OracleDBAudit - Query on Sensitive Table

Back


Id	d7fdcad5-ce96-4db6-9a5e-4a86a5166e5e
Rulename	OracleDBAudit - Query on Sensitive Table
Description	Detects when user queries sensitive tables.
Severity	Medium
Tactics	Collection
Techniques	T1005
Required data connectors	SyslogAma
Kind	Scheduled
Query frequency	30m
Query period	30m
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/OracleDatabaseAudit/Analytic Rules/OracleDBAuditQueryOnSensitiveTable.yaml
Version	1.0.3
Arm template	d7fdcad5-ce96-4db6-9a5e-4a86a5166e5e.json

KQL

let sensitive_tbls = dynamic(['table_name1', 'table_name2']);
OracleDatabaseAuditEvent
| where isnotempty(DstUserName)
| where isnotempty(Action)
| extend TableName = replace(@'[,\(\)]', '', extract(@'(?i)SELECT(.*?)FROM\s(.*?)\s', 2, Action))
| where isnotempty(TableName)
| where TableName in (sensitive_tbls)
| project TableName, DstUserName, DbAction
| extend AccountCustomEntity = DstUserName

YAML

tactics:
- Collection
triggerThreshold: 0
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/OracleDatabaseAudit/Analytic Rules/OracleDBAuditQueryOnSensitiveTable.yaml
description: |
    'Detects when user queries sensitive tables.'
id: d7fdcad5-ce96-4db6-9a5e-4a86a5166e5e
severity: Medium
entityMappings:
- fieldMappings:
  - identifier: FullName
    columnName: AccountCustomEntity
  entityType: Account
status: Available
requiredDataConnectors:
- connectorId: SyslogAma
  datatypes:
  - Syslog
kind: Scheduled
queryFrequency: 30m
name: OracleDBAudit - Query on Sensitive Table
triggerOperator: gt
queryPeriod: 30m
version: 1.0.3
query: |
  let sensitive_tbls = dynamic(['table_name1', 'table_name2']);
  OracleDatabaseAuditEvent
  | where isnotempty(DstUserName)
  | where isnotempty(Action)
  | extend TableName = replace(@'[,\(\)]', '', extract(@'(?i)SELECT(.*?)FROM\s(.*?)\s', 2, Action))
  | where isnotempty(TableName)
  | where TableName in (sensitive_tbls)
  | project TableName, DstUserName, DbAction
  | extend AccountCustomEntity = DstUserName  
relevantTechniques:
- T1005

ARM