Zscaler - ZPA connections from new country

Back


Id	c4902121-7a7e-44d1-810b-88d26db622ff
Rulename	Zscaler - ZPA connections from new country
Description	Detects ZPA connections from new country.
Severity	Medium
Tactics	InitialAccess
Techniques	T1190 T1133
Required data connectors	CustomLogsAma
Kind	Scheduled
Query frequency	1h
Query period	14d
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Zscaler Private Access (ZPA)/Analytic Rules/ZscalerZPAConnectionsFromNewCountry.yaml
Version	1.0.2
Arm template	c4902121-7a7e-44d1-810b-88d26db622ff.json

KQL

let listCountries =
ZPAEvent 
| where TimeGenerated > ago(14d)
| where DvcAction == 'open'
| summarize ListofCountries = make_set(SrcGeoCountry) by DstUserName
| project ListofCountries;
ZPAEvent
| where isnotempty(SrcGeoCountry)
| where SrcGeoCountry !in (listCountries)
| summarize EventCount = count() by DstUserName, SrcGeoCountry
| project-away EventCount
| extend AccountCustomEntity = DstUserName

YAML

queryPeriod: 14d
query: |
  let listCountries =
  ZPAEvent 
  | where TimeGenerated > ago(14d)
  | where DvcAction == 'open'
  | summarize ListofCountries = make_set(SrcGeoCountry) by DstUserName
  | project ListofCountries;
  ZPAEvent
  | where isnotempty(SrcGeoCountry)
  | where SrcGeoCountry !in (listCountries)
  | summarize EventCount = count() by DstUserName, SrcGeoCountry
  | project-away EventCount
  | extend AccountCustomEntity = DstUserName  
name: Zscaler - ZPA connections from new country
entityMappings:
- fieldMappings:
  - columnName: AccountCustomEntity
    identifier: Name
  entityType: Account
queryFrequency: 1h
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Zscaler Private Access (ZPA)/Analytic Rules/ZscalerZPAConnectionsFromNewCountry.yaml
requiredDataConnectors:
- connectorId: CustomLogsAma
  datatypes:
  - ZPA_CL
description: |
    'Detects ZPA connections from new country.'
kind: Scheduled
version: 1.0.2
status: Available
severity: Medium
relevantTechniques:
- T1190
- T1133
triggerOperator: gt
triggerThreshold: 0
tactics:
- InitialAccess
id: c4902121-7a7e-44d1-810b-88d26db622ff

ARM