Microsoft Sentinel Analytic Rules
cloudbrothers.infoAzure Sentinel RepoToggle Dark/Light/Auto modeToggle Dark/Light/Auto modeToggle Dark/Light/Auto modeBack to homepage

Zoom E2E Encryption Disabled

Back
Ide4779bdc-397a-4b71-be28-59e6a1e1d16b
RulenameZoom E2E Encryption Disabled
DescriptionThis alerts when end to end encryption is disabled for Zoom meetings.
SeverityMedium
TacticsCredentialAccess
Discovery
TechniquesT1040
KindScheduled
Query frequency1d
Query period1d
Trigger threshold0
Trigger operatorgt
Source Urihttps://github.com/Azure/Azure-Sentinel/blob/master/Detections/ZoomLogs/E2EEDisbaled.yaml
Version1.0.2
Arm templatee4779bdc-397a-4b71-be28-59e6a1e1d16b.json
Deploy To Azure
ZoomLogs
| where Event =~ "account.settings_updated"
| extend NewE2ESetting = columnifexists("payload_object_settings_in_meeting_e2e_encryption_b", "")
| extend OldE2ESetting = columnifexists("payload_old_object_settings_in_meeting_e2e_encryption_b", "")
| where OldE2ESetting =~ 'false' and NewE2ESetting =~ 'true'
| extend timestamp = TimeGenerated, AccountCustomEntity = User
severity: Medium
queryFrequency: 1d
relevantTechniques:
- T1040
tactics:
- CredentialAccess
- Discovery
kind: Scheduled
query: |
  ZoomLogs
  | where Event =~ "account.settings_updated"
  | extend NewE2ESetting = columnifexists("payload_object_settings_in_meeting_e2e_encryption_b", "")
  | extend OldE2ESetting = columnifexists("payload_old_object_settings_in_meeting_e2e_encryption_b", "")
  | where OldE2ESetting =~ 'false' and NewE2ESetting =~ 'true'
  | extend timestamp = TimeGenerated, AccountCustomEntity = User  
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Detections/ZoomLogs/E2EEDisbaled.yaml
queryPeriod: 1d
version: 1.0.2
metadata:
  support:
    tier: Community
  source:
    kind: Community
  categories:
    domains:
    - Security - Others
  author:
    name: Pete Bryan
name: Zoom E2E Encryption Disabled
requiredDataConnectors: []
triggerOperator: gt
entityMappings:
- entityType: Account
  fieldMappings:
  - identifier: FullName
    columnName: AccountCustomEntity
id: e4779bdc-397a-4b71-be28-59e6a1e1d16b
description: |
    'This alerts when end to end encryption is disabled for Zoom meetings.'
triggerThreshold: 0
{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "workspace": {
      "type": "String"
    }
  },
  "resources": [
    {
      "id": "[concat(resourceId('Microsoft.OperationalInsights/workspaces/providers', parameters('workspace'), 'Microsoft.SecurityInsights'),'/alertRules/e4779bdc-397a-4b71-be28-59e6a1e1d16b')]",
      "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/e4779bdc-397a-4b71-be28-59e6a1e1d16b')]",
      "type": "Microsoft.OperationalInsights/workspaces/providers/alertRules",
      "kind": "Scheduled",
      "apiVersion": "2022-11-01-preview",
      "properties": {
        "displayName": "Zoom E2E Encryption Disabled",
        "description": "'This alerts when end to end encryption is disabled for Zoom meetings.'\n",
        "severity": "Medium",
        "enabled": true,
        "query": "ZoomLogs\n| where Event =~ \"account.settings_updated\"\n| extend NewE2ESetting = columnifexists(\"payload_object_settings_in_meeting_e2e_encryption_b\", \"\")\n| extend OldE2ESetting = columnifexists(\"payload_old_object_settings_in_meeting_e2e_encryption_b\", \"\")\n| where OldE2ESetting =~ 'false' and NewE2ESetting =~ 'true'\n| extend timestamp = TimeGenerated, AccountCustomEntity = User\n",
        "queryFrequency": "P1D",
        "queryPeriod": "P1D",
        "triggerOperator": "GreaterThan",
        "triggerThreshold": 0,
        "suppressionDuration": "PT1H",
        "suppressionEnabled": false,
        "tactics": [
          "CredentialAccess",
          "Discovery"
        ],
        "techniques": [
          "T1040"
        ],
        "alertRuleTemplateName": "e4779bdc-397a-4b71-be28-59e6a1e1d16b",
        "customDetails": null,
        "entityMappings": [
          {
            "fieldMappings": [
              {
                "columnName": "AccountCustomEntity",
                "identifier": "FullName"
              }
            ],
            "entityType": "Account"
          }
        ],
        "templateVersion": "1.0.2",
        "OriginalUri": "https://github.com/Azure/Azure-Sentinel/blob/master/Detections/ZoomLogs/E2EEDisbaled.yaml"
      }
    }
  ]
}