Detection rules › Panther
MongoDB security alerts disabled or deleted
MongoDB provides security alerting policies for notifying admins when certain conditions are met. This rule detects when these policies are disabled or deleted.
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Stealth | T1562.001 Impair Defenses: Disable or Modify Tools |
Rule body yaml
AnalysisType: rule
Description:
MongoDB provides security alerting policies for notifying admins when certain conditions are met.
This rule detects when these policies are disabled or deleted.
DisplayName: "MongoDB security alerts disabled or deleted"
Enabled: true
LogTypes:
- MongoDB.OrganizationEvent
RuleID: "MongoDB.Alerting.Disabled.Or.Deleted"
Filename: mongodb_alerting_disabled.py
Severity: High
Reports:
MITRE ATT&CK:
- TA0005:T1562.001 # Impair Defenses: Disable or Modify Tools
Reference: https://www.mongodb.com/docs/atlas/configure-alerts/
Runbook: Re-enable security alerts
Tests:
- Name: Alert added
ExpectedResult: false
Log:
{
"alertConfigId": "alert_id",
"created": "2024-04-01 11:57:54.000000000",
"currentValue": {},
"eventTypeName": "ALERT_CONFIG_ADDED_AUDIT",
"id": "alert_id",
"isGlobalAdmin": false,
"links": [],
"orgId": "some_org_id",
"remoteAddress": "1.2.3.4",
"userId": "user_id",
"username": "some_user@company.com",
}
- Name: Alert deleted
ExpectedResult: true
Log:
{
"alertConfigId": "alert_id",
"created": "2024-04-01 11:58:52.000000000",
"currentValue": {},
"eventTypeName": "ALERT_CONFIG_DELETED_AUDIT",
"id": "alert_id",
"isGlobalAdmin": false,
"links": [],
"orgId": "some_org_id",
"remoteAddress": "1.2.3.4",
"userId": "user_id",
"username": "some_user@company.com",
}
DedupPeriodMinutes: 60
Threshold: 1
Detection logic
Condition
eventTypeName in ["ALERT_CONFIG_DISABLED_AUDIT", "ALERT_CONFIG_DELETED_AUDIT"]
Indicators
Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.
| Field | Kind | Values |
|---|---|---|
eventTypeName | in |
|
Output fields
Fields the rule emits when it matches. Chronicle authors list these in the outcome block; they appear on the detection and $risk_score drives alerting. Sentinel / Defender XDR rules build them up through project / summarize / extend stages. Sentinel maps these into alert fields via entityMappings and customDetails; Defender XDR custom detections surface them as alert fields directly.
| Field | Source |
|---|---|
username | |
target_username | targetUsername |
org_id | orgId |
remote_address | remoteAddress |
alertConfigId |