Dataverse - Organization settings modified

Back


Id	a6f6b734-3db8-4259-a988-69e0b8eac0c2
Rulename	Dataverse - Organization settings modified
Description	Identifies changes made at organization level in the Dataverse environment.
Severity	Informational
Tactics	Persistence
Techniques	T1078
Required data connectors	Dataverse
Kind	Scheduled
Query frequency	1h
Query period	14d
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Microsoft Business Applications/Analytic Rules/Dataverse - Organization settings modified.yaml
Version	3.2.0
Arm template	a6f6b734-3db8-4259-a988-69e0b8eac0c2.json

KQL

let query_frequency = 1h;
DataverseActivity
| where TimeGenerated >= ago(query_frequency)
| where Message == "Update" and EntityName == "organization"
| mv-expand Fields
| extend FieldName = tostring(Fields.Name)
| extend Value = tostring(Fields.Value)
| where FieldName != "organizationid"
| lookup MSBizAppsOrgSettings on FieldName
| extend
    CloudAppId = int(32780),
    AccountName = tostring(split(UserId, '@')[0]),
    UPNSuffix = tostring(split(UserId, '@')[1])
| project
    TimeGenerated,
    UserId,
    ClientIp,
    FieldName,
    Value,
    DisplayName,
    Description,
    InstanceUrl,
    CloudAppId,
    AccountName,
    UPNSuffix

YAML

relevantTechniques:
- T1078
name: Dataverse - Organization settings modified
queryPeriod: 14d
triggerThreshold: 0
alertDetailsOverride:
  alertDescriptionFormat: 'Organization setting {{DisplayName}} : {{Description}} changed by {{UserId}}'
  alertDisplayNameFormat: 'Dataverse - {{DisplayName}} changed in {{InstanceUrl}} '
id: a6f6b734-3db8-4259-a988-69e0b8eac0c2
eventGroupingSettings:
  aggregationKind: AlertPerResult
severity: Informational
requiredDataConnectors:
- dataTypes:
  - DataverseActivity
  connectorId: Dataverse
description: Identifies changes made at organization level in the Dataverse environment.
version: 3.2.0
status: Available
entityMappings:
- entityType: Account
  fieldMappings:
  - columnName: AccountName
    identifier: Name
  - columnName: UPNSuffix
    identifier: UPNSuffix
- entityType: IP
  fieldMappings:
  - columnName: ClientIp
    identifier: Address
- entityType: CloudApplication
  fieldMappings:
  - columnName: CloudAppId
    identifier: AppId
  - columnName: InstanceUrl
    identifier: InstanceName
tactics:
- Persistence
query: |
  let query_frequency = 1h;
  DataverseActivity
  | where TimeGenerated >= ago(query_frequency)
  | where Message == "Update" and EntityName == "organization"
  | mv-expand Fields
  | extend FieldName = tostring(Fields.Name)
  | extend Value = tostring(Fields.Value)
  | where FieldName != "organizationid"
  | lookup MSBizAppsOrgSettings on FieldName
  | extend
      CloudAppId = int(32780),
      AccountName = tostring(split(UserId, '@')[0]),
      UPNSuffix = tostring(split(UserId, '@')[1])
  | project
      TimeGenerated,
      UserId,
      ClientIp,
      FieldName,
      Value,
      DisplayName,
      Description,
      InstanceUrl,
      CloudAppId,
      AccountName,
      UPNSuffix  
kind: Scheduled
triggerOperator: gt
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Microsoft Business Applications/Analytic Rules/Dataverse - Organization settings modified.yaml
queryFrequency: 1h

ARM

{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "workspace": {
      "type": "String"
    }
  },
  "resources": [
    {
      "apiVersion": "2024-01-01-preview",
      "id": "[concat(resourceId('Microsoft.OperationalInsights/workspaces/providers', parameters('workspace'), 'Microsoft.SecurityInsights'),'/alertRules/a6f6b734-3db8-4259-a988-69e0b8eac0c2')]",
      "kind": "Scheduled",
      "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/a6f6b734-3db8-4259-a988-69e0b8eac0c2')]",
      "properties": {
        "alertDetailsOverride": {
          "alertDescriptionFormat": "Organization setting {{DisplayName}} : {{Description}} changed by {{UserId}}",
          "alertDisplayNameFormat": "Dataverse - {{DisplayName}} changed in {{InstanceUrl}} "
        },
        "alertRuleTemplateName": "a6f6b734-3db8-4259-a988-69e0b8eac0c2",
        "customDetails": null,
        "description": "Identifies changes made at organization level in the Dataverse environment.",
        "displayName": "Dataverse - Organization settings modified",
        "enabled": true,
        "entityMappings": [
          {
            "entityType": "Account",
            "fieldMappings": [
              {
                "columnName": "AccountName",
                "identifier": "Name"
              },
              {
                "columnName": "UPNSuffix",
                "identifier": "UPNSuffix"
              }
            ]
          },
          {
            "entityType": "IP",
            "fieldMappings": [
              {
                "columnName": "ClientIp",
                "identifier": "Address"
              }
            ]
          },
          {
            "entityType": "CloudApplication",
            "fieldMappings": [
              {
                "columnName": "CloudAppId",
                "identifier": "AppId"
              },
              {
                "columnName": "InstanceUrl",
                "identifier": "InstanceName"
              }
            ]
          }
        ],
        "eventGroupingSettings": {
          "aggregationKind": "AlertPerResult"
        },
        "OriginalUri": "https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Microsoft Business Applications/Analytic Rules/Dataverse - Organization settings modified.yaml",
        "query": "let query_frequency = 1h;\nDataverseActivity\n| where TimeGenerated >= ago(query_frequency)\n| where Message == \"Update\" and EntityName == \"organization\"\n| mv-expand Fields\n| extend FieldName = tostring(Fields.Name)\n| extend Value = tostring(Fields.Value)\n| where FieldName != \"organizationid\"\n| lookup MSBizAppsOrgSettings on FieldName\n| extend\n    CloudAppId = int(32780),\n    AccountName = tostring(split(UserId, '@')[0]),\n    UPNSuffix = tostring(split(UserId, '@')[1])\n| project\n    TimeGenerated,\n    UserId,\n    ClientIp,\n    FieldName,\n    Value,\n    DisplayName,\n    Description,\n    InstanceUrl,\n    CloudAppId,\n    AccountName,\n    UPNSuffix\n",
        "queryFrequency": "PT1H",
        "queryPeriod": "P14D",
        "severity": "Informational",
        "status": "Available",
        "subTechniques": [],
        "suppressionDuration": "PT1H",
        "suppressionEnabled": false,
        "tactics": [
          "Persistence"
        ],
        "techniques": [
          "T1078"
        ],
        "templateVersion": "3.2.0",
        "triggerOperator": "GreaterThan",
        "triggerThreshold": 0
      },
      "type": "Microsoft.OperationalInsights/workspaces/providers/alertRules"
    }
  ]
}