Microsoft Sentinel Analytic Rules
cloudbrothers.infoAzure Sentinel RepoToggle Dark/Light/Auto modeToggle Dark/Light/Auto modeToggle Dark/Light/Auto modeBack to homepage

NordPass - Manual invitation suspension or deletion

Back
Id693c5217-e840-427f-9661-3fa0ef266040
RulenameNordPass - Manual invitation, suspension, or deletion
DescriptionThis will alert you when the user is manually invited, suspended, or deleted.



!This rule should be enabled only by organizations that have User and Group Provisioning enabled.
SeverityMedium
TacticsPersistence
TechniquesT1098
Required data connectorsNordPass
KindScheduled
Query frequency1h
Query period1h
Trigger threshold0
Trigger operatorgt
Source Urihttps://github.com/Azure/Azure-Sentinel/blob/master/Solutions/NordPass/Analytics Rules/nordpass_manual_user_manipulation.yaml
Version1.0.0
Arm template693c5217-e840-427f-9661-3fa0ef266040.json
Deploy To Azure
NordPassEventLogs_CL  
| extend metadataParsed = parse_json(metadata)  
| where (event_type == "invites" and action == "user_invited") or (event_type == "access" and action == "user_status_updated" and (metadataParsed.status == "suspended" or metadataParsed.status == "deleted"))  
| extend TargetEmail = user_email
tactics:
- Persistence
relevantTechniques:
- T1098
triggerOperator: gt
name: NordPass - Manual invitation, suspension, or deletion
id: 693c5217-e840-427f-9661-3fa0ef266040
displayName: Manual invitation, suspension, or deletion
incidentConfiguration:
  createIncident: false
queryFrequency: 1h
description: |
  This will alert you when the user is manually invited, suspended, or deleted.

  !This rule should be enabled only by organizations that have User and Group Provisioning enabled.  
entityMappings:
- fieldMappings:
  - identifier: MailboxPrimaryAddress
    columnName: TargetEmail
  entityType: Mailbox
severity: Medium
query: |
  NordPassEventLogs_CL  
  | extend metadataParsed = parse_json(metadata)  
  | where (event_type == "invites" and action == "user_invited") or (event_type == "access" and action == "user_status_updated" and (metadataParsed.status == "suspended" or metadataParsed.status == "deleted"))  
  | extend TargetEmail = user_email  
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/NordPass/Analytics Rules/nordpass_manual_user_manipulation.yaml
queryPeriod: 1h
triggerThreshold: 0
kind: Scheduled
version: 1.0.0
requiredDataConnectors:
- dataTypes:
  - NordPassEventLogs_CL
  connectorId: NordPass