1Password - Changes to SSO configuration

Severity: medium
Time window: 5m
Source: github.com/Azure/Azure-Sentinel

This will alert when changes have been made to the SSO configuration. Once this analytics rule is triggered it will group all related future alerts for upto an hour when all related entities are the same. Ref: https://1password.com/ Ref: https://github.com/securehats/

MITRE ATT&CK coverage

Tactic	Techniques
Persistence	`T1556` Modify Authentication Process

Telemetry coverage

Platform	Record / event type
1Password	any: SSO (catch-all)

Rule body

id: 9406f5ab-1197-4db9-8042-9f3345be061c
name: 1Password - Changes to SSO configuration
version: 1.0.1
kind: Scheduled
description: |-
  This will alert when changes have been made to the SSO configuration. Once this analytics rule is triggered it will group all related future alerts for upto an hour when all related entities are the same.

  Ref: https://1password.com/
  Ref: https://github.com/securehats/
severity: Medium
requiredDataConnectors:
  - connectorId: 1Password
    dataTypes:
      - OnePasswordEventLogs_CL
queryFrequency: 5m
queryPeriod: 5m
triggerOperator: gt
triggerThreshold: 0
tactics:
- Persistence
relevantTechniques:
- T1556
query: |-
  OnePasswordEventLogs_CL
  | where log_source == "auditevents"
  | where action has_any("enblsso", "disblsso", "chngpsso", "chngasso", "chngdsso", "addgsso", "delgsso")
  | where object_type == "sso"
  | extend
      ActorUsername = actor_details.email
      , SrcIpAddr = session.ip
suppressionEnabled: false
incidentConfiguration:
  createIncident: true
  groupingConfiguration:
    enabled: true
    reopenClosedIncident: false
    lookbackDuration: 1h
    matchingMethod: AllEntities
suppressionDuration: 5h
alertDetailsOverride:
  alertDynamicProperties: []
eventGroupingSettings:
  aggregationKind: SingleAlert
entityMappings:
- entityType: Account
  fieldMappings:
  - identifier: FullName
    columnName: ActorUsername
- entityType: IP
  fieldMappings:
  - identifier: Address
    columnName: SrcIpAddr

Stages and Predicates

Stage 1: `source`

OnePasswordEventLogs_CL

Stage 2: `where`

| where log_source == "auditevents"

Stage 3: `where`

| where action has_any("enblsso", "disblsso", "chngpsso", "chngasso", "chngdsso", "addgsso", "delgsso")

Stage 4: `where`

| where object_type == "sso"

Stage 5: `extend`

| extend
    ActorUsername = actor_details.email
    , SrcIpAddr = session.ip

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`action`	match	`addgsso` transforms: `term` `chngasso` transforms: `term` `chngdsso` transforms: `term` `chngpsso` transforms: `term` `delgsso` transforms: `term` `disblsso` transforms: `term` `enblsso` transforms: `term`	`field:"action" kind:match`
`log_source`	eq	`auditevents`	`field:"log_source" kind:eq value:"auditevents"`
`object_type`	eq	`sso`	`field:"object_type" kind:eq value:"sso"`

Output fields

These fields are emitted when the rule matches.

Field	Source
`ActorUsername`	`extend`
`SrcIpAddr`	`extend`