Votiro - File Blocked from Connector

Back


Id	17bf3780-ae0d-4cd9-a884-5df8b687f3f5
Rulename	Votiro - File Blocked from Connector
Description	The analytic rule is intended to detect when a file is blocked by Votiro Sanitization Engine due to a specific policy, and notify the appropriate parties so that they can take appropriate action. The alert message will state that a file with a specific name and hash value was blocked by Votiro Sanatization Engine due to a specific policy name, and that more details can be found at a specific incident URL.
Severity	Low
Tactics	DefenseEvasion Discovery Impact
Techniques	T1036 T1083 T1057 T1082 T1565 T1498 T0837
Required data connectors	CefAma Votiro
Kind	Scheduled
Query frequency	10m
Query period	10m
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Votiro/Analytic Rules/VotiroFileBlockedFromConnector.yaml
Version	1.0.1
Arm template	17bf3780-ae0d-4cd9-a884-5df8b687f3f5.json

KQL

let Votiro_view  = view () { VotiroEvents | where sanitizationResult has "Blocked" and passwordProtected == "false" and from =~ "null" | extend FileWithConnectorDetails = strcat_delim(' ', fileName, 'with the hash', SrcFileSHA256, 'that was sent from connector', connectorName) | summarize count() by fileName, SrcFileSHA256, FileWithConnectorDetails, policyName, tostring(incidentURL), sanitizationResult, LogSeverity | extend FileHashAlgo = "SHA256", FileHashValue = SrcFileSHA256};Votiro_view

YAML

eventGroupingSettings:
  aggregationKind: AlertPerResult
id: 17bf3780-ae0d-4cd9-a884-5df8b687f3f5
version: 1.0.1
tactics:
- DefenseEvasion
- Discovery
- Impact
alertDetailsOverride:
  alertTacticsColumnName: sanitizationResult
  alertDescriptionFormat: The {{FileWithConnectorDetails}} was blocked by Votiro due to Policy rules, see more detail in the following link {{incidentURL}}
  alertDisplayNameFormat: File with hash {{SrcFileSHA256}} was blocked
  alertSeverityColumnName: LogSeverity
description: |
    'The analytic rule is intended to detect when a file is blocked by Votiro Sanitization Engine due to a specific policy, and notify the appropriate parties so that they can take appropriate action. The alert message will state that a file with a specific name and hash value was blocked by Votiro Sanatization Engine due to a specific policy name, and that more details can be found at a specific incident URL.'
requiredDataConnectors:
- dataTypes:
  - CommonSecurityLog
  connectorId: Votiro
- dataTypes:
  - CommonSecurityLog
  connectorId: CefAma
incidentConfiguration:
  createIncident: true
triggerOperator: gt
query: let Votiro_view  = view () { VotiroEvents | where sanitizationResult has "Blocked" and passwordProtected == "false" and from =~ "null" | extend FileWithConnectorDetails = strcat_delim(' ', fileName, 'with the hash', SrcFileSHA256, 'that was sent from connector', connectorName) | summarize count() by fileName, SrcFileSHA256, FileWithConnectorDetails, policyName, tostring(incidentURL), sanitizationResult, LogSeverity | extend FileHashAlgo = "SHA256", FileHashValue = SrcFileSHA256};Votiro_view
kind: Scheduled
queryPeriod: 10m
triggerThreshold: 0
severity: Low
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Votiro/Analytic Rules/VotiroFileBlockedFromConnector.yaml
queryFrequency: 10m
name: Votiro - File Blocked from Connector
relevantTechniques:
- T1036
- T1083
- T1057
- T1082
- T1565
- T1498
- T0837
entityMappings:
- entityType: FileHash
  fieldMappings:
  - identifier: Algorithm
    columnName: FileHashAlgo
  - identifier: Value
    columnName: FileHashValue

ARM