Authomize_v2_CL
| where ingestion_time() >= ago(30m)
| extend EventID = id_s, Policy = policy_name_s, Severity = severity_s,Description = description_s,Recommendation = recommendation_s,URL = url_s,Tactics = tactics_s
| where Policy has "New service account gained access to IaaS resource"
| project EventID, Policy, Severity, Description, Recommendation, URL, Category, Tactics
description: This policy detects when an application or service account gained new access to your assets. This policy is defined by Authomize and can be edited to change the configuration.
entityMappings:
- fieldMappings:
- columnName: URL
identifier: Url
entityType: URL
kind: Scheduled
tactics:
- InitialAccess
severity: Informational
triggerThreshold: 0
queryFrequency: 30m
status: Available
queryPeriod: 30m
relevantTechniques:
- T1078
version: 1.0.3
suppressionEnabled: false
id: 6c17f270-cd56-48cc-9196-1728ffea6538
name: New service account gained access to IaaS resource
incidentConfiguration:
createIncident: true
groupingConfiguration:
reopenClosedIncident: false
groupByCustomDetails: []
enabled: true
matchingMethod: AnyAlert
groupByAlertDetails: []
groupByEntities: []
lookbackDuration: 5h
query: |-
Authomize_v2_CL
| where ingestion_time() >= ago(30m)
| extend EventID = id_s, Policy = policy_name_s, Severity = severity_s,Description = description_s,Recommendation = recommendation_s,URL = url_s,Tactics = tactics_s
| where Policy has "New service account gained access to IaaS resource"
| project EventID, Policy, Severity, Description, Recommendation, URL, Category, Tactics
triggerOperator: gt
customDetails:
EventRecommendation: Recommendation
ReferencedURL: URL
EventName: Policy
EventDescription: Description
AuthomizeEventID: EventID
suppressionDuration: 5h
eventGroupingSettings:
aggregationKind: SingleAlert
alertDetailsOverride:
alertTactics: Tactics
alertSeverity: Severity
alertnameFormat: Alert from Authomize - New service account gained access to IaaS resource
alertDynamicProperties:
- value: URL
alertProperty: AlertLink
alertDescriptionFormat: New service account gained access to IaaS resource. This policy detects when an application or service account gained new access to your assets. This policy is defined by Authomize and can be edited to change the configuration.
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Authomize/Analytic Rules/New_service_account_gained_access_to_IaaS_resource.yaml
requiredDataConnectors:
- dataTypes:
- Authomize_v2_CL
connectorId: Authomize
