Votiro - File Blocked in Email

Back


Id	0b8b91de-c63e-4bc2-b5f4-b15d3b379ec9
Rulename	Votiro - File Blocked in Email
Description	The analytic rule is designed to identify when an email is blocked by Votiro Sanitization Engine policy. The rule generates an alert when an email is blocked after Sanitization process which is not password protected and has a from field meaning its a valid email. More information in terms of details about the blocked attachment, such as the file name and hash, and information about the email, such as the sender and recipient(s). The alert also includes information about the Votiro policy that blocked the attachment and provides a link to additional details about the incident.
Severity	Low
Tactics	CommandAndControl DefenseEvasion Impact InitialAccess
Techniques	T0885 T1036 T1027 T1486 T1566
Required data connectors	CefAma Votiro
Kind	Scheduled
Query frequency	10m
Query period	10m
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Votiro/Analytic Rules/VotiroFileBlockedInEmail.yaml
Version	1.0.1
Arm template	0b8b91de-c63e-4bc2-b5f4-b15d3b379ec9.json

KQL

let Votiro_view  = view () { VotiroEvents | where sanitizationResult has "Blocked" and passwordProtected == "false" and from =~ "null" | extend FileWithEmailDetails = strcat_delim(' ', fileName, 'with the hash', SrcFileSHA256, 'was blocked in an email that was sent from user', from, 'to the following recipients', recipients) | summarize count() by fileName, SrcFileSHA256, FileWithEmailDetails, policyName, tostring(incidentURL), sanitizationResult, LogSeverity | extend FileHashAlgo = "SHA256", FileHashValue = SrcFileSHA256};Votiro_view

YAML

name: Votiro - File Blocked in Email
query: let Votiro_view  = view () { VotiroEvents | where sanitizationResult has "Blocked" and passwordProtected == "false" and from =~ "null" | extend FileWithEmailDetails = strcat_delim(' ', fileName, 'with the hash', SrcFileSHA256, 'was blocked in an email that was sent from user', from, 'to the following recipients', recipients) | summarize count() by fileName, SrcFileSHA256, FileWithEmailDetails, policyName, tostring(incidentURL), sanitizationResult, LogSeverity | extend FileHashAlgo = "SHA256", FileHashValue = SrcFileSHA256};Votiro_view
queryFrequency: 10m
triggerOperator: gt
requiredDataConnectors:
- dataTypes:
  - CommonSecurityLog
  connectorId: Votiro
- dataTypes:
  - CommonSecurityLog
  connectorId: CefAma
eventGroupingSettings:
  aggregationKind: AlertPerResult
alertDetailsOverride:
  alertDescriptionFormat: Attachment {{FileWithEmailDetails}} by Votiro due to Policy rules, see more detail in the following link {{incidentURL}}
  alertSeverityColumnName: LogSeverity
  alertDisplayNameFormat: File with hash {{SrcFileSHA256}} was blocked
  alertTacticsColumnName: sanitizationResult
incidentConfiguration:
  createIncident: true
entityMappings:
- entityType: FileHash
  fieldMappings:
  - identifier: Algorithm
    columnName: FileHashAlgo
  - identifier: Value
    columnName: FileHashValue
triggerThreshold: 0
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Votiro/Analytic Rules/VotiroFileBlockedInEmail.yaml
description: |
    'The analytic rule is designed to identify when an email is blocked by Votiro Sanitization Engine policy. The rule generates an alert when an email is blocked after Sanitization process which is not password protected and has a from field meaning its a valid email. More information in terms of details about the blocked attachment, such as the file name and hash, and information about the email, such as the sender and recipient(s). The alert also includes information about the Votiro policy that blocked the attachment and provides a link to additional details about the incident.'
version: 1.0.1
id: 0b8b91de-c63e-4bc2-b5f4-b15d3b379ec9
kind: Scheduled
relevantTechniques:
- T0885
- T1036
- T1027
- T1486
- T1566
severity: Low
tactics:
- CommandAndControl
- DefenseEvasion
- Impact
- InitialAccess
queryPeriod: 10m

ARM