Keeper Security - Password Changed

Back


Id	f031fbbc-37d8-4667-b795-d386bf2b5ab2
Rulename	Keeper Security - Password Changed
Description	Creates an informational incident based on Keeper Security Password Changed data in Microsoft Sentinel
Severity	Informational
Tactics	Persistence
Techniques	T1556
Required data connectors	KeeperSecurityPush2
Kind	NRT
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Keeper Security/Analytic Rules/Keeper Security - Alternate Master Password.yaml
Version	1.0.3
Arm template	f031fbbc-37d8-4667-b795-d386bf2b5ab2.json

KQL

KeeperSecurityEventNewLogs_CL
| where AuditEvent == "change_master_password"

YAML

entityMappings:
- entityType: Account
  fieldMappings:
  - columnName: Username
    identifier: FullName
- entityType: IP
  fieldMappings:
  - columnName: RemoteAddress
    identifier: Address
version: 1.0.3
id: f031fbbc-37d8-4667-b795-d386bf2b5ab2
suppressionEnabled: false
severity: Informational
kind: NRT
suppressionDuration: PT5H
description: |
    'Creates an informational incident based on Keeper Security Password Changed data in Microsoft Sentinel'
requiredDataConnectors:
- connectorId: KeeperSecurityPush2
  dataTypes:
  - KeeperSecurityEventNewLogs_CL
eventGroupingSettings:
  aggregationKind: AlertPerResult
name: Keeper Security - Password Changed
tactics:
- Persistence
relevantTechniques:
- T1556
alertDetailsOverride:
  alertDescriptionFormat: '{{AuditEvent}} has been captured in the Keeper Security Event Logs'
  alertDisplayNameFormat: '{{AuditEvent}} on {{RemoteAddress}}'
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Keeper Security/Analytic Rules/Keeper Security - Alternate Master Password.yaml
query: |
  KeeperSecurityEventNewLogs_CL
  | where AuditEvent == "change_master_password"  
status: Available
incidentConfiguration:
  createIncident: true
  groupingConfiguration:
    lookbackDuration: PT5H
    enabled: false
    reopenClosedIncident: false
    matchingMethod: AllEntities

ARM