Skip to content

Commit 00c713b

Browse files
woodsonsecurityCopilot
woodsonsecurity
and
Copilot
committed
Add Fivetran community solution (DCR-based connector, analytics, workbook)
Fivetran pushes its platform/connector logs to Azure Monitor via the Logs Ingestion API (DCR-based custom table). Ships a data-connector tile, parser, two analytics rules, a hunting query and a workbook, plus the generated V3 Content Hub package. - Register Fivetran in detection-template ValidConnectorIds allow-list - Connector tile uses canonical workspaces + workspaces/sharedKeys permissions (DCR Monitoring Metrics Publisher guidance remains in the instruction steps) - Community support link uses valid GitHub handle (woodsonsecurity) - Connector tile isPreview aligned with generated package - README references only shipped artifacts - MITRE-COVERAGE cites the authoritative T1562 -> T1685 redirect Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 7b63e6ab-b863-4d14-ba12-e1e7837eca8d
1 parent 7900bd0 commit 00c713b

19 files changed

Lines changed: 1832 additions & 1 deletion

‎.script/tests/detectionTemplateSchemaValidation/ValidConnectorIds.json‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -328,5 +328,6 @@
328328
"TailscaleCCF",
329329
"TailscalePremiumCCF",
330330
"WhisperSecurityConnector",
331-
"VaronisSaaSAlertsPush"
331+
"VaronisSaaSAlertsPush",
332+
"Fivetran"
332333
]

‎Solutions/Fivetran/Analytic Rules/FivetranAuthFailures.yaml‎

Lines changed: 45 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,45 @@
1+
id: bbfbff4e-134d-4e21-a56b-93bc1de7cc2c
2+
name: Fivetran - Repeated authentication failures
3+
description: 'Detects an unusually high number of Fivetran log events referencing authentication, authorization or credential failures within a short window. Repeated failures can indicate brute-force or credential-stuffing attempts against the accounts Fivetran uses, credential theft/misuse, or (more benignly) expired or revoked credentials. The threshold is tuned so routine one-off credential expiry does not alert.'
4+
kind: Scheduled
5+
severity: Medium
6+
status: Available
7+
requiredDataConnectors:
8+
- connectorId: Fivetran
9+
dataTypes:
10+
- Fivetran_CL
11+
queryFrequency: 1h
12+
queryPeriod: 1h
13+
triggerOperator: GreaterThan
14+
triggerThreshold: 0
15+
tactics:
16+
- CredentialAccess
17+
relevantTechniques:
18+
- T1110
19+
query: |
20+
let threshold = 10;
21+
Fivetran_CL
22+
| where Level in ("SEVERE", "WARNING")
23+
| where Message has_any (
24+
"authentication failed", "authentication error", "unauthorized",
25+
"invalid credentials", "invalid token", "access denied",
26+
"permission denied", "forbidden", "401", "403",
27+
"token expired", "credential", "auth failure", "login failed")
28+
| summarize FailureCount = count(), SampleMessages = make_set(Message, 5),
29+
FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated)
30+
by bin(TimeGenerated, 1h)
31+
| where FailureCount > threshold
32+
| sort by FailureCount desc
33+
| extend Application = "Fivetran"
34+
eventGroupingSettings:
35+
aggregationKind: AlertPerResult
36+
customDetails:
37+
FailureCount: FailureCount
38+
FirstSeen: FirstSeen
39+
LastSeen: LastSeen
40+
entityMappings:
41+
- entityType: CloudApplication
42+
fieldMappings:
43+
- identifier: Name
44+
columnName: Application
45+
version: 1.0.0

‎Solutions/Fivetran/Analytic Rules/FivetranIngestionGap.yaml‎

Lines changed: 39 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,39 @@
1+
id: 5f539c60-f2ed-4a22-b779-75a50ea1b919
2+
name: Fivetran - Log ingestion gap (telemetry loss)
3+
description: 'Alerts when no Fivetran logs have been received in Fivetran_CL for more than 2 hours. A gap can indicate a broken Fivetran-to-Sentinel pipeline, disabled logging, expired app credentials, or deliberately impaired security telemetry.'
4+
kind: Scheduled
5+
severity: Medium
6+
status: Available
7+
requiredDataConnectors:
8+
- connectorId: Fivetran
9+
dataTypes:
10+
- Fivetran_CL
11+
queryFrequency: 1h
12+
queryPeriod: 14d
13+
triggerOperator: GreaterThan
14+
triggerThreshold: 0
15+
tactics:
16+
- DefenseEvasion
17+
relevantTechniques:
18+
- T1562
19+
query: |
20+
let lookback = 14d;
21+
let gapThreshold = 2h;
22+
Fivetran_CL
23+
| where TimeGenerated > ago(lookback)
24+
| summarize LastLogReceived = max(TimeGenerated)
25+
| extend GapDuration = now() - LastLogReceived
26+
| where GapDuration > gapThreshold
27+
| extend Reason = strcat("No Fivetran logs received for ", format_timespan(GapDuration, 'dd.hh:mm:ss'))
28+
| extend Application = "Fivetran"
29+
eventGroupingSettings:
30+
aggregationKind: SingleAlert
31+
customDetails:
32+
LastLogReceived: LastLogReceived
33+
Reason: Reason
34+
entityMappings:
35+
- entityType: CloudApplication
36+
fieldMappings:
37+
- identifier: Name
38+
columnName: Application
39+
version: 1.0.0

‎Solutions/Fivetran/Data Connectors/Fivetran_CCF/Fivetran_DCR.json‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
[
2+
{
3+
"name": "fivetranDCR1",
4+
"apiVersion": "2022-06-01",
5+
"type": "Microsoft.Insights/dataCollectionRules",
6+
"location": "{{location}}",
7+
"kind": "Direct",
8+
"properties": {
9+
"streamDeclarations": {
10+
"Custom-Fivetran_CL": {
11+
"columns": [
12+
{ "name": "Level", "type": "string" },
13+
{ "name": "CreatedAt", "type": "datetime" },
14+
{ "name": "Message", "type": "string" }
15+
]
16+
}
17+
},
18+
"destinations": {
19+
"logAnalytics": [
20+
{
21+
"workspaceResourceId": "{{workspaceResourceId}}",
22+
"name": "clv2ws1"
23+
}
24+
]
25+
},
26+
"dataFlows": [
27+
{
28+
"streams": [ "Custom-Fivetran_CL" ],
29+
"destinations": [ "clv2ws1" ],
30+
"outputStream": "Custom-Fivetran_CL",
31+
"transformKql": "source | extend TimeGenerated = CreatedAt"
32+
}
33+
]
34+
}
35+
}
36+
]

‎Solutions/Fivetran/Data Connectors/Fivetran_CCF/Fivetran_DataConnector.json‎

Lines changed: 95 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,95 @@
1+
{
2+
"id": "Fivetran",
3+
"title": "Fivetran Platform Logs",
4+
"publisher": "Michael Woods",
5+
"descriptionMarkdown": "Ingests Fivetran platform and connector logs into Microsoft Sentinel via the Azure Monitor Logs Ingestion API (DCR-based custom table). Fivetran PUSHES its own logs to a Data Collection Rule using an Entra ID app; this tile shows connection status and provides sample queries. It does not itself move data - ingestion is driven by Fivetran plus the DCR.",
6+
"graphQueries": [
7+
{
8+
"metricName": "Total Fivetran log events received",
9+
"legend": "Fivetran_CL",
10+
"baseQuery": "Fivetran_CL"
11+
}
12+
],
13+
"sampleQueries": [
14+
{
15+
"description": "All Fivetran log events (latest first)",
16+
"query": "Fivetran_CL\n| sort by TimeGenerated desc"
17+
},
18+
{
19+
"description": "Errors and warnings only",
20+
"query": "Fivetran_CL\n| where Level in (\"SEVERE\", \"WARNING\")\n| sort by TimeGenerated desc"
21+
},
22+
{
23+
"description": "Event volume by level over time",
24+
"query": "Fivetran_CL\n| summarize count() by Level, bin(TimeGenerated, 1h)"
25+
}
26+
],
27+
"dataTypes": [
28+
{
29+
"name": "Fivetran_CL",
30+
"lastDataReceivedQuery": "Fivetran_CL\n| summarize Time = max(TimeGenerated)\n| where isnotempty(Time)"
31+
}
32+
],
33+
"connectivityCriterias": [
34+
{
35+
"type": "IsConnectedQuery",
36+
"value": [
37+
"Fivetran_CL\n| summarize LastLogReceived = max(TimeGenerated)\n| project IsConnected = LastLogReceived > ago(30d)"
38+
]
39+
}
40+
],
41+
"availability": {
42+
"status": 1,
43+
"isPreview": false
44+
},
45+
"permissions": {
46+
"resourceProvider": [
47+
{
48+
"provider": "Microsoft.OperationalInsights/workspaces",
49+
"permissionsDisplayText": "read and write permissions are required.",
50+
"providerDisplayName": "Workspace",
51+
"scope": "Workspace",
52+
"requiredPermissions": {
53+
"write": true,
54+
"read": true,
55+
"delete": true
56+
}
57+
},
58+
{
59+
"provider": "Microsoft.OperationalInsights/workspaces/sharedKeys",
60+
"permissionsDisplayText": "read permissions to shared keys for the workspace are required. [See the documentation to learn more about workspace keys](https://docs.microsoft.com/azure/azure-monitor/platform/agent-windows#obtain-workspace-id-and-key).",
61+
"providerDisplayName": "Keys",
62+
"scope": "Workspace",
63+
"requiredPermissions": {
64+
"action": true
65+
}
66+
}
67+
]
68+
},
69+
"instructionSteps": [
70+
{
71+
"title": "1. Register an Entra ID app for Fivetran",
72+
"description": "In Microsoft Entra ID > App registrations, create an app and a client secret. Record the Application (Client) ID, Directory (Tenant) ID and secret value."
73+
},
74+
{
75+
"title": "2. Create the custom table, DCE and DCR",
76+
"description": "Deploy Fivetran_CL (columns TimeGenerated, Level, CreatedAt, Message) and a Data Collection Rule with stream Custom-Fivetran_CL and transform `source | extend TimeGenerated = CreatedAt`. See the michaelwoods-fivetran skill azure-setup.md."
77+
},
78+
{
79+
"title": "3. Grant the app access to the DCR",
80+
"description": "Assign the Entra app the Monitoring Metrics Publisher role on the DCR."
81+
},
82+
{
83+
"title": "4. Configure Fivetran",
84+
"description": "In Fivetran's external-log (Azure Monitor) setup form, choose the Logs Ingestion API mode and enter the Client ID, Tenant ID, Client secret, Logs Ingestion URI (or DCR logIngestion endpoint), DCR immutableId and stream name Custom-Fivetran_CL. Click Save & Test."
85+
}
86+
],
87+
"metadata": {
88+
"id": "138ff805-42c0-4c6c-b687-df18187a20fe",
89+
"version": "1.0.0",
90+
"kind": "dataConnector",
91+
"source": { "kind": "community" },
92+
"author": { "name": "Michael Woods" },
93+
"support": { "name": "Michael Woods", "tier": "developer" }
94+
}
95+
}

‎Solutions/Fivetran/Data Connectors/Fivetran_CCF/Fivetran_Table.json‎

Lines changed: 37 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,37 @@
1+
[
2+
{
3+
"name": "Fivetran_CL",
4+
"type": "Microsoft.OperationalInsights/workspaces/tables",
5+
"apiVersion": "2021-12-01-preview",
6+
"properties": {
7+
"totalRetentionInDays": 365,
8+
"plan": "Analytics",
9+
"schema": {
10+
"name": "Fivetran_CL",
11+
"description": "Fivetran platform and connector logs pushed via the Azure Monitor Logs Ingestion API (DCR-based custom table).",
12+
"columns": [
13+
{
14+
"name": "TimeGenerated",
15+
"type": "DateTime",
16+
"description": "Log Analytics ingestion timestamp, derived from CreatedAt in the DCR transform."
17+
},
18+
{
19+
"name": "Level",
20+
"type": "String",
21+
"description": "Log level reported by Fivetran (INFO, WARNING, SEVERE)."
22+
},
23+
{
24+
"name": "CreatedAt",
25+
"type": "DateTime",
26+
"description": "Timestamp of the log event as sent by Fivetran."
27+
},
28+
{
29+
"name": "Message",
30+
"type": "String",
31+
"description": "Log message body."
32+
}
33+
]
34+
}
35+
}
36+
}
37+
]

‎Solutions/Fivetran/Data/Solution_Fivetran.json‎

Lines changed: 27 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,27 @@
1+
{
2+
"Name": "Fivetran",
3+
"Author": "Michael Woods - michaelwoods@microsoft.com",
4+
"Logo": "\u003cimg src=\"https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/Logos/Fivetran.svg\" width=\"75px\" height=\"75px\"\u003e",
5+
"Description": "The Fivetran Solution for Microsoft Sentinel ingests Fivetran platform and connector logs into a DCR-based custom table using the Azure Monitor Logs Ingestion API. Fivetran pushes its own logs directly to a Data Collection Rule; this solution ships the custom table, DCR, a data-connector tile, a parser, two analytics rules, a hunting query and a workbook to give SecOps visibility of the Fivetran data pipeline.",
6+
"Data Connectors": [
7+
"Data Connectors/Fivetran_CCF/Fivetran_DataConnector.json"
8+
],
9+
"Parsers": [
10+
"Parsers/Fivetran.yaml"
11+
],
12+
"Analytic Rules": [
13+
"Analytic Rules/FivetranIngestionGap.yaml",
14+
"Analytic Rules/FivetranAuthFailures.yaml"
15+
],
16+
"Hunting Queries": [
17+
"Hunting Queries/FivetranSevereSpike.yaml"
18+
],
19+
"Workbooks": [
20+
"Workbooks/Fivetran.json"
21+
],
22+
"BasePath": "C:\\GitHub\\Azure-Sentinel\\Solutions\\Fivetran",
23+
"Version": "3.0.0",
24+
"Metadata": "SolutionMetadata.json",
25+
"TemplateSpec": true,
26+
"Is1PConnector": false
27+
}

‎Solutions/Fivetran/Hunting Queries/FivetranSevereSpike.yaml‎

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
id: 2de1fd60-97f4-4072-b78a-94dc7b047a63
2+
name: Fivetran - Spike in SEVERE log events
3+
description: 'Surfaces hourly windows with an unusually high number of Fivetran SEVERE-level events, which can indicate connector failures, credential problems, or data-pipeline tampering.'
4+
requiredDataConnectors:
5+
- connectorId: Fivetran
6+
dataTypes:
7+
- Fivetran_CL
8+
tactics:
9+
- DefenseEvasion
10+
relevantTechniques:
11+
- T1562
12+
query: |
13+
Fivetran_CL
14+
| where Level == "SEVERE"
15+
| summarize SevereCount = count(), SampleMessages = make_set(Message, 5) by bin(TimeGenerated, 1h)
16+
| where SevereCount > 10
17+
| sort by TimeGenerated desc
18+
version: 1.0.0

‎Solutions/Fivetran/MITRE-COVERAGE.md‎

Lines changed: 49 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,49 @@
1+
# MITRE ATT&CK coverage - Fivetran solution
2+
3+
Verified 2026-07-22 against
4+
https://learn.microsoft.com/en-us/azure/sentinel/mitre-coverage (Sentinel aligns
5+
to **ATT&CK v18**) and the live ATT&CK knowledge base.
6+
7+
## Mappings
8+
9+
| Artifact | Tactic | Technique | Why it is appropriate |
10+
| --- | --- | --- | --- |
11+
| `Analytic Rules/FivetranIngestionGap.yaml` | Defense Evasion | **T1562** (Impair Defenses) | A stop in Fivetran log ingestion = loss/impairment of security telemetry, the core behaviour T1562 covers (disrupting logging/forwarding pipelines and SIEM ingestion). |
12+
| `Analytic Rules/FivetranAuthFailures.yaml` | Credential Access | **T1110** (Brute Force) | A spike of authentication/authorization/credential failures in the Fivetran log stream matches the brute-force / credential-stuffing pattern against the accounts Fivetran uses. Threshold-based (>10/hour) so routine one-off credential expiry does not alert. Same mapping used by comparable Content Hub rules (Bitglass MultipleFailedLogins, GitLab BruteForce). |
13+
| `Hunting Queries/FivetranSevereSpike.yaml` | Defense Evasion | **T1562** (Impair Defenses) | A surge of SEVERE pipeline errors can indicate the log source being degraded or tampered with. Corrected from the initial `Impact`/`T1499` (Endpoint DoS), which specifically means resource-exhaustion/flooding and does not describe pipeline errors. |
14+
15+
The detections cover two real, distinct risks: **protecting the integrity and
16+
availability of the Fivetran security log source** (Defense Evasion / T1562) and
17+
**detecting credential attacks against the Fivetran service accounts** (Credential
18+
Access / T1110). Accuracy was prioritised over breadth - no technique is claimed
19+
that the query does not actually evidence.
20+
21+
### Honesty note on T1110
22+
23+
The only signal fields Fivetran emits are `Level`, `CreatedAt` and `Message`;
24+
there is no structured account or source-IP field, so no entity mappings are
25+
asserted. The T1110 claim rests on a *volume threshold* of failure-keyword
26+
messages, which is the defensible brute-force signal. A low count could also be
27+
benign credential expiry, which is why the rule only fires above the threshold.
28+
29+
## Important version note (why we use T1562, not T1685)
30+
31+
In the current MITRE ATT&CK knowledge base, **Impair Defenses was renumbered from
32+
`T1562` to `T1685`** (the old `T1562` and `T1562.008` URLs now redirect to
33+
`T1685` / `T1685/002`). This is verifiable directly at
34+
https://attack.mitre.org/techniques/T1562/ which issues an HTTP redirect to
35+
https://attack.mitre.org/techniques/T1685/ (checked 2026-07-26).
36+
37+
However, **Microsoft Sentinel and the Azure-Sentinel Content Hub tooling still use
38+
`T1562`** - every current solution rule maps to `T1562` and there are zero uses of
39+
`T1685` in the repo. Using `T1685` today would fail solution validation and would
40+
not light up the Sentinel MITRE coverage matrix. Revisit if/when Sentinel tooling
41+
adopts the `T1685` numbering.
42+
43+
## How to confirm coverage after deployment
44+
45+
In the Defender portal: **Microsoft Sentinel > Threat management > MITRE ATT&CK**.
46+
Search technique `T1562`; once the ingestion-gap analytics rule is active (and the
47+
hunting query present) the tile shows active/simulated coverage for Defense Evasion
48+
- Impair Defenses. Search `T1110`; once the auth-failures analytics rule is active
49+
the tile shows coverage for Credential Access - Brute Force.

0 commit comments

Comments
 (0)