admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #2443 from splunk/update_o365_disable_mfa.yml_clone

Browse Source 
Carried over changes from "Update o365_disable_mfa.yml #2441"
This commit is contained in:
Bhavin Patel
2022-11-11 13:22:13 -08:00
committed by GitHub
parent 850c59e57e c9624ff0bd
commit e22201a8d2
1 changed files with 8 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files
detections/cloud/o365_disable_mfa.yml
+8 -6
View File
@@ -7,11 +7,13 @@ type: TTP
datamodel: []
description: This search detects when multi factor authentication has been disabled,
what entitiy performed the action and against what user
search: '`o365_management_activity` Operation="Disable Strong Authentication." | stats
count earliest(_time) as firstTime latest(_time) as lastTime by UserType Operation
UserId ResultStatus |`security_content_ctime(firstTime)` |`security_content_ctime(lastTime)`
| `o365_disable_mfa_filter`'
how_to_implement: You must install splunk Microsoft Office 365 add-on. This search
search: '`o365_management_activity` Operation="Disable Strong Authentication."
| stats count earliest(_time) as firstTime latest(_time) as lastTime by UserType Operation UserId ResultStatus object
| rename UserType AS user_type, Operation AS action, UserId AS src_user, object AS user, ResultStatus AS result
| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`
| `o365_disable_mfa_filter`'
how_to_implement: You must install the Splunk Microsoft Office 365 add-on. This search
works with o365:management:activity
known_false_positives: Unless it is a special case, it is uncommon to disable MFA
or Strong Authentication
@@ -60,4 +62,4 @@ tags:
- dest
- ResultStatus
risk_score: 64
security_domain: threat
security_domain: threat