OracleDBAudit - Query on Sensitive Table

Back


Id	d7fdcad5-ce96-4db6-9a5e-4a86a5166e5e
Rulename	OracleDBAudit - Query on Sensitive Table
Description	Detects when user queries sensitive tables.
Severity	Medium
Tactics	Collection
Techniques	T1005
Required data connectors	SyslogAma
Kind	Scheduled
Query frequency	30m
Query period	30m
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/OracleDatabaseAudit/Analytic Rules/OracleDBAuditQueryOnSensitiveTable.yaml
Version	1.0.3
Arm template	d7fdcad5-ce96-4db6-9a5e-4a86a5166e5e.json

KQL

let sensitive_tbls = dynamic(['table_name1', 'table_name2']);
OracleDatabaseAuditEvent
| where isnotempty(DstUserName)
| where isnotempty(Action)
| extend TableName = replace(@'[,\(\)]', '', extract(@'(?i)SELECT(.*?)FROM\s(.*?)\s', 2, Action))
| where isnotempty(TableName)
| where TableName in (sensitive_tbls)
| project TableName, DstUserName, DbAction
| extend AccountCustomEntity = DstUserName

YAML

relevantTechniques:
- T1005
queryFrequency: 30m
description: |
    'Detects when user queries sensitive tables.'
triggerThreshold: 0
id: d7fdcad5-ce96-4db6-9a5e-4a86a5166e5e
name: OracleDBAudit - Query on Sensitive Table
queryPeriod: 30m
query: |
  let sensitive_tbls = dynamic(['table_name1', 'table_name2']);
  OracleDatabaseAuditEvent
  | where isnotempty(DstUserName)
  | where isnotempty(Action)
  | extend TableName = replace(@'[,\(\)]', '', extract(@'(?i)SELECT(.*?)FROM\s(.*?)\s', 2, Action))
  | where isnotempty(TableName)
  | where TableName in (sensitive_tbls)
  | project TableName, DstUserName, DbAction
  | extend AccountCustomEntity = DstUserName  
severity: Medium
triggerOperator: gt
entityMappings:
- fieldMappings:
  - columnName: AccountCustomEntity
    identifier: FullName
  entityType: Account
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/OracleDatabaseAudit/Analytic Rules/OracleDBAuditQueryOnSensitiveTable.yaml
requiredDataConnectors:
- connectorId: SyslogAma
  datatypes:
  - Syslog
status: Available
version: 1.0.3
tactics:
- Collection
kind: Scheduled

ARM