Microsoft Sentinel Analytic Rules
cloudbrothers.infoAzure Sentinel RepoToggle Dark/Light/Auto modeToggle Dark/Light/Auto modeToggle Dark/Light/Auto modeBack to homepage

Zoom E2E Encryption Disabled

Back
Ide4779bdc-397a-4b71-be28-59e6a1e1d16b
RulenameZoom E2E Encryption Disabled
DescriptionThis alerts when end to end encryption is disabled for Zoom meetings.
SeverityMedium
TacticsCredentialAccess
Discovery
TechniquesT1040
KindScheduled
Query frequency1d
Query period1d
Trigger threshold0
Trigger operatorgt
Source Urihttps://github.com/Azure/Azure-Sentinel/blob/master/Detections/ZoomLogs/E2EEDisbaled.yaml
Version1.0.2
Arm templatee4779bdc-397a-4b71-be28-59e6a1e1d16b.json
Deploy To Azure
ZoomLogs
| where Event =~ "account.settings_updated"
| extend NewE2ESetting = columnifexists("payload_object_settings_in_meeting_e2e_encryption_b", "")
| extend OldE2ESetting = columnifexists("payload_old_object_settings_in_meeting_e2e_encryption_b", "")
| where OldE2ESetting =~ 'false' and NewE2ESetting =~ 'true'
| extend timestamp = TimeGenerated, AccountCustomEntity = User
kind: Scheduled
triggerThreshold: 0
relevantTechniques:
- T1040
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Detections/ZoomLogs/E2EEDisbaled.yaml
requiredDataConnectors: []
queryPeriod: 1d
tactics:
- CredentialAccess
- Discovery
severity: Medium
triggerOperator: gt
description: |
    'This alerts when end to end encryption is disabled for Zoom meetings.'
query: |
  ZoomLogs
  | where Event =~ "account.settings_updated"
  | extend NewE2ESetting = columnifexists("payload_object_settings_in_meeting_e2e_encryption_b", "")
  | extend OldE2ESetting = columnifexists("payload_old_object_settings_in_meeting_e2e_encryption_b", "")
  | where OldE2ESetting =~ 'false' and NewE2ESetting =~ 'true'
  | extend timestamp = TimeGenerated, AccountCustomEntity = User  
name: Zoom E2E Encryption Disabled
version: 1.0.2
metadata:
  support:
    tier: Community
  categories:
    domains:
    - Security - Others
  author:
    name: Pete Bryan
  source:
    kind: Community
id: e4779bdc-397a-4b71-be28-59e6a1e1d16b
queryFrequency: 1d
entityMappings:
- entityType: Account
  fieldMappings:
  - columnName: AccountCustomEntity
    identifier: FullName
{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "workspace": {
      "type": "String"
    }
  },
  "resources": [
    {
      "apiVersion": "2023-02-01-preview",
      "id": "[concat(resourceId('Microsoft.OperationalInsights/workspaces/providers', parameters('workspace'), 'Microsoft.SecurityInsights'),'/alertRules/e4779bdc-397a-4b71-be28-59e6a1e1d16b')]",
      "kind": "Scheduled",
      "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/e4779bdc-397a-4b71-be28-59e6a1e1d16b')]",
      "properties": {
        "alertRuleTemplateName": "e4779bdc-397a-4b71-be28-59e6a1e1d16b",
        "customDetails": null,
        "description": "'This alerts when end to end encryption is disabled for Zoom meetings.'\n",
        "displayName": "Zoom E2E Encryption Disabled",
        "enabled": true,
        "entityMappings": [
          {
            "entityType": "Account",
            "fieldMappings": [
              {
                "columnName": "AccountCustomEntity",
                "identifier": "FullName"
              }
            ]
          }
        ],
        "OriginalUri": "https://github.com/Azure/Azure-Sentinel/blob/master/Detections/ZoomLogs/E2EEDisbaled.yaml",
        "query": "ZoomLogs\n| where Event =~ \"account.settings_updated\"\n| extend NewE2ESetting = columnifexists(\"payload_object_settings_in_meeting_e2e_encryption_b\", \"\")\n| extend OldE2ESetting = columnifexists(\"payload_old_object_settings_in_meeting_e2e_encryption_b\", \"\")\n| where OldE2ESetting =~ 'false' and NewE2ESetting =~ 'true'\n| extend timestamp = TimeGenerated, AccountCustomEntity = User\n",
        "queryFrequency": "P1D",
        "queryPeriod": "P1D",
        "severity": "Medium",
        "suppressionDuration": "PT1H",
        "suppressionEnabled": false,
        "tactics": [
          "CredentialAccess",
          "Discovery"
        ],
        "techniques": [
          "T1040"
        ],
        "templateVersion": "1.0.2",
        "triggerOperator": "GreaterThan",
        "triggerThreshold": 0
      },
      "type": "Microsoft.OperationalInsights/workspaces/providers/alertRules"
    }
  ]
}