{ "Name": "Microsoft Business Applications", "Author": "Microsoft", "Logo": "", "Description": "Microsoft Power Platform provides a wide range of tools for citizen developers to build, run and manage low-code and no-code applications quickly, simply and at scale. With that, it also introduces a concern around the risk of security vulnerabilities introduced by citizen developers, some of whom may lack the security awareness of traditional pro-dev community. To counter this, early threat detection is crucial and can complement preventative guardrails to enable frictionless productivity while minimizing cyber risk.\n\nThe Microsoft Sentinel solution for Microsoft Power Platform allows customers to monitor and detect various suspicious or malicious activities in their Power Platform environments.\n\nIt collects activity logs from the different Power Platform components (Power Apps, Power Automate, Power Platform Connectors, Power Platform DLP, Dataverse) as well as the Power Platform inventory data and analyzes those activity logs to detect threats and suspicious activities such as: Power Apps execution from unauthorized geographies, suspicious data destruction by Power Apps, mass deletion of Power Apps, phishing attacks made possible through Power Apps, Power Automate flows activity by departing employees, Microsoft Power Platform connectors added to the an environment, and the update or removal of Microsoft Power Platform data loss prevention policies.\n\nDue to the integration of the Power Platform inventory data, in addition to the activity logs, the solution also allows customers to investigate the detected threats in a full human readable context and understand for example what the name of the suspicious app is, the name of Power Platform environment it belongs to, the details of the user who created or modified the suspicious app, the details of the users using the app, and more.\n\n**Important**\n\n- Please review the solution [documentation](https://learn.microsoft.com/azure/sentinel/business-applications/power-platform-solution-overview) to learn more about deploying, configuring and using this solution.", "Data Connectors": [ "/Data Connectors/DynamicsFinOpsPollerConnector/DynamicsFinOps_DataConnectorDefinition.json" ], "Workbooks": [ "/Workbooks/Dynamics365Activity.json" ], "Analytic Rules": [ "/Analytic Rules/Dataverse - Anomalous application user activity.yaml", "/Analytic Rules/Dataverse - Audit log data deletion.yaml", "/Analytic Rules/Dataverse - Audit logging disabled.yaml", "/Analytic Rules/Dataverse - Bulk record ownership re-assignment or sharing.yaml", "/Analytic Rules/Dataverse - Executable uploaded to SharePoint document management site.yaml", "/Analytic Rules/Dataverse - Export activity from terminated or notified employee.yaml", "/Analytic Rules/Dataverse - Guest user exfiltration following Power Platform defense impairment.yaml", "/Analytic Rules/Dataverse - Hierarchy security manipulation.yaml", "/Analytic Rules/Dataverse - Honeypot instance activity.yaml", "/Analytic Rules/Dataverse - Login by a sensitive privileged user.yaml", "/Analytic Rules/Dataverse - Login from IP in the block list.yaml", "/Analytic Rules/Dataverse - Login from IP not in the allow list.yaml", "/Analytic Rules/Dataverse - Malware found in SharePoint document management site.yaml", "/Analytic Rules/Dataverse - Mass deletion of records.yaml", "/Analytic Rules/Dataverse - Mass download from SharePoint document management.yaml", "/Analytic Rules/Dataverse - Mass export of records to Excel.yaml", "/Analytic Rules/Dataverse - Mass record updates.yaml", "/Analytic Rules/Dataverse - New Dataverse application user activity type.yaml", "/Analytic Rules/Dataverse - New non-interactive identity granted access.yaml", "/Analytic Rules/Dataverse - New sign-in from an unauthorized domain.yaml", "/Analytic Rules/Dataverse - New user agent type that was not used before.yaml", "/Analytic Rules/Dataverse - New user agent type that was not used with Office 365.yaml", "/Analytic Rules/Dataverse - Organization settings modified.yaml", "/Analytic Rules/Dataverse - Removal of blocked file extensions.yaml", "/Analytic Rules/Dataverse - SharePoint document management site added or updated.yaml", "/Analytic Rules/Dataverse - Suspicious security role modifications.yaml", "/Analytic Rules/Dataverse - Suspicious use of TDS endpoint.yaml", "/Analytic Rules/Dataverse - Suspicious use of Web API.yaml", "/Analytic Rules/Dataverse - TI map IP to DataverseActivity.yaml", "/Analytic Rules/Dataverse - TI map URL to DataverseActivity.yaml", "/Analytic Rules/Dataverse - Terminated employee exfiltration over email.yaml", "/Analytic Rules/Dataverse - Terminated employee exfiltration to USB drive.yaml", "/Analytic Rules/Dataverse - Unusual sign-in following disabled IP address-based cookie binding protection.yaml", "/Analytic Rules/Dataverse - User bulk retrieval outside normal activity.yaml", "/Analytic Rules/F&O - Bank account change following network alias reassignment.yaml", "/Analytic Rules/F&O - Mass update or deletion of user records.yaml", "/Analytic Rules/F&O - Non-interactive account mapped to self or sensitive privileged user.yaml", "/Analytic Rules/F&O - Reverted bank account number modifications.yaml", "/Analytic Rules/F&O - Unusual sign-in activity using single factor authentication.yaml", "/Analytic Rules/Power Apps - App activity from unauthorized geo.yaml", "/Analytic Rules/Power Apps - Bulk sharing of Power Apps to newly created guest users.yaml", "/Analytic Rules/Power Apps - Multiple apps deleted.yaml", "/Analytic Rules/Power Apps - Multiple users access a malicious link after launching new app.yaml", "/Analytic Rules/Power Automate - Departing employee flow activity.yaml", "/Analytic Rules/Power Automate - Unusual bulk deletion of flow resources.yaml", "/Analytic Rules/Power Platform - Account added to privileged Microsoft Entra roles.yaml", "/Analytic Rules/Power Platform - Connector added to a sensitive environment.yaml", "/Analytic Rules/Power Platform - DLP policy updated or removed.yaml", "/Analytic Rules/Power Platform - Possibly compromised user accesses Power Platform services.yaml" ], "Hunting Queries": [ "/Hunting Queries/Dataverse - Activity after Microsoft Entra alerts.yaml", "/Hunting Queries/Dataverse - Activity after failed logons.yaml", "/Hunting Queries/Dataverse - Cross-environment data export activity.yaml", "/Hunting Queries/Dataverse - Dataverse export copied to USB devices.yaml", "/Hunting Queries/Dataverse - Generic client app used to access production environments.yaml", "/Hunting Queries/Dataverse - Identity management activity outside of privileged directory role membership.yaml", "/Hunting Queries/Dataverse - Identity management changes without MFA.yaml", "/Hunting Queries/Power Apps - Anomalous bulk sharing of Power App to newly created guest users.yaml" ], "Playbooks": [ "/Playbooks/Dataverse-Add-SharePoint-Site/azuredeploy.json", "/Playbooks/Dataverse-Blocklist-Add-User-AlertTrigger/azuredeploy.json", "/Playbooks/Dataverse-Blocklist-Add-User-Via-Outlook/azuredeploy.json", "/Playbooks/Dataverse-Blocklist-Add-User-Via-Teams/azuredeploy.json", "/Playbooks/Dataverse-Blocklist-Add-User/azuredeploy.json", "/Playbooks/Dataverse-Blocklist-Remove-User-AlertTrigger/azuredeploy.json", "/Playbooks/Dataverse-Send-Manager-Notification/azuredeploy.json", "/Playbooks/MSBizApps-Incident-From-Alert-Teams/azuredeploy.json" ], "Parsers": [ "/Parsers/DataverseSharePointSites.yaml", "/Parsers/MSBizAppsNetworkAddresses.yaml", "/Parsers/MSBizAppsOrgSettings.yaml", "/Parsers/MSBizAppsTerminatedEmployees.yaml", "/Parsers/MSBizAppsVIPUsers.yaml" ], "Watchlists": [ "/Watchlists/MSBizApps-Configuration.json" ], "BasePath": "/__w/1/s/Artifacts/Power Platform", "Version": "3.2.3", "Metadata": "SolutionMetadata.json", "TemplateSpec": true, "Is1PConnector": false }