NordPass - Manual invitation suspension or deletion

Back


Id	693c5217-e840-427f-9661-3fa0ef266040
Rulename	NordPass - Manual invitation, suspension, or deletion
Description	This will alert you when the user is manually invited, suspended, or deleted. !This rule should be enabled only by organizations that have User and Group Provisioning enabled.
Severity	Medium
Tactics	Persistence
Techniques	T1098
Required data connectors	NordPass
Kind	Scheduled
Query frequency	1h
Query period	1h
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/NordPass/Analytics Rules/nordpass_manual_user_manipulation.yaml
Version	1.0.0
Arm template	693c5217-e840-427f-9661-3fa0ef266040.json

KQL

NordPassEventLogs_CL  
| extend metadataParsed = parse_json(metadata)  
| where (event_type == "invites" and action == "user_invited") or (event_type == "access" and action == "user_status_updated" and (metadataParsed.status == "suspended" or metadataParsed.status == "deleted"))  
| extend TargetEmail = user_email

YAML

version: 1.0.0
severity: Medium
relevantTechniques:
- T1098
triggerOperator: gt
requiredDataConnectors:
- dataTypes:
  - NordPassEventLogs_CL
  connectorId: NordPass
queryFrequency: 1h
triggerThreshold: 0
entityMappings:
- fieldMappings:
  - columnName: TargetEmail
    identifier: MailboxPrimaryAddress
  entityType: Mailbox
incidentConfiguration:
  createIncident: false
id: 693c5217-e840-427f-9661-3fa0ef266040
description: |
  This will alert you when the user is manually invited, suspended, or deleted.

  !This rule should be enabled only by organizations that have User and Group Provisioning enabled.  
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/NordPass/Analytics Rules/nordpass_manual_user_manipulation.yaml
name: NordPass - Manual invitation, suspension, or deletion
query: |
  NordPassEventLogs_CL  
  | extend metadataParsed = parse_json(metadata)  
  | where (event_type == "invites" and action == "user_invited") or (event_type == "access" and action == "user_status_updated" and (metadataParsed.status == "suspended" or metadataParsed.status == "deleted"))  
  | extend TargetEmail = user_email  
queryPeriod: 1h
tactics:
- Persistence
kind: Scheduled
displayName: Manual invitation, suspension, or deletion

ARM