Link Search Menu Expand Document

O365_User_Updated

ID: 100263

Description:

An O365 user’s info has been updated

Repository: Fluency Group: Office365 Type: event

Default Status:

Enabled

Tags:
O365
 

Selector:

Query:

Filters:

Standard:

Field MUST hit
@sender office365
@fields.Operation Update user.
@fields.Workload AzureActiveDirectory
Field MUST NOT hit
@fields.UserType 4
  5
@fields.UserId fim_password_service
  fim_password_service@support.onmicrosoft.com

Additional JSON:

function json_doc_filter (doc)
   UserId = doc['@fields'].UserId
   if UserId == nil then
      return false
   end
   print("UserId: "..UserId)

   -- exempt the sync services
   if starts_with(UserId, "Sync_") then
      return false
   end

   ObjectId = doc['@fields'].ObjectId
   if ObjectId == nil then
      return false
   end
   print("ObjectId: "..ObjectId)

   -- user is editing own details
   if (UserId == ObjectId) then
      return false
   end
   
   return true

end

function starts_with(str, start)
   return str:sub(1, #start) == start
end

return json_doc_filter

Behavior Rule:

Key Type Behavior Category
@fields.UserId username application activity

Risks:

Risks Base Score Dimension
ALERT_POLICY 200 alert

Attributes:

Alias Key
Username @fields.UserId
Workload @fields.Workload
ResultStatus @fields.ResultStatus
TargetUser @fields.ObjectId

Correlation Rules:

First Occurrence:

Name Window Fields
NewUser 10 days @fields.UserId
  Risks: ML_NEW_USER

History:

User Date
em*n@fluencysecurity.com 2021 Mar 6 03:43:54 EST
em*n@fluencysecurity.com 2021 Mar 17 14:15:34 EDT
em*n@fluencysecurity.com 2021 Mar 18 15:09:10 EDT
em*n@fluencysecurity.com 2021 Mar 18 15:22:20 EDT
em*n@fluencysecurity.com 2021 Mar 18 15:25:22 EDT
em*n@fluencysecurity.com 2021 Apr 8 13:23:33 EDT
ke*y@fluencysecurity.com 2021 May 21 02:11:14 EDT
ho*d@fluencysecurity.com 2021 Jun 24 15:42:00 EDT
em*n@fluencysecurity.com 2021 Jul 6 23:31:19 EDT
ho*d@fluencysecurity.com 2021 Jul 7 08:56:01 EDT

This page was automatically created/formatted on Tue, 2021 Oct 19 00:29:17 EDT, from rule_dump.json (db47c470500ce8686ead334f5eda0596)