Microsoft Sentinel Analytic Rules
cloudbrothers.infoAzure Sentinel RepoToggle Dark/Light/Auto modeToggle Dark/Light/Auto modeToggle Dark/Light/Auto modeBack to homepage

GWorkspace - Multiple user agents for single source

Back
Id6ff0e16e-5999-11ec-bf63-0242ac130002
RulenameGWorkspace - Multiple user agents for single source
DescriptionDetects requests with different user agents from one source in short timeframe.
SeverityMedium
TacticsPersistence
Collection
TechniquesT1185
T1176
Required data connectorsGoogleWorkspaceReportsAPI
KindScheduled
Query frequency1h
Query period1h
Trigger threshold0
Trigger operatorgt
Source Urihttps://github.com/Azure/Azure-Sentinel/blob/master/Solutions/GoogleWorkspaceReports/Analytic Rules/GWorkspaceDifferentUAsFromSingleIP.yaml
Version1.0.1
Arm template6ff0e16e-5999-11ec-bf63-0242ac130002.json
Deploy To Azure
let threshold = 5;
GWorkspaceActivityReports
| where isnotempty(UserAgentOriginal)
| summarize user_ua = makeset(UserAgentOriginal) by SrcIpAddr, bin(TimeGenerated, 5m)
| where array_length(user_ua) > threshold
| extend IPCustomEntity = SrcIpAddr
query: |
  let threshold = 5;
  GWorkspaceActivityReports
  | where isnotempty(UserAgentOriginal)
  | summarize user_ua = makeset(UserAgentOriginal) by SrcIpAddr, bin(TimeGenerated, 5m)
  | where array_length(user_ua) > threshold
  | extend IPCustomEntity = SrcIpAddr  
queryPeriod: 1h
queryFrequency: 1h
status: Available
id: 6ff0e16e-5999-11ec-bf63-0242ac130002
entityMappings:
- entityType: IP
  fieldMappings:
  - columnName: IPCustomEntity
    identifier: Address
relevantTechniques:
- T1185
- T1176
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/GoogleWorkspaceReports/Analytic Rules/GWorkspaceDifferentUAsFromSingleIP.yaml
requiredDataConnectors:
- connectorId: GoogleWorkspaceReportsAPI
  dataTypes:
  - GWorkspaceActivityReports
name: GWorkspace - Multiple user agents for single source
description: |
    'Detects requests with different user agents from one source in short timeframe.'
tactics:
- Persistence
- Collection
severity: Medium
triggerThreshold: 0
version: 1.0.1
kind: Scheduled
triggerOperator: gt
{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "workspace": {
      "type": "String"
    }
  },
  "resources": [
    {
      "apiVersion": "2024-01-01-preview",
      "id": "[concat(resourceId('Microsoft.OperationalInsights/workspaces/providers', parameters('workspace'), 'Microsoft.SecurityInsights'),'/alertRules/6ff0e16e-5999-11ec-bf63-0242ac130002')]",
      "kind": "Scheduled",
      "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/6ff0e16e-5999-11ec-bf63-0242ac130002')]",
      "properties": {
        "alertRuleTemplateName": "6ff0e16e-5999-11ec-bf63-0242ac130002",
        "customDetails": null,
        "description": "'Detects requests with different user agents from one source in short timeframe.'\n",
        "displayName": "GWorkspace - Multiple user agents for single source",
        "enabled": true,
        "entityMappings": [
          {
            "entityType": "IP",
            "fieldMappings": [
              {
                "columnName": "IPCustomEntity",
                "identifier": "Address"
              }
            ]
          }
        ],
        "OriginalUri": "https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/GoogleWorkspaceReports/Analytic Rules/GWorkspaceDifferentUAsFromSingleIP.yaml",
        "query": "let threshold = 5;\nGWorkspaceActivityReports\n| where isnotempty(UserAgentOriginal)\n| summarize user_ua = makeset(UserAgentOriginal) by SrcIpAddr, bin(TimeGenerated, 5m)\n| where array_length(user_ua) > threshold\n| extend IPCustomEntity = SrcIpAddr\n",
        "queryFrequency": "PT1H",
        "queryPeriod": "PT1H",
        "severity": "Medium",
        "status": "Available",
        "subTechniques": [],
        "suppressionDuration": "PT1H",
        "suppressionEnabled": false,
        "tactics": [
          "Collection",
          "Persistence"
        ],
        "techniques": [
          "T1176",
          "T1185"
        ],
        "templateVersion": "1.0.1",
        "triggerOperator": "GreaterThan",
        "triggerThreshold": 0
      },
      "type": "Microsoft.OperationalInsights/workspaces/providers/alertRules"
    }
  ]
}