Microsoft Sentinel Analytic Rules
cloudbrothers.infoAzure Sentinel RepoToggle Dark/Light/Auto modeToggle Dark/Light/Auto modeToggle Dark/Light/Auto modeBack to homepage

Employee account deleted

Back
Id8a2cc466-342d-4ebb-8871-f9e1d83a24a5
RulenameEmployee account deleted
DescriptionThis rule will monitor for any employee accounts being deleted.

Deleting an employee account can have a big potential impact as all of the data for that user will be removed.
SeverityMedium
TacticsImpact
TechniquesT1485
Required data connectorsLastPass
KindScheduled
Query frequency1h
Query period1h
Trigger threshold0
Trigger operatorgt
Source Urihttps://github.com/Azure/Azure-Sentinel/blob/master/Solutions/LastPass/Analytic Rules/EmployeeAccountDeleted.yaml
Version1.0.0
Arm template8a2cc466-342d-4ebb-8871-f9e1d83a24a5.json
Deploy To Azure
LastPassNativePoller_CL
| where Action_s == "Employee Account Deleted" or Action_s == "Remove User From Company"
| extend AccountCustomEntity = Username_s, IPCustomEntity = IP_Address_s
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/LastPass/Analytic Rules/EmployeeAccountDeleted.yaml
query: |
  LastPassNativePoller_CL
  | where Action_s == "Employee Account Deleted" or Action_s == "Remove User From Company"
  | extend AccountCustomEntity = Username_s, IPCustomEntity = IP_Address_s  
description: |
  'This rule will monitor for any employee accounts being deleted.
  Deleting an employee account can have a big potential impact as all of the data for that user will be removed.'  
severity: Medium
requiredDataConnectors:
- dataTypes:
  - LastPassNativePoller_CL
  connectorId: LastPass
eventGroupingSettings:
  aggregationKind: AlertPerResult
name: Employee account deleted
triggerThreshold: 0
tactics:
- Impact
version: 1.0.0
relevantTechniques:
- T1485
triggerOperator: gt
entityMappings:
- entityType: Account
  fieldMappings:
  - columnName: AccountCustomEntity
    identifier: Name
- entityType: IP
  fieldMappings:
  - columnName: IPCustomEntity
    identifier: Address
id: 8a2cc466-342d-4ebb-8871-f9e1d83a24a5
status: Available
kind: Scheduled
queryFrequency: 1h
queryPeriod: 1h
{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "workspace": {
      "type": "String"
    }
  },
  "resources": [
    {
      "apiVersion": "2024-01-01-preview",
      "id": "[concat(resourceId('Microsoft.OperationalInsights/workspaces/providers', parameters('workspace'), 'Microsoft.SecurityInsights'),'/alertRules/8a2cc466-342d-4ebb-8871-f9e1d83a24a5')]",
      "kind": "Scheduled",
      "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/8a2cc466-342d-4ebb-8871-f9e1d83a24a5')]",
      "properties": {
        "alertRuleTemplateName": "8a2cc466-342d-4ebb-8871-f9e1d83a24a5",
        "customDetails": null,
        "description": "'This rule will monitor for any employee accounts being deleted.\nDeleting an employee account can have a big potential impact as all of the data for that user will be removed.'\n",
        "displayName": "Employee account deleted",
        "enabled": true,
        "entityMappings": [
          {
            "entityType": "Account",
            "fieldMappings": [
              {
                "columnName": "AccountCustomEntity",
                "identifier": "Name"
              }
            ]
          },
          {
            "entityType": "IP",
            "fieldMappings": [
              {
                "columnName": "IPCustomEntity",
                "identifier": "Address"
              }
            ]
          }
        ],
        "eventGroupingSettings": {
          "aggregationKind": "AlertPerResult"
        },
        "OriginalUri": "https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/LastPass/Analytic Rules/EmployeeAccountDeleted.yaml",
        "query": "LastPassNativePoller_CL\n| where Action_s == \"Employee Account Deleted\" or Action_s == \"Remove User From Company\"\n| extend AccountCustomEntity = Username_s, IPCustomEntity = IP_Address_s\n",
        "queryFrequency": "PT1H",
        "queryPeriod": "PT1H",
        "severity": "Medium",
        "status": "Available",
        "subTechniques": [],
        "suppressionDuration": "PT1H",
        "suppressionEnabled": false,
        "tactics": [
          "Impact"
        ],
        "techniques": [
          "T1485"
        ],
        "templateVersion": "1.0.0",
        "triggerOperator": "GreaterThan",
        "triggerThreshold": 0
      },
      "type": "Microsoft.OperationalInsights/workspaces/providers/alertRules"
    }
  ]
}