Microsoft Sentinel Analytic Rules
cloudbrothers.infoAzure Sentinel RepoToggle Dark/Light/Auto modeToggle Dark/Light/Auto modeToggle Dark/Light/Auto modeBack to homepage

Azure secure score role overlap

Back
Id8E6D9A66-F1B0-463D-BA90-11A5AEC0E15A
RulenameAzure secure score role overlap
DescriptionThis query searches for accounts that have been assigned Global Administrator do not need other roles assigned.

Global Administrators have access to all aspects of Azure
SeverityMedium
TacticsImpact
TechniquesT1529
Required data connectorsSenservaPro
KindScheduled
Query frequency6h
Query period6h
Trigger threshold0
Trigger operatorgt
Source Urihttps://github.com/Azure/Azure-Sentinel/blob/master/Solutions/SenservaPro/Analytic Rules/GlobaAdminRoleOverlap.yaml
Version1.0.0
Arm template8E6D9A66-F1B0-463D-BA90-11A5AEC0E15A.json
Deploy To Azure
SenservaPro_CL
| where ControlName_s == 'AzureSecureScoreRoleOverlap'
severity: Medium
name: Azure secure score role overlap
requiredDataConnectors:
- dataTypes:
  - SenservaPro_CL
  connectorId: SenservaPro
id: 8E6D9A66-F1B0-463D-BA90-11A5AEC0E15A
tactics:
- Impact
queryFrequency: 6h
triggerOperator: gt
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/SenservaPro/Analytic Rules/GlobaAdminRoleOverlap.yaml
description: |
  'This query searches for accounts that have been assigned Global Administrator do not need other roles assigned. 
    Global Administrators have access to all aspects of Azure'  
triggerThreshold: 0
kind: Scheduled
relevantTechniques:
- T1529
query: |
  SenservaPro_CL
  | where ControlName_s == 'AzureSecureScoreRoleOverlap'  
entityMappings:
- entityType: Account
  fieldMappings:
  - columnName: ControlName_s
    identifier: Name
  - columnName: TenantId
    identifier: AadTenantId
  - columnName: TenantDisplayName_s
    identifier: DisplayName
- entityType: SecurityGroup
  fieldMappings:
  - columnName: Group_s
    identifier: DistinguishedName
- entityType: AzureResource
  fieldMappings:
  - columnName: SourceSystem
    identifier: ResourceId
status: Available
version: 1.0.0
queryPeriod: 6h
{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "workspace": {
      "type": "String"
    }
  },
  "resources": [
    {
      "id": "[concat(resourceId('Microsoft.OperationalInsights/workspaces/providers', parameters('workspace'), 'Microsoft.SecurityInsights'),'/alertRules/8E6D9A66-F1B0-463D-BA90-11A5AEC0E15A')]",
      "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/8E6D9A66-F1B0-463D-BA90-11A5AEC0E15A')]",
      "type": "Microsoft.OperationalInsights/workspaces/providers/alertRules",
      "kind": "Scheduled",
      "apiVersion": "2022-11-01-preview",
      "properties": {
        "displayName": "Azure secure score role overlap",
        "description": "'This query searches for accounts that have been assigned Global Administrator do not need other roles assigned. \n  Global Administrators have access to all aspects of Azure'\n",
        "severity": "Medium",
        "enabled": true,
        "query": "SenservaPro_CL\n| where ControlName_s == 'AzureSecureScoreRoleOverlap'\n",
        "queryFrequency": "PT6H",
        "queryPeriod": "PT6H",
        "triggerOperator": "GreaterThan",
        "triggerThreshold": 0,
        "suppressionDuration": "PT1H",
        "suppressionEnabled": false,
        "tactics": [
          "Impact"
        ],
        "techniques": [
          "T1529"
        ],
        "alertRuleTemplateName": "8E6D9A66-F1B0-463D-BA90-11A5AEC0E15A",
        "customDetails": null,
        "entityMappings": [
          {
            "fieldMappings": [
              {
                "identifier": "Name",
                "columnName": "ControlName_s"
              },
              {
                "identifier": "AadTenantId",
                "columnName": "TenantId"
              },
              {
                "identifier": "DisplayName",
                "columnName": "TenantDisplayName_s"
              }
            ],
            "entityType": "Account"
          },
          {
            "fieldMappings": [
              {
                "identifier": "DistinguishedName",
                "columnName": "Group_s"
              }
            ],
            "entityType": "SecurityGroup"
          },
          {
            "fieldMappings": [
              {
                "identifier": "ResourceId",
                "columnName": "SourceSystem"
              }
            ],
            "entityType": "AzureResource"
          }
        ],
        "status": "Available",
        "templateVersion": "1.0.0",
        "OriginalUri": "https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/SenservaPro/Analytic Rules/GlobaAdminRoleOverlap.yaml"
      }
    }
  ]
}