Microsoft Sentinel Analytic Rules
cloudbrothers.infoAzure Sentinel RepoToggle Dark/Light/Auto modeToggle Dark/Light/Auto modeToggle Dark/Light/Auto modeBack to homepage

Theom - Dark Data with large fin value

Back
Id545fdcc7-2123-4b8a-baf6-409f29aad4b1
RulenameTheom - Dark Data with large fin value
Description“Creates Sentinel incidents for critical/high Theom risks, associated with ruleId TRIS0032 (Theom has observed data with a large financial value, but that has not been accessed recently. Use this information to enforce data retention policies)”
SeverityHigh
TacticsCollection
TechniquesT1560
T1530
Required data connectorsTheom
KindScheduled
Query frequency5m
Query period5m
Trigger threshold0
Trigger operatorgt
Source Urihttps://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Theom/Analytic Rules/TRIS0032_Dark_Data_with_large_fin_value.yaml
Version1.0.2
Arm template545fdcc7-2123-4b8a-baf6-409f29aad4b1.json
Deploy To Azure
TheomAlerts_CL
  | where customProps_RuleId_s == "TRIS0032" and (priority_s == "P1" or priority_s == "P2")
queryFrequency: 5m
entityMappings:
- entityType: CloudApplication
  fieldMappings:
  - identifier: Name
    columnName: customProps_AssetName_s
- entityType: URL
  fieldMappings:
  - identifier: Url
    columnName: deepLink_s
description: |
    "Creates Sentinel incidents for critical/high Theom risks, associated with ruleId TRIS0032 (Theom has observed data with a large financial value, but that has not been accessed recently. Use this information to enforce data retention policies)"
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Theom/Analytic Rules/TRIS0032_Dark_Data_with_large_fin_value.yaml
triggerOperator: gt
queryPeriod: 5m
kind: Scheduled
alertDetailsOverride:
  alertDisplayNameFormat: 'Theom Alert ID: {{id_s}} '
  alertDescriptionFormat: |2

    Summary: {{summary_s}}  
    Additional info: {{details_s}}
    Please investigate further on Theom UI at {{deepLink_s}}
status: Available
relevantTechniques:
- T1560
- T1530
tactics:
- Collection
severity: High
name: Theom - Dark Data with large fin value
query: |
  TheomAlerts_CL
    | where customProps_RuleId_s == "TRIS0032" and (priority_s == "P1" or priority_s == "P2")  
triggerThreshold: 0
eventGroupingSettings:
  aggregationKind: AlertPerResult
version: 1.0.2
requiredDataConnectors:
- dataTypes:
  - TheomAlerts_CL
  connectorId: Theom
id: 545fdcc7-2123-4b8a-baf6-409f29aad4b1
{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "workspace": {
      "type": "String"
    }
  },
  "resources": [
    {
      "apiVersion": "2024-01-01-preview",
      "id": "[concat(resourceId('Microsoft.OperationalInsights/workspaces/providers', parameters('workspace'), 'Microsoft.SecurityInsights'),'/alertRules/545fdcc7-2123-4b8a-baf6-409f29aad4b1')]",
      "kind": "Scheduled",
      "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/545fdcc7-2123-4b8a-baf6-409f29aad4b1')]",
      "properties": {
        "alertDetailsOverride": {
          "alertDescriptionFormat": "\nSummary: {{summary_s}}  \nAdditional info: {{details_s}}\nPlease investigate further on Theom UI at {{deepLink_s}}\n",
          "alertDisplayNameFormat": "Theom Alert ID: {{id_s}} "
        },
        "alertRuleTemplateName": "545fdcc7-2123-4b8a-baf6-409f29aad4b1",
        "customDetails": null,
        "description": "\"Creates Sentinel incidents for critical/high Theom risks, associated with ruleId TRIS0032 (Theom has observed data with a large financial value, but that has not been accessed recently. Use this information to enforce data retention policies)\"\n",
        "displayName": "Theom - Dark Data with large fin value",
        "enabled": true,
        "entityMappings": [
          {
            "entityType": "CloudApplication",
            "fieldMappings": [
              {
                "columnName": "customProps_AssetName_s",
                "identifier": "Name"
              }
            ]
          },
          {
            "entityType": "URL",
            "fieldMappings": [
              {
                "columnName": "deepLink_s",
                "identifier": "Url"
              }
            ]
          }
        ],
        "eventGroupingSettings": {
          "aggregationKind": "AlertPerResult"
        },
        "OriginalUri": "https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Theom/Analytic Rules/TRIS0032_Dark_Data_with_large_fin_value.yaml",
        "query": "TheomAlerts_CL\n  | where customProps_RuleId_s == \"TRIS0032\" and (priority_s == \"P1\" or priority_s == \"P2\")\n",
        "queryFrequency": "PT5M",
        "queryPeriod": "PT5M",
        "severity": "High",
        "status": "Available",
        "subTechniques": [],
        "suppressionDuration": "PT1H",
        "suppressionEnabled": false,
        "tactics": [
          "Collection"
        ],
        "techniques": [
          "T1530",
          "T1560"
        ],
        "templateVersion": "1.0.2",
        "triggerOperator": "GreaterThan",
        "triggerThreshold": 0
      },
      "type": "Microsoft.OperationalInsights/workspaces/providers/alertRules"
    }
  ]
}