- Notifications
You must be signed in to change notification settings - Fork 603
[New] First Time Seen User Auth via DeviceCode Protocol #4153
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Conversation
Rule: New - GuidelinesThese guidelines serve as a reminder set of considerations when proposing a new rule. Documentation and Context
Rule Metadata Checks
New BBR Rules
Testing and Validation
|
rules/integrations/azure/credential_access_first_time_seen_device_code_auth.toml Outdated Show resolved Hide resolved
rules/integrations/azure/credential_access_first_time_seen_device_code_auth.toml Outdated Show resolved Hide resolved
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Nice addition!
Works well with Entra ID Device Code Auth with Broker Client
rule.
Suggested name change only to explicitly label the CSP service associated (Entra ID) as we do with the CSP rules. Not a big deal though.
Added 2 additions to the query to account for activitylogs as well.
…ice_code_auth.toml Co-authored-by: Terrance DeJesus <99630311+terrancedejesus@users.noreply.github.com>
…ice_code_auth.toml Co-authored-by: Terrance DeJesus <99630311+terrancedejesus@users.noreply.github.com>
* Create credential_access_first_time_seen_device_code_auth.toml * Update credential_access_first_time_seen_device_code_auth.toml * Update credential_access_first_time_seen_device_code_auth.toml * Update rules/integrations/azure/credential_access_first_time_seen_device_code_auth.toml Co-authored-by: Terrance DeJesus <99630311+terrancedejesus@users.noreply.github.com> * Update rules/integrations/azure/credential_access_first_time_seen_device_code_auth.toml Co-authored-by: Terrance DeJesus <99630311+terrancedejesus@users.noreply.github.com> * Update credential_access_first_time_seen_device_code_auth.toml --------- Co-authored-by: shashank-elastic <91139415+shashank-elastic@users.noreply.github.com> Co-authored-by: Terrance DeJesus <99630311+terrancedejesus@users.noreply.github.com> (cherry picked from commit f368453)
* Create credential_access_first_time_seen_device_code_auth.toml * Update credential_access_first_time_seen_device_code_auth.toml * Update credential_access_first_time_seen_device_code_auth.toml * Update rules/integrations/azure/credential_access_first_time_seen_device_code_auth.toml Co-authored-by: Terrance DeJesus <99630311+terrancedejesus@users.noreply.github.com> * Update rules/integrations/azure/credential_access_first_time_seen_device_code_auth.toml Co-authored-by: Terrance DeJesus <99630311+terrancedejesus@users.noreply.github.com> * Update credential_access_first_time_seen_device_code_auth.toml --------- Co-authored-by: shashank-elastic <91139415+shashank-elastic@users.noreply.github.com> Co-authored-by: Terrance DeJesus <99630311+terrancedejesus@users.noreply.github.com> (cherry picked from commit f368453)
* Create credential_access_first_time_seen_device_code_auth.toml * Update credential_access_first_time_seen_device_code_auth.toml * Update credential_access_first_time_seen_device_code_auth.toml * Update rules/integrations/azure/credential_access_first_time_seen_device_code_auth.toml Co-authored-by: Terrance DeJesus <99630311+terrancedejesus@users.noreply.github.com> * Update rules/integrations/azure/credential_access_first_time_seen_device_code_auth.toml Co-authored-by: Terrance DeJesus <99630311+terrancedejesus@users.noreply.github.com> * Update credential_access_first_time_seen_device_code_auth.toml --------- Co-authored-by: shashank-elastic <91139415+shashank-elastic@users.noreply.github.com> Co-authored-by: Terrance DeJesus <99630311+terrancedejesus@users.noreply.github.com> (cherry picked from commit f368453)
* Create credential_access_first_time_seen_device_code_auth.toml * Update credential_access_first_time_seen_device_code_auth.toml * Update credential_access_first_time_seen_device_code_auth.toml * Update rules/integrations/azure/credential_access_first_time_seen_device_code_auth.toml Co-authored-by: Terrance DeJesus <99630311+terrancedejesus@users.noreply.github.com> * Update rules/integrations/azure/credential_access_first_time_seen_device_code_auth.toml Co-authored-by: Terrance DeJesus <99630311+terrancedejesus@users.noreply.github.com> * Update credential_access_first_time_seen_device_code_auth.toml --------- Co-authored-by: shashank-elastic <91139415+shashank-elastic@users.noreply.github.com> Co-authored-by: Terrance DeJesus <99630311+terrancedejesus@users.noreply.github.com> (cherry picked from commit f368453)
* Create credential_access_first_time_seen_device_code_auth.toml * Update credential_access_first_time_seen_device_code_auth.toml * Update credential_access_first_time_seen_device_code_auth.toml * Update rules/integrations/azure/credential_access_first_time_seen_device_code_auth.toml Co-authored-by: Terrance DeJesus <99630311+terrancedejesus@users.noreply.github.com> * Update rules/integrations/azure/credential_access_first_time_seen_device_code_auth.toml Co-authored-by: Terrance DeJesus <99630311+terrancedejesus@users.noreply.github.com> * Update credential_access_first_time_seen_device_code_auth.toml --------- Co-authored-by: shashank-elastic <91139415+shashank-elastic@users.noreply.github.com> Co-authored-by: Terrance DeJesus <99630311+terrancedejesus@users.noreply.github.com> (cherry picked from commit f368453)
* Create credential_access_first_time_seen_device_code_auth.toml * Update credential_access_first_time_seen_device_code_auth.toml * Update credential_access_first_time_seen_device_code_auth.toml * Update rules/integrations/azure/credential_access_first_time_seen_device_code_auth.toml Co-authored-by: Terrance DeJesus <99630311+terrancedejesus@users.noreply.github.com> * Update rules/integrations/azure/credential_access_first_time_seen_device_code_auth.toml Co-authored-by: Terrance DeJesus <99630311+terrancedejesus@users.noreply.github.com> * Update credential_access_first_time_seen_device_code_auth.toml --------- Co-authored-by: shashank-elastic <91139415+shashank-elastic@users.noreply.github.com> Co-authored-by: Terrance DeJesus <99630311+terrancedejesus@users.noreply.github.com> (cherry picked from commit f368453)
#3665