Digital Guardian - Incident with not blocked action

Back


Id	07bca129-e7d6-4421-b489-32abade0b6a7
Rulename	Digital Guardian - Incident with not blocked action
Description	Detects when incident has not block action.
Severity	High
Tactics	Exfiltration
Techniques	T1048
Required data connectors	SyslogAma
Kind	Scheduled
Query frequency	1h
Query period	1h
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Digital Guardian Data Loss Prevention/Analytic Rules/DigitalGuardianViolationNotBlocked.yaml
Version	1.0.2
Arm template	07bca129-e7d6-4421-b489-32abade0b6a7.json

KQL

DigitalGuardianDLPEvent
| where isnotempty(IncidentStatus)
| extend inc_act = split(IncidentStatus, ',')
| where inc_act has 'New'
| where inc_act !contains 'Block'
| extend AccountCustomEntity = SrcUserName

YAML

name: Digital Guardian - Incident with not blocked action
id: 07bca129-e7d6-4421-b489-32abade0b6a7
description: |
    'Detects when incident has not block action.'
triggerThreshold: 0
entityMappings:
- fieldMappings:
  - columnName: AccountCustomEntity
    identifier: Name
  entityType: Account
version: 1.0.2
triggerOperator: gt
query: |
  DigitalGuardianDLPEvent
  | where isnotempty(IncidentStatus)
  | extend inc_act = split(IncidentStatus, ',')
  | where inc_act has 'New'
  | where inc_act !contains 'Block'
  | extend AccountCustomEntity = SrcUserName  
tactics:
- Exfiltration
kind: Scheduled
queryFrequency: 1h
severity: High
queryPeriod: 1h
requiredDataConnectors:
- datatypes:
  - Syslog
  connectorId: SyslogAma
status: Available
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Digital Guardian Data Loss Prevention/Analytic Rules/DigitalGuardianViolationNotBlocked.yaml
relevantTechniques:
- T1048

ARM