Microsoft Sentinel Analytic Rules
cloudbrothers.infoAzure Sentinel RepoToggle Dark/Light/Auto modeToggle Dark/Light/Auto modeToggle Dark/Light/Auto modeBack to homepage

Admin SaaS account detected

Back
Id87419138-d75f-450d-aca4-1dc802e32540
RulenameAdmin SaaS account detected
DescriptionThe rule detects internal admins accounts, it’s recommended to review any new administrative permission.
SeverityLow
TacticsInitialAccess
PrivilegeEscalation
TechniquesT1078
T1078
Required data connectorsAuthomize
KindScheduled
Query frequency30m
Query period30m
Trigger threshold0
Trigger operatorgt
Source Urihttps://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Authomize/Analytic Rules/Admin_SaaS_account_detected.yaml
Version1.0.2
Arm template87419138-d75f-450d-aca4-1dc802e32540.json
Deploy To Azure
Authomize_v2_CL
| where ingestion_time() >= ago(30m)
| extend EventID = id_s, Policy = policy_name_s, Severity = severity_s,Description = description_s,Recommendation = recommendation_s,URL = url_s,Tactics = tactics_s
| where Policy has "Admin SaaS account detected"
| project  EventID, Policy, Severity, Description, Recommendation, URL, Category, Tactics
version: 1.0.2
severity: Low
eventGroupingSettings:
  aggregationKind: SingleAlert
triggerOperator: gt
kind: Scheduled
description: The rule detects internal admins accounts, it's recommended to review any new administrative permission.
incidentConfiguration:
  groupingConfiguration:
    lookbackDuration: 5h
    groupByAlertDetails: []
    groupByCustomDetails: []
    reopenClosedIncident: false
    groupByEntities: []
    matchingMethod: AnyAlert
    enabled: true
  createIncident: true
tactics:
- InitialAccess
- PrivilegeEscalation
triggerThreshold: 0
query: |-
  Authomize_v2_CL
  | where ingestion_time() >= ago(30m)
  | extend EventID = id_s, Policy = policy_name_s, Severity = severity_s,Description = description_s,Recommendation = recommendation_s,URL = url_s,Tactics = tactics_s
  | where Policy has "Admin SaaS account detected"
  | project  EventID, Policy, Severity, Description, Recommendation, URL, Category, Tactics  
name: Admin SaaS account detected
relevantTechniques:
- T1078
- T1078
requiredDataConnectors:
- dataTypes:
  - Authomize_v2_CL
  connectorId: Authomize
status: Available
queryPeriod: 30m
entityMappings:
- fieldMappings:
  - columnName: URL
    identifier: Url
  entityType: URL
suppressionDuration: 5h
customDetails:
  ReferencedURL: URL
  EventRecommendation: Recommendation
  AuthomizeEventID: EventID
  EventName: Policy
  EventDescription: Description
id: 87419138-d75f-450d-aca4-1dc802e32540
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Authomize/Analytic Rules/Admin_SaaS_account_detected.yaml
alertDetailsOverride:
  alertSeverity: Severity
  alertDynamicProperties:
  - alertProperty: AlertLink
    value: URL
  alertTactics: Tactics
  alertnameFormat: Alert from Authomize - Admin SaaS account detected
  alertDescriptionFormat: Admin SaaS account detected. The policy detects internal admins accounts, it's recommended to review any new administrative permission.
queryFrequency: 30m
suppressionEnabled: false
{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "workspace": {
      "type": "String"
    }
  },
  "resources": [
    {
      "apiVersion": "2024-01-01-preview",
      "id": "[concat(resourceId('Microsoft.OperationalInsights/workspaces/providers', parameters('workspace'), 'Microsoft.SecurityInsights'),'/alertRules/87419138-d75f-450d-aca4-1dc802e32540')]",
      "kind": "Scheduled",
      "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/87419138-d75f-450d-aca4-1dc802e32540')]",
      "properties": {
        "alertDetailsOverride": {
          "alertDescriptionFormat": "Admin SaaS account detected. The policy detects internal admins accounts, it's recommended to review any new administrative permission.",
          "alertDynamicProperties": [
            {
              "alertProperty": "AlertLink",
              "value": "URL"
            }
          ],
          "alertnameFormat": "Alert from Authomize - Admin SaaS account detected",
          "alertSeverity": "Severity",
          "alertTactics": "Tactics"
        },
        "alertRuleTemplateName": "87419138-d75f-450d-aca4-1dc802e32540",
        "customDetails": {
          "AuthomizeEventID": "EventID",
          "EventDescription": "Description",
          "EventName": "Policy",
          "EventRecommendation": "Recommendation",
          "ReferencedURL": "URL"
        },
        "description": "The rule detects internal admins accounts, it's recommended to review any new administrative permission.",
        "displayName": "Admin SaaS account detected",
        "enabled": true,
        "entityMappings": [
          {
            "entityType": "URL",
            "fieldMappings": [
              {
                "columnName": "URL",
                "identifier": "Url"
              }
            ]
          }
        ],
        "eventGroupingSettings": {
          "aggregationKind": "SingleAlert"
        },
        "incidentConfiguration": {
          "createIncident": true,
          "groupingConfiguration": {
            "enabled": true,
            "groupByAlertDetails": [],
            "groupByCustomDetails": [],
            "groupByEntities": [],
            "lookbackDuration": "PT5H",
            "matchingMethod": "AnyAlert",
            "reopenClosedIncident": false
          }
        },
        "OriginalUri": "https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Authomize/Analytic Rules/Admin_SaaS_account_detected.yaml",
        "query": "Authomize_v2_CL\n| where ingestion_time() >= ago(30m)\n| extend EventID = id_s, Policy = policy_name_s, Severity = severity_s,Description = description_s,Recommendation = recommendation_s,URL = url_s,Tactics = tactics_s\n| where Policy has \"Admin SaaS account detected\"\n| project  EventID, Policy, Severity, Description, Recommendation, URL, Category, Tactics",
        "queryFrequency": "PT30M",
        "queryPeriod": "PT30M",
        "severity": "Low",
        "status": "Available",
        "subTechniques": [],
        "suppressionDuration": "PT5H",
        "suppressionEnabled": false,
        "tactics": [
          "InitialAccess",
          "PrivilegeEscalation"
        ],
        "techniques": [
          "T1078"
        ],
        "templateVersion": "1.0.2",
        "triggerOperator": "GreaterThan",
        "triggerThreshold": 0
      },
      "type": "Microsoft.OperationalInsights/workspaces/providers/alertRules"
    }
  ]
}