OracleDBAudit - Query on Sensitive Table

Back


Id	d7fdcad5-ce96-4db6-9a5e-4a86a5166e5e
Rulename	OracleDBAudit - Query on Sensitive Table
Description	Detects when user queries sensitive tables.
Severity	Medium
Tactics	Collection
Techniques	T1005
Required data connectors	SyslogAma
Kind	Scheduled
Query frequency	30m
Query period	30m
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/OracleDatabaseAudit/Analytic Rules/OracleDBAuditQueryOnSensitiveTable.yaml
Version	1.0.3
Arm template	d7fdcad5-ce96-4db6-9a5e-4a86a5166e5e.json

KQL

let sensitive_tbls = dynamic(['table_name1', 'table_name2']);
OracleDatabaseAuditEvent
| where isnotempty(DstUserName)
| where isnotempty(Action)
| extend TableName = replace(@'[,\(\)]', '', extract(@'(?i)SELECT(.*?)FROM\s(.*?)\s', 2, Action))
| where isnotempty(TableName)
| where TableName in (sensitive_tbls)
| project TableName, DstUserName, DbAction
| extend AccountCustomEntity = DstUserName

YAML

OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/OracleDatabaseAudit/Analytic Rules/OracleDBAuditQueryOnSensitiveTable.yaml
description: |
    'Detects when user queries sensitive tables.'
queryFrequency: 30m
queryPeriod: 30m
triggerOperator: gt
triggerThreshold: 0
requiredDataConnectors:
- datatypes:
  - Syslog
  connectorId: SyslogAma
status: Available
entityMappings:
- entityType: Account
  fieldMappings:
  - columnName: AccountCustomEntity
    identifier: FullName
tactics:
- Collection
relevantTechniques:
- T1005
id: d7fdcad5-ce96-4db6-9a5e-4a86a5166e5e
name: OracleDBAudit - Query on Sensitive Table
query: |
  let sensitive_tbls = dynamic(['table_name1', 'table_name2']);
  OracleDatabaseAuditEvent
  | where isnotempty(DstUserName)
  | where isnotempty(Action)
  | extend TableName = replace(@'[,\(\)]', '', extract(@'(?i)SELECT(.*?)FROM\s(.*?)\s', 2, Action))
  | where isnotempty(TableName)
  | where TableName in (sensitive_tbls)
  | project TableName, DstUserName, DbAction
  | extend AccountCustomEntity = DstUserName  
version: 1.0.3
severity: Medium
kind: Scheduled

ARM