Mimecast Targeted Threat Protection - URL Protect

Back


Id	952faed4-c6a6-4873-aeb9-b348e9ce5aba
Rulename	Mimecast Targeted Threat Protection - URL Protect
Description	Detects malicious scan results and actions which are not allowed.
Severity	High
Tactics	InitialAccess Discovery
Techniques	T0865
Required data connectors	MimecastTTPAPI
Kind	Scheduled
Query frequency	30m
Query period	30m
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Mimecast/Analytic Rules/MimecastTTP/Mimecast_TTP_Url.yaml
Version	1.0.1
Arm template	952faed4-c6a6-4873-aeb9-b348e9ce5aba.json

KQL

MimecastTTPUrl
| where ['Scan Result'] == "malicious" and Action != "allow"
| extend  From_User_EmailAddress = ['From User Email Address'],MessageID = ['Message ID'] , User_EmailAddress = ['User Email Address'], SendingIP = ['Sending IP']

YAML

name: Mimecast Targeted Threat Protection - URL Protect
query: |
  MimecastTTPUrl
  | where ['Scan Result'] == "malicious" and Action != "allow"
  | extend  From_User_EmailAddress = ['From User Email Address'],MessageID = ['Message ID'] , User_EmailAddress = ['User Email Address'], SendingIP = ['Sending IP']  
queryFrequency: 30m
triggerOperator: gt
requiredDataConnectors:
- dataTypes:
  - MimecastTTPUrl
  connectorId: MimecastTTPAPI
entityMappings:
- entityType: IP
  fieldMappings:
  - identifier: Address
    columnName: SendingIP
- entityType: MailMessage
  fieldMappings:
  - identifier: Sender
    columnName: From_User_EmailAddress
  - identifier: InternetMessageId
    columnName: MessageID
  - identifier: Recipient
    columnName: User_EmailAddress
- entityType: URL
  fieldMappings:
  - identifier: Url
    columnName: Url
status: Available
incidentConfiguration:
  createIncident: true
  groupingConfiguration:
    matchingMethod: AllEntities
    reopenClosedIncident: false
    lookbackDuration: P7D
    enabled: true
eventGroupingSettings:
  aggregationKind: AlertPerResult
triggerThreshold: 0
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Mimecast/Analytic Rules/MimecastTTP/Mimecast_TTP_Url.yaml
description: |
    'Detects malicious scan results and actions which are not allowed.'
version: 1.0.1
id: 952faed4-c6a6-4873-aeb9-b348e9ce5aba
kind: Scheduled
suppressionEnabled: false
relevantTechniques:
- T0865
suppressionDuration: 5h
severity: High
tactics:
- InitialAccess
- Discovery
queryPeriod: 30m

ARM