Keeper Security - User MFA Changed

KeeperSecurityEventNewLogs_CL
| where AuditEvent in (```set_two_factor_off```, ```set_two_factor_on```)

entityMappings:
- entityType: Account
  fieldMappings:
  - columnName: Username
    identifier: FullName
- entityType: IP
  fieldMappings:
  - columnName: RemoteAddress
    identifier: Address
version: 1.0.3
id: 75ffc8a4-86db-4f48-8506-cb4c049be484
suppressionEnabled: false
severity: Informational
kind: NRT
suppressionDuration: PT5H
description: |
    'Creates an informational incident based on Keeper Security User MFA Changed data in Microsoft Sentinel'
requiredDataConnectors:
- connectorId: KeeperSecurityPush2
  dataTypes:
  - KeeperSecurityEventNewLogs_CL
eventGroupingSettings:
  aggregationKind: AlertPerResult
name: Keeper Security - User MFA Changed
tactics:
- Persistence
relevantTechniques:
- T1556
alertDetailsOverride:
  alertDescriptionFormat: '{{AuditEvent}} has been captured in the Keeper Security Event Logs'
  alertDisplayNameFormat: '{{AuditEvent}} on {{RemoteAddress}}'
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Keeper Security/Analytic Rules/Keeper Security - User MFA Changed.yaml
query: |
  KeeperSecurityEventNewLogs_CL
  | where AuditEvent in (```set_two_factor_off```, ```set_two_factor_on```)  
status: Available
incidentConfiguration:
  createIncident: true
  groupingConfiguration:
    lookbackDuration: PT5H
    enabled: false
    reopenClosedIncident: false
    matchingMethod: AllEntities