{
  "Name": "UEBA Essentials",
  "Author": "Microsoft - support@microsoft.com",
  "Logo": "<img src=\"https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/Logos/Azure_Sentinel.svg\"width=\"75px\"height=\"75px\">",
  "Description": "The Microsoft Sentinel UEBA content package will provide you with various queries based on UEBA tables, that allows you to hunt for tailored threat scenarios. You'll be able to investigate and search for anomalous activities over UEBA's enriched data, and get inspired to customize queries according to your own use-cases.\n\n**Important :** Some of the queries that are part of this solution, make use of [Built-in Watchlist Templates](https://docs.microsoft.com/azure/sentinel/watchlist-schemas) and will not work unless the corresponding watchlist is created. Other queries may requires changes to match your environment details.",
  "Workbooks": [
    "Workbooks/UEBABehaviorsAnalysisWorkbook.json"
  ],
  "Hunting Queries": [
    "Hunting Queries/anomaliesOnVIPUsers.yaml",
	"Hunting Queries/anomalousActionInTenant.yaml",
	"Hunting Queries/dormantAccountActivityFromUncommonCountry.yaml",
	"Hunting Queries/Anomalous connection from highly privileged user.yaml",
	"Hunting Queries/loginActivityFromBotnet.yaml",
	"Hunting Queries/updateKeyVaultActivity.yaml",
	"Hunting Queries/Anomalous Entra High-Privilege Role Modification.yaml",
	"Hunting Queries/Anomalous Account Creation.yaml",
	"Hunting Queries/Anomalous Activity Role Assignment.yaml",
	"Hunting Queries/Anomalous Code Execution.yaml",
	"Hunting Queries/Anomalous Database Export Activity.yaml",
	"Hunting Queries/Anomalous Database Vulnerability Baseline Removal.yaml",
	"Hunting Queries/Anomalous Failed Logon.yaml",
	"Hunting Queries/Dormant Local Admin Logon.yaml",
	"Hunting Queries/Anomalous Geo Location Logon.yaml",
	"Hunting Queries/Anomalous Password Reset.yaml",
	"Hunting Queries/Anomalous RDP Activity.yaml",
	"Hunting Queries/Anomalous Resource Access.yaml",
	"Hunting Queries/Anomalous High-Privileged Role Assignment.yaml",
	"Hunting Queries/Anomalous Sign-in Activity.yaml",
	"Hunting Queries/Anomalous AWS Console Login Without MFA from Uncommon Country.yaml",
	"Hunting Queries/UEBA Multi-Source Anomalous Activity Overview.yaml",
	"Hunting Queries/Anomalous First-Time Device Logon.yaml",
	"Hunting Queries/Anomalous Okta First-Time or Uncommon Actions.yaml",
	"Hunting Queries/Anomalous GCP IAM Activity.yaml",
	"Hunting Queries/Anomalous High-Score Activity Triage.yaml",
	"Hunting Queries/Anomaly Template Distribution by Tactics and Techniques.yaml",
	"Hunting Queries/User-Centric Anomaly Investigation.yaml",
	"Hunting Queries/Anomaly Detection Trend Analysis.yaml",
	"Hunting Queries/Top Anomalous Source IP Triage.yaml"
  ],
  "Metadata": "SolutionMetadata.json",
  "BasePath": "C:\\GitHub\\Azure-Sentinel\\Solutions\\UEBA Essentials",
  "Version": "3.0.6",
  "TemplateSpec": true
}