{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "workspace": {
      "type": "String"
    }
  },
  "resources": [
    {
      "apiVersion": "2024-01-01-preview",
      "id": "[concat(resourceId('Microsoft.OperationalInsights/workspaces/providers', parameters('workspace'), 'Microsoft.SecurityInsights'),'/alertRules/eea9c640-afe0-4ce4-9a41-c409d4c2c924')]",
      "kind": "Scheduled",
      "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/eea9c640-afe0-4ce4-9a41-c409d4c2c924')]",
      "properties": {
        "alertDetailsOverride": {
          "alertDescriptionFormat": "A Tier Model object Bitlocker Key was stored in AD. This Informational alert is generated as part of reporting.",
          "alertDisplayNameFormat": "(TM010.1) A {{ObjectTier}} Bitlocker Recovery Key was stored in AD"
        },
        "alertRuleTemplateName": "eea9c640-afe0-4ce4-9a41-c409d4c2c924",
        "customDetails": {
          "Account": "Account",
          "ActivityType": "ActivityType",
          "Channel": "Channel",
          "Computer": "Computer",
          "Domain": "Domain",
          "EventData": "EventData",
          "EventID": "EventID",
          "ObjectClass": "ObjectClass",
          "ObjectName": "ObjectName",
          "ObjectTier": "ObjectTier"
        },
        "description": "A Bitlocker recovery key was stored within a Tier Model computer object.\n",
        "displayName": "PROD (TM010.1) - BITLOCKER - Stored Bitlocker Recovery Key to Tier Level Computer Object",
        "enabled": true,
        "entityMappings": [
          {
            "entityType": "Account",
            "fieldMappings": [
              {
                "columnName": "ObjectName",
                "identifier": "FullName"
              }
            ]
          },
          {
            "entityType": "Host",
            "fieldMappings": [
              {
                "columnName": "Computer",
                "identifier": "HostName"
              }
            ]
          },
          {
            "entityType": "Account",
            "fieldMappings": [
              {
                "columnName": "Account",
                "identifier": "FullName"
              }
            ]
          }
        ],
        "eventGroupingSettings": {
          "aggregationKind": "AlertPerResult"
        },
        "incidentConfiguration": {
          "createIncident": true,
          "groupingConfiguration": {
            "enabled": false,
            "lookbackDuration": "PT5H",
            "matchingMethod": "AllEntities",
            "reopenClosedIncident": false
          }
        },
        "OriginalUri": "https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Microsoft%20Active%20Directory%20Tier%20Model/Analytic%20Rules/TM010_BITLOCKERStoredBitlockerRecoveryKeyToTierLevelComputerObject.yaml",
        "query": "SecurityEvent\n| where EventID == 5137\n    and (EventData matches regex @\"(?i)OU=Domain Controllers\"\n        or EventData matches regex @\"(?i)OU=Tier 0 PAW\"\n        or EventData matches regex @\"(?i)OU=Tier 1 PAW\"\n        or EventData matches regex @\"(?i)OU=Tier 2 PAW\"\n        or EventData matches regex @\"(?i)OU=Tier 0 Member Servers\"\n        or EventData matches regex @\"(?i)OU=Tier 1 Member Servers\")\n| extend ObjectClass = extract(\"<Data Name=\\\"ObjectClass\\\">([^<]+)</Data>\", 1, EventData)\n| where ObjectClass has \"msFVE-RecoveryInformation\"\n| extend ObjectBitName_e = extract(\"<Data Name=\\\"ObjectDN\\\">([^<]+)</Data>\", 1, EventData)\n| extend ObjectFullName = extract(\"(?i)(CN=[^,]+,(?i)OU=[^,]+)\", 1, ObjectBitName_e)\n| extend ObjectName = extract(\"(?i)CN=([^,]+)\", 1, ObjectFullName)\n| extend ObjectTier = case(\n    ObjectFullName has \"Tier 0\", \"Tier 0\",\n    ObjectFullName has \"Tier 1\", \"Tier 1\",\n    ObjectFullName has \"Tier Model Administration\", \"Tier 0\",\n    ObjectFullName has \"Tier Model Computer Quarantine\", \"Tier 0\",\n    ObjectFullName has \"Domain Controllers\", \"Tier 0\",\n    \"Unknown\")\n| extend ActivityType = extract(\"([a-zA-Z]+)\\\\.$\", 1, Activity)\n| extend Domain = extract(\"([^.]+\\\\.[^.]+)$\", 1, Computer)\n| project TimeGenerated\n   , ObjectName\n   , ObjectTier\n   , ObjectClass\n   , ActivityType\n   , Account\n   , Domain\n   , Computer\n   , Channel\n   , EventID\n   , EventData\n",
        "queryFrequency": "PT5H",
        "queryPeriod": "PT5H",
        "severity": "Informational",
        "status": "Available",
        "subTechniques": [
          "T1552.004"
        ],
        "suppressionDuration": "PT1H",
        "suppressionEnabled": false,
        "tactics": [
          "CredentialAccess"
        ],
        "techniques": [
          "T1552"
        ],
        "templateVersion": "1.0.0",
        "triggerOperator": "GreaterThan",
        "triggerThreshold": 0
      },
      "type": "Microsoft.OperationalInsights/workspaces/providers/alertRules"
    }
  ]
}