Jira - New site admin user

Back


Id	b894593a-2b4c-4573-bc47-78715224a6f5
Rulename	Jira - New site admin user
Description	Detects new site admin user.
Severity	High
Tactics	Persistence PrivilegeEscalation
Techniques	T1078
Required data connectors	JiraAuditAPI
Kind	Scheduled
Query frequency	1h
Query period	1h
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/AtlassianJiraAudit/Analytic Rules/JiraNewPrivilegedUser.yaml
Version	1.0.1
Arm template	b894593a-2b4c-4573-bc47-78715224a6f5.json

KQL

JiraAudit
| where EventMessage =~ 'User added to group'
| where ObjectItemName =~ 'site-admins'
| extend user = todynamic(AssociatedItems)[0]['name']
| extend AccountCustomEntity = user

YAML

tactics:
- Persistence
- PrivilegeEscalation
relevantTechniques:
- T1078
version: 1.0.1
triggerOperator: gt
name: Jira - New site admin user
id: b894593a-2b4c-4573-bc47-78715224a6f5
description: |
    'Detects new site admin user.'
queryFrequency: 1h
severity: High
status: Available
query: |
  JiraAudit
  | where EventMessage =~ 'User added to group'
  | where ObjectItemName =~ 'site-admins'
  | extend user = todynamic(AssociatedItems)[0]['name']
  | extend AccountCustomEntity = user  
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/AtlassianJiraAudit/Analytic Rules/JiraNewPrivilegedUser.yaml
queryPeriod: 1h
triggerThreshold: 0
kind: Scheduled
entityMappings:
- fieldMappings:
  - identifier: Name
    columnName: AccountCustomEntity
  entityType: Account
requiredDataConnectors:
- dataTypes:
  - JiraAudit
  connectorId: JiraAuditAPI

ARM