CYFIRMA - Social and Public Exposure - Exposure of PIICII in Public Domain Rule

Back


Id	b484f224-687f-4406-af8a-ff019f9f2c24
Rulename	CYFIRMA - Social and Public Exposure - Exposure of PII/CII in Public Domain Rule
Description	“This analytics rule detects high severity alerts from CYFIRMA indicating exposure of Personally Identifiable Information (PII) or Confidential Information (CII) in public or unsecured sources. Such leaks may include email addresses, credentials, phone numbers, or other sensitive personal or organizational data. These exposures can lead to identity theft, phishing, credential compromise, or regulatory non-compliance. Investigate promptly and initiate remediation steps including user notifications and credential resets.”
Severity	Medium
Tactics	InitialAccess Exfiltration Collection CredentialAccess
Techniques	T1078 T1003 T1213 T1537
Required data connectors	CyfirmaDigitalRiskAlertsConnector
Kind	Scheduled
Query frequency	5m
Query period	5m
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Cyfirma Digital Risk/Analytic Rules/SPEExposureOfPIICIIMediumRule.yaml
Version	1.0.1
Arm template	b484f224-687f-4406-af8a-ff019f9f2c24.json

KQL

// Medium severity - Social and Public Exposure - Exposure of PII/CII in Public Domain
let timeFrame = 5m;
CyfirmaSPEPIIAndCIIAlerts_CL
| where severity == 'High' and TimeGenerated between (ago(timeFrame) .. now())
| extend
    Description=description,
    FirstSeen=first_seen,
    LastSeen=last_seen,
    RiskScore=risk_score,
    AlertUID=alert_uid,
    UID=uid,
    AssetType=asset_type,
    AssetValue=signature,
    Source=source,
    Impact=impact,
    Recommendation=recommendation,
    PostedDate=posted_date,
    ProviderName='CYFIRMA',
    ProductName='DeCYFIR/DeTCT',
    AlertTitle=Alert_title
| project
    TimeGenerated,
    Description,
    RiskScore,
    FirstSeen,
    LastSeen,
    AlertUID,
    UID,
    AssetType,
    AssetValue,
    Source,
    Impact,
    Recommendation,
    PostedDate,
    ProductName,
    ProviderName,
    AlertTitle

YAML

alertDetailsOverride:
  alertDynamicProperties:
  - alertProperty: ProductName
    value: ProductName
  - alertProperty: ProviderName
    value: ProviderName
  alertDescriptionFormat: '{{Description}} '
  alertDisplayNameFormat: 'CYFIRMA - Medium Severity: Exposure of PII/CII in Public Domain - {{AlertTitle}} '
incidentConfiguration:
  createIncident: true
  groupingConfiguration:
    matchingMethod: AllEntities
    lookbackDuration: PT5H
    reopenClosedIncident: false
    enabled: false
requiredDataConnectors:
- dataTypes:
  - CyfirmaSPEPIIAndCIIAlerts_CL
  connectorId: CyfirmaDigitalRiskAlertsConnector
relevantTechniques:
- T1078
- T1003
- T1213
- T1537
triggerOperator: gt
version: 1.0.1
queryFrequency: 5m
severity: Medium
description: |
  "This analytics rule detects high severity alerts from CYFIRMA indicating exposure of Personally Identifiable Information (PII) or Confidential Information (CII) in public or unsecured sources. 
  Such leaks may include email addresses, credentials, phone numbers, or other sensitive personal or organizational data. 
  These exposures can lead to identity theft, phishing, credential compromise, or regulatory non-compliance. 
  Investigate promptly and initiate remediation steps including user notifications and credential resets."      
triggerThreshold: 0
customDetails:
  AssetValue: AssetValue
  Description: Description
  LastSeen: LastSeen
  AssetType: AssetType
  FirstSeen: FirstSeen
  RiskScore: RiskScore
  Recommendation: Recommendation
  AlertUID: AlertUID
  Source: Source
  Impact: Impact
  UID: UID
  TimeGenerated: TimeGenerated
name: CYFIRMA - Social and Public Exposure - Exposure of PII/CII in Public Domain Rule
query: |
  // Medium severity - Social and Public Exposure - Exposure of PII/CII in Public Domain
  let timeFrame = 5m;
  CyfirmaSPEPIIAndCIIAlerts_CL
  | where severity == 'High' and TimeGenerated between (ago(timeFrame) .. now())
  | extend
      Description=description,
      FirstSeen=first_seen,
      LastSeen=last_seen,
      RiskScore=risk_score,
      AlertUID=alert_uid,
      UID=uid,
      AssetType=asset_type,
      AssetValue=signature,
      Source=source,
      Impact=impact,
      Recommendation=recommendation,
      PostedDate=posted_date,
      ProviderName='CYFIRMA',
      ProductName='DeCYFIR/DeTCT',
      AlertTitle=Alert_title
  | project
      TimeGenerated,
      Description,
      RiskScore,
      FirstSeen,
      LastSeen,
      AlertUID,
      UID,
      AssetType,
      AssetValue,
      Source,
      Impact,
      Recommendation,
      PostedDate,
      ProductName,
      ProviderName,
      AlertTitle  
tactics:
- InitialAccess
- Exfiltration
- Collection
- CredentialAccess
queryPeriod: 5m
kind: Scheduled
id: b484f224-687f-4406-af8a-ff019f9f2c24
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Cyfirma Digital Risk/Analytic Rules/SPEExposureOfPIICIIMediumRule.yaml
eventGroupingSettings:
  aggregationKind: AlertPerResult
status: Available

ARM