let known_countries =
PingFederateEvent
| where TimeGenerated between (ago(1d) .. (1h))
| where isnotempty(DstGeoCountry)
| summarize makeset(DstGeoCountry);
PingFederateEvent
| where isnotempty(DstGeoCountry)
| where DstGeoCountry !in (known_countries)
| extend AccountCustomEntity = DstUserName
| extend IpCustomEntity = SrcIpAddr
triggerOperator: gt
queryFrequency: 1h
requiredDataConnectors:
- connectorId: CefAma
dataTypes:
- CommonSecurityLog
relevantTechniques:
- T1078
entityMappings:
- entityType: Account
fieldMappings:
- identifier: Name
columnName: AccountCustomEntity
- entityType: IP
fieldMappings:
- identifier: Address
columnName: IpCustomEntity
query: |
let known_countries =
PingFederateEvent
| where TimeGenerated between (ago(1d) .. (1h))
| where isnotempty(DstGeoCountry)
| summarize makeset(DstGeoCountry);
PingFederateEvent
| where isnotempty(DstGeoCountry)
| where DstGeoCountry !in (known_countries)
| extend AccountCustomEntity = DstUserName
| extend IpCustomEntity = SrcIpAddr
triggerThreshold: 0
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/PingFederate/Analytic Rules/PingFederateUnexpectedUserCountry.yaml
queryPeriod: 1d
name: Ping Federate - Unexpected country for user
status: Available
kind: Scheduled
description: |
'Detects requests from different countries for user in shotr term.'
id: 64e65105-c4fc-4c28-a4e9-bb1a3ce7652d
version: 1.0.3
tactics:
- InitialAccess
severity: Medium
