O365_User_Updated
ID: 100263
Description:
An O365 user’s info has been updated
Repository: Fluency Group: Office365 Type: event
Default Status:
Enabled
Tags: |
---|
O365 |
Selector:
Query:
Filters:
Standard:
Field | MUST hit |
---|---|
@sender | office365 |
@fields.Operation | Update user. |
@fields.Workload | AzureActiveDirectory |
Field | MUST NOT hit |
---|---|
@fields.UserType | 4 |
5 | |
@fields.UserId | fim_password_service |
fim_password_service@support.onmicrosoft.com |
Additional JSON:
function json_doc_filter (doc)
UserId = doc['@fields'].UserId
if UserId == nil then
return false
end
print("UserId: "..UserId)
-- exempt the sync services
if starts_with(UserId, "Sync_") then
return false
end
ObjectId = doc['@fields'].ObjectId
if ObjectId == nil then
return false
end
print("ObjectId: "..ObjectId)
-- user is editing own details
if (UserId == ObjectId) then
return false
end
return true
end
function starts_with(str, start)
return str:sub(1, #start) == start
end
return json_doc_filter
Behavior Rule:
Key | Type | Behavior Category |
---|---|---|
@fields.UserId | username | application activity |
Risks:
Risks | Base Score | Dimension |
---|---|---|
ALERT_POLICY | 200 | alert |
Attributes:
Alias | Key |
---|---|
Username | @fields.UserId |
Workload | @fields.Workload |
ResultStatus | @fields.ResultStatus |
TargetUser | @fields.ObjectId |
Correlation Rules:
First Occurrence:
Name | Window | Fields |
---|---|---|
NewUser | 30 days | @fields.UserId |
Risks: | ML_NEW_USER |
History:
User | Date |
---|---|
em*n@fluencysecurity.com | 2021 Mar 6 03:43:54 EST |
em*n@fluencysecurity.com | 2021 Mar 17 14:15:34 EDT |
em*n@fluencysecurity.com | 2021 Mar 18 15:09:10 EDT |
em*n@fluencysecurity.com | 2021 Mar 18 15:22:20 EDT |
em*n@fluencysecurity.com | 2021 Mar 18 15:25:22 EDT |
em*n@fluencysecurity.com | 2021 Apr 8 13:23:33 EDT |
ke*y@fluencysecurity.com | 2021 May 21 02:11:14 EDT |
ho*d@fluencysecurity.com | 2021 Jun 24 15:42:00 EDT |
em*n@fluencysecurity.com | 2021 Jul 6 23:31:19 EDT |
ho*d@fluencysecurity.com | 2021 Jul 7 08:56:01 EDT |
ke*y@fluencysecurity.com | 2022 Feb 18 01:15:13 EST |
This page was automatically created/formatted on Wed, 2022 May 4 21:43:53 EDT, from rule_dump.json (4d88bffdfb1cea26b3985f2193033606)