Identifying Inactive Accounts via Sentinel

The purpose of this whitepaper on “Identifying Inactive Accounts via Sentinel” is to provide a how-to guide on setting up an Azure Sentinel analytic to identify inactive accounts per the approved Organizationally Defined Parameter (ODP) for 3.5.6[a].

This analytic only works if the entire organization depends on using Azure AD for access to Federal Contract Information (FCI) and Controlled Unclassified Information (CUI).  This analytic also presumes your organization is using Microsoft Azure Sentinel as your Security Incident & Event Management (SIEM) solution to fulfill 3.3, Audit & Accountability, requirements.  This analytic will not work with other SIEMs but may point you on the path to make it work in other platforms.

An Adobe Acrobat verison of this whitepaper is available at https://peakinfosec.com/wp-content/uploads/2024/05/Identifying-Inactive-Accounts-via-Sentinel.pdf.

Below is a composite Security Requirement table form NIST SP 800-171 and NIST SP 800-171A for 3.5.6, Disable identifiers after a defined period of inactivity.

This Analytic depends on the Organization Seeking Certification (OSC) having the following approved ODPs established by the organization:

• 3.3.1[e] retention requirements for audit records are defined.
• 3.5.6[a] a period of inactivity after which an identifier is disabled is defined.

If there are multiple ODPs for either of these, this query may not function properly.

Building the Azure Sentinel analytic to identify inactive accounts is a three-step process:

1. Create the “exempt_inactive_accounts” Watchlist
2. Create the identify_inactive_accounts query
3. Create the Alert

These steps are detailed below.

The analytic uses a watchlist to exempt user accounts from generating false alerts.

For more information about Azure Sentinel watchlists, please go to Watchlists in Microsoft Sentinel – Microsoft Sentinel | Microsoft Learn; and, for more detailed instructions about creating watchlists, please go to Create new watchlists – Microsoft Sentinel | Microsoft Learn.

You can download our sample watchlist file for easy importing at https://peakinfosec.com/wp-content/uploads/2024/05/exempt_inactive_accounts.csv.

You can pre-populate the information prior to import using the template or update the template as is and manage it via the watchlist user interface.

The template has the following fields:

To get the Watchlist Wizard started, click on the Watchlist item under Configuration on the left sidebar.

To start the Watchlist Wizard, click on “New.”

Once you start the Watchlist Wizard in Azure Sentinel, you will see the form above appear.  Populate the form with the following information:

• Name*: exempt_inactive_accounts
• Description: exempt inactive accounts watchlist
• Alias*:  exempt_inactive_accounts

Do not deviate the from items in Bold Red.  When you are done, click “Next: Source>” at the bottom of the screen.

For this form, leave the first 3 settings as shown in the picture above.

Upload the exempt_inactive_accounts.csv file you created manually or if used our template. Once you do, you should see the file preview match the content of the file.

Last thing to do is to set the SearchKey* to AccountObjectld.

Now you can hit “Next: Review + Create>” at the bottom of the page.

The next screen should look like the one above.  Description may be different becuase that can be tailored as you see fit.

If it does, click “Create” at the bottom of the page.

After it creates the exempt_inactive_accounts watchlist, you may need to refresh your screen for it to show up in the list.

To create the analytic, click on Logs under General on the left sidebar.

The next thing to do is to copy the query below and past it into the log editor.

There are two places where the analytics’ logic is based on Peak InfoSec and need to be changed.  In the online version, these occur at lines 6 and 43 with the preceding comments section providing instructions.  In the PDF version of this whitepaper, the lines of code are highlighted.

After updating the queries logic, you can run the query and see if it returns any results.

Presuming everything works, you next steps are to save the query, as shown below.

We suggest naming the query “Inactive_Users_Query.”

Next steps are to turn the query into an Azure Sentinel Alert.

More information about creating Azure Sentinel Alerts and playbooks can be found at Create incidents from alerts in Microsoft Sentinel | Microsoft Learn.