Adding identity attribute to Correlation rule for entra accounts

Identity Security Cloud (ISC) ISC Discussion and Questions
1

Hello,

have written a correlation rule which works, but I would like to improve it, specifically to handle exceptional cases.

Currently, we have exceptional identities with emails in the format @ext.testcompany.com, while Entra creates accounts only with @testcompany.com. I initially considered using the mailNickname attribute from the Entra account (typically formatted as name.surname, sometimes prefixed with adm, aws, or onmicrosoft for privileged accounts) and the email identity attribute

The main challenge I’m facing is accessing or matching the email identity attribute within the correlation rule.

If anyone is willing to review the rule or provide suggestions, it would be greatly appreciated.

Map returnMap = new HashMap();

String calculatedmailNickname = account.getStringAttribute("mailNickname");
calculatedmailNickname = calculatedmailNickname.replaceFirst("(?i)^adm.", "");
calculatedmailNickname = calculatedmailNickname.replaceFirst("(?i)^aws.", "");
calculatedmailNickname = calculatedmailNickname.replaceFirst("(?i)onmicrosoft.", "");

String identityAttributeName = "email";
String identityAttributeValue = identity.getAttribute(identityAttributeName);

if (calculatedmailNickname != null && identityAttributeValue != null) {
    if (identityAttributeValue.contains("@ext.testcompany.com")) {
        calculatedmailNickname = calculatedmailNickname + "@ext.testcompany.com";
    } else if (identityAttributeValue.contains("@testcompany.com")) {
        calculatedmailNickname = calculatedmailNickname + "@testcompany.com";
    }
}

returnMap.put("identityAttributeName", identityAttributeName);
returnMap.put("identityAttributeValue", calculatedmailNickname);

return returnMap;

validator error:

[RegExRuleValidator(598)] <Rule> tag: Rule name defined within the Rule tag does not match name defined in the file name
  Line 19 - [LintBSHMethodInvocation(93)] null Exception: Could not retrieve definition for variable name 'identity'
    19: String identityAttributeValue = identity .getAttribute ( identityAttributeName )


    Variables may be injected by IDN, these variables can be injected into the rule by modifying the Rule's XML Signature, Add an Argument to the Input Section.  Example adding a variable 'academicLevel':
    <Inputs>
      <Argument name="academicLevel" type="java.lang.String"...
2

I don’t believe that the Correlation Rule has access to the ‘identity’ object within it, based on the documentation for the Rule and the available input variables:

You’ll likely have to use the idnRuleUtil ‘idn’ to search for the identity to compare to based on the possibly name options.

3

This topic was automatically closed 60 days after the last reply. New replies are no longer allowed.