Merge branch 'master' of https://github.com/Azure/Azure-Sentinel

Azure · Sep 2, 2023 · f337d42 · f337d42
2 parents 5916db6 + 99069e9
commit f337d42
Show file tree

Hide file tree

Showing 139 changed files with 3,356 additions and 8,588 deletions.
diff --git a/Detections/AuditLogs/AdditionofaTemporaryAccessPasstoaPrivilegedAccount.yaml b/Detections/AuditLogs/AdditionofaTemporaryAccessPasstoaPrivilegedAccount.yaml
@@ -14,6 +14,9 @@ requiredDataConnectors:
   - connectorId: BehaviorAnalytics
     dataTypes:
       - BehaviorAnalytics
+  - connectorId: BehaviorAnalytics
+    dataTypes:
+      - IdentityInfo
 queryFrequency: 1d
 queryPeriod: 1d
 triggerOperator: gt
@@ -39,7 +42,7 @@ entityMappings:
     fieldMappings:
       - identifier: FullName
         columnName: userPrincipalName
-version: 1.0.1
+version: 1.0.2
 kind: Scheduled
 metadata:
     source:

diff --git a/Detections/MultipleDataSources/RunCommandUEBABreach.yaml b/Detections/MultipleDataSources/RunCommandUEBABreach.yaml
@@ -8,6 +8,9 @@ requiredDataConnectors:
   - connectorId: AzureActivity
     dataTypes:
       - AzureActivity
+  - connectorId: BehaviorAnalytics
+    dataTypes:
+      - BehaviorAnalytics
 queryFrequency: 1d
 queryPeriod: 2d
 triggerOperator: gt
@@ -60,7 +63,7 @@ entityMappings:
     fieldMappings:
       - identifier: Address
         columnName: IPCustomEntity
-version: 1.0.7
+version: 1.0.8
 kind: Scheduled
 metadata:
     source:

diff --git a/Detections/SigninLogs/AuthenticationsofPrivilegedAccountsOutsideofExpectedControls.yaml b/Detections/SigninLogs/AuthenticationsofPrivilegedAccountsOutsideofExpectedControls.yaml
@@ -13,6 +13,9 @@ requiredDataConnectors:
   - connectorId: BehaviorAnalytics
     dataTypes:
       - BehaviorAnalytics
+  - connectorId: BehaviorAnalytics
+    dataTypes:
+      - IdentityInfo
 queryFrequency: 1d
 queryPeriod: 7d
 triggerOperator: gt
@@ -53,7 +56,7 @@ entityMappings:
     fieldMappings:
       - identifier: FullName
         columnName: UserPrincipalName
-version: 1.0.1
+version: 1.0.2
 kind: Scheduled
 metadata:
     source:

diff --git a/Detections/SigninLogs/PrivilegedUserLogonfromnewASN.yaml b/Detections/SigninLogs/PrivilegedUserLogonfromnewASN.yaml
@@ -11,6 +11,9 @@ requiredDataConnectors:
   - connectorId: BehaviorAnalytics
     dataTypes:
       - BehaviorAnalytics
+  - connectorId: BehaviorAnalytics
+    dataTypes:
+      - IdentityInfo
 queryFrequency: 1d
 queryPeriod: 7d
 triggerOperator: gt
@@ -46,7 +49,7 @@ entityMappings:
     fieldMappings:
       - identifier: Address
         columnName: IPCustomEntity
-version: 1.0.4
+version: 1.0.5
 kind: Scheduled
 metadata:
     source:

diff --git a/Solutions/AIShield AI Security Monitoring/Parsers/AIShield.txt b/Solutions/AIShield AI Security Monitoring/Parsers/AIShield.txt
diff --git a/Solutions/Alibaba Cloud/Parsers/AliCloud.txt b/Solutions/Alibaba Cloud/Parsers/AliCloud.txt
diff --git a/Solutions/Alsid For AD/Parsers/afad_parser.kql.txt b/Solutions/Alsid For AD/Parsers/afad_parser.kql.txt