SailPointIdentityNowFailedEvents | Microsoft Sentinel Analytic Rules

Back


Id	c3835197-fd07-447e-a0ac-7540d51a1f64
Rulename	SailPointIdentityNowFailedEvents
Description	Detects all events with status failed.
Severity	High
Tactics	InitialAccess
Techniques	T1133
Required data connectors	SailPointIdentityNow SailPointIdentityNowConnector
Kind	Scheduled
Query frequency	1d
Query period	14d
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/SailPointIdentityNow/Analytic%20Rules/SailPointIdentityNowFailedEvents.yaml
Version	1.1.0
Arm template	c3835197-fd07-447e-a0ac-7540d51a1f64.json

KQL

declare query_parameters(lbperiod:timespan = 14d);
  SailPointIDN_Events
  | where TimeGenerated > ago(lbperiod) and Status == "FAILED"
  | project TechnicalName, Operation, EventType

YAML

entityMappings:
- entityType: Account
  fieldMappings:
  - identifier: Name
    columnName: TechnicalName
name: SailPointIdentityNowFailedEvents
kind: Scheduled
triggerOperator: gt
status: Available
queryPeriod: 14d
requiredDataConnectors:
- connectorId: SailPointIdentityNow
  dataTypes:
  - SailPointIDN_Events
- connectorId: SailPointIdentityNowConnector
  dataTypes:
  - SailPointIDN_Events
tactics:
- InitialAccess
query: |
  declare query_parameters(lbperiod:timespan = 14d);
    SailPointIDN_Events
    | where TimeGenerated > ago(lbperiod) and Status == "FAILED"
    | project TechnicalName, Operation, EventType
description: |
  'Detects all events with status failed.'
severity: High
id: c3835197-fd07-447e-a0ac-7540d51a1f64
triggerThreshold: 0
queryFrequency: 1d
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/SailPointIdentityNow/Analytic%20Rules/SailPointIdentityNowFailedEvents.yaml
version: 1.1.0
relevantTechniques:
- T1133

ARM

{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "workspace": {
      "type": "String"
    }
  },
  "resources": [
    {
      "apiVersion": "2024-01-01-preview",
      "id": "[concat(resourceId('Microsoft.OperationalInsights/workspaces/providers', parameters('workspace'), 'Microsoft.SecurityInsights'),'/alertRules/c3835197-fd07-447e-a0ac-7540d51a1f64')]",
      "kind": "Scheduled",
      "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/c3835197-fd07-447e-a0ac-7540d51a1f64')]",
      "properties": {
        "alertRuleTemplateName": "c3835197-fd07-447e-a0ac-7540d51a1f64",
        "customDetails": null,
        "description": "'Detects all events with status failed.'\n",
        "displayName": "SailPointIdentityNowFailedEvents",
        "enabled": true,
        "entityMappings": [
          {
            "entityType": "Account",
            "fieldMappings": [
              {
                "columnName": "TechnicalName",
                "identifier": "Name"
              }
            ]
          }
        ],
        "OriginalUri": "https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/SailPointIdentityNow/Analytic%20Rules/SailPointIdentityNowFailedEvents.yaml",
        "query": "declare query_parameters(lbperiod:timespan = 14d);\n  SailPointIDN_Events\n  | where TimeGenerated > ago(lbperiod) and Status == \"FAILED\"\n  | project TechnicalName, Operation, EventType\n",
        "queryFrequency": "P1D",
        "queryPeriod": "P14D",
        "severity": "High",
        "status": "Available",
        "subTechniques": [],
        "suppressionDuration": "PT1H",
        "suppressionEnabled": false,
        "tactics": [
          "InitialAccess"
        ],
        "techniques": [
          "T1133"
        ],
        "templateVersion": "1.1.0",
        "triggerOperator": "GreaterThan",
        "triggerThreshold": 0
      },
      "type": "Microsoft.OperationalInsights/workspaces/providers/alertRules"
    }
  ]
}