Valimail Enforce - High-Value User Management Event | Microsoft Sentinel Analytic Rules

Back


Id	e960f5b0-cd80-474a-996a-013ff3989772
Rulename	Valimail Enforce - High-Value User Management Event
Description	This query searches for high-severity user management events such as user deletion or deactivation in Valimail Enforce, which may indicate unauthorized access or insider threat.
Severity	High
Tactics	Impact PrivilegeEscalation
Techniques	T1531 T1078
Required data connectors	ValimailEnforce
Kind	Scheduled
Query frequency	1h
Query period	1h
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/ValimailEnforce/Analytic%20Rules/ValimailEnforce_UserManagementHighValue.yaml
Version	1.0.0
Arm template	e960f5b0-cd80-474a-996a-013ff3989772.json

KQL

ValimailEnforceEvents_CL
| where EventCategory == "UserManagement"
| where EventSeverity == "High"
| where IsHighValueEvent == true
| summarize
    EventCount = count(),
    FirstSeen = min(PerformedAt),
    LastSeen = max(PerformedAt),
    AffectedUsers = make_set(Subject),
    Actions = make_set(EventType)
  by User, EventCategory
| extend
    AccountName = tostring(split(User, "@")[0]),
    AccountDomain = tostring(split(User, "@")[1])

YAML

entityMappings:
- entityType: Account
  fieldMappings:
  - columnName: AccountName
    identifier: Name
  - columnName: AccountDomain
    identifier: UPNSuffix
tactics:
- Impact
- PrivilegeEscalation
status: Available
queryPeriod: 1h
queryFrequency: 1h
incidentConfiguration:
  createIncident: true
  groupingConfiguration:
    enabled: true
    matchingMethod: Selected
    reopenClosedIncident: false
    lookbackDuration: 1d
    groupByEntities:
    - Account
requiredDataConnectors:
- connectorId: ValimailEnforce
  dataTypes:
  - ValimailEnforceEvents_CL
severity: High
relevantTechniques:
- T1531
- T1078
name: Valimail Enforce - High-Value User Management Event
kind: Scheduled
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/ValimailEnforce/Analytic%20Rules/ValimailEnforce_UserManagementHighValue.yaml
description: |
  This query searches for high-severity user management events such as user deletion or deactivation
  in Valimail Enforce, which may indicate unauthorized access or insider threat.
triggerOperator: gt
alertDetailsOverride:
  alertDescriptionFormat: |
    User '{{User}}' performed {{EventCount}} high-value user management
    action(s) in Valimail Enforce. Actions: {{Actions}}
  alertDisplayNameFormat: High-value user management action by {{User}}
id: e960f5b0-cd80-474a-996a-013ff3989772
version: 1.0.0
triggerThreshold: 0
query: |
  ValimailEnforceEvents_CL
  | where EventCategory == "UserManagement"
  | where EventSeverity == "High"
  | where IsHighValueEvent == true
  | summarize
      EventCount = count(),
      FirstSeen = min(PerformedAt),
      LastSeen = max(PerformedAt),
      AffectedUsers = make_set(Subject),
      Actions = make_set(EventType)
    by User, EventCategory
  | extend
      AccountName = tostring(split(User, "@")[0]),
      AccountDomain = tostring(split(User, "@")[1])

ARM

{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "workspace": {
      "type": "String"
    }
  },
  "resources": [
    {
      "apiVersion": "2024-01-01-preview",
      "id": "[concat(resourceId('Microsoft.OperationalInsights/workspaces/providers', parameters('workspace'), 'Microsoft.SecurityInsights'),'/alertRules/e960f5b0-cd80-474a-996a-013ff3989772')]",
      "kind": "Scheduled",
      "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/e960f5b0-cd80-474a-996a-013ff3989772')]",
      "properties": {
        "alertDetailsOverride": {
          "alertDescriptionFormat": "User '{{User}}' performed {{EventCount}} high-value user management\naction(s) in Valimail Enforce. Actions: {{Actions}}\n",
          "alertDisplayNameFormat": "High-value user management action by {{User}}"
        },
        "alertRuleTemplateName": "e960f5b0-cd80-474a-996a-013ff3989772",
        "customDetails": null,
        "description": "This query searches for high-severity user management events such as user deletion or deactivation\nin Valimail Enforce, which may indicate unauthorized access or insider threat.\n",
        "displayName": "Valimail Enforce - High-Value User Management Event",
        "enabled": true,
        "entityMappings": [
          {
            "entityType": "Account",
            "fieldMappings": [
              {
                "columnName": "AccountName",
                "identifier": "Name"
              },
              {
                "columnName": "AccountDomain",
                "identifier": "UPNSuffix"
              }
            ]
          }
        ],
        "incidentConfiguration": {
          "createIncident": true,
          "groupingConfiguration": {
            "enabled": true,
            "groupByEntities": [
              "Account"
            ],
            "lookbackDuration": "P1D",
            "matchingMethod": "Selected",
            "reopenClosedIncident": false
          }
        },
        "OriginalUri": "https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/ValimailEnforce/Analytic%20Rules/ValimailEnforce_UserManagementHighValue.yaml",
        "query": "ValimailEnforceEvents_CL\n| where EventCategory == \"UserManagement\"\n| where EventSeverity == \"High\"\n| where IsHighValueEvent == true\n| summarize\n    EventCount = count(),\n    FirstSeen = min(PerformedAt),\n    LastSeen = max(PerformedAt),\n    AffectedUsers = make_set(Subject),\n    Actions = make_set(EventType)\n  by User, EventCategory\n| extend\n    AccountName = tostring(split(User, \"@\")[0]),\n    AccountDomain = tostring(split(User, \"@\")[1])\n",
        "queryFrequency": "PT1H",
        "queryPeriod": "PT1H",
        "severity": "High",
        "status": "Available",
        "subTechniques": [],
        "suppressionDuration": "PT1H",
        "suppressionEnabled": false,
        "tactics": [
          "Impact",
          "PrivilegeEscalation"
        ],
        "techniques": [
          "T1078",
          "T1531"
        ],
        "templateVersion": "1.0.0",
        "triggerOperator": "GreaterThan",
        "triggerThreshold": 0
      },
      "type": "Microsoft.OperationalInsights/workspaces/providers/alertRules"
    }
  ]
}