Azure / Azure/Azure-Sentinel

TI Map Domain entity to Cloud App Events

Open
#14,779 4 comments 0 reactions 2 assignees Claimed by @v-kasghosh View on GitHub
Analytic Rules
Dominant language
Python
Stars
6.1k
Forks
3.8k
Avg merge
4d 7h
Merged PRs (30d)
125

Description

**Describe the bug**
Detection "TI Map Domain entity to Cloud App Events" does not work. https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Threat%20Intelligence%20(NEW)/Analytic%20Rules/DomainEntity_CloudAppEvents_Updated.yaml

**To Reproduce**
1. Line 32: extend DomainName = tolower(IndicatorType) - should be tolower(ObservableValue)
2. list_tlds (declared line 24) is never used
3. Line 53: extend PAUrl = columnifexists("RequestURL", "None") - RequestURL is not part of the CloudAppEvents schema (see closed issue #12348)
4. Because CloudAppEvents will never have a result in the innerunique join on line 49, this detection will never trigger.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.