Ping Federate - SAML old version

Back


Id	fddd3840-acd2-41ed-94d9-1474b0a7c8a6
Rulename	Ping Federate - SAML old version
Description	Detects requests using not the latest version of SAML protocol.
Severity	Medium
Tactics	InitialAccess
Techniques	T1190
Required data connectors	CefAma
Kind	Scheduled
Query frequency	1d
Query period	1d
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/PingFederate/Analytic Rules/PingFederateSamlOld.yaml
Version	1.0.3
Arm template	fddd3840-acd2-41ed-94d9-1474b0a7c8a6.json

KQL

PingFederateEvent
| where isnotempty(DeviceCustomString3)
| extend proto = extract(@'(SAML)', 1, DeviceCustomString3)
| extend ver = extract(@'(\d+)', 1, DeviceCustomString3)
| where proto =~ 'SAML'
| where ver !~ '20'
| extend AccountCustomEntity = DstUserName
| extend IpCustomEntity = SrcIpAddr

YAML

id: fddd3840-acd2-41ed-94d9-1474b0a7c8a6
triggerOperator: gt
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/PingFederate/Analytic Rules/PingFederateSamlOld.yaml
entityMappings:
- fieldMappings:
  - identifier: Name
    columnName: AccountCustomEntity
  entityType: Account
- fieldMappings:
  - identifier: Address
    columnName: IpCustomEntity
  entityType: IP
requiredDataConnectors:
- dataTypes:
  - CommonSecurityLog
  connectorId: CefAma
queryFrequency: 1d
queryPeriod: 1d
status: Available
query: |
  PingFederateEvent
  | where isnotempty(DeviceCustomString3)
  | extend proto = extract(@'(SAML)', 1, DeviceCustomString3)
  | extend ver = extract(@'(\d+)', 1, DeviceCustomString3)
  | where proto =~ 'SAML'
  | where ver !~ '20'
  | extend AccountCustomEntity = DstUserName
  | extend IpCustomEntity = SrcIpAddr  
name: Ping Federate - SAML old version
kind: Scheduled
tactics:
- InitialAccess
severity: Medium
relevantTechniques:
- T1190
triggerThreshold: 0
version: 1.0.3
description: |
    'Detects requests using not the latest version of SAML protocol.'

ARM