Dear Team,
I am seeking assistance in adding a parameter to one of my Office 365 rules to identify the specific user to whom the rule applies.
For example, we received an alert stating that "User Permission has changed." However, the raw logs for this alert do not contain information on which user's permission was changed or which account had administrative access altered. The only available parameter is "Object ID," which helps us locate Office 365 logs but does not provide definitive results.
I would like to enhance my rule to include the necessary details to identify the impacted user. Could someone please assist me with this?
For reference, I have included the relevant rule below:
rule O365_USER_CHANGE_PERMISSIONS {
meta:
author = "Google Cloud Security"
description = "This rule tracks and monitors USER_CHANGE_PERMISSIONS for email identities or mailboxes within an Office 365 environment. The event is triggered when a mailbox, email alias, or user account associated with an email address is deleted from the system."
assumption = "The list msgraph_watchlist_roles is populated with role names, e.g., Application Administrator."
mitre_attack_tactic = "Persistence"
mitre_attack_technique = "Account Manipulation: Additional Cloud Roles"
mitre_attack_url = "https://attack.mitre.org/techniques/T1098/003/"
mitre_attack_version = "v14.1"
type = "alert"
platform = "Microsoft"
data_source = "Office 365"
severity = "Medium"
priority = "Medium"
events:
$app.metadata.product_name = "Office 365"
$app.metadata.vendor_name = "Microsoft"
$app.metadata.log_type = "OFFICE_365"
$app.metadata.product_event_type = "MemberRemoved"
$app.principal.user.userid = $userid
$app.target.application = "MicrosoftTeams"
$app.metadata.event_type = "USER_CHANGE_PERMISSIONS"
$app.principal.user.email_addresses = ""
$app.target.user.email_addresses = ""
$app.security_result.action = "UNKNOWN_ACTION"
match:
$userid over 5m
condition:
$app
}