Microsoft Sentinel Analytic Rules
cloudbrothers.infoAzure Sentinel RepoToggle Dark/Light/Auto modeToggle Dark/Light/Auto modeToggle Dark/Light/Auto modeBack to homepage

Azure secure score one admin

Back
IdF539B2A7-D9E7-4438-AA20-893BC61DF130
RulenameAzure secure score one admin
DescriptionThis query searches for having 1 Global Administrator reduces the surface area of attack for your Azure tenant,

but sets up a single point of failure for the whole tenant. Global Administrators have access

to all aspects of Azure
SeverityHigh
TacticsImpact
TechniquesT1529
Required data connectorsSenservaPro
KindScheduled
Query frequency6h
Query period6h
Trigger threshold0
Trigger operatorgt
Source Urihttps://github.com/Azure/Azure-Sentinel/blob/master/Solutions/SenservaPro/Analytic Rules/OneGlobalAdmin.yaml
Version1.0.0
Arm templateF539B2A7-D9E7-4438-AA20-893BC61DF130.json
Deploy To Azure
SenservaPro_CL
| where ControlName_s == 'AzureSecureScoreOneAdmin'
kind: Scheduled
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/SenservaPro/Analytic Rules/OneGlobalAdmin.yaml
severity: High
name: Azure secure score one admin
entityMappings:
- entityType: Account
  fieldMappings:
  - columnName: ControlName_s
    identifier: Name
  - columnName: TenantId
    identifier: AadTenantId
  - columnName: TenantDisplayName_s
    identifier: DisplayName
- entityType: SecurityGroup
  fieldMappings:
  - columnName: Group_s
    identifier: DistinguishedName
- entityType: AzureResource
  fieldMappings:
  - columnName: SourceSystem
    identifier: ResourceId
relevantTechniques:
- T1529
queryFrequency: 6h
triggerThreshold: 0
queryPeriod: 6h
description: |
  'This query searches for having 1 Global Administrator reduces the surface area of attack for your Azure tenant, 
   but sets up a single point of failure for the whole tenant. Global Administrators have access
   to all aspects of Azure'  
id: F539B2A7-D9E7-4438-AA20-893BC61DF130
version: 1.0.0
tactics:
- Impact
query: |
  SenservaPro_CL
  | where ControlName_s == 'AzureSecureScoreOneAdmin'  
status: Available
requiredDataConnectors:
- dataTypes:
  - SenservaPro_CL
  connectorId: SenservaPro
triggerOperator: gt
{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "workspace": {
      "type": "String"
    }
  },
  "resources": [
    {
      "id": "[concat(resourceId('Microsoft.OperationalInsights/workspaces/providers', parameters('workspace'), 'Microsoft.SecurityInsights'),'/alertRules/F539B2A7-D9E7-4438-AA20-893BC61DF130')]",
      "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/F539B2A7-D9E7-4438-AA20-893BC61DF130')]",
      "type": "Microsoft.OperationalInsights/workspaces/providers/alertRules",
      "kind": "Scheduled",
      "apiVersion": "2022-11-01-preview",
      "properties": {
        "displayName": "Azure secure score one admin",
        "description": "'This query searches for having 1 Global Administrator reduces the surface area of attack for your Azure tenant, \n but sets up a single point of failure for the whole tenant. Global Administrators have access\n to all aspects of Azure'\n",
        "severity": "High",
        "enabled": true,
        "query": "SenservaPro_CL\n| where ControlName_s == 'AzureSecureScoreOneAdmin'\n",
        "queryFrequency": "PT6H",
        "queryPeriod": "PT6H",
        "triggerOperator": "GreaterThan",
        "triggerThreshold": 0,
        "suppressionDuration": "PT1H",
        "suppressionEnabled": false,
        "tactics": [
          "Impact"
        ],
        "techniques": [
          "T1529"
        ],
        "alertRuleTemplateName": "F539B2A7-D9E7-4438-AA20-893BC61DF130",
        "customDetails": null,
        "entityMappings": [
          {
            "entityType": "Account",
            "fieldMappings": [
              {
                "identifier": "Name",
                "columnName": "ControlName_s"
              },
              {
                "identifier": "AadTenantId",
                "columnName": "TenantId"
              },
              {
                "identifier": "DisplayName",
                "columnName": "TenantDisplayName_s"
              }
            ]
          },
          {
            "entityType": "SecurityGroup",
            "fieldMappings": [
              {
                "identifier": "DistinguishedName",
                "columnName": "Group_s"
              }
            ]
          },
          {
            "entityType": "AzureResource",
            "fieldMappings": [
              {
                "identifier": "ResourceId",
                "columnName": "SourceSystem"
              }
            ]
          }
        ],
        "OriginalUri": "https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/SenservaPro/Analytic Rules/OneGlobalAdmin.yaml",
        "status": "Available",
        "templateVersion": "1.0.0"
      }
    }
  ]
}