M2131_DataConnectorAddedChangedRemoved

Back


Id	eeb11b6b-e626-4228-b74d-3e730dca8999
Rulename	M2131_DataConnectorAddedChangedRemoved
Description	This alert is designed to monitor data connector configurations. This alert is triggered when a data connector is added, updated, or deleted.
Severity	Medium
Tactics	Discovery
Techniques	T1082
Kind	Scheduled
Query frequency	1d
Query period	14d
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/MaturityModelForEventLogManagementM2131/Analytic Rules/M2131DataConnectorAddedChangedRemoved.yaml
Version	1.0.0
Arm template	eeb11b6b-e626-4228-b74d-3e730dca8999.json

KQL

AzureActivity
| where OperationNameValue contains "Microsoft.SecurityInsights/dataConnectors/"
| where ActivityStatusValue == "Succeeded"
| project OperationNameValue, Caller, CallerIpAddress, ActivityStatusValue, ActivitySubstatusValue, ResourceGroup, Properties, ResourceId, TimeGenerated
| sort by TimeGenerated desc
| extend Account = Caller

YAML

triggerThreshold: 0
entityMappings:
- entityType: AzureResource
  fieldMappings:
  - identifier: ResourceId
    columnName: ResourceId
requiredDataConnectors: []
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/MaturityModelForEventLogManagementM2131/Analytic Rules/M2131DataConnectorAddedChangedRemoved.yaml
name: M2131_DataConnectorAddedChangedRemoved
relevantTechniques:
- T1082
status: Available
version: 1.0.0
queryPeriod: 14d
kind: Scheduled
id: eeb11b6b-e626-4228-b74d-3e730dca8999
query: |
  AzureActivity
  | where OperationNameValue contains "Microsoft.SecurityInsights/dataConnectors/"
  | where ActivityStatusValue == "Succeeded"
  | project OperationNameValue, Caller, CallerIpAddress, ActivityStatusValue, ActivitySubstatusValue, ResourceGroup, Properties, ResourceId, TimeGenerated
  | sort by TimeGenerated desc
  | extend Account = Caller  
description: |
    'This alert is designed to monitor data connector configurations. This alert is triggered when a data connector is added, updated, or deleted.'
queryFrequency: 1d
severity: Medium
triggerOperator: gt
tactics:
- Discovery

ARM