Microsoft Sentinel Analytic Rules
cloudbrothers.infoAzure Sentinel RepoToggle Dark/Light/Auto modeToggle Dark/Light/Auto modeToggle Dark/Light/Auto modeBack to homepage

CiscoISE - Attempt to delete local store logs

Back
Idb6549a28-d61c-476e-b350-4404352ee427
RulenameCiscoISE - Attempt to delete local store logs
DescriptionDetects when attempt to delete local store logs failed.
SeverityMedium
TacticsDefenseEvasion
Required data connectorsCiscoISE
KindScheduled
Query frequency5m
Query period5m
Trigger threshold0
Trigger operatorgt
Source Urihttps://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Cisco ISE/Analytic Rules/CiscoISEAttempDeleteLocalStoreLogs.yaml
Version1.0.0
Arm templateb6549a28-d61c-476e-b350-4404352ee427.json
Deploy To Azure
let lbtime = 5m;
CiscoISEEvent
| where TimeGenerated > ago(lbtime)
| where EventId == '59103'
| project TimeGenerated, DvcHostname, DvcIpAddr, DstUserName
| extend HostCustomEntity = DvcHostname
| extend IPCustomEntity = DvcIpAddr
| extend AccountCustomEntity = DstUserName
name: CiscoISE - Attempt to delete local store logs
triggerOperator: gt
status: Available
query: |
  let lbtime = 5m;
  CiscoISEEvent
  | where TimeGenerated > ago(lbtime)
  | where EventId == '59103'
  | project TimeGenerated, DvcHostname, DvcIpAddr, DstUserName
  | extend HostCustomEntity = DvcHostname
  | extend IPCustomEntity = DvcIpAddr
  | extend AccountCustomEntity = DstUserName  
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Cisco ISE/Analytic Rules/CiscoISEAttempDeleteLocalStoreLogs.yaml
description: |
    'Detects when attempt to delete local store logs failed.'
triggerThreshold: 0
id: b6549a28-d61c-476e-b350-4404352ee427
kind: Scheduled
severity: Medium
version: 1.0.0
entityMappings:
- fieldMappings:
  - identifier: FullName
    columnName: AccountCustomEntity
  entityType: Account
- fieldMappings:
  - identifier: Address
    columnName: IPCustomEntity
  entityType: IP
- fieldMappings:
  - identifier: FullName
    columnName: HostCustomEntity
  entityType: Host
queryFrequency: 5m
queryPeriod: 5m
requiredDataConnectors:
- dataTypes:
  - Syslog
  connectorId: CiscoISE
tactics:
- DefenseEvasion
{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "workspace": {
      "type": "String"
    }
  },
  "resources": [
    {
      "apiVersion": "2023-02-01-preview",
      "id": "[concat(resourceId('Microsoft.OperationalInsights/workspaces/providers', parameters('workspace'), 'Microsoft.SecurityInsights'),'/alertRules/b6549a28-d61c-476e-b350-4404352ee427')]",
      "kind": "Scheduled",
      "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/b6549a28-d61c-476e-b350-4404352ee427')]",
      "properties": {
        "alertRuleTemplateName": "b6549a28-d61c-476e-b350-4404352ee427",
        "customDetails": null,
        "description": "'Detects when attempt to delete local store logs failed.'\n",
        "displayName": "CiscoISE - Attempt to delete local store logs",
        "enabled": true,
        "entityMappings": [
          {
            "entityType": "Account",
            "fieldMappings": [
              {
                "columnName": "AccountCustomEntity",
                "identifier": "FullName"
              }
            ]
          },
          {
            "entityType": "IP",
            "fieldMappings": [
              {
                "columnName": "IPCustomEntity",
                "identifier": "Address"
              }
            ]
          },
          {
            "entityType": "Host",
            "fieldMappings": [
              {
                "columnName": "HostCustomEntity",
                "identifier": "FullName"
              }
            ]
          }
        ],
        "OriginalUri": "https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Cisco ISE/Analytic Rules/CiscoISEAttempDeleteLocalStoreLogs.yaml",
        "query": "let lbtime = 5m;\nCiscoISEEvent\n| where TimeGenerated > ago(lbtime)\n| where EventId == '59103'\n| project TimeGenerated, DvcHostname, DvcIpAddr, DstUserName\n| extend HostCustomEntity = DvcHostname\n| extend IPCustomEntity = DvcIpAddr\n| extend AccountCustomEntity = DstUserName\n",
        "queryFrequency": "PT5M",
        "queryPeriod": "PT5M",
        "severity": "Medium",
        "status": "Available",
        "suppressionDuration": "PT1H",
        "suppressionEnabled": false,
        "tactics": [
          "DefenseEvasion"
        ],
        "templateVersion": "1.0.0",
        "triggerOperator": "GreaterThan",
        "triggerThreshold": 0
      },
      "type": "Microsoft.OperationalInsights/workspaces/providers/alertRules"
    }
  ]
}