Bitglass - Multiple files shared with external entity

Back


Id	09690f9b-33d1-4372-a6aa-eb7d3b3cdebc
Rulename	Bitglass - Multiple files shared with external entity
Description	Detects when multiple files shared with external entity.
Severity	Medium
Tactics	Exfiltration
Techniques	T1567
Required data connectors	Bitglass
Kind	Scheduled
Query frequency	1h
Query period	1h
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Bitglass/Analytic Rules/BitglassFilesSharedWithExternal.yaml
Version	1.0.0
Arm template	09690f9b-33d1-4372-a6aa-eb7d3b3cdebc.json

KQL

let threshold = 5;
Bitglass
| where EventType =~ 'cloudaudit'
| where Action =~ 'Action  DLPScan'
| where EventMessage has_all ('External', 'Shared', 'DLP')
| summarize f_cnt = makeset(SrcFileName) by User, bin(TimeGenerated, 10m)
| where array_length(f_cnt) >= threshold
| extend AccountCustomEntity = User

YAML

entityMappings:
- entityType: Account
  fieldMappings:
  - identifier: Name
    columnName: AccountCustomEntity
queryFrequency: 1h
triggerOperator: gt
requiredDataConnectors:
- dataTypes:
  - Bitglass
  connectorId: Bitglass
kind: Scheduled
triggerThreshold: 0
description: |
    'Detects when multiple files shared with external entity.'
relevantTechniques:
- T1567
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Bitglass/Analytic Rules/BitglassFilesSharedWithExternal.yaml
queryPeriod: 1h
version: 1.0.0
name: Bitglass - Multiple files shared with external entity
status: Available
id: 09690f9b-33d1-4372-a6aa-eb7d3b3cdebc
severity: Medium
query: |
  let threshold = 5;
  Bitglass
  | where EventType =~ 'cloudaudit'
  | where Action =~ 'Action  DLPScan'
  | where EventMessage has_all ('External', 'Shared', 'DLP')
  | summarize f_cnt = makeset(SrcFileName) by User, bin(TimeGenerated, 10m)
  | where array_length(f_cnt) >= threshold
  | extend AccountCustomEntity = User  
tactics:
- Exfiltration

ARM