Keeper Security - Password Changed

Back


Id	f031fbbc-37d8-4667-b795-d386bf2b5ab2
Rulename	Keeper Security - Password Changed
Description	Creates an informational incident based on Keeper Security Password Changed data in Microsoft Sentinel
Severity	Informational
Tactics	Persistence
Techniques	T1556
Required data connectors	KeeperSecurityPush2
Kind	NRT
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Keeper Security/Analytic Rules/Keeper Security - Alternate Master Password.yaml
Version	1.0.3
Arm template	f031fbbc-37d8-4667-b795-d386bf2b5ab2.json

KQL

KeeperSecurityEventNewLogs_CL
| where AuditEvent == "change_master_password"

YAML

suppressionEnabled: false
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Keeper Security/Analytic Rules/Keeper Security - Alternate Master Password.yaml
suppressionDuration: PT5H
entityMappings:
- fieldMappings:
  - identifier: FullName
    columnName: Username
  entityType: Account
- fieldMappings:
  - identifier: Address
    columnName: RemoteAddress
  entityType: IP
alertDetailsOverride:
  alertDisplayNameFormat: '{{AuditEvent}} on {{RemoteAddress}}'
  alertDescriptionFormat: '{{AuditEvent}} has been captured in the Keeper Security Event Logs'
requiredDataConnectors:
- dataTypes:
  - KeeperSecurityEventNewLogs_CL
  connectorId: KeeperSecurityPush2
eventGroupingSettings:
  aggregationKind: AlertPerResult
status: Available
incidentConfiguration:
  groupingConfiguration:
    enabled: false
    reopenClosedIncident: false
    matchingMethod: AllEntities
    lookbackDuration: PT5H
  createIncident: true
query: |
  KeeperSecurityEventNewLogs_CL
  | where AuditEvent == "change_master_password"  
name: Keeper Security - Password Changed
kind: NRT
id: f031fbbc-37d8-4667-b795-d386bf2b5ab2
tactics:
- Persistence
severity: Informational
relevantTechniques:
- T1556
version: 1.0.3
description: |
    'Creates an informational incident based on Keeper Security Password Changed data in Microsoft Sentinel'

ARM