Mimecast Secure Email Gateway - Virus

Back


Id	30f73baa-602c-4373-8f02-04ff5e51fc7f
Rulename	Mimecast Secure Email Gateway - Virus
Description	Detect threat for virus from mail receipt virus event
Severity	Informational
Tactics	Execution
Techniques	T1053
Required data connectors	MimecastSIEMAPI
Kind	Scheduled
Query frequency	5m
Query period	15m
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/MimecastSEG/Analytic Rules/MimecastSIEM_Virus.yaml
Version	1.0.1
Arm template	30f73baa-602c-4373-8f02-04ff5e51fc7f.json

KQL

MimecastSIEM_CL| where mimecastEventId_s=="mail_receipt_virus"

YAML

customDetails:
  MsgId_s: MsgId_s
  RejCode: RejCode_s
  Dir: Dir_s
  Error: Error_s
  RejInfo: RejInfo_s
  Cphr: Cphr_s
  headerFrom: headerFrom_s
  Act: Act_s
  IP: IP_s
  Virus: Virus_s
  TlsVer: TlsVer_s
  RejType: RejType_s
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/MimecastSEG/Analytic Rules/MimecastSIEM_Virus.yaml
alertDetailsOverride: 
query: MimecastSIEM_CL| where mimecastEventId_s=="mail_receipt_virus"
requiredDataConnectors:
- dataTypes:
  - MimecastSIEM_CL
  connectorId: MimecastSIEMAPI
incidentConfiguration:
  groupingConfiguration:
    reopenClosedIncident: false
    enabled: true
    matchingMethod: AllEntities
    lookbackDuration: 1d
  createIncident: true
relevantTechniques:
- T1053
kind: Scheduled
name: Mimecast Secure Email Gateway - Virus
tactics:
- Execution
severity: Informational
suppressionDuration: 5h
enabled: true
triggerOperator: gt
description: Detect threat for virus from mail receipt virus event
queryFrequency: 5m
triggerThreshold: 0
queryPeriod: 15m
version: 1.0.1
suppressionEnabled: false
entityMappings:
- fieldMappings:
  - identifier: Sender
    columnName: Sender_s
  - identifier: Recipient
    columnName: Rcpt_s
  - identifier: Subject
    columnName: Subject_s
  entityType: MailMessage
eventGroupingSettings:
  aggregationKind: SingleAlert
id: 30f73baa-602c-4373-8f02-04ff5e51fc7f

ARM