MongoDB
Telemetry Evidence
These values show how indexed rules identify MongoDB telemetry.Elastic
logs-network_traffic.mongodb-* Panther
MongoDB.OrganizationEvent MongoDB.ProjectEvent mongodb
Detection Rules
Elastic #
- First-Time Destructive MongoDB Command from a Client IP source high: Identifies the first client IP observed issuing MongoDB commands that can drop databases, collections, indexes, users, or roles within a five-day history window. Adversaries with access to an exposed or compromised MongoDB service may use these commands to destroy data, disrupt applications, or prepare a wipe-and-extort attack.
T1485
Panther #
- MongoDB 2FA Disabled source medium: 2FA was disabled.
- MongoDB access allowed from anywhere source high: Atlas only allows client connections to the database deployment from entries in the project's IP access list. This rule detects when 0.0.0.0/0 is added to that list, which allows access from anywhere.
T1021.007,T1556.009 - MongoDB Atlas API Key Created source medium: A MongoDB Atlas api key's access list was updated
- MongoDB External User Invited source medium: An external user has been invited to a MongoDB org.
- MongoDB External User Invited (no config) source high: An external user has been invited to a MongoDB org (no config).
- MongoDB Identity Provider Activity source medium: Changes to identity provider settings are privileged activities that should be carefully audited. Attackers may add or change IDP integrations to gain persistence to environments
T1556.007 - MongoDB logging toggled source low: MongoDB logging toggled
T1685.002 - MongoDB org membership restriction disabled source high: You can configure Atlas to require API access lists at the organization level. When you enable IP access list for the Atlas Administration API, all API calls in that organization must originate from a valid entry in the associated Atlas Administration API key access list. This rule detects when IP access list is disabled
T1556.009 - MongoDB security alerts disabled or deleted source high: MongoDB provides security alerting policies for notifying admins when certain conditions are met. This rule detects when these policies are disabled or deleted.
T1685 - MongoDB user roles changed source low: User roles changed.
Show 1 more
- MongoDB user was created or deleted source medium: User was created or deleted.