Microsoft Sentinel Analytic Rules
cloudbrothers.infoAzure Sentinel RepoToggle Dark/Light/Auto modeToggle Dark/Light/Auto modeToggle Dark/Light/Auto modeBack to homepage

Box - Item shared to external entity

Back
Id3b803560-f8a6-4db4-89cb-617d89724ba1
RulenameBox - Item shared to external entity
DescriptionDetects when an item was shared to external entity.
SeverityMedium
TacticsExfiltration
TechniquesT1537
Required data connectorsBoxDataConnector
KindScheduled
Query frequency1h
Query period1h
Trigger threshold0
Trigger operatorgt
Source Urihttps://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Box/Analytic Rules/BoxItemSharedToExternalUser.yaml
Version1.0.0
Arm template3b803560-f8a6-4db4-89cb-617d89724ba1.json
Deploy To Azure
BoxEvents
| where EventType =~ 'COLLABORATION_INVITE'
| extend corp_domain = tolower(extract(@'@(.*)', 1, SrcUserUpn))
| extend accessibleby_domain = tolower(extract(@'@(.*)', 1, AccessibleByLogin))
| where corp_domain != accessibleby_domain
| extend AccountCustomEntity = SrcUserUpn
queryPeriod: 1h
version: 1.0.0
relevantTechniques:
- T1537
queryFrequency: 1h
kind: Scheduled
name: Box - Item shared to external entity
id: 3b803560-f8a6-4db4-89cb-617d89724ba1
entityMappings:
- fieldMappings:
  - columnName: AccountCustomEntity
    identifier: FullName
  entityType: Account
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Box/Analytic Rules/BoxItemSharedToExternalUser.yaml
severity: Medium
query: |
  BoxEvents
  | where EventType =~ 'COLLABORATION_INVITE'
  | extend corp_domain = tolower(extract(@'@(.*)', 1, SrcUserUpn))
  | extend accessibleby_domain = tolower(extract(@'@(.*)', 1, AccessibleByLogin))
  | where corp_domain != accessibleby_domain
  | extend AccountCustomEntity = SrcUserUpn  
tactics:
- Exfiltration
description: |
    'Detects when an item was shared to external entity.'
requiredDataConnectors:
- connectorId: BoxDataConnector
  dataTypes:
  - BoxEvents_CL
status: Available
triggerThreshold: 0
triggerOperator: gt
{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "workspace": {
      "type": "String"
    }
  },
  "resources": [
    {
      "id": "[concat(resourceId('Microsoft.OperationalInsights/workspaces/providers', parameters('workspace'), 'Microsoft.SecurityInsights'),'/alertRules/3b803560-f8a6-4db4-89cb-617d89724ba1')]",
      "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/3b803560-f8a6-4db4-89cb-617d89724ba1')]",
      "type": "Microsoft.OperationalInsights/workspaces/providers/alertRules",
      "kind": "Scheduled",
      "apiVersion": "2022-11-01",
      "properties": {
        "displayName": "Box - Item shared to external entity",
        "description": "'Detects when an item was shared to external entity.'\n",
        "severity": "Medium",
        "enabled": true,
        "query": "BoxEvents\n| where EventType =~ 'COLLABORATION_INVITE'\n| extend corp_domain = tolower(extract(@'@(.*)', 1, SrcUserUpn))\n| extend accessibleby_domain = tolower(extract(@'@(.*)', 1, AccessibleByLogin))\n| where corp_domain != accessibleby_domain\n| extend AccountCustomEntity = SrcUserUpn\n",
        "queryFrequency": "PT1H",
        "queryPeriod": "PT1H",
        "triggerOperator": "GreaterThan",
        "triggerThreshold": 0,
        "suppressionDuration": "PT1H",
        "suppressionEnabled": false,
        "tactics": [
          "Exfiltration"
        ],
        "techniques": [
          "T1537"
        ],
        "alertRuleTemplateName": "3b803560-f8a6-4db4-89cb-617d89724ba1",
        "customDetails": null,
        "entityMappings": [
          {
            "fieldMappings": [
              {
                "identifier": "FullName",
                "columnName": "AccountCustomEntity"
              }
            ],
            "entityType": "Account"
          }
        ],
        "OriginalUri": "https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Box/Analytic Rules/BoxItemSharedToExternalUser.yaml",
        "status": "Available",
        "templateVersion": "1.0.0"
      }
    }
  ]
}