NordPassEventLogs_CL
| where event_type == "breach"
| where action == "email_breached"
| extend TargetEmail = user_email
entityMappings:
- fieldMappings:
- columnName: TargetEmail
identifier: MailboxPrimaryAddress
entityType: Mailbox
triggerThreshold: 0
severity: High
incidentConfiguration:
createIncident: false
queryFrequency: 5m
queryPeriod: 5m
relevantTechniques:
- T1020
displayName: User data detected in breach
triggerOperator: gt
description: |
This will alert you when Data Breach Scanner discovers data related to a member of your organization on the dark web.
id: c4d2eb42-a4ab-4db6-a270-3d2ed7e057a0
requiredDataConnectors:
- connectorId: NordPass
dataTypes:
- NordPassEventLogs_CL
name: NordPass - User data detected in breach
version: 1.0.0
query: |
NordPassEventLogs_CL
| where event_type == "breach"
| where action == "email_breached"
| extend TargetEmail = user_email
tactics:
- Exfiltration
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/NordPass/Analytics Rules/nordpass_user_data_detected_in_breach.yaml
kind: Scheduled
{
"$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
"contentVersion": "1.0.0.0",
"parameters": {
"workspace": {
"type": "String"
}
},
"resources": [
{
"apiVersion": "2024-01-01-preview",
"id": "[concat(resourceId('Microsoft.OperationalInsights/workspaces/providers', parameters('workspace'), 'Microsoft.SecurityInsights'),'/alertRules/c4d2eb42-a4ab-4db6-a270-3d2ed7e057a0')]",
"kind": "Scheduled",
"name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/c4d2eb42-a4ab-4db6-a270-3d2ed7e057a0')]",
"properties": {
"alertRuleTemplateName": "c4d2eb42-a4ab-4db6-a270-3d2ed7e057a0",
"customDetails": null,
"description": "This will alert you when Data Breach Scanner discovers data related to a member of your organization on the dark web.\n",
"displayName": "User data detected in breach",
"enabled": true,
"entityMappings": [
{
"entityType": "Mailbox",
"fieldMappings": [
{
"columnName": "TargetEmail",
"identifier": "MailboxPrimaryAddress"
}
]
}
],
"incidentConfiguration": {
"createIncident": false
},
"OriginalUri": "https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/NordPass/Analytics Rules/nordpass_user_data_detected_in_breach.yaml",
"query": "NordPassEventLogs_CL\n| where event_type == \"breach\"\n| where action == \"email_breached\"\n| extend TargetEmail = user_email\n",
"queryFrequency": "PT5M",
"queryPeriod": "PT5M",
"severity": "High",
"subTechniques": [],
"suppressionDuration": "PT1H",
"suppressionEnabled": false,
"tactics": [
"Exfiltration"
],
"techniques": [
"T1020"
],
"templateVersion": "1.0.0",
"triggerOperator": "GreaterThan",
"triggerThreshold": 0
},
"type": "Microsoft.OperationalInsights/workspaces/providers/alertRules"
}
]
}