Mimecast Data Leak Prevention - Notifications

MimecastDLP_CL| where action_s == "notification";

OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/MimecastSEG/Analytic Rules/MimecastDLP.yaml
severity: High
eventGroupingSettings:
  aggregationKind: SingleAlert
queryPeriod: 15m
suppressionDuration: 5h
name: Mimecast Data Leak Prevention - Notifications
entityMappings:
- fieldMappings:
  - columnName: senderAddress_s
    identifier: Sender
  - columnName: recipientAddress_s
    identifier: Recipient
  - columnName: action_s
    identifier: DeliveryAction
  entityType: MailMessage
version: 1.0.0
relevantTechniques:
- T1030
suppressionEnabled: false
id: 1818aeaa-4cc8-426b-ba54-539de896d299
queryFrequency: 5m
triggerThreshold: 0
triggerOperator: gt
incidentConfiguration:
  groupingConfiguration:
    enabled: true
    reopenClosedIncident: false
    matchingMethod: AllEntities
    lookbackDuration: 1d
  createIncident: true
alertRuleTemplateName: 
query: MimecastDLP_CL| where action_s == "notification";
description: Detects threat for data leak when action is notification
enabled: true
requiredDataConnectors:
- connectorId: MimecastSIEMAPI
  dataTypes:
  - MimecastDLP_CL
tactics:
- Exfiltration
kind: Scheduled