M2131_DataConnectorAddedChangedRemoved

Status: available
Severity: medium
Time window: 14d
Source: github.com/Azure/Azure-Sentinel

'This alert is designed to monitor data connector configurations. This alert is triggered when a data connector is added, updated, or deleted.'

MITRE ATT&CK coverage

Tactic	Techniques
Discovery	`T1082` System Information Discovery

Rule body

id: eeb11b6b-e626-4228-b74d-3e730dca8999
name: M2131_DataConnectorAddedChangedRemoved
description: |
  'This alert is designed to monitor data connector configurations. This alert is triggered when a data connector is added, updated, or deleted.'
severity: Medium
status: Available
requiredDataConnectors: []
queryFrequency: 1d
queryPeriod: 14d
triggerOperator: gt
triggerThreshold: 0
tactics:
  - Discovery
relevantTechniques:
  - T1082
query: |
  AzureActivity
  | where OperationNameValue contains "Microsoft.SecurityInsights/dataConnectors/"
  | where ActivityStatusValue == "Succeeded"
  | project OperationNameValue, Caller, CallerIpAddress, ActivityStatusValue, ActivitySubstatusValue, ResourceGroup, Properties, ResourceId, TimeGenerated
  | sort by TimeGenerated desc
  | extend Account = Caller
entityMappings:
  - entityType: AzureResource
    fieldMappings:
      - identifier: ResourceId
        columnName: ResourceId
version: 1.0.0
kind: Scheduled

Stages and Predicates

Stage 1: `source`

AzureActivity

Stage 2: `where`

| where OperationNameValue contains "Microsoft.SecurityInsights/dataConnectors/"

Stage 3: `where`

| where ActivityStatusValue == "Succeeded"

Stage 4: `project`

| project OperationNameValue, Caller, CallerIpAddress, ActivityStatusValue, ActivitySubstatusValue, ResourceGroup, Properties, ResourceId, TimeGenerated

Stage 5: `sort`

| sort by TimeGenerated desc

Stage 6: `extend`

| extend Account = Caller

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`ActivityStatusValue`	eq	`Succeeded`	`field:"ActivityStatusValue" kind:eq value:"Succeeded"`
`OperationNameValue`	contains	`Microsoft.SecurityInsights/dataConnectors/`	`field:"azure_ad::operation_name_value" kind:contains value:"Microsoft.SecurityInsights/dataConnectors/"`

Output fields

These fields are emitted when the rule matches.

Field	Source
`ActivityStatusValue`	`project`
`ActivitySubstatusValue`	`project`
`Caller`	`project`
`CallerIpAddress`	`project`
`OperationNameValue`	`project`
`Properties`	`project`
`ResourceGroup`	`project`
`ResourceId`	`project`
`TimeGenerated`	`project`
`Account`	`extend`

M2131_DataConnectorAddedChangedRemoved

MITRE ATT&CK coverage

Rule body

Stages and Predicates

Stage 1: source

Stage 2: where

Stage 3: where

Stage 4: project

Stage 5: sort

Stage 6: extend