Dataverse - Audit logging disabled

Back


Id	ea07523b-e6b8-469b-9e25-cdef1ae6fb45
Rulename	Dataverse - Audit logging disabled
Description	Identifies a change in system audit configuration whereby audit logging is turned off.
Severity	Low
Tactics	DefenseEvasion
Techniques	T1562
Required data connectors	Dataverse
Kind	Scheduled
Query frequency	1h
Query period	14d
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Microsoft Business Applications/Analytic Rules/Dataverse - Audit logging disabled.yaml
Version	3.2.1
Arm template	ea07523b-e6b8-469b-9e25-cdef1ae6fb45.json

KQL

let query_frequency = 1h;
let audit_properties = dynamic(['isauditenabled', 'isuseraccessauditenabled','isreadauditenabled']);
DataverseActivity
| where TimeGenerated >= ago(query_frequency)
| where Message in~ ("Update", "UpdateAuditSettings")
| where Fields has_any (audit_properties)
| mv-expand Fields
| extend AuditValue = Fields.Name, AuditEnabled = tobool(Fields.Value)
| where AuditValue in~ (audit_properties) and not (AuditEnabled)
| extend
    CloudAppId = int(32780),
    AccountName = tostring(split(UserId, '@')[0]),
    UPNSuffix = tostring(split(UserId, '@')[1])
| project
    TimeGenerated,
    UserId,
    ClientIp,
    OriginalObjectId,
    AuditValue,
    AuditEnabled,
    InstanceUrl,
    CloudAppId,
    AccountName,
    UPNSuffix

YAML

triggerThreshold: 0
description: Identifies a change in system audit configuration whereby audit logging is turned off.
query: |
  let query_frequency = 1h;
  let audit_properties = dynamic(['isauditenabled', 'isuseraccessauditenabled','isreadauditenabled']);
  DataverseActivity
  | where TimeGenerated >= ago(query_frequency)
  | where Message in~ ("Update", "UpdateAuditSettings")
  | where Fields has_any (audit_properties)
  | mv-expand Fields
  | extend AuditValue = Fields.Name, AuditEnabled = tobool(Fields.Value)
  | where AuditValue in~ (audit_properties) and not (AuditEnabled)
  | extend
      CloudAppId = int(32780),
      AccountName = tostring(split(UserId, '@')[0]),
      UPNSuffix = tostring(split(UserId, '@')[1])
  | project
      TimeGenerated,
      UserId,
      ClientIp,
      OriginalObjectId,
      AuditValue,
      AuditEnabled,
      InstanceUrl,
      CloudAppId,
      AccountName,
      UPNSuffix  
relevantTechniques:
- T1562
triggerOperator: gt
entityMappings:
- entityType: Account
  fieldMappings:
  - identifier: Name
    columnName: AccountName
  - identifier: UPNSuffix
    columnName: UPNSuffix
- entityType: IP
  fieldMappings:
  - identifier: Address
    columnName: ClientIp
- entityType: CloudApplication
  fieldMappings:
  - identifier: AppId
    columnName: CloudAppId
  - identifier: InstanceName
    columnName: InstanceUrl
name: Dataverse - Audit logging disabled
version: 3.2.1
severity: Low
eventGroupingSettings:
  aggregationKind: SingleAlert
requiredDataConnectors:
- connectorId: Dataverse
  dataTypes:
  - DataverseActivity
queryPeriod: 14d
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Microsoft Business Applications/Analytic Rules/Dataverse - Audit logging disabled.yaml
kind: Scheduled
alertDetailsOverride:
  alertDisplayNameFormat: 'Dataverse - Audit logging was disabled in {{InstanceUrl}} '
  alertDescriptionFormat: 'Audit settings changes were detected in {{InstanceUrl}}. {{AuditValue}} enabled: was set to {{AuditEnabled}}.'
queryFrequency: 1h
tactics:
- DefenseEvasion
status: Available
id: ea07523b-e6b8-469b-9e25-cdef1ae6fb45

ARM