1Password - Changes to firewall rules

Severity: medium
Time window: 5m
Source: github.com/Azure/Azure-Sentinel

This will alert when changes have been made to the firewall rules. Once this analytics rule is triggered it will group all related future alerts for upto an hour when all related entities are the same. Ref: https://1password.com/ Ref: https://github.com/securehats/

MITRE ATT&CK coverage

Tactic	Techniques
Defense Impairment	`T1685` Disable or Modify Tools

Telemetry coverage

Platform	Record / event type
1Password	account-updatfw: Update Firewall Rules

Rule body

id: 54e6bb8e-2935-422f-9387-dba1961abfd7
name: 1Password - Changes to firewall rules
version: 1.0.0
kind: Scheduled
description: |-
  This will alert when changes have been made to the firewall rules. Once this analytics rule is triggered it will group all related future alerts for upto an hour when all related entities are the same.

  Ref: https://1password.com/
  Ref: https://github.com/securehats/
severity: Medium
requiredDataConnectors:
  - connectorId: 1Password
    dataTypes:
      - OnePasswordEventLogs_CL
queryFrequency: 5m
queryPeriod: 5m
triggerOperator: gt
triggerThreshold: 0
tactics:
- DefenseEvasion
relevantTechniques:
- T1562
query: |-
  OnePasswordEventLogs_CL
  | where log_source == "auditevents"
  | where action == "updatfw"
  | where object_type == "account"
  | extend
      ActorUsername = actor_details.email
      , SrcIpAddr = session.ip
subTechniques:
- T1562.007
suppressionEnabled: false
incidentConfiguration:
  createIncident: true
  groupingConfiguration:
    enabled: true
    reopenClosedIncident: false
    lookbackDuration: 1h
    matchingMethod: AllEntities
suppressionDuration: 5h
eventGroupingSettings:
  aggregationKind: SingleAlert
entityMappings:
- entityType: Account
  fieldMappings:
  - identifier: FullName
    columnName: ActorUsername
- entityType: IP
  fieldMappings:
  - identifier: Address
    columnName: SrcIpAddr

Stages and Predicates

Stage 1: `source`

OnePasswordEventLogs_CL

Stage 2: `where`

| where log_source == "auditevents"

Stage 3: `where`

| where action == "updatfw"

Stage 4: `where`

| where object_type == "account"

Stage 5: `extend`

| extend
    ActorUsername = actor_details.email
    , SrcIpAddr = session.ip

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`action`	eq	`updatfw`	`field:"action" kind:eq value:"updatfw"`
`log_source`	eq	`auditevents`	`field:"log_source" kind:eq value:"auditevents"`
`object_type`	eq	`account`	`field:"object_type" kind:eq value:"account"`

Output fields

These fields are emitted when the rule matches.

Field	Source
`ActorUsername`	`extend`
`SrcIpAddr`	`extend`