SailPointIdentityNowFailedEvents

Back


Id	c3835197-fd07-447e-a0ac-7540d51a1f64
Rulename	SailPointIdentityNowFailedEvents
Description	Detects all events with status failed.
Severity	High
Tactics	InitialAccess
Techniques	T1133
Required data connectors	SailPointIdentityNow SailPointIdentityNowConnector
Kind	Scheduled
Query frequency	1d
Query period	14d
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/SailPointIdentityNow/Analytic Rules/SailPointIdentityNowFailedEvents.yaml
Version	1.1.0
Arm template	c3835197-fd07-447e-a0ac-7540d51a1f64.json

KQL

declare query_parameters(lbperiod:timespan = 14d);
  SailPointIDN_Events
  | where TimeGenerated > ago(lbperiod) and Status == "FAILED"
  | project TechnicalName, Operation, EventType

YAML

status: Available
relevantTechniques:
- T1133
triggerThreshold: 0
severity: High
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/SailPointIdentityNow/Analytic Rules/SailPointIdentityNowFailedEvents.yaml
queryPeriod: 14d
query: |
  declare query_parameters(lbperiod:timespan = 14d);
    SailPointIDN_Events
    | where TimeGenerated > ago(lbperiod) and Status == "FAILED"
    | project TechnicalName, Operation, EventType  
id: c3835197-fd07-447e-a0ac-7540d51a1f64
entityMappings:
- fieldMappings:
  - columnName: TechnicalName
    identifier: Name
  entityType: Account
name: SailPointIdentityNowFailedEvents
kind: Scheduled
description: |
    'Detects all events with status failed.'
tactics:
- InitialAccess
version: 1.1.0
triggerOperator: gt
queryFrequency: 1d
requiredDataConnectors:
- connectorId: SailPointIdentityNow
  dataTypes:
  - SailPointIDN_Events
- connectorId: SailPointIdentityNowConnector
  dataTypes:
  - SailPointIDN_Events

ARM