add IdentityInfo/BehaviourAnalytics to missing detections

Azure · Aug 30, 2023 · 3e8b65b · 3e8b65b
1 parent 858f865
commit 3e8b65b
Show file tree

Hide file tree

Showing 4 changed files with 12 additions and 0 deletions.
diff --git a/Detections/AuditLogs/AdditionofaTemporaryAccessPasstoaPrivilegedAccount.yaml b/Detections/AuditLogs/AdditionofaTemporaryAccessPasstoaPrivilegedAccount.yaml
@@ -14,6 +14,9 @@ requiredDataConnectors:
   - connectorId: BehaviorAnalytics
     dataTypes:
       - BehaviorAnalytics
+  - connectorId: BehaviorAnalytics
+    dataTypes:
+      - IdentityInfo
 queryFrequency: 1d
 queryPeriod: 1d
 triggerOperator: gt

diff --git a/Detections/MultipleDataSources/RunCommandUEBABreach.yaml b/Detections/MultipleDataSources/RunCommandUEBABreach.yaml
@@ -8,6 +8,9 @@ requiredDataConnectors:
   - connectorId: AzureActivity
     dataTypes:
       - AzureActivity
+  - connectorId: BehaviorAnalytics
+    dataTypes:
+      - BehaviorAnalytics
 queryFrequency: 1d
 queryPeriod: 2d
 triggerOperator: gt

diff --git a/Detections/SigninLogs/AuthenticationsofPrivilegedAccountsOutsideofExpectedControls.yaml b/Detections/SigninLogs/AuthenticationsofPrivilegedAccountsOutsideofExpectedControls.yaml
@@ -13,6 +13,9 @@ requiredDataConnectors:
   - connectorId: BehaviorAnalytics
     dataTypes:
       - BehaviorAnalytics
+  - connectorId: BehaviorAnalytics
+    dataTypes:
+      - IdentityInfo
 queryFrequency: 1d
 queryPeriod: 7d
 triggerOperator: gt

diff --git a/Detections/SigninLogs/PrivilegedUserLogonfromnewASN.yaml b/Detections/SigninLogs/PrivilegedUserLogonfromnewASN.yaml
@@ -11,6 +11,9 @@ requiredDataConnectors:
   - connectorId: BehaviorAnalytics
     dataTypes:
       - BehaviorAnalytics
+  - connectorId: BehaviorAnalytics
+    dataTypes:
+      - IdentityInfo
 queryFrequency: 1d
 queryPeriod: 7d
 triggerOperator: gt