{
  "rules": [
    {
      "displayName": "Decision Terrain - Audit or data-governance policy changed",
      "description": "Audit evidence retention or Organization data-governance policy was changed. Shortening retention can erase evidence.",
      "enabled": false,
      "severity": "High",
      "query": "DTAudit_CL\n| where TimeGenerated > ago(15m)\n| summarize arg_max(TimeGenerated, *) by OrganizationId, EventId\n| where EventName == \"organization.security\" and (Action in (\"policy_updated\", \"organization_data_governance_policy_updated\"))\n| project TimeGenerated, OrganizationId, ActorKind, ActorUserId, Action, Result, ResourceType, ResourceId, EventId",
      "queryFrequency": "PT5M",
      "queryPeriod": "PT15M",
      "triggerOperator": "GreaterThan",
      "triggerThreshold": 0,
      "suppressionDuration": "PT1H",
      "suppressionEnabled": false,
      "tactics": [
        "DefenseEvasion"
      ]
    },
    {
      "displayName": "Decision Terrain - Audit evidence revealed or exported",
      "description": "Full agent evidence was revealed, used, or exported, or an Organization export was requested or downloaded.",
      "enabled": false,
      "severity": "Medium",
      "query": "DTAudit_CL\n| where TimeGenerated > ago(15m)\n| summarize arg_max(TimeGenerated, *) by OrganizationId, EventId\n| where EventName == \"organization.security\" and (Action in (\"evidence_revealed\", \"export_created\", \"export_downloaded\", \"investigation_evidence_used\", \"audit_explanation_evidence_requested\", \"audit_explanation_evidence_used\", \"audit_explanation_revealed\", \"security_audit_exported\", \"organization_portable_export_requested\"))\n| project TimeGenerated, OrganizationId, ActorKind, ActorUserId, Action, Result, ResourceType, ResourceId, EventId",
      "queryFrequency": "PT5M",
      "queryPeriod": "PT15M",
      "triggerOperator": "GreaterThan",
      "triggerThreshold": 0,
      "suppressionDuration": "PT1H",
      "suppressionEnabled": false,
      "tactics": [
        "Collection"
      ]
    },
    {
      "displayName": "Decision Terrain - SIEM forwarding stopped or restricted",
      "description": "A SIEM destination was stopped, paused or retired, or installation forwarding scope or limits changed. Treat as possible log tampering.",
      "enabled": false,
      "severity": "High",
      "query": "DTAudit_CL\n| where TimeGenerated > ago(15m)\n| summarize arg_max(TimeGenerated, *) by OrganizationId, EventId\n| where EventName == \"organization.security\" and (Action in (\"siem_destination_stop\", \"siem_destination_pause\", \"siem_destination_retire\", \"siem_installation_forwarding_changed\", \"siem_installation_eligibility_changed\", \"siem_installation_storage_limits_changed\"))\n| project TimeGenerated, OrganizationId, ActorKind, ActorUserId, Action, Result, ResourceType, ResourceId, EventId",
      "queryFrequency": "PT5M",
      "queryPeriod": "PT15M",
      "triggerOperator": "GreaterThan",
      "triggerThreshold": 0,
      "suppressionDuration": "PT1H",
      "suppressionEnabled": false,
      "tactics": [
        "DefenseEvasion"
      ]
    },
    {
      "displayName": "Decision Terrain - Credential or machine identity issued",
      "description": "An API key, SCIM token, machine identity, security service identity or native integration credential was created or rotated.",
      "enabled": false,
      "severity": "Medium",
      "query": "DTAudit_CL\n| where TimeGenerated > ago(15m)\n| summarize arg_max(TimeGenerated, *) by OrganizationId, EventId\n| where EventName == \"organization.security\" and (Action in (\"organization_api_key_created\", \"scim_token_created\", \"scim_token_rotated\", \"machine_identity_created\", \"machine_identity_version_activated\", \"security_service_identity_created\", \"security_service_credential_rotated\", \"native_integration_credentials_created\"))\n| project TimeGenerated, OrganizationId, ActorKind, ActorUserId, Action, Result, ResourceType, ResourceId, EventId",
      "queryFrequency": "PT5M",
      "queryPeriod": "PT15M",
      "triggerOperator": "GreaterThan",
      "triggerThreshold": 0,
      "suppressionDuration": "PT1H",
      "suppressionEnabled": false,
      "tactics": [
        "Persistence",
        "CredentialAccess"
      ]
    },
    {
      "displayName": "Decision Terrain - Role mapping or access policy changed",
      "description": "A member role, SCIM role mapping, default role or Organization access policy was changed, or an invitation was created.",
      "enabled": false,
      "severity": "Medium",
      "query": "DTAudit_CL\n| where TimeGenerated > ago(15m)\n| summarize arg_max(TimeGenerated, *) by OrganizationId, EventId\n| where EventName == \"organization.security\" and (Action in (\"organization_member_role_updated\", \"scim_group_mapping_updated\", \"scim_default_role_updated\", \"organization_access_policy_updated\", \"organization_invite_created\"))\n| project TimeGenerated, OrganizationId, ActorKind, ActorUserId, Action, Result, ResourceType, ResourceId, EventId",
      "queryFrequency": "PT5M",
      "queryPeriod": "PT15M",
      "triggerOperator": "GreaterThan",
      "triggerThreshold": 0,
      "suppressionDuration": "PT1H",
      "suppressionEnabled": false,
      "tactics": [
        "PrivilegeEscalation"
      ]
    },
    {
      "displayName": "Decision Terrain - SSO enforcement weakened or recovery used",
      "description": "An SSO connection was deactivated, enforcement was relaxed, a recovery kit was created, rotated or used, or an identity was unlinked.",
      "enabled": false,
      "severity": "High",
      "query": "DTAudit_CL\n| where TimeGenerated > ago(15m)\n| summarize arg_max(TimeGenerated, *) by OrganizationId, EventId\n| where EventName == \"organization.security\" and (Action in (\"connection_deactivated\", \"recovery_enforcement_relaxed\", \"recovery_kit_created\", \"recovery_kit_rotated\", \"recovery_session_started\", \"identity_unlinked\"))\n| project TimeGenerated, OrganizationId, ActorKind, ActorUserId, Action, Result, ResourceType, ResourceId, EventId",
      "queryFrequency": "PT5M",
      "queryPeriod": "PT15M",
      "triggerOperator": "GreaterThan",
      "triggerThreshold": 0,
      "suppressionDuration": "PT1H",
      "suppressionEnabled": false,
      "tactics": [
        "DefenseEvasion",
        "Persistence"
      ]
    },
    {
      "displayName": "Decision Terrain - Agent security hold placed",
      "description": "An external, internal or rule-driven security hold was accepted for an agent or a group of agents.",
      "enabled": false,
      "severity": "High",
      "query": "DTAudit_CL\n| where TimeGenerated > ago(15m)\n| summarize arg_max(TimeGenerated, *) by OrganizationId, EventId\n| where EventName == \"organization.security\" and (Action in (\"security_rule_halt_accepted\", \"external_security_halt_accepted\", \"internal_security_halt_accepted\", \"security_halt_batch_started\"))\n| project TimeGenerated, OrganizationId, ActorKind, ActorUserId, Action, Result, ResourceType, ResourceId, EventId",
      "queryFrequency": "PT5M",
      "queryPeriod": "PT15M",
      "triggerOperator": "GreaterThan",
      "triggerThreshold": 0,
      "suppressionDuration": "PT1H",
      "suppressionEnabled": false,
      "tactics": [
        "Impact"
      ]
    },
    {
      "displayName": "Decision Terrain - Emergency control step failed",
      "description": "A platform or sandbox emergency control step reported failure, so containment may be incomplete.",
      "enabled": false,
      "severity": "High",
      "query": "DTAudit_CL\n| where TimeGenerated > ago(15m)\n| summarize arg_max(TimeGenerated, *) by OrganizationId, EventId\n| where EventName == \"organization.security\" and (Action startswith \"agent_emergency_\" or Action startswith \"sandbox_emergency_\")\n| where Result in (\"failed\")\n| project TimeGenerated, OrganizationId, ActorKind, ActorUserId, Action, Result, ResourceType, ResourceId, EventId",
      "queryFrequency": "PT5M",
      "queryPeriod": "PT15M",
      "triggerOperator": "GreaterThan",
      "triggerThreshold": 0,
      "suppressionDuration": "PT1H",
      "suppressionEnabled": false,
      "tactics": [
        "Impact"
      ]
    },
    {
      "displayName": "Decision Terrain - Repeated failed sign-ins for one account",
      "description": "Five failed sign-ins for the same account within ten minutes.",
      "enabled": false,
      "severity": "High",
      "query": "DTAudit_CL\n| where TimeGenerated > ago(10m)\n| summarize arg_max(TimeGenerated, *) by OrganizationId, EventId\n| where EventName == \"organization.security\" and (Action in (\"member_login_failed\"))\n| summarize Events=count(), FirstSeen=min(OccurredAt), LastSeen=max(OccurredAt) by OrganizationId, ResourceId\n| where Events >= 5",
      "queryFrequency": "PT5M",
      "queryPeriod": "PT15M",
      "triggerOperator": "GreaterThan",
      "triggerThreshold": 0,
      "suppressionDuration": "PT1H",
      "suppressionEnabled": false,
      "tactics": [
        "CredentialAccess"
      ]
    },
    {
      "displayName": "Decision Terrain - Repeated rejected API key or service credential",
      "description": "Three rejections of the same API key or service credential within ten minutes.",
      "enabled": false,
      "severity": "Medium",
      "query": "DTAudit_CL\n| where TimeGenerated > ago(10m)\n| summarize arg_max(TimeGenerated, *) by OrganizationId, EventId\n| where EventName == \"organization.security\" and (Action in (\"api_key_authentication_failed\", \"service_credential_authentication_failed\"))\n| summarize Events=count(), FirstSeen=min(OccurredAt), LastSeen=max(OccurredAt) by OrganizationId, ResourceId\n| where Events >= 3",
      "queryFrequency": "PT5M",
      "queryPeriod": "PT15M",
      "triggerOperator": "GreaterThan",
      "triggerThreshold": 0,
      "suppressionDuration": "PT1H",
      "suppressionEnabled": false,
      "tactics": [
        "CredentialAccess"
      ]
    },
    {
      "displayName": "Decision Terrain - Agent repeatedly denied by policy",
      "description": "Ten security-rule or sandbox-network denials for the same agent within fifteen minutes.",
      "enabled": false,
      "severity": "Medium",
      "query": "DTAgentAudit_CL\n| where TimeGenerated > ago(15m)\n| summarize arg_max(TimeGenerated, *) by OrganizationId, EventId\n| where EventName == \"agent.audit\" and (Action in (\"security_rule_evaluated\", \"sandbox_network_request\"))\n| where Result in (\"denied\")\n| summarize Events=count(), FirstSeen=min(OccurredAt), LastSeen=max(OccurredAt) by OrganizationId, AgentId\n| where Events >= 10",
      "queryFrequency": "PT5M",
      "queryPeriod": "PT15M",
      "triggerOperator": "GreaterThan",
      "triggerThreshold": 0,
      "suppressionDuration": "PT1H",
      "suppressionEnabled": false,
      "tactics": [
        "Execution"
      ]
    }
  ]
}