Dataverse - Mass deletion of records
| Id | 716cf6d4-97ad-407b-923e-6790083acb58 |
| Rulename | Dataverse - Mass deletion of records |
| Description | Identifies large scale record delete operations based on a predefined threshold and also detects scheduled bulk deletion jobs. |
| Severity | Medium |
| Tactics | Impact |
| Techniques | T1485 |
| Required data connectors | Dataverse |
| Kind | Scheduled |
| Query frequency | 1h |
| Query period | 14d |
| Trigger threshold | 0 |
| Trigger operator | gt |
| Source Uri | https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Microsoft Business Applications/Analytic Rules/Dataverse - Mass deletion of records.yaml |
| Version | 3.2.0 |
| Arm template | 716cf6d4-97ad-407b-923e-6790083acb58.json |
let mass_delete_threshold = 10000;
let query_frequency = 1d;
let delete_activities = DataverseActivity
| where TimeGenerated >= ago(query_frequency)
| where Message == "Delete";
union
(
delete_activities
| summarize FirstEvent = min(TimeGenerated), TotalEvents = count() by UserId, InstanceUrl
| where TotalEvents > mass_delete_threshold
| join kind=inner (
delete_activities
| summarize DeleteCount = count() by UserId, InstanceUrl, ClientIp, EntityName)
on UserId, InstanceUrl
| extend Entities = bag_pack("Entity", EntityName, "Count", DeleteCount)
| summarize Details = make_set(Entities, 100), FirstEvent = min(FirstEvent) by UserId, InstanceUrl, ClientIp, TotalEvents
),
(
DataverseActivity
| where TimeGenerated >= ago(query_frequency)
| where Message == "BulkDelete"
| summarize FirstEvent = min(TimeGenerated), TotalEvents = count() by UserId, InstanceUrl, ClientIp
| extend Details = todynamic("Bulk delete scheduled")
)
| extend
CloudAppId = int(32780),
AccountName = tostring(split(UserId, '@')[0]),
UPNSuffix = tostring(split(UserId, '@')[1])
| project
FirstEvent,
UserId,
ClientIp,
TotalEvents,
Details,
InstanceUrl,
CloudAppId,
AccountName,
UPNSuffix
queryPeriod: 14d
id: 716cf6d4-97ad-407b-923e-6790083acb58
relevantTechniques:
- T1485
triggerOperator: gt
entityMappings:
- fieldMappings:
- columnName: AccountName
identifier: Name
- columnName: UPNSuffix
identifier: UPNSuffix
entityType: Account
- fieldMappings:
- columnName: CloudAppId
identifier: AppId
- columnName: InstanceUrl
identifier: InstanceName
entityType: CloudApplication
- fieldMappings:
- columnName: ClientIp
identifier: Address
entityType: IP
query: |
let mass_delete_threshold = 10000;
let query_frequency = 1d;
let delete_activities = DataverseActivity
| where TimeGenerated >= ago(query_frequency)
| where Message == "Delete";
union
(
delete_activities
| summarize FirstEvent = min(TimeGenerated), TotalEvents = count() by UserId, InstanceUrl
| where TotalEvents > mass_delete_threshold
| join kind=inner (
delete_activities
| summarize DeleteCount = count() by UserId, InstanceUrl, ClientIp, EntityName)
on UserId, InstanceUrl
| extend Entities = bag_pack("Entity", EntityName, "Count", DeleteCount)
| summarize Details = make_set(Entities, 100), FirstEvent = min(FirstEvent) by UserId, InstanceUrl, ClientIp, TotalEvents
),
(
DataverseActivity
| where TimeGenerated >= ago(query_frequency)
| where Message == "BulkDelete"
| summarize FirstEvent = min(TimeGenerated), TotalEvents = count() by UserId, InstanceUrl, ClientIp
| extend Details = todynamic("Bulk delete scheduled")
)
| extend
CloudAppId = int(32780),
AccountName = tostring(split(UserId, '@')[0]),
UPNSuffix = tostring(split(UserId, '@')[1])
| project
FirstEvent,
UserId,
ClientIp,
TotalEvents,
Details,
InstanceUrl,
CloudAppId,
AccountName,
UPNSuffix
kind: Scheduled
triggerThreshold: 0
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Microsoft Business Applications/Analytic Rules/Dataverse - Mass deletion of records.yaml
queryFrequency: 1h
requiredDataConnectors:
- dataTypes:
- DataverseActivity
connectorId: Dataverse
eventGroupingSettings:
aggregationKind: AlertPerResult
name: Dataverse - Mass deletion of records
version: 3.2.0
description: Identifies large scale record delete operations based on a predefined threshold and also detects scheduled bulk deletion jobs.
alertDetailsOverride:
alertDisplayNameFormat: 'Dataverse - mass deletion or bulk deletion job detected in {{InstanceUrl}} '
alertDescriptionFormat: '{{UserId}} triggered the mass deletion detection with the following information: {{Details}}'
tactics:
- Impact
severity: Medium
status: Available
{
"$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
"contentVersion": "1.0.0.0",
"parameters": {
"workspace": {
"type": "String"
}
},
"resources": [
{
"apiVersion": "2024-01-01-preview",
"id": "[concat(resourceId('Microsoft.OperationalInsights/workspaces/providers', parameters('workspace'), 'Microsoft.SecurityInsights'),'/alertRules/716cf6d4-97ad-407b-923e-6790083acb58')]",
"kind": "Scheduled",
"name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/716cf6d4-97ad-407b-923e-6790083acb58')]",
"properties": {
"alertDetailsOverride": {
"alertDescriptionFormat": "{{UserId}} triggered the mass deletion detection with the following information: {{Details}}",
"alertDisplayNameFormat": "Dataverse - mass deletion or bulk deletion job detected in {{InstanceUrl}} "
},
"alertRuleTemplateName": "716cf6d4-97ad-407b-923e-6790083acb58",
"customDetails": null,
"description": "Identifies large scale record delete operations based on a predefined threshold and also detects scheduled bulk deletion jobs.",
"displayName": "Dataverse - Mass deletion of records",
"enabled": true,
"entityMappings": [
{
"entityType": "Account",
"fieldMappings": [
{
"columnName": "AccountName",
"identifier": "Name"
},
{
"columnName": "UPNSuffix",
"identifier": "UPNSuffix"
}
]
},
{
"entityType": "CloudApplication",
"fieldMappings": [
{
"columnName": "CloudAppId",
"identifier": "AppId"
},
{
"columnName": "InstanceUrl",
"identifier": "InstanceName"
}
]
},
{
"entityType": "IP",
"fieldMappings": [
{
"columnName": "ClientIp",
"identifier": "Address"
}
]
}
],
"eventGroupingSettings": {
"aggregationKind": "AlertPerResult"
},
"OriginalUri": "https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Microsoft Business Applications/Analytic Rules/Dataverse - Mass deletion of records.yaml",
"query": "let mass_delete_threshold = 10000;\nlet query_frequency = 1d;\nlet delete_activities = DataverseActivity\n | where TimeGenerated >= ago(query_frequency)\n | where Message == \"Delete\";\nunion\n (\n delete_activities\n | summarize FirstEvent = min(TimeGenerated), TotalEvents = count() by UserId, InstanceUrl\n | where TotalEvents > mass_delete_threshold\n | join kind=inner (\n delete_activities\n | summarize DeleteCount = count() by UserId, InstanceUrl, ClientIp, EntityName)\n on UserId, InstanceUrl\n | extend Entities = bag_pack(\"Entity\", EntityName, \"Count\", DeleteCount)\n | summarize Details = make_set(Entities, 100), FirstEvent = min(FirstEvent) by UserId, InstanceUrl, ClientIp, TotalEvents\n ),\n (\n DataverseActivity\n | where TimeGenerated >= ago(query_frequency)\n | where Message == \"BulkDelete\"\n | summarize FirstEvent = min(TimeGenerated), TotalEvents = count() by UserId, InstanceUrl, ClientIp\n | extend Details = todynamic(\"Bulk delete scheduled\")\n )\n| extend\n CloudAppId = int(32780),\n AccountName = tostring(split(UserId, '@')[0]),\n UPNSuffix = tostring(split(UserId, '@')[1])\n| project\n FirstEvent,\n UserId,\n ClientIp,\n TotalEvents,\n Details,\n InstanceUrl,\n CloudAppId,\n AccountName,\n UPNSuffix\n",
"queryFrequency": "PT1H",
"queryPeriod": "P14D",
"severity": "Medium",
"status": "Available",
"subTechniques": [],
"suppressionDuration": "PT1H",
"suppressionEnabled": false,
"tactics": [
"Impact"
],
"techniques": [
"T1485"
],
"templateVersion": "3.2.0",
"triggerOperator": "GreaterThan",
"triggerThreshold": 0
},
"type": "Microsoft.OperationalInsights/workspaces/providers/alertRules"
}
]
}