Digital Guardian - Incident with not blocked action

Back


Id	07bca129-e7d6-4421-b489-32abade0b6a7
Rulename	Digital Guardian - Incident with not blocked action
Description	Detects when incident has not block action.
Severity	High
Tactics	Exfiltration
Techniques	T1048
Required data connectors	SyslogAma
Kind	Scheduled
Query frequency	1h
Query period	1h
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Digital Guardian Data Loss Prevention/Analytic Rules/DigitalGuardianViolationNotBlocked.yaml
Version	1.0.2
Arm template	07bca129-e7d6-4421-b489-32abade0b6a7.json

KQL

DigitalGuardianDLPEvent
| where isnotempty(IncidentStatus)
| extend inc_act = split(IncidentStatus, ',')
| where inc_act has 'New'
| where inc_act !contains 'Block'
| extend AccountCustomEntity = SrcUserName

YAML

name: Digital Guardian - Incident with not blocked action
query: |
  DigitalGuardianDLPEvent
  | where isnotempty(IncidentStatus)
  | extend inc_act = split(IncidentStatus, ',')
  | where inc_act has 'New'
  | where inc_act !contains 'Block'
  | extend AccountCustomEntity = SrcUserName  
entityMappings:
- entityType: Account
  fieldMappings:
  - columnName: AccountCustomEntity
    identifier: Name
queryPeriod: 1h
version: 1.0.2
tactics:
- Exfiltration
triggerOperator: gt
kind: Scheduled
triggerThreshold: 0
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Digital Guardian Data Loss Prevention/Analytic Rules/DigitalGuardianViolationNotBlocked.yaml
relevantTechniques:
- T1048
id: 07bca129-e7d6-4421-b489-32abade0b6a7
severity: High
requiredDataConnectors:
- connectorId: SyslogAma
  datatypes:
  - Syslog
status: Available
description: |
    'Detects when incident has not block action.'
queryFrequency: 1h

ARM