Dataverse - Organization settings modified

Back


Id	a6f6b734-3db8-4259-a988-69e0b8eac0c2
Rulename	Dataverse - Organization settings modified
Description	Identifies changes made at organization level in the Dataverse environment.
Severity	Informational
Tactics	Persistence
Techniques	T1078
Required data connectors	Dataverse
Kind	Scheduled
Query frequency	1h
Query period	14d
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Microsoft Business Applications/Analytic Rules/Dataverse - Organization settings modified.yaml
Version	3.2.0
Arm template	a6f6b734-3db8-4259-a988-69e0b8eac0c2.json

KQL

let query_frequency = 1h;
DataverseActivity
| where TimeGenerated >= ago(query_frequency)
| where Message == "Update" and EntityName == "organization"
| mv-expand Fields
| extend FieldName = tostring(Fields.Name)
| extend Value = tostring(Fields.Value)
| where FieldName != "organizationid"
| lookup MSBizAppsOrgSettings on FieldName
| extend
    CloudAppId = int(32780),
    AccountName = tostring(split(UserId, '@')[0]),
    UPNSuffix = tostring(split(UserId, '@')[1])
| project
    TimeGenerated,
    UserId,
    ClientIp,
    FieldName,
    Value,
    DisplayName,
    Description,
    InstanceUrl,
    CloudAppId,
    AccountName,
    UPNSuffix

YAML

id: a6f6b734-3db8-4259-a988-69e0b8eac0c2
eventGroupingSettings:
  aggregationKind: AlertPerResult
requiredDataConnectors:
- dataTypes:
  - DataverseActivity
  connectorId: Dataverse
name: Dataverse - Organization settings modified
version: 3.2.0
query: |
  let query_frequency = 1h;
  DataverseActivity
  | where TimeGenerated >= ago(query_frequency)
  | where Message == "Update" and EntityName == "organization"
  | mv-expand Fields
  | extend FieldName = tostring(Fields.Name)
  | extend Value = tostring(Fields.Value)
  | where FieldName != "organizationid"
  | lookup MSBizAppsOrgSettings on FieldName
  | extend
      CloudAppId = int(32780),
      AccountName = tostring(split(UserId, '@')[0]),
      UPNSuffix = tostring(split(UserId, '@')[1])
  | project
      TimeGenerated,
      UserId,
      ClientIp,
      FieldName,
      Value,
      DisplayName,
      Description,
      InstanceUrl,
      CloudAppId,
      AccountName,
      UPNSuffix  
entityMappings:
- fieldMappings:
  - identifier: Name
    columnName: AccountName
  - identifier: UPNSuffix
    columnName: UPNSuffix
  entityType: Account
- fieldMappings:
  - identifier: Address
    columnName: ClientIp
  entityType: IP
- fieldMappings:
  - identifier: AppId
    columnName: CloudAppId
  - identifier: InstanceName
    columnName: InstanceUrl
  entityType: CloudApplication
triggerThreshold: 0
alertDetailsOverride:
  alertDescriptionFormat: 'Organization setting {{DisplayName}} : {{Description}} changed by {{UserId}}'
  alertDisplayNameFormat: 'Dataverse - {{DisplayName}} changed in {{InstanceUrl}} '
relevantTechniques:
- T1078
tactics:
- Persistence
kind: Scheduled
queryPeriod: 14d
queryFrequency: 1h
severity: Informational
triggerOperator: gt
status: Available
description: Identifies changes made at organization level in the Dataverse environment.
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Microsoft Business Applications/Analytic Rules/Dataverse - Organization settings modified.yaml

ARM