1Password - Log Ingestion Failure

Back


Id	bf9132c7-9d4d-4244-98c7-7d994703c208
Rulename	1Password - Log Ingestion Failure
Description	This will alert when the log ingestion for the OnePasswordEventLogs_CL logs is failing. The alert is based on the healthevents that are created every 5 minutes and will trigger if no logs have been received for 1 hour. Log ingestion troubleshooting: <insert URL> Ref: https://1password.com/ Ref: https://github.com/securehats/
Severity	Medium
Tactics	DefenseEvasion
Techniques	T1562
Required data connectors	1Password
Kind	Scheduled
Query frequency	1h
Query period	1h
Trigger threshold	0
Trigger operator	Equal
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/1Password/Analytics Rules/1Password - Log Ingestion Failure.yaml
Version	1.0.0
Arm template	bf9132c7-9d4d-4244-98c7-7d994703c208.json

KQL

OnePasswordEventLogs_CL
| where log_source == "healthevents"

YAML

suppressionEnabled: false
description: |-
  This will alert when the log ingestion for the OnePasswordEventLogs_CL logs is failing. The alert is based on the healthevents that are created every 5 minutes and will trigger if no logs have been received for 1 hour.

  Log ingestion troubleshooting:
  <insert URL>

  Ref: https://1password.com/
  Ref: https://github.com/securehats/  
kind: Scheduled
tactics:
- DefenseEvasion
requiredDataConnectors:
- connectorId: 1Password
  dataTypes:
  - OnePasswordEventLogs_CL
incidentConfiguration:
  groupingConfiguration:
    reopenClosedIncident: false
    lookbackDuration: 5h
    enabled: false
    matchingMethod: AllEntities
  createIncident: true
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/1Password/Analytics Rules/1Password - Log Ingestion Failure.yaml
severity: Medium
name: 1Password - Log Ingestion Failure
suppressionDuration: 5h
eventGroupingSettings:
  aggregationKind: SingleAlert
triggerThreshold: 0
queryPeriod: 1h
query: |-
  OnePasswordEventLogs_CL
  | where log_source == "healthevents"  
relevantTechniques:
- T1562
id: bf9132c7-9d4d-4244-98c7-7d994703c208
queryFrequency: 1h
triggerOperator: Equal
version: 1.0.0
subTechniques:
- T1562.008

ARM