CyberArk - Multiple Failed Actions Followed by Success 15m

let window = 15m;
let fails =
    CyberArk_AuditEvents_CL
    | where TimeGenerated > ago(window)
    | where actionType has_any ("Fail","Failed","Denied","Error")
        or message has_any ("fail","failed","denied","unauthorized")
    | summarize Fails=count(), firstFail=min(TimeGenerated), lastFail=max(TimeGenerated) by username, targetAccount;
let success =
    CyberArk_AuditEvents_CL
    | where TimeGenerated > ago(window)
    | where actionType has_any ("Success","Succeeded","Allow","Allowed")
        or message has_any ("success","allowed")
    | summarize Successes=count(), firstSuccess=min(TimeGenerated) by username, targetAccount;
fails
| where Fails >= 3
| join kind=inner success on username, targetAccount
| join kind=inner (
    CyberArk_AuditEvents_CL
    | extend cd = parse_json(customData)
    | extend cd_client_ip = tostring(cd.client_ip_address),
             cd_source_ip = tostring(cd.source_ip_address),
             cd_device_os = tostring(cd.device_os),
             cd_browser = tostring(cd.browser_name),
             cd_geo_city = tostring(cd.geoip_city_name),
             cd_geo_country = tostring(cd.geoip_country_name),
             cd_target = coalesce(tostring(cd.target), tostring(cd.target_resource), tostring(cd.new_target))
    | project username, targetAccount, any_cd_client_ip = cd_client_ip, any_cd_source_ip = cd_source_ip,
              any_cd_device_os = cd_device_os, any_cd_browser = cd_browser,
              any_cd_geo_city = cd_geo_city, any_cd_geo_country = cd_geo_country, any_cd_target = cd_target
  ) on username, targetAccount
| project username, targetAccount, Fails, Successes, firstFail, lastFail, firstSuccess,
          any_cd_source_ip, any_cd_client_ip, any_cd_device_os, any_cd_browser,
          any_cd_geo_city, any_cd_geo_country, any_cd_target

kind: Scheduled
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/CyberArkAudit/Analytics%20Rules/CyberArkAuditMultiFailedAndSuccess.yaml
version: 1.0.0
triggerThreshold: 0
suppressionEnabled: false
tactics:
- CredentialAccess
queryFrequency: 5M
id: bdf3cf98-d64f-4c55-97e4-43483d6d3237
query: |
  let window = 15m;
  let fails =
      CyberArk_AuditEvents_CL
      | where TimeGenerated > ago(window)
      | where actionType has_any ("Fail","Failed","Denied","Error")
          or message has_any ("fail","failed","denied","unauthorized")
      | summarize Fails=count(), firstFail=min(TimeGenerated), lastFail=max(TimeGenerated) by username, targetAccount;
  let success =
      CyberArk_AuditEvents_CL
      | where TimeGenerated > ago(window)
      | where actionType has_any ("Success","Succeeded","Allow","Allowed")
          or message has_any ("success","allowed")
      | summarize Successes=count(), firstSuccess=min(TimeGenerated) by username, targetAccount;
  fails
  | where Fails >= 3
  | join kind=inner success on username, targetAccount
  | join kind=inner (
      CyberArk_AuditEvents_CL
      | extend cd = parse_json(customData)
      | extend cd_client_ip = tostring(cd.client_ip_address),
               cd_source_ip = tostring(cd.source_ip_address),
               cd_device_os = tostring(cd.device_os),
               cd_browser = tostring(cd.browser_name),
               cd_geo_city = tostring(cd.geoip_city_name),
               cd_geo_country = tostring(cd.geoip_country_name),
               cd_target = coalesce(tostring(cd.target), tostring(cd.target_resource), tostring(cd.new_target))
      | project username, targetAccount, any_cd_client_ip = cd_client_ip, any_cd_source_ip = cd_source_ip,
                any_cd_device_os = cd_device_os, any_cd_browser = cd_browser,
                any_cd_geo_city = cd_geo_city, any_cd_geo_country = cd_geo_country, any_cd_target = cd_target
    ) on username, targetAccount
  | project username, targetAccount, Fails, Successes, firstFail, lastFail, firstSuccess,
            any_cd_source_ip, any_cd_client_ip, any_cd_device_os, any_cd_browser,
            any_cd_geo_city, any_cd_geo_country, any_cd_target
triggerOperator: GreaterThan
name: CyberArk - Multiple Failed Actions Followed by Success (15m)
queryPeriod: 15M
severity: Medium
entityMappings:
- fieldMappings:
  - columnName: username
    identifier: FullName
  entityType: Account
- fieldMappings:
  - columnName: targetAccount
    identifier: Name
  entityType: Account
description: |
  Detects 3+ failed actions against an account followed by a success in a short window, indicating brute-force or credential guessing.

{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "workspace": {
      "type": "String"
    }
  },
  "resources": [
    {
      "apiVersion": "2024-01-01-preview",
      "id": "[concat(resourceId('Microsoft.OperationalInsights/workspaces/providers', parameters('workspace'), 'Microsoft.SecurityInsights'),'/alertRules/bdf3cf98-d64f-4c55-97e4-43483d6d3237')]",
      "kind": "Scheduled",
      "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/bdf3cf98-d64f-4c55-97e4-43483d6d3237')]",
      "properties": {
        "alertRuleTemplateName": "bdf3cf98-d64f-4c55-97e4-43483d6d3237",
        "customDetails": null,
        "description": "Detects 3+ failed actions against an account followed by a success in a short window, indicating brute-force or credential guessing.\n",
        "displayName": "CyberArk - Multiple Failed Actions Followed by Success (15m)",
        "enabled": true,
        "entityMappings": [
          {
            "entityType": "Account",
            "fieldMappings": [
              {
                "columnName": "username",
                "identifier": "FullName"
              }
            ]
          },
          {
            "entityType": "Account",
            "fieldMappings": [
              {
                "columnName": "targetAccount",
                "identifier": "Name"
              }
            ]
          }
        ],
        "OriginalUri": "https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/CyberArkAudit/Analytics%20Rules/CyberArkAuditMultiFailedAndSuccess.yaml",
        "query": "let window = 15m;\nlet fails =\n    CyberArk_AuditEvents_CL\n    | where TimeGenerated > ago(window)\n    | where actionType has_any (\"Fail\",\"Failed\",\"Denied\",\"Error\")\n        or message has_any (\"fail\",\"failed\",\"denied\",\"unauthorized\")\n    | summarize Fails=count(), firstFail=min(TimeGenerated), lastFail=max(TimeGenerated) by username, targetAccount;\nlet success =\n    CyberArk_AuditEvents_CL\n    | where TimeGenerated > ago(window)\n    | where actionType has_any (\"Success\",\"Succeeded\",\"Allow\",\"Allowed\")\n        or message has_any (\"success\",\"allowed\")\n    | summarize Successes=count(), firstSuccess=min(TimeGenerated) by username, targetAccount;\nfails\n| where Fails >= 3\n| join kind=inner success on username, targetAccount\n| join kind=inner (\n    CyberArk_AuditEvents_CL\n    | extend cd = parse_json(customData)\n    | extend cd_client_ip = tostring(cd.client_ip_address),\n             cd_source_ip = tostring(cd.source_ip_address),\n             cd_device_os = tostring(cd.device_os),\n             cd_browser = tostring(cd.browser_name),\n             cd_geo_city = tostring(cd.geoip_city_name),\n             cd_geo_country = tostring(cd.geoip_country_name),\n             cd_target = coalesce(tostring(cd.target), tostring(cd.target_resource), tostring(cd.new_target))\n    | project username, targetAccount, any_cd_client_ip = cd_client_ip, any_cd_source_ip = cd_source_ip,\n              any_cd_device_os = cd_device_os, any_cd_browser = cd_browser,\n              any_cd_geo_city = cd_geo_city, any_cd_geo_country = cd_geo_country, any_cd_target = cd_target\n  ) on username, targetAccount\n| project username, targetAccount, Fails, Successes, firstFail, lastFail, firstSuccess,\n          any_cd_source_ip, any_cd_client_ip, any_cd_device_os, any_cd_browser,\n          any_cd_geo_city, any_cd_geo_country, any_cd_target\n",
        "queryFrequency": "PT5M",
        "queryPeriod": "PT15M",
        "severity": "Medium",
        "subTechniques": [],
        "suppressionDuration": "PT1H",
        "suppressionEnabled": false,
        "tactics": [
          "CredentialAccess"
        ],
        "templateVersion": "1.0.0",
        "triggerOperator": "GreaterThan",
        "triggerThreshold": 0
      },
      "type": "Microsoft.OperationalInsights/workspaces/providers/alertRules"
    }
  ]
}