Detection rules › Kusto

Bitglass - User login from new geo location

Status
available
Severity
medium
Time window
14d
Group by
User
Source
github.com/Azure/Azure-Sentinel

'Detects user login from new geo location.'

MITRE ATT&CK coverage

TacticTechniques
Initial Access

Rule body

id: 34401e66-9fe9-476b-a443-3a3f89e4f3b0
name: Bitglass - User login from new geo location
description: |
  'Detects user login from new geo location.'
severity: Medium
status: Available
requiredDataConnectors:
  - connectorId: Bitglass
    dataTypes:
      - Bitglass
queryFrequency: 1h
queryPeriod: 14d
triggerOperator: gt
triggerThreshold: 0
tactics:
  - InitialAccess
relevantTechniques:
  - T1078
query: |
  Bitglass
  | where EventType =~ 'access'
  | where EventMessage =~ 'Login'
  | summarize g_loc = makeset(SrcGeoLocation) by User
  | join (Bitglass
          | where EventType =~ 'access'
          | where EventMessage =~ 'Login') on User
  | where g_loc !contains SrcGeoLocation
  | extend AccountCustomEntity = User, FileCustomEntity = SrcFileName
entityMappings:
  - entityType: Account
    fieldMappings:
      - identifier: Name
        columnName: AccountCustomEntity
  - entityType: File
    fieldMappings:
      - identifier: Name
        columnName: FileCustomEntity
version: 1.0.0
kind: Scheduled

Stages and Predicates

Stage 1: source

Bitglass

Stage 2: where

| where EventType =~ 'access'

Stage 3: where

| where EventMessage =~ 'Login'

Stage 4: summarize

| summarize g_loc = makeset(SrcGeoLocation) by User

Stage 5: join

| join (Bitglass
        | where EventType =~ 'access'
        | where EventMessage =~ 'Login') on User

Stage 6: where

| where g_loc !contains SrcGeoLocation

Stage 7: extend

| extend AccountCustomEntity = User, FileCustomEntity = SrcFileName

Indicators

These rows show field, operator, and value matches.

Output fields

These fields are emitted when the rule matches.

FieldSource
Usersummarize
g_locsummarize
AccountCustomEntityextend
FileCustomEntityextend