Dataverse - Organization settings modified

Back


Id	a6f6b734-3db8-4259-a988-69e0b8eac0c2
Rulename	Dataverse - Organization settings modified
Description	Identifies changes made at organization level in the Dataverse environment.
Severity	Informational
Tactics	Persistence
Techniques	T1078
Required data connectors	Dataverse
Kind	Scheduled
Query frequency	1h
Query period	14d
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Microsoft Business Applications/Analytic Rules/Dataverse - Organization settings modified.yaml
Version	3.2.0
Arm template	a6f6b734-3db8-4259-a988-69e0b8eac0c2.json

KQL

let query_frequency = 1h;
DataverseActivity
| where TimeGenerated >= ago(query_frequency)
| where Message == "Update" and EntityName == "organization"
| mv-expand Fields
| extend FieldName = tostring(Fields.Name)
| extend Value = tostring(Fields.Value)
| where FieldName != "organizationid"
| lookup MSBizAppsOrgSettings on FieldName
| extend
    CloudAppId = int(32780),
    AccountName = tostring(split(UserId, '@')[0]),
    UPNSuffix = tostring(split(UserId, '@')[1])
| project
    TimeGenerated,
    UserId,
    ClientIp,
    FieldName,
    Value,
    DisplayName,
    Description,
    InstanceUrl,
    CloudAppId,
    AccountName,
    UPNSuffix

YAML

entityMappings:
- entityType: Account
  fieldMappings:
  - identifier: Name
    columnName: AccountName
  - identifier: UPNSuffix
    columnName: UPNSuffix
- entityType: IP
  fieldMappings:
  - identifier: Address
    columnName: ClientIp
- entityType: CloudApplication
  fieldMappings:
  - identifier: AppId
    columnName: CloudAppId
  - identifier: InstanceName
    columnName: InstanceUrl
queryFrequency: 1h
name: Dataverse - Organization settings modified
alertDetailsOverride:
  alertDisplayNameFormat: 'Dataverse - {{DisplayName}} changed in {{InstanceUrl}} '
  alertDescriptionFormat: 'Organization setting {{DisplayName}} : {{Description}} changed by {{UserId}}'
kind: Scheduled
tactics:
- Persistence
triggerThreshold: 0
query: |
  let query_frequency = 1h;
  DataverseActivity
  | where TimeGenerated >= ago(query_frequency)
  | where Message == "Update" and EntityName == "organization"
  | mv-expand Fields
  | extend FieldName = tostring(Fields.Name)
  | extend Value = tostring(Fields.Value)
  | where FieldName != "organizationid"
  | lookup MSBizAppsOrgSettings on FieldName
  | extend
      CloudAppId = int(32780),
      AccountName = tostring(split(UserId, '@')[0]),
      UPNSuffix = tostring(split(UserId, '@')[1])
  | project
      TimeGenerated,
      UserId,
      ClientIp,
      FieldName,
      Value,
      DisplayName,
      Description,
      InstanceUrl,
      CloudAppId,
      AccountName,
      UPNSuffix  
relevantTechniques:
- T1078
triggerOperator: gt
queryPeriod: 14d
eventGroupingSettings:
  aggregationKind: AlertPerResult
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Microsoft Business Applications/Analytic Rules/Dataverse - Organization settings modified.yaml
severity: Informational
status: Available
id: a6f6b734-3db8-4259-a988-69e0b8eac0c2
requiredDataConnectors:
- connectorId: Dataverse
  dataTypes:
  - DataverseActivity
version: 3.2.0
description: Identifies changes made at organization level in the Dataverse environment.

ARM

{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "workspace": {
      "type": "String"
    }
  },
  "resources": [
    {
      "apiVersion": "2024-01-01-preview",
      "id": "[concat(resourceId('Microsoft.OperationalInsights/workspaces/providers', parameters('workspace'), 'Microsoft.SecurityInsights'),'/alertRules/a6f6b734-3db8-4259-a988-69e0b8eac0c2')]",
      "kind": "Scheduled",
      "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/a6f6b734-3db8-4259-a988-69e0b8eac0c2')]",
      "properties": {
        "alertDetailsOverride": {
          "alertDescriptionFormat": "Organization setting {{DisplayName}} : {{Description}} changed by {{UserId}}",
          "alertDisplayNameFormat": "Dataverse - {{DisplayName}} changed in {{InstanceUrl}} "
        },
        "alertRuleTemplateName": "a6f6b734-3db8-4259-a988-69e0b8eac0c2",
        "customDetails": null,
        "description": "Identifies changes made at organization level in the Dataverse environment.",
        "displayName": "Dataverse - Organization settings modified",
        "enabled": true,
        "entityMappings": [
          {
            "entityType": "Account",
            "fieldMappings": [
              {
                "columnName": "AccountName",
                "identifier": "Name"
              },
              {
                "columnName": "UPNSuffix",
                "identifier": "UPNSuffix"
              }
            ]
          },
          {
            "entityType": "IP",
            "fieldMappings": [
              {
                "columnName": "ClientIp",
                "identifier": "Address"
              }
            ]
          },
          {
            "entityType": "CloudApplication",
            "fieldMappings": [
              {
                "columnName": "CloudAppId",
                "identifier": "AppId"
              },
              {
                "columnName": "InstanceUrl",
                "identifier": "InstanceName"
              }
            ]
          }
        ],
        "eventGroupingSettings": {
          "aggregationKind": "AlertPerResult"
        },
        "OriginalUri": "https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Microsoft Business Applications/Analytic Rules/Dataverse - Organization settings modified.yaml",
        "query": "let query_frequency = 1h;\nDataverseActivity\n| where TimeGenerated >= ago(query_frequency)\n| where Message == \"Update\" and EntityName == \"organization\"\n| mv-expand Fields\n| extend FieldName = tostring(Fields.Name)\n| extend Value = tostring(Fields.Value)\n| where FieldName != \"organizationid\"\n| lookup MSBizAppsOrgSettings on FieldName\n| extend\n    CloudAppId = int(32780),\n    AccountName = tostring(split(UserId, '@')[0]),\n    UPNSuffix = tostring(split(UserId, '@')[1])\n| project\n    TimeGenerated,\n    UserId,\n    ClientIp,\n    FieldName,\n    Value,\n    DisplayName,\n    Description,\n    InstanceUrl,\n    CloudAppId,\n    AccountName,\n    UPNSuffix\n",
        "queryFrequency": "PT1H",
        "queryPeriod": "P14D",
        "severity": "Informational",
        "status": "Available",
        "subTechniques": [],
        "suppressionDuration": "PT1H",
        "suppressionEnabled": false,
        "tactics": [
          "Persistence"
        ],
        "techniques": [
          "T1078"
        ],
        "templateVersion": "3.2.0",
        "triggerOperator": "GreaterThan",
        "triggerThreshold": 0
      },
      "type": "Microsoft.OperationalInsights/workspaces/providers/alertRules"
    }
  ]
}