let known_countries =
PingFederateEvent
| where TimeGenerated between (ago(1d) .. (1h))
| where isnotempty(DstGeoCountry)
| summarize makeset(DstGeoCountry);
PingFederateEvent
| where isnotempty(DstGeoCountry)
| where DstGeoCountry !in (known_countries)
| extend AccountCustomEntity = DstUserName
| extend IpCustomEntity = SrcIpAddr
entityMappings:
- entityType: Account
fieldMappings:
- identifier: Name
columnName: AccountCustomEntity
- entityType: IP
fieldMappings:
- identifier: Address
columnName: IpCustomEntity
tactics:
- InitialAccess
requiredDataConnectors:
- dataTypes:
- CommonSecurityLog
connectorId: CefAma
id: 64e65105-c4fc-4c28-a4e9-bb1a3ce7652d
severity: Medium
status: Available
query: |
let known_countries =
PingFederateEvent
| where TimeGenerated between (ago(1d) .. (1h))
| where isnotempty(DstGeoCountry)
| summarize makeset(DstGeoCountry);
PingFederateEvent
| where isnotempty(DstGeoCountry)
| where DstGeoCountry !in (known_countries)
| extend AccountCustomEntity = DstUserName
| extend IpCustomEntity = SrcIpAddr
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/PingFederate/Analytic Rules/PingFederateUnexpectedUserCountry.yaml
kind: Scheduled
queryPeriod: 1d
version: 1.0.3
name: Ping Federate - Unexpected country for user
queryFrequency: 1h
triggerThreshold: 0
relevantTechniques:
- T1078
description: |
'Detects requests from different countries for user in shotr term.'
triggerOperator: gt
