CiscoISE - Attempt to delete local store logs

Back


Id	b6549a28-d61c-476e-b350-4404352ee427
Rulename	CiscoISE - Attempt to delete local store logs
Description	Detects when attempt to delete local store logs failed.
Severity	Medium
Tactics	DefenseEvasion
Techniques	T1070
Required data connectors	CiscoISE SyslogAma
Kind	Scheduled
Query frequency	5m
Query period	5m
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Cisco ISE/Analytic Rules/CiscoISEAttempDeleteLocalStoreLogs.yaml
Version	1.0.2
Arm template	b6549a28-d61c-476e-b350-4404352ee427.json

KQL

let lbtime = 5m;
CiscoISEEvent
| where TimeGenerated > ago(lbtime)
| where EventId == '59103'
| project TimeGenerated, DvcHostname, DvcIpAddr, DstUserName
| extend HostCustomEntity = DvcHostname
| extend IPCustomEntity = DvcIpAddr
| extend AccountCustomEntity = DstUserName

YAML

relevantTechniques:
- T1070
name: CiscoISE - Attempt to delete local store logs
requiredDataConnectors:
- dataTypes:
  - Syslog
  connectorId: CiscoISE
- datatypes:
  - Syslog
  connectorId: SyslogAma
entityMappings:
- fieldMappings:
  - identifier: FullName
    columnName: AccountCustomEntity
  entityType: Account
- fieldMappings:
  - identifier: Address
    columnName: IPCustomEntity
  entityType: IP
- fieldMappings:
  - identifier: FullName
    columnName: HostCustomEntity
  entityType: Host
triggerThreshold: 0
id: b6549a28-d61c-476e-b350-4404352ee427
tactics:
- DefenseEvasion
version: 1.0.2
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Cisco ISE/Analytic Rules/CiscoISEAttempDeleteLocalStoreLogs.yaml
queryPeriod: 5m
kind: Scheduled
queryFrequency: 5m
severity: Medium
status: Available
description: |
    'Detects when attempt to delete local store logs failed.'
query: |
  let lbtime = 5m;
  CiscoISEEvent
  | where TimeGenerated > ago(lbtime)
  | where EventId == '59103'
  | project TimeGenerated, DvcHostname, DvcIpAddr, DstUserName
  | extend HostCustomEntity = DvcHostname
  | extend IPCustomEntity = DvcIpAddr
  | extend AccountCustomEntity = DstUserName  
triggerOperator: gt

ARM

{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "workspace": {
      "type": "String"
    }
  },
  "resources": [
    {
      "apiVersion": "2024-01-01-preview",
      "id": "[concat(resourceId('Microsoft.OperationalInsights/workspaces/providers', parameters('workspace'), 'Microsoft.SecurityInsights'),'/alertRules/b6549a28-d61c-476e-b350-4404352ee427')]",
      "kind": "Scheduled",
      "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/b6549a28-d61c-476e-b350-4404352ee427')]",
      "properties": {
        "alertRuleTemplateName": "b6549a28-d61c-476e-b350-4404352ee427",
        "customDetails": null,
        "description": "'Detects when attempt to delete local store logs failed.'\n",
        "displayName": "CiscoISE - Attempt to delete local store logs",
        "enabled": true,
        "entityMappings": [
          {
            "entityType": "Account",
            "fieldMappings": [
              {
                "columnName": "AccountCustomEntity",
                "identifier": "FullName"
              }
            ]
          },
          {
            "entityType": "IP",
            "fieldMappings": [
              {
                "columnName": "IPCustomEntity",
                "identifier": "Address"
              }
            ]
          },
          {
            "entityType": "Host",
            "fieldMappings": [
              {
                "columnName": "HostCustomEntity",
                "identifier": "FullName"
              }
            ]
          }
        ],
        "OriginalUri": "https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Cisco ISE/Analytic Rules/CiscoISEAttempDeleteLocalStoreLogs.yaml",
        "query": "let lbtime = 5m;\nCiscoISEEvent\n| where TimeGenerated > ago(lbtime)\n| where EventId == '59103'\n| project TimeGenerated, DvcHostname, DvcIpAddr, DstUserName\n| extend HostCustomEntity = DvcHostname\n| extend IPCustomEntity = DvcIpAddr\n| extend AccountCustomEntity = DstUserName\n",
        "queryFrequency": "PT5M",
        "queryPeriod": "PT5M",
        "severity": "Medium",
        "status": "Available",
        "subTechniques": [],
        "suppressionDuration": "PT1H",
        "suppressionEnabled": false,
        "tactics": [
          "DefenseEvasion"
        ],
        "techniques": [
          "T1070"
        ],
        "templateVersion": "1.0.2",
        "triggerOperator": "GreaterThan",
        "triggerThreshold": 0
      },
      "type": "Microsoft.OperationalInsights/workspaces/providers/alertRules"
    }
  ]
}