Mimecast Secure Email Gateway - Internal Email Protect

Back


Id	5b66d176-e344-4abf-b915-e5f09a6430ef
Rulename	Mimecast Secure Email Gateway - Internal Email Protect
Description	Detects threats from internal email threat protection
Severity	High
Tactics	LateralMovement Persistence Exfiltration
Techniques	T1534 T1546
Required data connectors	MimecastSIEMAPI
Kind	Scheduled
Query frequency	5m
Query period	15m
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/MimecastSEG/Analytic Rules/MimecastSIEM_Internal_Mail_Protect.yaml
Version	1.0.0
Arm template	5b66d176-e344-4abf-b915-e5f09a6430ef.json

KQL

MimecastSIEM_CL| where mimecastEventId_s=="mail_ttp_iep"

YAML

queryPeriod: 15m
query: MimecastSIEM_CL| where mimecastEventId_s=="mail_ttp_iep"
enabled: true
name: Mimecast Secure Email Gateway - Internal Email Protect
entityMappings:
- fieldMappings:
  - columnName: Sender_s
    identifier: Sender
  - columnName: Recipient_s
    identifier: Recipient
  - columnName: MsgId_s
    identifier: InternetMessageId
  entityType: MailMessage
- fieldMappings:
  - columnName: URL_s
    identifier: Url
  entityType: URL
suppressionDuration: 5h
suppressionEnabled: false
description: Detects threats from internal email threat protection
kind: Scheduled
incidentConfiguration:
  groupingConfiguration:
    lookbackDuration: 1d
    reopenClosedIncident: false
    matchingMethod: AllEntities
    enabled: true
  createIncident: true
version: 1.0.0
eventGroupingSettings:
  aggregationKind: SingleAlert
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/MimecastSEG/Analytic Rules/MimecastSIEM_Internal_Mail_Protect.yaml
queryFrequency: 5m
severity: High
requiredDataConnectors:
- connectorId: MimecastSIEMAPI
  dataTypes:
  - MimecastSIEM_CL
triggerOperator: gt
triggerThreshold: 0
customDetails:
  Route: Route_s
  Subject: Subject_s
  ScanResultInfo: ScanResultInfo_s
  UrlCategory: UrlCategory_s
tactics:
- LateralMovement
- Persistence
- Exfiltration
id: 5b66d176-e344-4abf-b915-e5f09a6430ef
relevantTechniques:
- T1534
- T1546

ARM