/providers', parameters('workspace'), 'Microsoft.SecurityInsights'),'/alertRules/5ab00fbb-ba2c-44dc-b02e-f119639b9a11')]",
      "kind": "Scheduled",
      "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/5ab00fbb-ba2c-44dc-b02e-f119639b9a11')]",
      "properties": {
        "alertDetailsOverride": {
          "alertDescriptionFormat": "{{TotalEvents}} user records deleted in F&O by user {{Username}}",
          "alertDisplayNameFormat": "F&O - many user account records deleted"
        },
        "alertRuleTemplateName": "5ab00fbb-ba2c-44dc-b02e-f119639b9a11",
        "customDetails": null,
        "description": "Identifies large delete or update operations on Finance & Operations user records based on predefined thresholds.",
        "displayName": "F&O - Mass update or deletion of user records",
        "enabled": true,
        "entityMappings": [
          {
            "entityType": "Account",
            "fieldMappings": [
              {
                "columnName": "Username",
                "identifier": "FullName"
              }
            ]
          },
          {
            "entityType": "CloudApplication",
            "fieldMappings": [
              {
                "columnName": "FinOpsAppId",
                "identifier": "AppId"
              }
            ]
          }
        ],
        "eventGroupingSettings": {
          "aggregationKind": "SingleAlert"
        },
        "OriginalUri": "https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Microsoft Business Applications/Analytic Rules/F&O - Mass update or deletion of user records.yaml",
        "query": "// Set threshold for number of updated or deleted records\nlet update_detection_threshold = 50;\nlet deleted_detection_threshold = 10;\nFinanceOperationsActivity_CL\n| where TableName == \"UserInfo\" and LogType in (\"Update\", \"Delete\")\n| summarize\n    TotalEvents = count(),\n    StartTime = min(LogCreatedDateTime),\n    EndTime = max(LogCreatedDateTime)\n    by TableName, Username, LogType\n| where (LogType == \"Update\" and TotalEvents > update_detection_threshold) or (LogType == \"Delete\" and TotalEvents > deleted_detection_threshold)\n| extend FinOpsAppId = 32780\n| project StartTime, EndTime, Username, LogType, TableName, TotalEvents, FinOpsAppId\n",
        "queryFrequency": "PT1H",
        "queryPeriod": "PT1H",
        "severity": "Medium",
        "status": "Available",
        "subTechniques": [],
        "suppressionDuration": "PT1H",
        "suppressionEnabled": false,
        "tactics": [
          "Impact"
        ],
        "techniques": [
          "T1485",
          "T1491",
          "T1565"
        ],
        "templateVersion": "3.2.0",
        "triggerOperator": "GreaterThan",
        "triggerThreshold": 0
      },
      "type": "Microsoft.OperationalInsights/workspaces/providers/alertRules"
    }
  ]
}