Merge pull request #8908 from Kaloszer/master

add IdentityInfo/BehaviourAnalytics to missing detections
Azure · Sep 1, 2023 · 0945f54 · 0945f54
2 parents 7360c0d + 5683518
commit 0945f54
Show file tree

Hide file tree

Showing 4 changed files with 16 additions and 4 deletions.
diff --git a/Detections/AuditLogs/AdditionofaTemporaryAccessPasstoaPrivilegedAccount.yaml b/Detections/AuditLogs/AdditionofaTemporaryAccessPasstoaPrivilegedAccount.yaml
@@ -14,6 +14,9 @@ requiredDataConnectors:
   - connectorId: BehaviorAnalytics
     dataTypes:
       - BehaviorAnalytics
+  - connectorId: BehaviorAnalytics
+    dataTypes:
+      - IdentityInfo
 queryFrequency: 1d
 queryPeriod: 1d
 triggerOperator: gt
@@ -39,7 +42,7 @@ entityMappings:
     fieldMappings:
       - identifier: FullName
         columnName: userPrincipalName
-version: 1.0.1
+version: 1.0.2
 kind: Scheduled
 metadata:
     source:

diff --git a/Detections/MultipleDataSources/RunCommandUEBABreach.yaml b/Detections/MultipleDataSources/RunCommandUEBABreach.yaml
@@ -8,6 +8,9 @@ requiredDataConnectors:
   - connectorId: AzureActivity
     dataTypes:
       - AzureActivity
+  - connectorId: BehaviorAnalytics
+    dataTypes:
+      - BehaviorAnalytics
 queryFrequency: 1d
 queryPeriod: 2d
 triggerOperator: gt
@@ -60,7 +63,7 @@ entityMappings:
     fieldMappings:
       - identifier: Address
         columnName: IPCustomEntity
-version: 1.0.7
+version: 1.0.8
 kind: Scheduled
 metadata:
     source:

diff --git a/Detections/SigninLogs/AuthenticationsofPrivilegedAccountsOutsideofExpectedControls.yaml b/Detections/SigninLogs/AuthenticationsofPrivilegedAccountsOutsideofExpectedControls.yaml
@@ -13,6 +13,9 @@ requiredDataConnectors:
   - connectorId: BehaviorAnalytics
     dataTypes:
       - BehaviorAnalytics
+  - connectorId: BehaviorAnalytics
+    dataTypes:
+      - IdentityInfo
 queryFrequency: 1d
 queryPeriod: 7d
 triggerOperator: gt
@@ -53,7 +56,7 @@ entityMappings:
     fieldMappings:
       - identifier: FullName
         columnName: UserPrincipalName
-version: 1.0.1
+version: 1.0.2
 kind: Scheduled
 metadata:
     source:

diff --git a/Detections/SigninLogs/PrivilegedUserLogonfromnewASN.yaml b/Detections/SigninLogs/PrivilegedUserLogonfromnewASN.yaml
@@ -11,6 +11,9 @@ requiredDataConnectors:
   - connectorId: BehaviorAnalytics
     dataTypes:
       - BehaviorAnalytics
+  - connectorId: BehaviorAnalytics
+    dataTypes:
+      - IdentityInfo
 queryFrequency: 1d
 queryPeriod: 7d
 triggerOperator: gt
@@ -46,7 +49,7 @@ entityMappings:
     fieldMappings:
       - identifier: Address
         columnName: IPCustomEntity
-version: 1.0.4
+version: 1.0.5
 kind: Scheduled
 metadata:
     source: