Dataverse - Audit logging disabled

Back


Id	ea07523b-e6b8-469b-9e25-cdef1ae6fb45
Rulename	Dataverse - Audit logging disabled
Description	Identifies a change in system audit configuration whereby audit logging is turned off.
Severity	Low
Tactics	DefenseEvasion
Techniques	T1562
Required data connectors	Dataverse
Kind	Scheduled
Query frequency	1h
Query period	14d
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Microsoft Business Applications/Analytic Rules/Dataverse - Audit logging disabled.yaml
Version	3.2.1
Arm template	ea07523b-e6b8-469b-9e25-cdef1ae6fb45.json

KQL

let query_frequency = 1h;
let audit_properties = dynamic(['isauditenabled', 'isuseraccessauditenabled','isreadauditenabled']);
DataverseActivity
| where TimeGenerated >= ago(query_frequency)
| where Message in~ ("Update", "UpdateAuditSettings")
| where Fields has_any (audit_properties)
| mv-expand Fields
| extend AuditValue = Fields.Name, AuditEnabled = tobool(Fields.Value)
| where AuditValue in~ (audit_properties) and not (AuditEnabled)
| extend
    CloudAppId = int(32780),
    AccountName = tostring(split(UserId, '@')[0]),
    UPNSuffix = tostring(split(UserId, '@')[1])
| project
    TimeGenerated,
    UserId,
    ClientIp,
    OriginalObjectId,
    AuditValue,
    AuditEnabled,
    InstanceUrl,
    CloudAppId,
    AccountName,
    UPNSuffix

YAML

relevantTechniques:
- T1562
version: 3.2.1
query: |
  let query_frequency = 1h;
  let audit_properties = dynamic(['isauditenabled', 'isuseraccessauditenabled','isreadauditenabled']);
  DataverseActivity
  | where TimeGenerated >= ago(query_frequency)
  | where Message in~ ("Update", "UpdateAuditSettings")
  | where Fields has_any (audit_properties)
  | mv-expand Fields
  | extend AuditValue = Fields.Name, AuditEnabled = tobool(Fields.Value)
  | where AuditValue in~ (audit_properties) and not (AuditEnabled)
  | extend
      CloudAppId = int(32780),
      AccountName = tostring(split(UserId, '@')[0]),
      UPNSuffix = tostring(split(UserId, '@')[1])
  | project
      TimeGenerated,
      UserId,
      ClientIp,
      OriginalObjectId,
      AuditValue,
      AuditEnabled,
      InstanceUrl,
      CloudAppId,
      AccountName,
      UPNSuffix  
triggerThreshold: 0
severity: Low
requiredDataConnectors:
- dataTypes:
  - DataverseActivity
  connectorId: Dataverse
status: Available
queryFrequency: 1h
triggerOperator: gt
kind: Scheduled
eventGroupingSettings:
  aggregationKind: SingleAlert
entityMappings:
- entityType: Account
  fieldMappings:
  - identifier: Name
    columnName: AccountName
  - identifier: UPNSuffix
    columnName: UPNSuffix
- entityType: IP
  fieldMappings:
  - identifier: Address
    columnName: ClientIp
- entityType: CloudApplication
  fieldMappings:
  - identifier: AppId
    columnName: CloudAppId
  - identifier: InstanceName
    columnName: InstanceUrl
alertDetailsOverride:
  alertDescriptionFormat: 'Audit settings changes were detected in {{InstanceUrl}}. {{AuditValue}} enabled: was set to {{AuditEnabled}}.'
  alertDisplayNameFormat: 'Dataverse - Audit logging was disabled in {{InstanceUrl}} '
description: Identifies a change in system audit configuration whereby audit logging is turned off.
tactics:
- DefenseEvasion
name: Dataverse - Audit logging disabled
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Microsoft Business Applications/Analytic Rules/Dataverse - Audit logging disabled.yaml
id: ea07523b-e6b8-469b-9e25-cdef1ae6fb45
queryPeriod: 14d

ARM