Forum Discussion
Saeed Sheikh
Jan 31, 2024Copper Contributor
Unable to update rule New User Assigned to Privileged Role
When trying to update this analytic rule to latest version (1.0.10), I get this error message.
Failed to save analytics rule 'New User Assigned to Privileged Role'. BadRequest:Invalid data model. [: Invalid identifier 'Initiator' for type 'Account' encountered. Valid identifiers are: [Name, NTDomain, DnsDomain, UPNSuffix, Sid, AadTenantId, AadUserId, PUID, IsDomainJoined, DisplayName, ObjectGuid, CloudAppAccountId, IsAnonymized, FullName]]
Here is the new KQL query.
// Define the start and end times based on input values
let starttime = now()-1h;
let endtime = now();
// Set a lookback period of 14 days
let lookback = starttime - 14d;
// Define a reusable function to query audit logs
let awsFunc = (start:datetime, end:datetime) {
AuditLogs
| where TimeGenerated between (start..end)
| where Category =~ "RoleManagement"
| where AADOperationType in ("Assign", "AssignEligibleRole")
| where ActivityDisplayName has_any ("Add eligible member to role", "Add member to role")
| mv-apply TargetResource = TargetResources on
(
where TargetResource.type in~ ("User", "ServicePrincipal")
| extend Target = iff(TargetResource.type =~ "ServicePrincipal", tostring(TargetResource.displayName), tostring(TargetResource.userPrincipalName)),
props = TargetResource.modifiedProperties
)
| mv-apply Property = props on
(
where Property.displayName =~ "Role.DisplayName"
| extend RoleName = trim('"', tostring(Property.newValue))
)
| where RoleName contains "Admin" and Result == "success"
};
// Query for audit events in the current day
let EventInfo_CurrentDay = awsFunc(starttime, endtime);
// Query for audit events in the historical period (lookback)
let EventInfo_historical = awsFunc(lookback, starttime);
// Find unseen events by performing a left anti-join
let EventInfo_Unseen = (EventInfo_CurrentDay
| join kind=leftanti(EventInfo_historical) on Target, RoleName, OperationName
);
// Extend and clean up the results
EventInfo_Unseen
| extend InitiatingAppName = tostring(InitiatedBy.app.displayName)
| extend InitiatingAppServicePrincipalId = tostring(InitiatedBy.app.servicePrincipalId)
| extend InitiatingUserPrincipalName = tostring(InitiatedBy.user.userPrincipalName)
| extend InitiatingAadUserId = tostring(InitiatedBy.user.id)
| extend InitiatingIpAddress = tostring(iff(isnotempty(InitiatedBy.user.ipAddress), InitiatedBy.user.ipAddress, InitiatedBy.app.ipAddress))
| extend Initiator = iif(isnotempty(InitiatingAppName), InitiatingAppName, InitiatingUserPrincipalName)
// You can uncomment the lines below to filter out PIM activations
// | where Initiator != "MS-PIM"
// | summarize StartTime=min(TimeGenerated), EndTime=min(TimeGenerated) by OperationName, RoleName, Target, Initiator, Result
// Project specific columns and split them for further analysis
| project TimeGenerated, OperationName, RoleName, Target, Initiator, InitiatingUserPrincipalName, InitiatingAadUserId, InitiatingAppName, InitiatingAppServicePrincipalId, InitiatingIpAddress, Result
| extend TargetName = tostring(split(Target,'@',0)[0]), TargetUPNSuffix = tostring(split(Target,'@',1)[0]), InitiatorName = tostring(split(InitiatingUserPrincipalName,'@',0)[0]), InitiatorUPNSuffix = tostring(split(InitiatingUserPrincipalName,'@',1)[0])
Not sure how to fix this. Appreciate any help.
- That looks like a YAML error, I'm assuming you are deploying this rather than manually creating it? Check the entity mappings:
https://github.com/Azure/Azure-Sentinel/blob/0202a5a5797218909f035cea4db1037807152dbb/Solutions/Microsoft%20Entra%20ID/Analytic%20Rules/UserAssignedPrivilegedRole.yaml#L32
2 Replies
- Clive_WatsonBronze ContributorThat looks like a YAML error, I'm assuming you are deploying this rather than manually creating it? Check the entity mappings:
https://github.com/Azure/Azure-Sentinel/blob/0202a5a5797218909f035cea4db1037807152dbb/Solutions/Microsoft%20Entra%20ID/Analytic%20Rules/UserAssignedPrivilegedRole.yaml#L32- Saeed SheikhCopper Contributor
Thank you Clive_Watson. I was able to review the entity mappings and sure it was missing the one for Name. Selected that and I was able to update the rule. Thank you for the quick response!