Microsoft Sentinel Analytic Rules
cloudbrothers.infoAzure Sentinel RepoToggle Dark/Light/Auto modeToggle Dark/Light/Auto modeToggle Dark/Light/Auto modeBack to homepage

CiscoISE - ISE administrator password has been reset

Back
Ide63b4d90-d0a8-4609-b187-babfcc7f86d7
RulenameCiscoISE - ISE administrator password has been reset
DescriptionDetects when the ISE administrator password has been reset.
SeverityMedium
TacticsInitialAccess
Persistence
PrivilegeEscalation
DefenseEvasion
Required data connectorsCiscoISE
KindScheduled
Query frequency5m
Query period5m
Trigger threshold0
Trigger operatorgt
Source Urihttps://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Cisco ISE/Analytic Rules/CiscoISEAdminPasswordReset.yaml
Version1.0.0
Arm templatee63b4d90-d0a8-4609-b187-babfcc7f86d7.json
Deploy To Azure
let lbtime = 5m;
CiscoISEEvent
| where TimeGenerated > ago(lbtime)
| where EventId == '58019'
| project TimeGenerated, SrcIpAddr, DstUserName
| extend AccountCustomEntity = DstUserName
| extend IPCustomEntity = SrcIpAddr
kind: Scheduled
triggerOperator: gt
queryFrequency: 5m
name: CiscoISE - ISE administrator password has been reset
status: Available
queryPeriod: 5m
id: e63b4d90-d0a8-4609-b187-babfcc7f86d7
description: |
    'Detects when the ISE administrator password has been reset.'
severity: Medium
query: |
  let lbtime = 5m;
  CiscoISEEvent
  | where TimeGenerated > ago(lbtime)
  | where EventId == '58019'
  | project TimeGenerated, SrcIpAddr, DstUserName
  | extend AccountCustomEntity = DstUserName
  | extend IPCustomEntity = SrcIpAddr  
version: 1.0.0
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Cisco ISE/Analytic Rules/CiscoISEAdminPasswordReset.yaml
entityMappings:
- entityType: Account
  fieldMappings:
  - identifier: FullName
    columnName: AccountCustomEntity
- entityType: IP
  fieldMappings:
  - identifier: Address
    columnName: IPCustomEntity
requiredDataConnectors:
- connectorId: CiscoISE
  dataTypes:
  - Syslog
tactics:
- InitialAccess
- Persistence
- PrivilegeEscalation
- DefenseEvasion
triggerThreshold: 0
{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "workspace": {
      "type": "String"
    }
  },
  "resources": [
    {
      "id": "[concat(resourceId('Microsoft.OperationalInsights/workspaces/providers', parameters('workspace'), 'Microsoft.SecurityInsights'),'/alertRules/e63b4d90-d0a8-4609-b187-babfcc7f86d7')]",
      "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/e63b4d90-d0a8-4609-b187-babfcc7f86d7')]",
      "type": "Microsoft.OperationalInsights/workspaces/providers/alertRules",
      "kind": "Scheduled",
      "apiVersion": "2022-11-01-preview",
      "properties": {
        "displayName": "CiscoISE - ISE administrator password has been reset",
        "description": "'Detects when the ISE administrator password has been reset.'\n",
        "severity": "Medium",
        "enabled": true,
        "query": "let lbtime = 5m;\nCiscoISEEvent\n| where TimeGenerated > ago(lbtime)\n| where EventId == '58019'\n| project TimeGenerated, SrcIpAddr, DstUserName\n| extend AccountCustomEntity = DstUserName\n| extend IPCustomEntity = SrcIpAddr\n",
        "queryFrequency": "PT5M",
        "queryPeriod": "PT5M",
        "triggerOperator": "GreaterThan",
        "triggerThreshold": 0,
        "suppressionDuration": "PT1H",
        "suppressionEnabled": false,
        "tactics": [
          "InitialAccess",
          "Persistence",
          "PrivilegeEscalation",
          "DefenseEvasion"
        ],
        "alertRuleTemplateName": "e63b4d90-d0a8-4609-b187-babfcc7f86d7",
        "customDetails": null,
        "entityMappings": [
          {
            "fieldMappings": [
              {
                "identifier": "FullName",
                "columnName": "AccountCustomEntity"
              }
            ],
            "entityType": "Account"
          },
          {
            "fieldMappings": [
              {
                "identifier": "Address",
                "columnName": "IPCustomEntity"
              }
            ],
            "entityType": "IP"
          }
        ],
        "templateVersion": "1.0.0",
        "OriginalUri": "https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Cisco ISE/Analytic Rules/CiscoISEAdminPasswordReset.yaml",
        "status": "Available"
      }
    }
  ]
}