Votiro - File Blocked from Connector

Back


Id	17bf3780-ae0d-4cd9-a884-5df8b687f3f5
Rulename	Votiro - File Blocked from Connector
Description	The analytic rule is intended to detect when a file is blocked by Votiro Sanitization Engine due to a specific policy, and notify the appropriate parties so that they can take appropriate action. The alert message will state that a file with a specific name and hash value was blocked by Votiro Sanatization Engine due to a specific policy name, and that more details can be found at a specific incident URL.
Severity	Low
Tactics	DefenseEvasion Discovery Impact
Techniques	T1036 T1083 T1057 T1082 T1565 T1498 T0837
Required data connectors	CefAma Votiro
Kind	Scheduled
Query frequency	10m
Query period	10m
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Votiro/Analytic Rules/VotiroFileBlockedFromConnector.yaml
Version	1.0.1
Arm template	17bf3780-ae0d-4cd9-a884-5df8b687f3f5.json

KQL

let Votiro_view  = view () { VotiroEvents | where sanitizationResult has "Blocked" and passwordProtected == "false" and from =~ "null" | extend FileWithConnectorDetails = strcat_delim(' ', fileName, 'with the hash', SrcFileSHA256, 'that was sent from connector', connectorName) | summarize count() by fileName, SrcFileSHA256, FileWithConnectorDetails, policyName, tostring(incidentURL), sanitizationResult, LogSeverity | extend FileHashAlgo = "SHA256", FileHashValue = SrcFileSHA256};Votiro_view

YAML

alertDetailsOverride:
  alertDescriptionFormat: The {{FileWithConnectorDetails}} was blocked by Votiro due to Policy rules, see more detail in the following link {{incidentURL}}
  alertTacticsColumnName: sanitizationResult
  alertSeverityColumnName: LogSeverity
  alertDisplayNameFormat: File with hash {{SrcFileSHA256}} was blocked
description: |
    'The analytic rule is intended to detect when a file is blocked by Votiro Sanitization Engine due to a specific policy, and notify the appropriate parties so that they can take appropriate action. The alert message will state that a file with a specific name and hash value was blocked by Votiro Sanatization Engine due to a specific policy name, and that more details can be found at a specific incident URL.'
kind: Scheduled
tactics:
- DefenseEvasion
- Discovery
- Impact
requiredDataConnectors:
- connectorId: Votiro
  dataTypes:
  - CommonSecurityLog
- connectorId: CefAma
  dataTypes:
  - CommonSecurityLog
incidentConfiguration:
  createIncident: true
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Votiro/Analytic Rules/VotiroFileBlockedFromConnector.yaml
severity: Low
name: Votiro - File Blocked from Connector
triggerThreshold: 0
queryPeriod: 10m
query: let Votiro_view  = view () { VotiroEvents | where sanitizationResult has "Blocked" and passwordProtected == "false" and from =~ "null" | extend FileWithConnectorDetails = strcat_delim(' ', fileName, 'with the hash', SrcFileSHA256, 'that was sent from connector', connectorName) | summarize count() by fileName, SrcFileSHA256, FileWithConnectorDetails, policyName, tostring(incidentURL), sanitizationResult, LogSeverity | extend FileHashAlgo = "SHA256", FileHashValue = SrcFileSHA256};Votiro_view
relevantTechniques:
- T1036
- T1083
- T1057
- T1082
- T1565
- T1498
- T0837
id: 17bf3780-ae0d-4cd9-a884-5df8b687f3f5
queryFrequency: 10m
entityMappings:
- entityType: FileHash
  fieldMappings:
  - columnName: FileHashAlgo
    identifier: Algorithm
  - columnName: FileHashValue
    identifier: Value
version: 1.0.1
triggerOperator: gt
eventGroupingSettings:
  aggregationKind: AlertPerResult

ARM