Microsoft Sentinel Analytic Rules
cloudbrothers.infoAzure Sentinel RepoToggle Dark/Light/Auto modeToggle Dark/Light/Auto modeToggle Dark/Light/Auto modeBack to homepage

Box - Item shared to external entity

Back
Id3b803560-f8a6-4db4-89cb-617d89724ba1
RulenameBox - Item shared to external entity
DescriptionDetects when an item was shared to external entity.
SeverityMedium
TacticsExfiltration
TechniquesT1537
Required data connectorsBoxDataConnector
KindScheduled
Query frequency1h
Query period1h
Trigger threshold0
Trigger operatorgt
Source Urihttps://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Box/Analytic Rules/BoxItemSharedToExternalUser.yaml
Version1.0.0
Arm template3b803560-f8a6-4db4-89cb-617d89724ba1.json
Deploy To Azure
BoxEvents
| where EventType =~ 'COLLABORATION_INVITE'
| extend corp_domain = tolower(extract(@'@(.*)', 1, SrcUserUpn))
| extend accessibleby_domain = tolower(extract(@'@(.*)', 1, AccessibleByLogin))
| where corp_domain != accessibleby_domain
| extend AccountCustomEntity = SrcUserUpn
requiredDataConnectors:
- connectorId: BoxDataConnector
  dataTypes:
  - BoxEvents_CL
triggerOperator: gt
queryFrequency: 1h
name: Box - Item shared to external entity
status: Available
queryPeriod: 1h
id: 3b803560-f8a6-4db4-89cb-617d89724ba1
description: |
    'Detects when an item was shared to external entity.'
severity: Medium
query: |
  BoxEvents
  | where EventType =~ 'COLLABORATION_INVITE'
  | extend corp_domain = tolower(extract(@'@(.*)', 1, SrcUserUpn))
  | extend accessibleby_domain = tolower(extract(@'@(.*)', 1, AccessibleByLogin))
  | where corp_domain != accessibleby_domain
  | extend AccountCustomEntity = SrcUserUpn  
version: 1.0.0
kind: Scheduled
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Box/Analytic Rules/BoxItemSharedToExternalUser.yaml
entityMappings:
- entityType: Account
  fieldMappings:
  - identifier: FullName
    columnName: AccountCustomEntity
relevantTechniques:
- T1537
tactics:
- Exfiltration
triggerThreshold: 0
{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "workspace": {
      "type": "String"
    }
  },
  "resources": [
    {
      "id": "[concat(resourceId('Microsoft.OperationalInsights/workspaces/providers', parameters('workspace'), 'Microsoft.SecurityInsights'),'/alertRules/3b803560-f8a6-4db4-89cb-617d89724ba1')]",
      "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/3b803560-f8a6-4db4-89cb-617d89724ba1')]",
      "type": "Microsoft.OperationalInsights/workspaces/providers/alertRules",
      "kind": "Scheduled",
      "apiVersion": "2022-11-01-preview",
      "properties": {
        "displayName": "Box - Item shared to external entity",
        "description": "'Detects when an item was shared to external entity.'\n",
        "severity": "Medium",
        "enabled": true,
        "query": "BoxEvents\n| where EventType =~ 'COLLABORATION_INVITE'\n| extend corp_domain = tolower(extract(@'@(.*)', 1, SrcUserUpn))\n| extend accessibleby_domain = tolower(extract(@'@(.*)', 1, AccessibleByLogin))\n| where corp_domain != accessibleby_domain\n| extend AccountCustomEntity = SrcUserUpn\n",
        "queryFrequency": "PT1H",
        "queryPeriod": "PT1H",
        "triggerOperator": "GreaterThan",
        "triggerThreshold": 0,
        "suppressionDuration": "PT1H",
        "suppressionEnabled": false,
        "tactics": [
          "Exfiltration"
        ],
        "techniques": [
          "T1537"
        ],
        "alertRuleTemplateName": "3b803560-f8a6-4db4-89cb-617d89724ba1",
        "customDetails": null,
        "entityMappings": [
          {
            "fieldMappings": [
              {
                "identifier": "FullName",
                "columnName": "AccountCustomEntity"
              }
            ],
            "entityType": "Account"
          }
        ],
        "templateVersion": "1.0.0",
        "OriginalUri": "https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Box/Analytic Rules/BoxItemSharedToExternalUser.yaml",
        "status": "Available"
      }
    }
  ]
}