{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "workspace": {
      "type": "String"
    }
  },
  "resources": [
    {
      "apiVersion": "2024-01-01-preview",
      "id": "[concat(resourceId('Microsoft.OperationalInsights/workspaces/providers', parameters('workspace'), 'Microsoft.SecurityInsights'),'/alertRules/8a2c6e94-1b5d-4f7a-b3e8-2c9d4f6a1e52')]",
      "kind": "Scheduled",
      "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/8a2c6e94-1b5d-4f7a-b3e8-2c9d4f6a1e52')]",
      "properties": {
        "alertDetailsOverride": {
          "alertDescriptionFormat": "{{ActorName}} performed {{ActivityType}} on {{TargetResourceName}}.",
          "alertDisplayNameFormat": "ContraForce machine credential activity: {{ActivityType}} on {{TargetResourceName}}"
        },
        "alertRuleTemplateName": "8a2c6e94-1b5d-4f7a-b3e8-2c9d4f6a1e52",
        "customDetails": {
          "ActorEmail": "ActorEmail",
          "CfWorkspaceId": "CfWorkspaceId",
          "EventId": "EventId",
          "TargetResourceId": "TargetResourceId"
        },
        "description": "'Identifies service-account and machine-credential lifecycle activity in the ContraForce\nworkspace: service accounts created or deleted, credentials created, regenerated or revoked,\nand API client secret regenerations. Machine credentials grant standing programmatic access,\nso unexpected lifecycle events can indicate persistence being established or an attempt to\nrotate credentials out from under their legitimate owner.'\n",
        "displayName": "ContraForce - Machine credential activity",
        "enabled": true,
        "entityMappings": null,
        "eventGroupingSettings": {
          "aggregationKind": "AlertPerResult"
        },
        "incidentConfiguration": {
          "createIncident": true,
          "groupingConfiguration": {
            "enabled": true,
            "groupByCustomDetails": [
              "EventId"
            ],
            "lookbackDuration": "PT2H",
            "matchingMethod": "Selected",
            "reopenClosedIncident": false
          }
        },
        "OriginalUri": "https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/ContraForce/Analytic%20Rules/ContraForceMachineCredentialActivity.yaml",
        "query": "ContraForceEvents_CL\n| where ingestion_time() > ago(5m)\n| where ActivityType in (\"ServiceAccountCreated\", \"ServiceAccountDeleted\", \"ServiceAccountCredentialCreated\", \"ServiceAccountCredentialRegenerated\", \"ServiceAccountCredentialRevoked\", \"ApiClientSecretRegenerated\")\n| extend Meta = parse_json(Metadata)\n| project TimeGenerated, EventId, CfWorkspaceId, ActivityType, ActivityAction,\n          ActorName, ActorEmail, TargetResourceType, TargetResourceId, TargetResourceName, Metadata\n",
        "queryFrequency": "PT5M",
        "queryPeriod": "P1D",
        "severity": "Medium",
        "status": "Available",
        "subTechniques": [],
        "suppressionDuration": "PT1H",
        "suppressionEnabled": false,
        "tactics": [
          "CredentialAccess",
          "Persistence"
        ],
        "techniques": [
          "T1098",
          "T1136"
        ],
        "templateVersion": "1.0.0",
        "triggerOperator": "GreaterThan",
        "triggerThreshold": 0
      },
      "type": "Microsoft.OperationalInsights/workspaces/providers/alertRules"
    }
  ]
}