↳ GitHub sourceAnalytics ruleHigh
Uniqkey - Departing employee credential export
Description
Correlates the archival, deletion or detachment of a Uniqkey employee account with data exports performed by that same employee during the preceding 14 days. An employee who exports credentials shortly before losing access is a classic insider-risk scenario, and organization credentials touched by the export should be considered for rotation. The action filter matches the offboarding action identifiers from the Uniqkey audit-log catalog, with a name-based fallback for future action variants.
- Rule type
- Scheduled
- Version
- 1.0.0
- Query frequency
- 1h
- Query period
- 14d
- Trigger
- gt 0
Declared MITRE coverage
Declared sources
Metadata from the source file. No dependencies inferred from KQL.
Connectors
Data types
KQL query
Original query, unchanged.
let lookback = 14d;
let frequency = 1h;
let exports =
UniqkeyEvents_CL
| where TimeGenerated > ago(lookback)
| where Category == "data_export"
| project ExportTime = TimeGenerated, ActorId, ActorEmail, ExportAction = Action, ExportedTargetType = TargetType, ExportedTargetName = TargetName, SrcIpAddr;
let removalActionIds = dynamic([
"a2e18fcb-4d28-4f53-b2e3-24f03d0e188e", // Archive employee account
"319c8a05-abd5-4b13-b51f-d6198578e61c", // Archive bulk employee
"f1ed588f-975b-4bbe-83e9-e7a5c23e647f", // Hard delete employee
"f8b81b6c-0082-4ed8-916e-83350f932e89", // Permanent delete employee account
"4361dd86-0f70-47e0-91de-071a81d49834" // Detach bulk employee account
]);
UniqkeyEvents_CL
| where TimeGenerated > ago(frequency)
| where Category == "account_management"
| where tolower(ActionId) in (removalActionIds) or Action has_any ("archive", "delete", "detach")
| where TargetType == "employee"
| project RemovalTime = TimeGenerated, RemovalAction = Action, RemovedEmployeeId = TargetId, RemovedEmployeeName = TargetName, RemovalActor = ActorEmail
| join kind=inner exports on $left.RemovedEmployeeId == $right.ActorId
| project RemovalTime, RemovalAction, RemovedEmployeeName, RemovalActor, ExportTime, ExportAction, ExportedTargetType, ExportedTargetName, ActorEmail, SrcIpAddrDeclared entities
Related content
Links established from declared identifiers and solution manifests.
Source provenance
GitHubDisplayed values come from files in Azure/Azure-Sentinel. They describe the published template, not your workspace configuration.
- Commit
9800e51↗- Source identifier
cee6bbae-e1ee-4b65-9782-6afce5c330e6
GSTEP / CATALOG TRACKING
Added to catalog : 16 Sept 2026 · 05:49 UTC
Last change observed : 16 Sept 2026 · 05:49 UTC