ApexOne - Device access permissions was changed

let threshold = 1;
TMApexOneEvent
| where EventMessage has "Device access"
| extend DeviceCustomNumber3 = coalesce(
                                  column_ifexists("FieldDeviceCustomNumber3", long(null)),
                                  DeviceCustomNumber3,
                                  long(null)
                              )
| extend Permission = case(
                            DeviceCustomNumber3 == "0", "Modify", 
                            DeviceCustomNumber3 == "1", "Read and execute",
                            DeviceCustomNumber3 == "2", "Read",
                            DeviceCustomNumber3 == "3", "List device content only", 
                            DeviceCustomNumber3 == "4", "Block",
                            "unknown"
                      )
| summarize Permissions = make_set(Permission) by DstUserName
| extend PermissionCount = array_length(Permissions)
| where PermissionCount > threshold
| extend AccountCustomEntity = DstUserName

queryPeriod: 1h
query: |
  let threshold = 1;
  TMApexOneEvent
  | where EventMessage has "Device access"
  | extend DeviceCustomNumber3 = coalesce(
                                    column_ifexists("FieldDeviceCustomNumber3", long(null)),
                                    DeviceCustomNumber3,
                                    long(null)
                                )
  | extend Permission = case(
                              DeviceCustomNumber3 == "0", "Modify", 
                              DeviceCustomNumber3 == "1", "Read and execute",
                              DeviceCustomNumber3 == "2", "Read",
                              DeviceCustomNumber3 == "3", "List device content only", 
                              DeviceCustomNumber3 == "4", "Block",
                              "unknown"
                        )
  | summarize Permissions = make_set(Permission) by DstUserName
  | extend PermissionCount = array_length(Permissions)
  | where PermissionCount > threshold
  | extend AccountCustomEntity = DstUserName  
name: ApexOne - Device access permissions was changed
entityMappings:
- fieldMappings:
  - columnName: AccountCustomEntity
    identifier: Name
  entityType: Account
queryFrequency: 1h
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Trend Micro Apex One/Analytic Rules/TMApexOneDvcAccessPermissionWasChanged.yaml
requiredDataConnectors:
- connectorId: CefAma
  dataTypes:
  - CommonSecurityLog
description: |
    'Query shows device access permissions was changed.'
kind: Scheduled
version: 1.0.4
status: Available
severity: Medium
relevantTechniques:
- T1078
triggerOperator: gt
triggerThreshold: 0
tactics:
- PrivilegeEscalation
id: b463b952-67b8-11ec-90d6-0242ac120003