let known_countries =
PingFederateEvent
| where TimeGenerated between (ago(1d) .. (1h))
| where isnotempty(DstGeoCountry)
| summarize makeset(DstGeoCountry);
PingFederateEvent
| where isnotempty(DstGeoCountry)
| where DstGeoCountry !in (known_countries)
| extend AccountCustomEntity = DstUserName
| extend IpCustomEntity = SrcIpAddr
id: 64e65105-c4fc-4c28-a4e9-bb1a3ce7652d
triggerOperator: gt
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/PingFederate/Analytic Rules/PingFederateUnexpectedUserCountry.yaml
entityMappings:
- fieldMappings:
- identifier: Name
columnName: AccountCustomEntity
entityType: Account
- fieldMappings:
- identifier: Address
columnName: IpCustomEntity
entityType: IP
requiredDataConnectors:
- dataTypes:
- CommonSecurityLog
connectorId: CefAma
queryFrequency: 1h
queryPeriod: 1d
status: Available
query: |
let known_countries =
PingFederateEvent
| where TimeGenerated between (ago(1d) .. (1h))
| where isnotempty(DstGeoCountry)
| summarize makeset(DstGeoCountry);
PingFederateEvent
| where isnotempty(DstGeoCountry)
| where DstGeoCountry !in (known_countries)
| extend AccountCustomEntity = DstUserName
| extend IpCustomEntity = SrcIpAddr
name: Ping Federate - Unexpected country for user
kind: Scheduled
tactics:
- InitialAccess
severity: Medium
relevantTechniques:
- T1078
triggerThreshold: 0
version: 1.0.3
description: |
'Detects requests from different countries for user in shotr term.'
