Mimecast Secure Email Gateway - Internal Email Protect

Back


Id	5b66d176-e344-4abf-b915-e5f09a6430ef
Rulename	Mimecast Secure Email Gateway - Internal Email Protect
Description	Detects threats from internal email threat protection
Severity	High
Tactics	LateralMovement Persistence Exfiltration
Techniques	T1534 T1546
Required data connectors	MimecastSIEMAPI
Kind	Scheduled
Query frequency	5m
Query period	15m
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/MimecastSEG/Analytic Rules/MimecastSIEM_Internal_Mail_Protect.yaml
Version	1.0.0
Arm template	5b66d176-e344-4abf-b915-e5f09a6430ef.json

KQL

MimecastSIEM_CL| where mimecastEventId_s=="mail_ttp_iep"

YAML

suppressionDuration: 5h
name: Mimecast Secure Email Gateway - Internal Email Protect
enabled: true
severity: High
suppressionEnabled: false
description: Detects threats from internal email threat protection
version: 1.0.0
customDetails:
  Subject: Subject_s
  Route: Route_s
  UrlCategory: UrlCategory_s
  ScanResultInfo: ScanResultInfo_s
requiredDataConnectors:
- dataTypes:
  - MimecastSIEM_CL
  connectorId: MimecastSIEMAPI
tactics:
- LateralMovement
- Persistence
- Exfiltration
relevantTechniques:
- T1534
- T1546
entityMappings:
- entityType: MailMessage
  fieldMappings:
  - identifier: Sender
    columnName: Sender_s
  - identifier: Recipient
    columnName: Recipient_s
  - identifier: InternetMessageId
    columnName: MsgId_s
- entityType: URL
  fieldMappings:
  - identifier: Url
    columnName: URL_s
triggerThreshold: 0
id: 5b66d176-e344-4abf-b915-e5f09a6430ef
queryPeriod: 15m
incidentConfiguration:
  groupingConfiguration:
    reopenClosedIncident: false
    lookbackDuration: 1d
    matchingMethod: AllEntities
    enabled: true
  createIncident: true
triggerOperator: gt
query: MimecastSIEM_CL| where mimecastEventId_s=="mail_ttp_iep"
eventGroupingSettings:
  aggregationKind: SingleAlert
queryFrequency: 5m
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/MimecastSEG/Analytic Rules/MimecastSIEM_Internal_Mail_Protect.yaml
kind: Scheduled

ARM