Detection rules › Kusto

Jira - New user created

Status
available
Severity
medium
Time window
1h
Source
github.com/Azure/Azure-Sentinel

'Detects when new user was created.'

MITRE ATT&CK coverage

TacticTechniques
Persistence

Rule body

id: 8c90f30f-c612-407c-91a0-c6a6b41ac199
name: Jira - New user created
description: |
  'Detects when new user was created.'
severity: Medium
status: Available
requiredDataConnectors:
  - connectorId: JiraAuditAPI
    dataTypes:
      - JiraAudit
queryFrequency: 1h
queryPeriod: 1h
triggerOperator: gt
triggerThreshold: 0
tactics:
  - Persistence
relevantTechniques:
  - T1078
query: |
  JiraAudit
  | where EventMessage =~ 'User created'
  | where ObjectItemTypeName =~ 'USER'
  | project EventCreationTime, UserName, SrcIpAddr, ObjectItemName, AssociatedItems
  | extend AccountCustomEntity = ObjectItemName
entityMappings:
  - entityType: Account
    fieldMappings:
      - identifier: Name
        columnName: AccountCustomEntity
version: 1.0.0
kind: Scheduled

Stages and Predicates

Stage 1: source

JiraAudit

Stage 2: where

| where EventMessage =~ 'User created'

Stage 3: where

| where ObjectItemTypeName =~ 'USER'

Stage 4: project

| project EventCreationTime, UserName, SrcIpAddr, ObjectItemName, AssociatedItems

Stage 5: extend

| extend AccountCustomEntity = ObjectItemName

Indicators

These rows show field, operator, and value matches.

Output fields

These fields are emitted when the rule matches.

FieldSource
AssociatedItemsproject
EventCreationTimeproject
ObjectItemNameproject
SrcIpAddrproject
UserNameproject
AccountCustomEntityextend