Digital Guardian - Incident with not blocked action

Back


Id	07bca129-e7d6-4421-b489-32abade0b6a7
Rulename	Digital Guardian - Incident with not blocked action
Description	Detects when incident has not block action.
Severity	High
Tactics	Exfiltration
Techniques	T1048
Required data connectors	SyslogAma
Kind	Scheduled
Query frequency	1h
Query period	1h
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Digital Guardian Data Loss Prevention/Analytic Rules/DigitalGuardianViolationNotBlocked.yaml
Version	1.0.2
Arm template	07bca129-e7d6-4421-b489-32abade0b6a7.json

KQL

DigitalGuardianDLPEvent
| where isnotempty(IncidentStatus)
| extend inc_act = split(IncidentStatus, ',')
| where inc_act has 'New'
| where inc_act !contains 'Block'
| extend AccountCustomEntity = SrcUserName

YAML

entityMappings:
- entityType: Account
  fieldMappings:
  - identifier: Name
    columnName: AccountCustomEntity
tactics:
- Exfiltration
requiredDataConnectors:
- datatypes:
  - Syslog
  connectorId: SyslogAma
id: 07bca129-e7d6-4421-b489-32abade0b6a7
severity: High
status: Available
query: |
  DigitalGuardianDLPEvent
  | where isnotempty(IncidentStatus)
  | extend inc_act = split(IncidentStatus, ',')
  | where inc_act has 'New'
  | where inc_act !contains 'Block'
  | extend AccountCustomEntity = SrcUserName  
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Digital Guardian Data Loss Prevention/Analytic Rules/DigitalGuardianViolationNotBlocked.yaml
kind: Scheduled
queryPeriod: 1h
version: 1.0.2
name: Digital Guardian - Incident with not blocked action
queryFrequency: 1h
triggerThreshold: 0
relevantTechniques:
- T1048
description: |
    'Detects when incident has not block action.'
triggerOperator: gt

ARM