Microsoft Sentinel Analytic Rules
cloudbrothers.infoAzure Sentinel RepoToggle Dark/Light/Auto modeToggle Dark/Light/Auto modeToggle Dark/Light/Auto modeBack to homepage

GWorkspace - Multiple user agents for single source

Back
Id6ff0e16e-5999-11ec-bf63-0242ac130002
RulenameGWorkspace - Multiple user agents for single source
DescriptionDetects requests with different user agents from one source in short timeframe.
SeverityMedium
TacticsPersistence
Collection
TechniquesT1185
T1176
Required data connectorsGoogleWorkspaceReportsAPI
KindScheduled
Query frequency1h
Query period1h
Trigger threshold0
Trigger operatorgt
Source Urihttps://github.com/Azure/Azure-Sentinel/blob/master/Solutions/GoogleWorkspaceReports/Analytic Rules/GWorkspaceDifferentUAsFromSingleIP.yaml
Version1.0.1
Arm template6ff0e16e-5999-11ec-bf63-0242ac130002.json
Deploy To Azure
let threshold = 5;
GWorkspaceActivityReports
| where isnotempty(UserAgentOriginal)
| summarize user_ua = makeset(UserAgentOriginal) by SrcIpAddr, bin(TimeGenerated, 5m)
| where array_length(user_ua) > threshold
| extend IPCustomEntity = SrcIpAddr
severity: Medium
triggerThreshold: 0
query: |
  let threshold = 5;
  GWorkspaceActivityReports
  | where isnotempty(UserAgentOriginal)
  | summarize user_ua = makeset(UserAgentOriginal) by SrcIpAddr, bin(TimeGenerated, 5m)
  | where array_length(user_ua) > threshold
  | extend IPCustomEntity = SrcIpAddr  
queryFrequency: 1h
requiredDataConnectors:
- connectorId: GoogleWorkspaceReportsAPI
  dataTypes:
  - GWorkspaceActivityReports
id: 6ff0e16e-5999-11ec-bf63-0242ac130002
version: 1.0.1
name: GWorkspace - Multiple user agents for single source
kind: Scheduled
status: Available
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/GoogleWorkspaceReports/Analytic Rules/GWorkspaceDifferentUAsFromSingleIP.yaml
queryPeriod: 1h
relevantTechniques:
- T1185
- T1176
triggerOperator: gt
tactics:
- Persistence
- Collection
description: |
    'Detects requests with different user agents from one source in short timeframe.'
entityMappings:
- entityType: IP
  fieldMappings:
  - identifier: Address
    columnName: IPCustomEntity
{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "workspace": {
      "type": "String"
    }
  },
  "resources": [
    {
      "id": "[concat(resourceId('Microsoft.OperationalInsights/workspaces/providers', parameters('workspace'), 'Microsoft.SecurityInsights'),'/alertRules/6ff0e16e-5999-11ec-bf63-0242ac130002')]",
      "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/6ff0e16e-5999-11ec-bf63-0242ac130002')]",
      "type": "Microsoft.OperationalInsights/workspaces/providers/alertRules",
      "kind": "Scheduled",
      "apiVersion": "2022-11-01",
      "properties": {
        "displayName": "GWorkspace - Multiple user agents for single source",
        "description": "'Detects requests with different user agents from one source in short timeframe.'\n",
        "severity": "Medium",
        "enabled": true,
        "query": "let threshold = 5;\nGWorkspaceActivityReports\n| where isnotempty(UserAgentOriginal)\n| summarize user_ua = makeset(UserAgentOriginal) by SrcIpAddr, bin(TimeGenerated, 5m)\n| where array_length(user_ua) > threshold\n| extend IPCustomEntity = SrcIpAddr\n",
        "queryFrequency": "PT1H",
        "queryPeriod": "PT1H",
        "triggerOperator": "GreaterThan",
        "triggerThreshold": 0,
        "suppressionDuration": "PT1H",
        "suppressionEnabled": false,
        "tactics": [
          "Persistence",
          "Collection"
        ],
        "techniques": [
          "T1185",
          "T1176"
        ],
        "alertRuleTemplateName": "6ff0e16e-5999-11ec-bf63-0242ac130002",
        "customDetails": null,
        "entityMappings": [
          {
            "fieldMappings": [
              {
                "columnName": "IPCustomEntity",
                "identifier": "Address"
              }
            ],
            "entityType": "IP"
          }
        ],
        "OriginalUri": "https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/GoogleWorkspaceReports/Analytic Rules/GWorkspaceDifferentUAsFromSingleIP.yaml",
        "templateVersion": "1.0.1",
        "status": "Available"
      }
    }
  ]
}