Microsoft Sentinel Analytic Rules
cloudbrothers.infoAzure Sentinel RepoToggle Dark/Light/Auto modeToggle Dark/Light/Auto modeToggle Dark/Light/Auto modeBack to homepage

Admin SaaS account detected

Back
Id87419138-d75f-450d-aca4-1dc802e32540
RulenameAdmin SaaS account detected
DescriptionThe rule detects internal admins accounts, it’s recommended to review any new administrative permission.
SeverityLow
TacticsInitialAccess
PrivilegeEscalation
TechniquesT1078
T1078
Required data connectorsAuthomize
KindScheduled
Query frequency30m
Query period30m
Trigger threshold0
Trigger operatorgt
Source Urihttps://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Authomize/Analytic Rules/Admin_SaaS_account_detected.yaml
Version1.0.2
Arm template87419138-d75f-450d-aca4-1dc802e32540.json
Deploy To Azure
Authomize_v2_CL
| where ingestion_time() >= ago(30m)
| extend EventID = id_s, Policy = policy_name_s, Severity = severity_s,Description = description_s,Recommendation = recommendation_s,URL = url_s,Tactics = tactics_s
| where Policy has "Admin SaaS account detected"
| project  EventID, Policy, Severity, Description, Recommendation, URL, Category, Tactics
triggerThreshold: 0
alertDetailsOverride:
  alertTactics: Tactics
  alertSeverity: Severity
  alertnameFormat: Alert from Authomize - Admin SaaS account detected
  alertDynamicProperties:
  - value: URL
    alertProperty: AlertLink
  alertDescriptionFormat: Admin SaaS account detected. The policy detects internal admins accounts, it's recommended to review any new administrative permission.
suppressionDuration: 5h
requiredDataConnectors:
- connectorId: Authomize
  dataTypes:
  - Authomize_v2_CL
severity: Low
queryFrequency: 30m
id: 87419138-d75f-450d-aca4-1dc802e32540
relevantTechniques:
- T1078
- T1078
queryPeriod: 30m
name: Admin SaaS account detected
status: Available
kind: Scheduled
incidentConfiguration:
  createIncident: true
  groupingConfiguration:
    groupByAlertDetails: []
    groupByCustomDetails: []
    matchingMethod: AnyAlert
    reopenClosedIncident: false
    groupByEntities: []
    enabled: true
    lookbackDuration: 5h
tactics:
- InitialAccess
- PrivilegeEscalation
triggerOperator: gt
version: 1.0.2
entityMappings:
- entityType: URL
  fieldMappings:
  - columnName: URL
    identifier: Url
eventGroupingSettings:
  aggregationKind: SingleAlert
customDetails:
  ReferencedURL: URL
  EventRecommendation: Recommendation
  EventDescription: Description
  EventName: Policy
  AuthomizeEventID: EventID
description: The rule detects internal admins accounts, it's recommended to review any new administrative permission.
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Authomize/Analytic Rules/Admin_SaaS_account_detected.yaml
query: |-
  Authomize_v2_CL
  | where ingestion_time() >= ago(30m)
  | extend EventID = id_s, Policy = policy_name_s, Severity = severity_s,Description = description_s,Recommendation = recommendation_s,URL = url_s,Tactics = tactics_s
  | where Policy has "Admin SaaS account detected"
  | project  EventID, Policy, Severity, Description, Recommendation, URL, Category, Tactics  
suppressionEnabled: false
{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "workspace": {
      "type": "String"
    }
  },
  "resources": [
    {
      "apiVersion": "2024-01-01-preview",
      "id": "[concat(resourceId('Microsoft.OperationalInsights/workspaces/providers', parameters('workspace'), 'Microsoft.SecurityInsights'),'/alertRules/87419138-d75f-450d-aca4-1dc802e32540')]",
      "kind": "Scheduled",
      "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/87419138-d75f-450d-aca4-1dc802e32540')]",
      "properties": {
        "alertDetailsOverride": {
          "alertDescriptionFormat": "Admin SaaS account detected. The policy detects internal admins accounts, it's recommended to review any new administrative permission.",
          "alertDynamicProperties": [
            {
              "alertProperty": "AlertLink",
              "value": "URL"
            }
          ],
          "alertnameFormat": "Alert from Authomize - Admin SaaS account detected",
          "alertSeverity": "Severity",
          "alertTactics": "Tactics"
        },
        "alertRuleTemplateName": "87419138-d75f-450d-aca4-1dc802e32540",
        "customDetails": {
          "AuthomizeEventID": "EventID",
          "EventDescription": "Description",
          "EventName": "Policy",
          "EventRecommendation": "Recommendation",
          "ReferencedURL": "URL"
        },
        "description": "The rule detects internal admins accounts, it's recommended to review any new administrative permission.",
        "displayName": "Admin SaaS account detected",
        "enabled": true,
        "entityMappings": [
          {
            "entityType": "URL",
            "fieldMappings": [
              {
                "columnName": "URL",
                "identifier": "Url"
              }
            ]
          }
        ],
        "eventGroupingSettings": {
          "aggregationKind": "SingleAlert"
        },
        "incidentConfiguration": {
          "createIncident": true,
          "groupingConfiguration": {
            "enabled": true,
            "groupByAlertDetails": [],
            "groupByCustomDetails": [],
            "groupByEntities": [],
            "lookbackDuration": "PT5H",
            "matchingMethod": "AnyAlert",
            "reopenClosedIncident": false
          }
        },
        "OriginalUri": "https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Authomize/Analytic Rules/Admin_SaaS_account_detected.yaml",
        "query": "Authomize_v2_CL\n| where ingestion_time() >= ago(30m)\n| extend EventID = id_s, Policy = policy_name_s, Severity = severity_s,Description = description_s,Recommendation = recommendation_s,URL = url_s,Tactics = tactics_s\n| where Policy has \"Admin SaaS account detected\"\n| project  EventID, Policy, Severity, Description, Recommendation, URL, Category, Tactics",
        "queryFrequency": "PT30M",
        "queryPeriod": "PT30M",
        "severity": "Low",
        "status": "Available",
        "subTechniques": [],
        "suppressionDuration": "PT5H",
        "suppressionEnabled": false,
        "tactics": [
          "InitialAccess",
          "PrivilegeEscalation"
        ],
        "techniques": [
          "T1078"
        ],
        "templateVersion": "1.0.2",
        "triggerOperator": "GreaterThan",
        "triggerThreshold": 0
      },
      "type": "Microsoft.OperationalInsights/workspaces/providers/alertRules"
    }
  ]
}