Third party integrated apps

SenservaPro_CL
| where ControlName_s == 'AzureSecureScoreIntegratedApps'

severity: High
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/SenservaPro/Analytic Rules/ThirdPartyIntegratedApps.yaml
description: |
  'This query searches for your services by regulating the access of third-party integrated apps. 
   Only allow access to necessary apps that support robust security controls. 
   Third-party applications are not created by Microsoft, 
   so there is a possibility they could be used for malicious purposes like exfiltrating data from your tenancy.
   Attackers can maintain persistent access to your services through these integrated apps, without relying on compromised accounts.'  
triggerOperator: gt
queryPeriod: 6h
requiredDataConnectors:
- dataTypes:
  - SenservaPro_CL
  connectorId: SenservaPro
queryFrequency: 6h
triggerThreshold: 0
tactics:
- Exfiltration
query: |
  SenservaPro_CL
  | where ControlName_s == 'AzureSecureScoreIntegratedApps'  
status: Available
kind: Scheduled
relevantTechniques:
- T1020
version: 1.0.0
id: BFA7EE22-B5A9-42C8-BD50-2E95885640BB
entityMappings:
- fieldMappings:
  - columnName: ControlName_s
    identifier: Name
  - columnName: TenantId
    identifier: AadTenantId
  - columnName: TenantDisplayName_s
    identifier: DisplayName
  entityType: Account
- fieldMappings:
  - columnName: Group_s
    identifier: DistinguishedName
  entityType: SecurityGroup
- fieldMappings:
  - columnName: SourceSystem
    identifier: ResourceId
  entityType: AzureResource
name: Third party integrated apps

{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "workspace": {
      "type": "String"
    }
  },
  "resources": [
    {
      "id": "[concat(resourceId('Microsoft.OperationalInsights/workspaces/providers', parameters('workspace'), 'Microsoft.SecurityInsights'),'/alertRules/BFA7EE22-B5A9-42C8-BD50-2E95885640BB')]",
      "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/BFA7EE22-B5A9-42C8-BD50-2E95885640BB')]",
      "type": "Microsoft.OperationalInsights/workspaces/providers/alertRules",
      "kind": "Scheduled",
      "apiVersion": "2022-11-01-preview",
      "properties": {
        "displayName": "Third party integrated apps",
        "description": "'This query searches for your services by regulating the access of third-party integrated apps. \n Only allow access to necessary apps that support robust security controls. \n Third-party applications are not created by Microsoft, \n so there is a possibility they could be used for malicious purposes like exfiltrating data from your tenancy.\n Attackers can maintain persistent access to your services through these integrated apps, without relying on compromised accounts.'\n",
        "severity": "High",
        "enabled": true,
        "query": "SenservaPro_CL\n| where ControlName_s == 'AzureSecureScoreIntegratedApps'\n",
        "queryFrequency": "PT6H",
        "queryPeriod": "PT6H",
        "triggerOperator": "GreaterThan",
        "triggerThreshold": 0,
        "suppressionDuration": "PT1H",
        "suppressionEnabled": false,
        "tactics": [
          "Exfiltration"
        ],
        "techniques": [
          "T1020"
        ],
        "alertRuleTemplateName": "BFA7EE22-B5A9-42C8-BD50-2E95885640BB",
        "customDetails": null,
        "entityMappings": [
          {
            "entityType": "Account",
            "fieldMappings": [
              {
                "columnName": "ControlName_s",
                "identifier": "Name"
              },
              {
                "columnName": "TenantId",
                "identifier": "AadTenantId"
              },
              {
                "columnName": "TenantDisplayName_s",
                "identifier": "DisplayName"
              }
            ]
          },
          {
            "entityType": "SecurityGroup",
            "fieldMappings": [
              {
                "columnName": "Group_s",
                "identifier": "DistinguishedName"
              }
            ]
          },
          {
            "entityType": "AzureResource",
            "fieldMappings": [
              {
                "columnName": "SourceSystem",
                "identifier": "ResourceId"
              }
            ]
          }
        ],
        "status": "Available",
        "templateVersion": "1.0.0",
        "OriginalUri": "https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/SenservaPro/Analytic Rules/ThirdPartyIntegratedApps.yaml"
      }
    }
  ]
}