1Password - Log Ingestion Failure

Back


Id	bf9132c7-9d4d-4244-98c7-7d994703c208
Rulename	1Password - Log Ingestion Failure
Description	This will alert when the log ingestion for the OnePasswordEventLogs_CL logs is failing. The alert is based on the healthevents that are created every 5 minutes and will trigger if no logs have been received for 1 hour. Log ingestion troubleshooting: <insert URL> Ref: https://1password.com/ Ref: https://github.com/securehats/
Severity	Medium
Tactics	DefenseEvasion
Techniques	T1562
Required data connectors	1Password
Kind	Scheduled
Query frequency	1h
Query period	1h
Trigger threshold	0
Trigger operator	Equal
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/1Password/Analytics Rules/1Password - Log Ingestion Failure.yaml
Version	1.0.0
Arm template	bf9132c7-9d4d-4244-98c7-7d994703c208.json

KQL

OnePasswordEventLogs_CL
| where log_source == "healthevents"

YAML

suppressionEnabled: false
relevantTechniques:
- T1562
incidentConfiguration:
  groupingConfiguration:
    reopenClosedIncident: false
    matchingMethod: AllEntities
    enabled: false
    lookbackDuration: 5h
  createIncident: true
version: 1.0.0
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/1Password/Analytics Rules/1Password - Log Ingestion Failure.yaml
suppressionDuration: 5h
id: bf9132c7-9d4d-4244-98c7-7d994703c208
description: |-
  This will alert when the log ingestion for the OnePasswordEventLogs_CL logs is failing. The alert is based on the healthevents that are created every 5 minutes and will trigger if no logs have been received for 1 hour.

  Log ingestion troubleshooting:
  <insert URL>

  Ref: https://1password.com/
  Ref: https://github.com/securehats/  
requiredDataConnectors:
- connectorId: 1Password
  dataTypes:
  - OnePasswordEventLogs_CL
triggerThreshold: 0
subTechniques:
- T1562.008
eventGroupingSettings:
  aggregationKind: SingleAlert
triggerOperator: Equal
queryFrequency: 1h
query: |-
  OnePasswordEventLogs_CL
  | where log_source == "healthevents"  
severity: Medium
queryPeriod: 1h
name: 1Password - Log Ingestion Failure
tactics:
- DefenseEvasion
kind: Scheduled

ARM