OracleDBAudit - Query on Sensitive Table

Back


Id	d7fdcad5-ce96-4db6-9a5e-4a86a5166e5e
Rulename	OracleDBAudit - Query on Sensitive Table
Description	Detects when user queries sensitive tables.
Severity	Medium
Tactics	Collection
Techniques	T1005
Required data connectors	SyslogAma
Kind	Scheduled
Query frequency	30m
Query period	30m
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/OracleDatabaseAudit/Analytic Rules/OracleDBAuditQueryOnSensitiveTable.yaml
Version	1.0.3
Arm template	d7fdcad5-ce96-4db6-9a5e-4a86a5166e5e.json

KQL

let sensitive_tbls = dynamic(['table_name1', 'table_name2']);
OracleDatabaseAuditEvent
| where isnotempty(DstUserName)
| where isnotempty(Action)
| extend TableName = replace(@'[,\(\)]', '', extract(@'(?i)SELECT(.*?)FROM\s(.*?)\s', 2, Action))
| where isnotempty(TableName)
| where TableName in (sensitive_tbls)
| project TableName, DstUserName, DbAction
| extend AccountCustomEntity = DstUserName

YAML

triggerOperator: gt
queryFrequency: 30m
requiredDataConnectors:
- connectorId: SyslogAma
  datatypes:
  - Syslog
relevantTechniques:
- T1005
entityMappings:
- entityType: Account
  fieldMappings:
  - identifier: FullName
    columnName: AccountCustomEntity
query: |
  let sensitive_tbls = dynamic(['table_name1', 'table_name2']);
  OracleDatabaseAuditEvent
  | where isnotempty(DstUserName)
  | where isnotempty(Action)
  | extend TableName = replace(@'[,\(\)]', '', extract(@'(?i)SELECT(.*?)FROM\s(.*?)\s', 2, Action))
  | where isnotempty(TableName)
  | where TableName in (sensitive_tbls)
  | project TableName, DstUserName, DbAction
  | extend AccountCustomEntity = DstUserName  
triggerThreshold: 0
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/OracleDatabaseAudit/Analytic Rules/OracleDBAuditQueryOnSensitiveTable.yaml
queryPeriod: 30m
name: OracleDBAudit - Query on Sensitive Table
status: Available
kind: Scheduled
description: |
    'Detects when user queries sensitive tables.'
id: d7fdcad5-ce96-4db6-9a5e-4a86a5166e5e
version: 1.0.3
tactics:
- Collection
severity: Medium

ARM