Skip to content

Commit 1f499b3

Browse files
woodsonsecurityCopilot
woodsonsecurity
and
Copilot
committed
Add Fivetran community solution (DCR-based connector, analytics, workbook)
Fivetran pushes its platform/connector logs to Azure Monitor via the Logs Ingestion API (DCR-based custom table). Ships a data-connector tile, parser, two analytics rules, a hunting query and a workbook, plus the generated V3 Content Hub package. - Register Fivetran in detection-template ValidConnectorIds allow-list - Connector tile uses canonical workspaces + workspaces/sharedKeys permissions (DCR Monitoring Metrics Publisher guidance remains in the instruction steps) - Community support link uses valid GitHub handle (woodsonsecurity) - Connector tile isPreview aligned with generated package - README references only shipped artifacts - MITRE-COVERAGE cites the authoritative T1562 -> T1685 redirect Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 7b63e6ab-b863-4d14-ba12-e1e7837eca8d
1 parent 7900bd0 commit 1f499b3

21 files changed

Lines changed: 1865 additions & 1 deletion

File tree

‎.script/tests/KqlvalidationsTests/CustomTables/Fivetran_CL.json‎

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
{
2+
"Name": "Fivetran_CL",
3+
"Properties": [
4+
{
5+
"Name": "TimeGenerated",
6+
"Type": "DateTime"
7+
},
8+
{
9+
"Name": "Level",
10+
"Type": "String"
11+
},
12+
{
13+
"Name": "CreatedAt",
14+
"Type": "DateTime"
15+
},
16+
{
17+
"Name": "Message",
18+
"Type": "String"
19+
}
20+
]
21+
}

‎.script/tests/detectionTemplateSchemaValidation/ValidConnectorIds.json‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -328,5 +328,6 @@
328328
"TailscaleCCF",
329329
"TailscalePremiumCCF",
330330
"WhisperSecurityConnector",
331-
"VaronisSaaSAlertsPush"
331+
"VaronisSaaSAlertsPush",
332+
"Fivetran"
332333
]

‎Logos/Fivetran.svg‎

Lines changed: 12 additions & 0 deletions
Loading

‎Solutions/Fivetran/Analytic Rules/FivetranAuthFailures.yaml‎

Lines changed: 45 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,45 @@
1+
id: bbfbff4e-134d-4e21-a56b-93bc1de7cc2c
2+
name: Fivetran - Repeated authentication failures
3+
description: 'Detects an unusually high number of Fivetran log events referencing authentication, authorization or credential failures within a short window. Repeated failures can indicate brute-force or credential-stuffing attempts against the accounts Fivetran uses, credential theft/misuse, or (more benignly) expired or revoked credentials. The threshold is tuned so routine one-off credential expiry does not alert.'
4+
kind: Scheduled
5+
severity: Medium
6+
status: Available
7+
requiredDataConnectors:
8+
- connectorId: Fivetran
9+
dataTypes:
10+
- Fivetran_CL
11+
queryFrequency: 1h
12+
queryPeriod: 1h
13+
triggerOperator: GreaterThan
14+
triggerThreshold: 0
15+
tactics:
16+
- CredentialAccess
17+
relevantTechniques:
18+
- T1110
19+
query: |
20+
let threshold = 10;
21+
Fivetran_CL
22+
| where Level in ("SEVERE", "WARNING")
23+
| where Message has_any (
24+
"authentication failed", "authentication error", "unauthorized",
25+
"invalid credentials", "invalid token", "access denied",
26+
"permission denied", "forbidden", "401", "403",
27+
"token expired", "credential", "auth failure", "login failed")
28+
| summarize FailureCount = count(), SampleMessages = make_set(Message, 5),
29+
FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated)
30+
by bin(TimeGenerated, 1h)
31+
| where FailureCount > threshold
32+
| sort by FailureCount desc
33+
| extend Application = "Fivetran"
34+
eventGroupingSettings:
35+
aggregationKind: AlertPerResult
36+
customDetails:
37+
FailureCount: FailureCount
38+
FirstSeen: FirstSeen
39+
LastSeen: LastSeen
40+
entityMappings:
41+
- entityType: CloudApplication
42+
fieldMappings:
43+
- identifier: Name
44+
columnName: Application
45+
version: 1.0.0

‎Solutions/Fivetran/Analytic Rules/FivetranIngestionGap.yaml‎

Lines changed: 39 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,39 @@
1+
id: 5f539c60-f2ed-4a22-b779-75a50ea1b919
2+
name: Fivetran - Log ingestion gap (telemetry loss)
3+
description: 'Alerts when no Fivetran logs have been received in Fivetran_CL for more than 2 hours. A gap can indicate a broken Fivetran-to-Sentinel pipeline, disabled logging, expired app credentials, or deliberately impaired security telemetry.'
4+
kind: Scheduled
5+
severity: Medium
6+
status: Available
7+
requiredDataConnectors:
8+
- connectorId: Fivetran
9+
dataTypes:
10+
- Fivetran_CL
11+
queryFrequency: 1h
12+
queryPeriod: 14d
13+
triggerOperator: GreaterThan
14+
triggerThreshold: 0
15+
tactics:
16+
- DefenseEvasion
17+
relevantTechniques:
18+
- T1562
19+
query: |
20+
let lookback = 14d;
21+
let gapThreshold = 2h;
22+
Fivetran_CL
23+
| where TimeGenerated > ago(lookback)
24+
| summarize LastLogReceived = max(TimeGenerated)
25+
| extend GapDuration = now() - LastLogReceived
26+
| where GapDuration > gapThreshold
27+
| extend Reason = strcat("No Fivetran logs received for ", format_timespan(GapDuration, 'dd.hh:mm:ss'))
28+
| extend Application = "Fivetran"
29+
eventGroupingSettings:
30+
aggregationKind: SingleAlert
31+
customDetails:
32+
LastLogReceived: LastLogReceived
33+
Reason: Reason
34+
entityMappings:
35+
- entityType: CloudApplication
36+
fieldMappings:
37+
- identifier: Name
38+
columnName: Application
39+
version: 1.0.0

‎Solutions/Fivetran/Data Connectors/Fivetran_CCF/Fivetran_DCR.json‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
[
2+
{
3+
"name": "fivetranDCR1",
4+
"apiVersion": "2022-06-01",
5+
"type": "Microsoft.Insights/dataCollectionRules",
6+
"location": "{{location}}",
7+
"kind": "Direct",
8+
"properties": {
9+
"streamDeclarations": {
10+
"Custom-Fivetran_CL": {
11+
"columns": [
12+
{ "name": "Level", "type": "string" },
13+
{ "name": "CreatedAt", "type": "datetime" },
14+
{ "name": "Message", "type": "string" }
15+
]
16+
}
17+
},
18+
"destinations": {
19+
"logAnalytics": [
20+
{
21+
"workspaceResourceId": "{{workspaceResourceId}}",
22+
"name": "clv2ws1"
23+
}
24+
]
25+
},
26+
"dataFlows": [
27+
{
28+
"streams": [ "Custom-Fivetran_CL" ],
29+
"destinations": [ "clv2ws1" ],
30+
"outputStream": "Custom-Fivetran_CL",
31+
"transformKql": "source | extend TimeGenerated = CreatedAt"
32+
}
33+
]
34+
}
35+
}
36+
]

‎Solutions/Fivetran/Data Connectors/Fivetran_CCF/Fivetran_DataConnector.json‎

Lines changed: 95 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,95 @@
1+
{
2+
"id": "Fivetran",
3+
"title": "Fivetran Platform Logs",
4+
"publisher": "Michael Woods",
5+
"descriptionMarkdown": "Ingests Fivetran platform and connector logs into Microsoft Sentinel via the Azure Monitor Logs Ingestion API (DCR-based custom table). Fivetran PUSHES its own logs to a Data Collection Rule using an Entra ID app; this tile shows connection status and provides sample queries. It does not itself move data - ingestion is driven by Fivetran plus the DCR.",
6+
"graphQueries": [
7+
{
8+
"metricName": "Total Fivetran log events received",
9+
"legend": "Fivetran_CL",
10+
"baseQuery": "Fivetran_CL"
11+
}
12+
],
13+
"sampleQueries": [
14+
{
15+
"description": "All Fivetran log events (latest first)",
16+
"query": "Fivetran_CL\n| sort by TimeGenerated desc"
17+
},
18+
{
19+
"description": "Errors and warnings only",
20+
"query": "Fivetran_CL\n| where Level in (\"SEVERE\", \"WARNING\")\n| sort by TimeGenerated desc"
21+
},
22+
{
23+
"description": "Event volume by level over time",
24+
"query": "Fivetran_CL\n| summarize count() by Level, bin(TimeGenerated, 1h)"
25+
}
26+
],
27+
"dataTypes": [
28+
{
29+
"name": "Fivetran_CL",
30+
"lastDataReceivedQuery": "Fivetran_CL\n| summarize Time = max(TimeGenerated)\n| where isnotempty(Time)"
31+
}
32+
],
33+
"connectivityCriterias": [
34+
{
35+
"type": "IsConnectedQuery",
36+
"value": [
37+
"Fivetran_CL\n| summarize LastLogReceived = max(TimeGenerated)\n| project IsConnected = LastLogReceived > ago(30d)"
38+
]
39+
}
40+
],
41+
"availability": {
42+
"status": 1,
43+
"isPreview": false
44+
},
45+
"permissions": {
46+
"resourceProvider": [
47+
{
48+
"provider": "Microsoft.OperationalInsights/workspaces",
49+
"permissionsDisplayText": "read and write permissions are required.",
50+
"providerDisplayName": "Workspace",
51+
"scope": "Workspace",
52+
"requiredPermissions": {
53+
"write": true,
54+
"read": true,
55+
"delete": true
56+
}
57+
},
58+
{
59+
"provider": "Microsoft.OperationalInsights/workspaces/sharedKeys",
60+
"permissionsDisplayText": "read permissions to shared keys for the workspace are required. [See the documentation to learn more about workspace keys](https://docs.microsoft.com/azure/azure-monitor/platform/agent-windows#obtain-workspace-id-and-key).",
61+
"providerDisplayName": "Keys",
62+
"scope": "Workspace",
63+
"requiredPermissions": {
64+
"action": true
65+
}
66+
}
67+
]
68+
},
69+
"instructionSteps": [
70+
{
71+
"title": "1. Register an Entra ID app for Fivetran",
72+
"description": "In Microsoft Entra ID > App registrations, create an app and a client secret. Record the Application (Client) ID, Directory (Tenant) ID and secret value."
73+
},
74+
{
75+
"title": "2. Create the custom table, DCE and DCR",
76+
"description": "Deploy Fivetran_CL (columns TimeGenerated, Level, CreatedAt, Message) and a Data Collection Rule with stream Custom-Fivetran_CL and transform `source | extend TimeGenerated = CreatedAt`. See the michaelwoods-fivetran skill azure-setup.md."
77+
},
78+
{
79+
"title": "3. Grant the app access to the DCR",
80+
"description": "Assign the Entra app the Monitoring Metrics Publisher role on the DCR."
81+
},
82+
{
83+
"title": "4. Configure Fivetran",
84+
"description": "In Fivetran's external-log (Azure Monitor) setup form, choose the Logs Ingestion API mode and enter the Client ID, Tenant ID, Client secret, Logs Ingestion URI (or DCR logIngestion endpoint), DCR immutableId and stream name Custom-Fivetran_CL. Click Save & Test."
85+
}
86+
],
87+
"metadata": {
88+
"id": "138ff805-42c0-4c6c-b687-df18187a20fe",
89+
"version": "1.0.0",
90+
"kind": "dataConnector",
91+
"source": { "kind": "community" },
92+
"author": { "name": "Michael Woods" },
93+
"support": { "name": "Michael Woods", "tier": "developer" }
94+
}
95+
}

‎Solutions/Fivetran/Data Connectors/Fivetran_CCF/Fivetran_Table.json‎

Lines changed: 37 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,37 @@
1+
[
2+
{
3+
"name": "Fivetran_CL",
4+
"type": "Microsoft.OperationalInsights/workspaces/tables",
5+
"apiVersion": "2021-12-01-preview",
6+
"properties": {
7+
"totalRetentionInDays": 365,
8+
"plan": "Analytics",
9+
"schema": {
10+
"name": "Fivetran_CL",
11+
"description": "Fivetran platform and connector logs pushed via the Azure Monitor Logs Ingestion API (DCR-based custom table).",
12+
"columns": [
13+
{
14+
"name": "TimeGenerated",
15+
"type": "DateTime",
16+
"description": "Log Analytics ingestion timestamp, derived from CreatedAt in the DCR transform."
17+
},
18+
{
19+
"name": "Level",
20+
"type": "String",
21+
"description": "Log level reported by Fivetran (INFO, WARNING, SEVERE)."
22+
},
23+
{
24+
"name": "CreatedAt",
25+
"type": "DateTime",
26+
"description": "Timestamp of the log event as sent by Fivetran."
27+
},
28+
{
29+
"name": "Message",
30+
"type": "String",
31+
"description": "Log message body."
32+
}
33+
]
34+
}
35+
}
36+
}
37+
]

‎Solutions/Fivetran/Data/Solution_Fivetran.json‎

Lines changed: 27 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,27 @@
1+
{
2+
"Name": "Fivetran",
3+
"Author": "Michael Woods - michaelwoods@microsoft.com",
4+
"Logo": "\u003cimg src=\"https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/Logos/Fivetran.svg\" width=\"75px\" height=\"75px\"\u003e",
5+
"Description": "The Fivetran Solution for Microsoft Sentinel ingests Fivetran platform and connector logs into a DCR-based custom table using the Azure Monitor Logs Ingestion API. Fivetran pushes its own logs directly to a Data Collection Rule; this solution ships the custom table, DCR, a data-connector tile, a parser, two analytics rules, a hunting query and a workbook to give SecOps visibility of the Fivetran data pipeline.",
6+
"Data Connectors": [
7+
"Data Connectors/Fivetran_CCF/Fivetran_DataConnector.json"
8+
],
9+
"Parsers": [
10+
"Parsers/Fivetran.yaml"
11+
],
12+
"Analytic Rules": [
13+
"Analytic Rules/FivetranIngestionGap.yaml",
14+
"Analytic Rules/FivetranAuthFailures.yaml"
15+
],
16+
"Hunting Queries": [
17+
"Hunting Queries/FivetranSevereSpike.yaml"
18+
],
19+
"Workbooks": [
20+
"Workbooks/Fivetran.json"
21+
],
22+
"BasePath": "C:\\GitHub\\Azure-Sentinel\\Solutions\\Fivetran",
23+
"Version": "3.0.0",
24+
"Metadata": "SolutionMetadata.json",
25+
"TemplateSpec": true,
26+
"Is1PConnector": false
27+
}

‎Solutions/Fivetran/Hunting Queries/FivetranSevereSpike.yaml‎

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
id: 2de1fd60-97f4-4072-b78a-94dc7b047a63
2+
name: Fivetran - Spike in SEVERE log events
3+
description: 'Surfaces hourly windows with an unusually high number of Fivetran SEVERE-level events, which can indicate connector failures, credential problems, or data-pipeline tampering.'
4+
requiredDataConnectors:
5+
- connectorId: Fivetran
6+
dataTypes:
7+
- Fivetran_CL
8+
tactics:
9+
- DefenseEvasion
10+
relevantTechniques:
11+
- T1562
12+
query: |
13+
Fivetran_CL
14+
| where Level == "SEVERE"
15+
| summarize SevereCount = count(), SampleMessages = make_set(Message, 5) by bin(TimeGenerated, 1h)
16+
| where SevereCount > 10
17+
| sort by TimeGenerated desc
18+
version: 1.0.0

0 commit comments

Comments
 (0)