Dataverse - Audit log data deletion

Back


Id	f1634822-b7e9-44f5-95ac-fa4a04f14513
Rulename	Dataverse - Audit log data deletion
Description	Identifies audit log data deletion activity in Dataverse.
Severity	Low
Tactics	DefenseEvasion
Techniques	T1070
Required data connectors	Dataverse
Kind	Scheduled
Query frequency	1h
Query period	14d
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Microsoft Business Applications/Analytic Rules/Dataverse - Audit log data deletion.yaml
Version	3.2.0
Arm template	f1634822-b7e9-44f5-95ac-fa4a04f14513.json

KQL

let query_frequency = 1h;
DataverseActivity
| where TimeGenerated >= ago(query_frequency)
| where Message =~ 'DeleteRecordChangeHistory' or Message =~ 'DeleteAuditData'
| extend CloudAppId = int(32780)
| extend AccountName = tostring(split(UserId, "@")[0])
| extend UPNSuffix = tostring(split(UserId, "@")[1])
| project
    TimeGenerated,
    UserId,
    ClientIp,
    UserAgent,
    Message,
    EntityName,
    InstanceUrl,
    AccountName,
    UPNSuffix,
    CloudAppId

YAML

alertDetailsOverride:
  alertDescriptionFormat: User {{UserId}} deleted audit log data in {{InstanceUrl}}. The message type is  {{Message}}.
  alertDisplayNameFormat: Dataverse - Audit logs deleted in {{InstanceUrl}}
description: Identifies audit log data deletion activity in Dataverse.
kind: Scheduled
tactics:
- DefenseEvasion
requiredDataConnectors:
- connectorId: Dataverse
  dataTypes:
  - DataverseActivity
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Microsoft Business Applications/Analytic Rules/Dataverse - Audit log data deletion.yaml
severity: Low
name: Dataverse - Audit log data deletion
triggerThreshold: 0
queryPeriod: 14d
query: |
  let query_frequency = 1h;
  DataverseActivity
  | where TimeGenerated >= ago(query_frequency)
  | where Message =~ 'DeleteRecordChangeHistory' or Message =~ 'DeleteAuditData'
  | extend CloudAppId = int(32780)
  | extend AccountName = tostring(split(UserId, "@")[0])
  | extend UPNSuffix = tostring(split(UserId, "@")[1])
  | project
      TimeGenerated,
      UserId,
      ClientIp,
      UserAgent,
      Message,
      EntityName,
      InstanceUrl,
      AccountName,
      UPNSuffix,
      CloudAppId  
relevantTechniques:
- T1070
id: f1634822-b7e9-44f5-95ac-fa4a04f14513
queryFrequency: 1h
status: Available
version: 3.2.0
triggerOperator: gt
eventGroupingSettings:
  aggregationKind: SingleAlert
entityMappings:
- entityType: Account
  fieldMappings:
  - columnName: AccountName
    identifier: Name
  - columnName: UPNSuffix
    identifier: UPNSuffix
- entityType: CloudApplication
  fieldMappings:
  - columnName: CloudAppId
    identifier: AppId
  - columnName: InstanceUrl
    identifier: InstanceName
- entityType: IP
  fieldMappings:
  - columnName: ClientIp
    identifier: Address

ARM