Merge pull request #202255 from ElazarK/key-vault-21

New Key vault alert

Author: PRMerger-2

articles/defender-for-cloud/alerts-reference.md

@@ -4,7 +4,7 @@ description: This article lists the security alerts visible in Microsoft Defende
 ms.topic: reference
 ms.author: elkrieger
 author: ElazarK
-ms.date: 06/21/2022
+ms.date: 06/22/2022
 ---
 
 # Security alerts - a reference guide
@@ -574,8 +574,10 @@ Microsoft Defender for Containers provides security alerts on the cluster level
 | **High volume of operations in a key vault**<br>(KV_OperationVolumeAnomaly)        | An anomalous number of key vault operations were performed by a user, service principal, and/or a specific key vault. This anomalous activity pattern may be legitimate, but it could be an indication that a threat actor has gained access to the key vault and the secrets contained within it. We recommend further investigations.                                                                                                                                                                                                                         | Credential Access                            | Medium   |
 | **Suspicious policy change and secret query in a key vault**<br>(KV_PutGetAnomaly) | A user or service principal has performed an anomalous Vault Put policy change operation followed by one or more Secret Get operations. This pattern is not normally performed by the specified user or service principal. This may be legitimate activity, but it could be an indication that a threat actor  has updated the key vault policy to access previously inaccessible secrets. We recommend further investigations.                                                                                                                                 | Credential Access                            | Medium   |
 | **Suspicious secret listing and query in a key vault**<br>(KV_ListGetAnomaly)      | A user or service principal has performed an anomalous Secret List operation followed by one or more Secret Get operations. This pattern is not normally performed by the specified user or service principal and is typically associated with secret dumping. This may be legitimate activity, but it could be an indication that a threat actor  has gained access to the key vault and is trying to discover secrets that can be used to move laterally through your network and/or gain access to sensitive resources. We recommend further investigations. | Credential Access                            | Medium   |
+| **Unusual access denied - User accessing high volume of key vaults denied**<br>(KV_DeniedAccountVolumeAnomaly) | A user or service principal has attempted access to anomalously high volume of key vaults in the last 24 hours. This anomalous access pattern may be legitimate activity. Though this attempt was unsuccessful, it could be an indication of a possible attempt to gain access of key vault and the secrets contained within it. We recommend further investigations. | Discovery | Low |
+| **Unusual access denied - Unusual user accessing key vault denied**<br>(KV_UserAccessDeniedAnomaly) | A key vault access was attempted by a user that does not normally access it, this anomalous access pattern may be legitimate activity. Though this attempt was unsuccessful, it could be an indication of a possible attempt to gain access of key vault and the secrets contained within it.  | Initial Access, Discovery | Low |
 | **Unusual application accessed a key vault**<br>(KV_AppAnomaly)                    | A key vault has been accessed by a service principal that does not normally access it. This anomalous access pattern may be legitimate activity, but it could be an indication that a threat actor  has gained access to the key vault in an attempt to access the secrets contained within it. We recommend further investigations.                                                                                                                                                                                                                            | Credential Access                            | Medium   |
-| **Unusual operation pattern in a key vault**<br>KV_OperationPatternAnomaly)        | An anomalous pattern of key vault operations was performed by a user, service principal, and/or a specific key vault. This anomalous activity pattern may be legitimate, but it could be an indication that a threat actor has gained access to the key vault and the secrets contained within it. We recommend further investigations.                                                                                                                                                                                                                         | Credential Access                            | Medium   |
+| **Unusual operation pattern in a key vault**<br>(KV_OperationPatternAnomaly)        | An anomalous pattern of key vault operations was performed by a user, service principal, and/or a specific key vault. This anomalous activity pattern may be legitimate, but it could be an indication that a threat actor has gained access to the key vault and the secrets contained within it. We recommend further investigations.                                                                                                                                                                                                                         | Credential Access                            | Medium   |
 | **Unusual user accessed a key vault**<br>(KV_UserAnomaly)                          | A key vault has been accessed by a user that does not normally access it. This anomalous access pattern may be legitimate activity, but it could be an indication that a threat actor  has gained access to the key vault in an attempt to access the secrets contained within it. We recommend further investigations.                                                                                                                                                                                                                                         | Credential Access                            | Medium   |
 | **Unusual user-application pair accessed a key vault**<br>(KV_UserAppAnomaly)      | A key vault has been accessed by a user-service principal pair that does not normally access it. This anomalous access pattern may be legitimate activity, but it could be an indication that a threat actor  has gained access to the key vault in an attempt to access the secrets contained within it. We recommend further investigations.                                                                                                                                                                                                                  | Credential Access                            | Medium   |
 | **User accessed high volume of key vaults**<br>(KV_AccountVolumeAnomaly)           | A user or service principal has accessed an anomalously high volume of key vaults. This anomalous access pattern may be legitimate activity, but it could be an indication that a threat actor  has gained access to multiple key vaults in an attempt to access the secrets contained within them. We recommend further investigations.                                                                                                                                                                                                                        | Credential Access                            | Medium   |

articles/defender-for-cloud/release-notes.md

@@ -27,6 +27,7 @@ Updates in June include:
 - [Alerts by resource group](#alerts-by-resource-group)
 - [Auto-provisioning of Microsoft Defender for Endpoint unified solution](#auto-provisioning-of-microsoft-defender-for-endpoint-unified-solution)
 - [Deprecating the "API App should only be accessible over HTTPS" policy](#deprecating-the-api-app-should-only-be-accessible-over-https-policy)
+- [New Key Vault alerts](#new-key-vault-alerts)
 
 ### General availability (GA) for Microsoft Defender for Azure Cosmos DB
 
@@ -104,6 +105,17 @@ The policy `API App should only be accessible over HTTPS` has been deprecated. T
 
 To learn more about policy definitions for Azure App Service, see [Azure Policy built-in definitions for Azure App Service](../azure-app-configuration/policy-reference.md).
 
+### New Key Vault alerts
+
+To expand the threat protections provided by Microsoft Defender for Key Vault, we've added two new alerts.
+
+These alerts inform you of an access denied anomaly, is detected for any of your key vaults.
+
+| Alert (alert type) | Description | MITRE tactics | Severity |
+|--|--|--|--|
+| **Unusual access denied - User accessing high volume of key vaults denied**<br>(KV_DeniedAccountVolumeAnomaly) | A user or service principal has attempted access to anomalously high volume of key vaults in the last 24 hours. This anomalous access pattern may be legitimate activity. Though this attempt was unsuccessful, it could be an indication of a possible attempt to gain access of key vault and the secrets contained within it. We recommend further investigations. | Discovery | Low |
+| **Unusual access denied - Unusual user accessing key vault denied**<br>(KV_UserAccessDeniedAnomaly) | A key vault access was attempted by a user that does not normally access it, this anomalous access pattern may be legitimate activity. Though this attempt was unsuccessful, it could be an indication of a possible attempt to gain access of key vault and the secrets contained within it.  | Initial Access, Discovery | Low |
+
 ## May 2022
 
 Updates in May include: