M2131_DataConnectorAddedChangedRemoved

Back


Id	eeb11b6b-e626-4228-b74d-3e730dca8999
Rulename	M2131_DataConnectorAddedChangedRemoved
Description	This alert is designed to monitor data connector configurations. This alert is triggered when a data connector is added, updated, or deleted.
Severity	Medium
Tactics	Discovery
Techniques	T1082
Kind	Scheduled
Query frequency	1d
Query period	14d
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/MaturityModelForEventLogManagementM2131/Analytic Rules/M2131DataConnectorAddedChangedRemoved.yaml
Version	1.0.0
Arm template	eeb11b6b-e626-4228-b74d-3e730dca8999.json

KQL

AzureActivity
| where OperationNameValue contains "Microsoft.SecurityInsights/dataConnectors/"
| where ActivityStatusValue == "Succeeded"
| project OperationNameValue, Caller, CallerIpAddress, ActivityStatusValue, ActivitySubstatusValue, ResourceGroup, Properties, ResourceId, TimeGenerated
| sort by TimeGenerated desc
| extend Account = Caller

YAML

queryPeriod: 14d
query: |
  AzureActivity
  | where OperationNameValue contains "Microsoft.SecurityInsights/dataConnectors/"
  | where ActivityStatusValue == "Succeeded"
  | project OperationNameValue, Caller, CallerIpAddress, ActivityStatusValue, ActivitySubstatusValue, ResourceGroup, Properties, ResourceId, TimeGenerated
  | sort by TimeGenerated desc
  | extend Account = Caller  
name: M2131_DataConnectorAddedChangedRemoved
entityMappings:
- fieldMappings:
  - columnName: ResourceId
    identifier: ResourceId
  entityType: AzureResource
queryFrequency: 1d
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/MaturityModelForEventLogManagementM2131/Analytic Rules/M2131DataConnectorAddedChangedRemoved.yaml
requiredDataConnectors: []
description: |
    'This alert is designed to monitor data connector configurations. This alert is triggered when a data connector is added, updated, or deleted.'
kind: Scheduled
version: 1.0.0
status: Available
severity: Medium
relevantTechniques:
- T1082
triggerOperator: gt
triggerThreshold: 0
tactics:
- Discovery
id: eeb11b6b-e626-4228-b74d-3e730dca8999

ARM