SailPointIdentityNowFailedEvents

Back


Id	c3835197-fd07-447e-a0ac-7540d51a1f64
Rulename	SailPointIdentityNowFailedEvents
Description	Detects all events with status failed.
Severity	High
Tactics	InitialAccess
Techniques	T1133
Required data connectors	SailPointIdentityNow SailPointIdentityNowConnector
Kind	Scheduled
Query frequency	1d
Query period	14d
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/SailPointIdentityNow/Analytic Rules/SailPointIdentityNowFailedEvents.yaml
Version	1.1.0
Arm template	c3835197-fd07-447e-a0ac-7540d51a1f64.json

KQL

declare query_parameters(lbperiod:timespan = 14d);
  SailPointIDN_Events
  | where TimeGenerated > ago(lbperiod) and Status == "FAILED"
  | project TechnicalName, Operation, EventType

YAML

entityMappings:
- entityType: Account
  fieldMappings:
  - identifier: Name
    columnName: TechnicalName
tactics:
- InitialAccess
requiredDataConnectors:
- dataTypes:
  - SailPointIDN_Events
  connectorId: SailPointIdentityNow
- dataTypes:
  - SailPointIDN_Events
  connectorId: SailPointIdentityNowConnector
id: c3835197-fd07-447e-a0ac-7540d51a1f64
severity: High
status: Available
query: |
  declare query_parameters(lbperiod:timespan = 14d);
    SailPointIDN_Events
    | where TimeGenerated > ago(lbperiod) and Status == "FAILED"
    | project TechnicalName, Operation, EventType  
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/SailPointIdentityNow/Analytic Rules/SailPointIdentityNowFailedEvents.yaml
kind: Scheduled
queryPeriod: 14d
version: 1.1.0
name: SailPointIdentityNowFailedEvents
queryFrequency: 1d
triggerThreshold: 0
relevantTechniques:
- T1133
description: |
    'Detects all events with status failed.'
triggerOperator: gt

ARM