Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · Logic Apps · 📊
| Attribute | Value |
|---|---|
| Type | Workbook |
| Solution | AzureSecurityBenchmark |
| Source | View on GitHub |
This content item queries data from the following tables:
| Table | Selection Criteria | Transformations | Ingestion API | Lake-Only |
|---|---|---|---|---|
AADManagedIdentitySignInLogs |
✓ | ✗ | ✓ | |
AADNonInteractiveUserSignInLogs |
✓ | ✗ | ✓ | |
AADServicePrincipalSignInLogs |
✓ | ✗ | ✓ | |
AADUserRiskEvents |
✓ | ✗ | ✓ | |
AuditLogs |
✓ | ✗ | ✓ | |
AzureActivity |
ActivityStatusValue in "Succeeded,Success"OperationName in "Add member to role,Add user,AzureFirewallIDSLog,NetworkSecurityGroupEvents,Reset user password,Update user"OperationName contains "PIM"OperationName contains "create"OperationName contains "delete"OperationName contains "lockbox"OperationName contains "remove"OperationName contains "update"OperationNameValue contains "recovery"OperationNameValue startswith "Microsoft.KeyVault"OperationNameValue startswith "Microsoft.Logic" |
✗ | ✗ | ✗ |
AzureDevOpsAuditing |
✓ | ✗ | ? | |
AzureDiagnostics 🔶 |
Category in "All,AzureFirewallNetworkRule,NetworkSecurityGroupRuleCounter"ResourceProvider == "MICROSOFT.KEYVAULT"ResourceType == "AZUREFIREWALLS"msg_s !has ". Rule Collection:"msg_s !has "DNAT"msg_s !has "Policy:"msg_s !has "Rule Collection:"msg_s !has "Type="msg_s has ". Rule Collection:"msg_s has "DNAT"msg_s has "Policy:"msg_s has "Rule Collection:"msg_s has "Type=" |
✗ | ✗ | ✗ |
BehaviorAnalytics |
✓ | ✗ | ? | |
Event |
✓ | ✓ | ✗ | |
GitHubAuditLogPolling_CL |
✓ | ✓ | ✓ | |
IdentityInfo |
✓ | ✗ | ? | |
InformationProtectionLogs_CL 🔶 |
? | ✓ | ? | |
ProtectionStatus |
✓ | ✗ | ? | |
SecurityAlert |
AlertName contains "auth"AlertName contains "cert"AlertName contains "cred"AlertName contains "password"AlertName contains "secret" |
✓ | ✗ | ✓ |
SecurityBaseline |
AnalyzeResult in "Failed,Passed" |
✓ | ✗ | ? |
SecurityEvent |
Account !contains "ANONYMOUS LOGON"AuthenticationPackageName == "NTLM"EventID in "2889,3000,4624,4768,4769,4776"LmPackageName == "NTLM V1"PackageName contains "WDigest" |
✓ | ✓ | ✓ |
SecurityIncident |
Severity == "High"Title !contains "URL"Title !contains "net"Title !contains "normalization"Title !contains "web"Title contains "AAD"Title contains "Account"Title contains "Identity"Title contains "Login"Title contains "Sign"Title contains "User"Title contains "WAF"Title contains "access"Title contains "anti"Title contains "app"Title contains "auth"Title contains "cert"Title contains "certificate"Title contains "cred"Title contains "data"Title contains "dns"Title contains "dos"Title contains "exploit"Title contains "impersonate"Title contains "inject"Title contains "intrusion"Title contains "key"Title contains "mal"Title contains "mining"Title contains "password"Title contains "program"Title contains "secret"Title contains "sensitive"Title contains "service principal"Title contains "tool"Title contains "travel"Title contains "virus"Title contains "ware"Title contains "worm" |
✓ | ✗ | ✓ |
SecurityNestedRecommendation |
RecommendationState == "Unhealthy" |
✓ | ✗ | ? |
SecurityRegulatoryCompliance |
ComplianceStandard == "Microsoft-cloud-security-benchmark"State == "Failed" |
✓ | ✗ | ? |
SigninLogs |
✓ | ✗ | ✓ |
Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · Logic Apps · 📊