Microsoft Sentinel Analytic Rules
cloudbrothers.infoAzure Sentinel RepoToggle Dark/Light/Auto modeToggle Dark/Light/Auto modeToggle Dark/Light/Auto modeBack to homepage

NordPass - Vault export

Back
Idc7f14b43-7625-4516-b137-30b7fda65bcf
RulenameNordPass - Vault export
DescriptionThis will alert you if the vault has been exported, allowing you to review and evaluate the incident to mitigate potential risks.

NOTE: The organization can control whether it allows its members to export the vault, although we recommend that it always be disabled.
SeverityHigh
TacticsExfiltration
TechniquesT1020
Required data connectorsNordPass
KindScheduled
Query frequency5m
Query period5m
Trigger threshold0
Trigger operatorgt
Source Urihttps://github.com/Azure/Azure-Sentinel/blob/master/Solutions/NordPass/Analytics Rules/nordpass_vault_exported.yaml
Version1.0.0
Arm templatec7f14b43-7625-4516-b137-30b7fda65bcf.json
Deploy To Azure
NordPassEventLogs_CL
| where event_type == "item_access"
| where action == "vault_exported"
| extend TargetEmail = user_email
queryPeriod: 5m
name: NordPass - Vault export
description: |
  This will alert you if the vault has been exported, allowing you to review and evaluate the incident to mitigate potential risks.
  NOTE: The organization can control whether it allows its members to export the vault, although we recommend that it always be disabled.  
displayName: Vault export
requiredDataConnectors:
- dataTypes:
  - NordPassEventLogs_CL
  connectorId: NordPass
kind: Scheduled
id: c7f14b43-7625-4516-b137-30b7fda65bcf
version: 1.0.0
triggerOperator: gt
triggerThreshold: 0
query: |
  NordPassEventLogs_CL
  | where event_type == "item_access"
  | where action == "vault_exported"
  | extend TargetEmail = user_email  
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/NordPass/Analytics Rules/nordpass_vault_exported.yaml
incidentConfiguration:
  createIncident: false
entityMappings:
- fieldMappings:
  - identifier: MailboxPrimaryAddress
    columnName: TargetEmail
  entityType: Mailbox
tactics:
- Exfiltration
relevantTechniques:
- T1020
queryFrequency: 5m
severity: High
{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "workspace": {
      "type": "String"
    }
  },
  "resources": [
    {
      "apiVersion": "2024-01-01-preview",
      "id": "[concat(resourceId('Microsoft.OperationalInsights/workspaces/providers', parameters('workspace'), 'Microsoft.SecurityInsights'),'/alertRules/c7f14b43-7625-4516-b137-30b7fda65bcf')]",
      "kind": "Scheduled",
      "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/c7f14b43-7625-4516-b137-30b7fda65bcf')]",
      "properties": {
        "alertRuleTemplateName": "c7f14b43-7625-4516-b137-30b7fda65bcf",
        "customDetails": null,
        "description": "This will alert you if the vault has been exported, allowing you to review and evaluate the incident to mitigate potential risks.\nNOTE: The organization can control whether it allows its members to export the vault, although we recommend that it always be disabled.\n",
        "displayName": "Vault export",
        "enabled": true,
        "entityMappings": [
          {
            "entityType": "Mailbox",
            "fieldMappings": [
              {
                "columnName": "TargetEmail",
                "identifier": "MailboxPrimaryAddress"
              }
            ]
          }
        ],
        "incidentConfiguration": {
          "createIncident": false
        },
        "OriginalUri": "https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/NordPass/Analytics Rules/nordpass_vault_exported.yaml",
        "query": "NordPassEventLogs_CL\n| where event_type == \"item_access\"\n| where action == \"vault_exported\"\n| extend TargetEmail = user_email\n",
        "queryFrequency": "PT5M",
        "queryPeriod": "PT5M",
        "severity": "High",
        "subTechniques": [],
        "suppressionDuration": "PT1H",
        "suppressionEnabled": false,
        "tactics": [
          "Exfiltration"
        ],
        "techniques": [
          "T1020"
        ],
        "templateVersion": "1.0.0",
        "triggerOperator": "GreaterThan",
        "triggerThreshold": 0
      },
      "type": "Microsoft.OperationalInsights/workspaces/providers/alertRules"
    }
  ]
}