Digital Guardian - Incident with not blocked action

Back


Id	07bca129-e7d6-4421-b489-32abade0b6a7
Rulename	Digital Guardian - Incident with not blocked action
Description	Detects when incident has not block action.
Severity	High
Tactics	Exfiltration
Techniques	T1048
Required data connectors	SyslogAma
Kind	Scheduled
Query frequency	1h
Query period	1h
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Digital Guardian Data Loss Prevention/Analytic Rules/DigitalGuardianViolationNotBlocked.yaml
Version	1.0.2
Arm template	07bca129-e7d6-4421-b489-32abade0b6a7.json

KQL

DigitalGuardianDLPEvent
| where isnotempty(IncidentStatus)
| extend inc_act = split(IncidentStatus, ',')
| where inc_act has 'New'
| where inc_act !contains 'Block'
| extend AccountCustomEntity = SrcUserName

YAML

queryPeriod: 1h
query: |
  DigitalGuardianDLPEvent
  | where isnotempty(IncidentStatus)
  | extend inc_act = split(IncidentStatus, ',')
  | where inc_act has 'New'
  | where inc_act !contains 'Block'
  | extend AccountCustomEntity = SrcUserName  
name: Digital Guardian - Incident with not blocked action
entityMappings:
- fieldMappings:
  - columnName: AccountCustomEntity
    identifier: Name
  entityType: Account
queryFrequency: 1h
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Digital Guardian Data Loss Prevention/Analytic Rules/DigitalGuardianViolationNotBlocked.yaml
requiredDataConnectors:
- connectorId: SyslogAma
  datatypes:
  - Syslog
description: |
    'Detects when incident has not block action.'
kind: Scheduled
version: 1.0.2
status: Available
severity: High
relevantTechniques:
- T1048
triggerOperator: gt
triggerThreshold: 0
tactics:
- Exfiltration
id: 07bca129-e7d6-4421-b489-32abade0b6a7

ARM