Microsoft Sentinel Analytic Rules
cloudbrothers.infoAzure Sentinel RepoToggle Dark/Light/Auto modeToggle Dark/Light/Auto modeToggle Dark/Light/Auto modeBack to homepage

Ping Federate - Unexpected country for user

Back
Id64e65105-c4fc-4c28-a4e9-bb1a3ce7652d
RulenamePing Federate - Unexpected country for user
DescriptionDetects requests from different countries for user in shotr term.
SeverityMedium
TacticsInitialAccess
TechniquesT1078
Required data connectorsCefAma
KindScheduled
Query frequency1h
Query period1d
Trigger threshold0
Trigger operatorgt
Source Urihttps://github.com/Azure/Azure-Sentinel/blob/master/Solutions/PingFederate/Analytic Rules/PingFederateUnexpectedUserCountry.yaml
Version1.0.3
Arm template64e65105-c4fc-4c28-a4e9-bb1a3ce7652d.json
Deploy To Azure
let known_countries = 
PingFederateEvent
| where TimeGenerated between (ago(1d) .. (1h))
| where isnotempty(DstGeoCountry)
| summarize makeset(DstGeoCountry);
PingFederateEvent
| where isnotempty(DstGeoCountry)
| where DstGeoCountry !in (known_countries)
| extend AccountCustomEntity = DstUserName
| extend IpCustomEntity = SrcIpAddr
status: Available
id: 64e65105-c4fc-4c28-a4e9-bb1a3ce7652d
query: |
  let known_countries = 
  PingFederateEvent
  | where TimeGenerated between (ago(1d) .. (1h))
  | where isnotempty(DstGeoCountry)
  | summarize makeset(DstGeoCountry);
  PingFederateEvent
  | where isnotempty(DstGeoCountry)
  | where DstGeoCountry !in (known_countries)
  | extend AccountCustomEntity = DstUserName
  | extend IpCustomEntity = SrcIpAddr  
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/PingFederate/Analytic Rules/PingFederateUnexpectedUserCountry.yaml
description: |
    'Detects requests from different countries for user in shotr term.'
name: Ping Federate - Unexpected country for user
relevantTechniques:
- T1078
entityMappings:
- entityType: Account
  fieldMappings:
  - identifier: Name
    columnName: AccountCustomEntity
- entityType: IP
  fieldMappings:
  - identifier: Address
    columnName: IpCustomEntity
triggerThreshold: 0
severity: Medium
requiredDataConnectors:
- dataTypes:
  - CommonSecurityLog
  connectorId: CefAma
queryFrequency: 1h
queryPeriod: 1d
version: 1.0.3
kind: Scheduled
tactics:
- InitialAccess
triggerOperator: gt
{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "workspace": {
      "type": "String"
    }
  },
  "resources": [
    {
      "apiVersion": "2024-01-01-preview",
      "id": "[concat(resourceId('Microsoft.OperationalInsights/workspaces/providers', parameters('workspace'), 'Microsoft.SecurityInsights'),'/alertRules/64e65105-c4fc-4c28-a4e9-bb1a3ce7652d')]",
      "kind": "Scheduled",
      "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/64e65105-c4fc-4c28-a4e9-bb1a3ce7652d')]",
      "properties": {
        "alertRuleTemplateName": "64e65105-c4fc-4c28-a4e9-bb1a3ce7652d",
        "customDetails": null,
        "description": "'Detects requests from different countries for user in shotr term.'\n",
        "displayName": "Ping Federate - Unexpected country for user",
        "enabled": true,
        "entityMappings": [
          {
            "entityType": "Account",
            "fieldMappings": [
              {
                "columnName": "AccountCustomEntity",
                "identifier": "Name"
              }
            ]
          },
          {
            "entityType": "IP",
            "fieldMappings": [
              {
                "columnName": "IpCustomEntity",
                "identifier": "Address"
              }
            ]
          }
        ],
        "OriginalUri": "https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/PingFederate/Analytic Rules/PingFederateUnexpectedUserCountry.yaml",
        "query": "let known_countries = \nPingFederateEvent\n| where TimeGenerated between (ago(1d) .. (1h))\n| where isnotempty(DstGeoCountry)\n| summarize makeset(DstGeoCountry);\nPingFederateEvent\n| where isnotempty(DstGeoCountry)\n| where DstGeoCountry !in (known_countries)\n| extend AccountCustomEntity = DstUserName\n| extend IpCustomEntity = SrcIpAddr\n",
        "queryFrequency": "PT1H",
        "queryPeriod": "P1D",
        "severity": "Medium",
        "status": "Available",
        "subTechniques": [],
        "suppressionDuration": "PT1H",
        "suppressionEnabled": false,
        "tactics": [
          "InitialAccess"
        ],
        "techniques": [
          "T1078"
        ],
        "templateVersion": "1.0.3",
        "triggerOperator": "GreaterThan",
        "triggerThreshold": 0
      },
      "type": "Microsoft.OperationalInsights/workspaces/providers/alertRules"
    }
  ]
}