NordPass - User data detected in breach

Back


Id	c4d2eb42-a4ab-4db6-a270-3d2ed7e057a0
Rulename	NordPass - User data detected in breach
Description	This will alert you when Data Breach Scanner discovers data related to a member of your organization on the dark web.
Severity	High
Tactics	Exfiltration
Techniques	T1020
Required data connectors	NordPass
Kind	Scheduled
Query frequency	5m
Query period	5m
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/NordPass/Analytics Rules/nordpass_user_data_detected_in_breach.yaml
Version	1.0.0
Arm template	c4d2eb42-a4ab-4db6-a270-3d2ed7e057a0.json

KQL

NordPassEventLogs_CL
| where event_type == "breach"
| where action == "email_breached"
| extend TargetEmail = user_email

YAML

OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/NordPass/Analytics Rules/nordpass_user_data_detected_in_breach.yaml
query: |
  NordPassEventLogs_CL
  | where event_type == "breach"
  | where action == "email_breached"
  | extend TargetEmail = user_email  
requiredDataConnectors:
- dataTypes:
  - NordPassEventLogs_CL
  connectorId: NordPass
incidentConfiguration:
  createIncident: false
relevantTechniques:
- T1020
kind: Scheduled
name: NordPass - User data detected in breach
tactics:
- Exfiltration
severity: High
entityMappings:
- fieldMappings:
  - identifier: MailboxPrimaryAddress
    columnName: TargetEmail
  entityType: Mailbox
displayName: User data detected in breach
triggerOperator: gt
description: |
    This will alert you when Data Breach Scanner discovers data related to a member of your organization on the dark web.
queryFrequency: 5m
triggerThreshold: 0
queryPeriod: 5m
version: 1.0.0
id: c4d2eb42-a4ab-4db6-a270-3d2ed7e057a0

ARM