Query

AzureDevOpsAuditing
| where OperationName == "OrganizationPolicy.PolicyValueUpdated"
| extend PolicyName = tostring(Data.PolicyName)
| extend PolicyValue = tostring(Data.PolicyValue)
| where PolicyValue == "OFF"
| where PolicyName == "Policy.ArtifactsExternalPackageProtectionToken"
| project TimeGenerated, ActorUPN, IpAddress, PolicyName, PolicyValue, ScopeDisplayName

About this query

Azure DevOps - Organization Policy - Additional Protection when using public package registries

Query Information

MITRE ATT&CK Technique(s)

Technique ID	Title	Link

Description

Use the below query to identify when Additional Protection when using public package registries is disabled in Azure DevOps

References

Changes to Azure Artifacts Upstream Behavior

Microsoft Sentinel

Explanation

This KQL query is designed to monitor Azure DevOps for changes in organization policies specifically related to the security of using public package registries. It identifies instances where the "Additional Protection" policy for external package protection tokens is turned off. Here's a simple breakdown of what the query does:

Data Source: It looks at the AzureDevOpsAuditing logs, which track changes and operations within Azure DevOps.
Filter by Operation: The query filters for operations where the policy value has been updated, specifically the operation named "OrganizationPolicy.PolicyValueUpdated".
Extract Policy Details: It extracts the policy name and value from the data, converting them to string format for easier handling.
Check Policy Status: It further filters the results to find cases where the policy named "Policy.ArtifactsExternalPackageProtectionToken" is set to "OFF". This indicates that the additional protection for using public package registries has been disabled.
Select Relevant Information: Finally, it projects (selects) specific columns to display: the time the change was made (TimeGenerated), the user who made the change (ActorUPN), their IP address (IpAddress), the policy name and value, and the scope of the policy change (ScopeDisplayName).

This query helps administrators quickly identify and respond to potential security risks associated with disabling additional protection when using public package registries in Azure DevOps.

KQL Search