CiscoDuo TI rule fails to deploy due to wrong table name DuoSecurityAuthentication_CL

[presidio-ddg]

https://github.com/Azure/Azure-Sentinel/blob/b11e86a2a113b3103cf0d2555bb84794ca1c1006/Solutions/Threat Intelligence (NEW)/Analytic Rules/IPEntity_DuoSecurity.yaml#L45C8-L45C36

Hi.

Solutions/Threat Intelligence (NEW)/Analytic Rules/IPEntity_DuoSecurity.yaml

https://github.com/Azure/Azure-Sentinel/blob/b11e86a2a113b3103cf0d2555bb84794ca1c1006/Solutions/Threat%20Intelligence%20(NEW)/Analytic%20Rules/IPEntity_DuoSecurity.yaml#L45C1-L45C1

references table DuoSecurityAuthentication_CL which does not seem to exist.

Instead, table name with matching schema seems to be CiscoDuo_CL.

See also rules in https://github.com/Azure/Azure-Sentinel/tree/master/Solutions/CiscoDuoSecurity/Analytic%20Rules

Regards.

[v-utpalkumar]

Hello @presidio-ddg, thanks for flagging this issue. we will investigate this issue and get back to you with some updates. Thanks!

[v-kasghosh]

Hey @presidio-ddg ,

Could you please test the updated analytic rule and check if it produces the expected test results?

let dt_lookBack = 1h;
  let ioc_lookBack = 14d;
  ThreatIntelIndicators
  //extract key part of kv pair
       | extend IndicatorType = replace(@"\[|\]|\""", "", tostring(split(ObservableKey, ":", 0)))
       | where IndicatorType in ("ipv4-addr", "ipv6-addr", "network-traffic")
       | extend NetworkSourceIP = toupper(ObservableValue)
       | extend TrafficLightProtocolLevel = tostring(parse_json(AdditionalFields).TLPLevel)
  // Picking up only IOC's that contain the entities we want
  | where TimeGenerated >= ago(ioc_lookBack)
  // As there is potentially more than 1 indicator type for matching IP, taking NetworkIP first, then others if that is empty.
  // Taking the first non-empty value based on potential IOC match availability
  | extend TI_ipEntity = iff(isnotempty(NetworkSourceIP), NetworkSourceIP, NetworkSourceIP)
  | extend TI_ipEntity = iff(isempty(TI_ipEntity) and isnotempty(NetworkSourceIP), NetworkSourceIP, TI_ipEntity)
  | summarize LatestIndicatorTime = arg_max(TimeGenerated, *) by Id, ObservableValue
  | where IsActive and (ValidUntil > now() or isempty(ValidUntil))
   | join (
       CiscoDuo
       | where TimeGenerated >= ago(dt_lookBack)
       | where isnotempty(AccessDvcIpAddr)
       | extend Duo_TimeGenerated = IsoTimestamp
   )
   on $left.TI_ipEntity == $right.AccessDvcIpAddr
   | where TimeGenerated >= ago(ioc_lookBack)
   | summarize LatestIndicatorTime = arg_max(TimeGenerated, *) by Id, ObservableValue
   | where IsActive and (ValidUntil > now() or isempty(ValidUntil))
   | extend Description = tostring(parse_json(Data).description)
   | extend ActivityGroupNames = extract(@"ActivityGroup:(\S+)", 1, tostring(parse_json(Data).labels))
   | project LatestIndicatorTime, Description, ActivityGroupNames, Id, ValidUntil, Confidence, Duo_TimeGenerated,
   TI_ipEntity, DstUserName, AuthFactor, EventResult, SrcAppName, EventType, TransactionId, SrcUserId, AccessDvcIpAddr, SrcGeoCity, AccessDvcLocationState, SrcGeoCountry
   | extend timestamp = Duo_TimeGenerated, Name = tostring(split(DstUserName, '@', 0)[0]), UPNSuffix = tostring(split(DstUserName, '@', 1)[0])

Please let me know of the results
Thanks!

[presidio-ddg]

Please let me know of the results Thanks!

Yes, it is working with the new KQL.
Thanks.

[v-kasghosh]

@presidio-ddg Thank you for confirming. Could you please share screenshots as proof ?
We will move forward with reviewing PR #13774. After the review is complete, we will merge the PR and close this thread.