Detection rules › Panther
MongoDB Identity Provider Activity
Changes to identity provider settings are privileged activities that should be carefully audited. Attackers may add or change IDP integrations to gain persistence to environments
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Persistence | T1556.007 Modify Authentication Process: Hybrid Identity |
| Defense Impairment | T1556.007 Modify Authentication Process: Hybrid Identity |
| Credential Access | T1556.007 Modify Authentication Process: Hybrid Identity |
Rule body yaml
AnalysisType: rule
Description: "Changes to identity provider settings are privileged activities that should be carefully audited. Attackers may add or change IDP integrations to gain persistence to environments"
DisplayName: "MongoDB Identity Provider Activity"
Enabled: true
Filename: mongodb_identity_provider_activity.py
Severity: Medium
Reference: https://attack.mitre.org/techniques/T1556/007/
Tests:
- ExpectedResult: false
Log:
eventTypeName: cat_jumped
Name: Random event
- ExpectedResult: true
Log:
eventTypeName: FEDERATION_SETTINGS_CREATED
Name: FEDERATION_SETTINGS_CREATED
- ExpectedResult: true
Log:
eventTypeName: IDENTITY_PROVIDER_CREATED
Name: IDENTITY_PROVIDER_CREATED
DedupPeriodMinutes: 60
LogTypes:
- MongoDB.OrganizationEvent
RuleID: "MongoDB.Identity.Provider.Activity"
Threshold: 1
Detection logic
Condition
eventTypeName in ["FEDERATION_SETTINGS_CREATED", "FEDERATION_SETTINGS_DELETED", "FEDERATION_SETTINGS_UPDATED", "IDENTITY_PROVIDER_CREATED", "IDENTITY_PROVIDER_UPDATED", "IDENTITY_PROVIDER_DELETED", "IDENTITY_PROVIDER_ACTIVATED", "IDENTITY_PROVIDER_DEACTIVATED", "IDENTITY_PROVIDER_JWKS_REVOKED", "OIDC_IDENTITY_PROVIDER_UPDATED", "OIDC_IDENTITY_PROVIDER_ENABLED", "OIDC_IDENTITY_PROVIDER_DISABLED"]
Indicators
Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.
| Field | Kind | Values |
|---|---|---|
eventTypeName | in |
|
Output fields
Fields the rule emits when it matches. Chronicle authors list these in the outcome block; they appear on the detection and $risk_score drives alerting. Sentinel / Defender XDR rules build them up through project / summarize / extend stages. Sentinel maps these into alert fields via entityMappings and customDetails; Defender XDR custom detections surface them as alert fields directly.
| Field | Source |
|---|---|
username | |
target_username | targetUsername |
org_id | orgId |
remote_address | remoteAddress |