OracleDBAudit - Query on Sensitive Table

Back


Id	d7fdcad5-ce96-4db6-9a5e-4a86a5166e5e
Rulename	OracleDBAudit - Query on Sensitive Table
Description	Detects when user queries sensitive tables.
Severity	Medium
Tactics	Collection
Techniques	T1005
Required data connectors	SyslogAma
Kind	Scheduled
Query frequency	30m
Query period	30m
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/OracleDatabaseAudit/Analytic Rules/OracleDBAuditQueryOnSensitiveTable.yaml
Version	1.0.3
Arm template	d7fdcad5-ce96-4db6-9a5e-4a86a5166e5e.json

KQL

let sensitive_tbls = dynamic(['table_name1', 'table_name2']);
OracleDatabaseAuditEvent
| where isnotempty(DstUserName)
| where isnotempty(Action)
| extend TableName = replace(@'[,\(\)]', '', extract(@'(?i)SELECT(.*?)FROM\s(.*?)\s', 2, Action))
| where isnotempty(TableName)
| where TableName in (sensitive_tbls)
| project TableName, DstUserName, DbAction
| extend AccountCustomEntity = DstUserName

YAML

queryPeriod: 30m
query: |
  let sensitive_tbls = dynamic(['table_name1', 'table_name2']);
  OracleDatabaseAuditEvent
  | where isnotempty(DstUserName)
  | where isnotempty(Action)
  | extend TableName = replace(@'[,\(\)]', '', extract(@'(?i)SELECT(.*?)FROM\s(.*?)\s', 2, Action))
  | where isnotempty(TableName)
  | where TableName in (sensitive_tbls)
  | project TableName, DstUserName, DbAction
  | extend AccountCustomEntity = DstUserName  
name: OracleDBAudit - Query on Sensitive Table
entityMappings:
- fieldMappings:
  - columnName: AccountCustomEntity
    identifier: FullName
  entityType: Account
queryFrequency: 30m
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/OracleDatabaseAudit/Analytic Rules/OracleDBAuditQueryOnSensitiveTable.yaml
requiredDataConnectors:
- connectorId: SyslogAma
  datatypes:
  - Syslog
description: |
    'Detects when user queries sensitive tables.'
kind: Scheduled
version: 1.0.3
status: Available
severity: Medium
relevantTechniques:
- T1005
triggerOperator: gt
triggerThreshold: 0
tactics:
- Collection
id: d7fdcad5-ce96-4db6-9a5e-4a86a5166e5e

ARM