NordPass - User data detected in breach

Back


Id	c4d2eb42-a4ab-4db6-a270-3d2ed7e057a0
Rulename	NordPass - User data detected in breach
Description	This will alert you when Data Breach Scanner discovers data related to a member of your organization on the dark web.
Severity	High
Tactics	Exfiltration
Techniques	T1020
Required data connectors	NordPass
Kind	Scheduled
Query frequency	5m
Query period	5m
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/NordPass/Analytics Rules/nordpass_user_data_detected_in_breach.yaml
Version	1.0.0
Arm template	c4d2eb42-a4ab-4db6-a270-3d2ed7e057a0.json

KQL

NordPassEventLogs_CL
| where event_type == "breach"
| where action == "email_breached"
| extend TargetEmail = user_email

YAML

displayName: User data detected in breach
version: 1.0.0
triggerThreshold: 0
entityMappings:
- fieldMappings:
  - columnName: TargetEmail
    identifier: MailboxPrimaryAddress
  entityType: Mailbox
id: c4d2eb42-a4ab-4db6-a270-3d2ed7e057a0
triggerOperator: gt
query: |
  NordPassEventLogs_CL
  | where event_type == "breach"
  | where action == "email_breached"
  | extend TargetEmail = user_email  
description: |
    This will alert you when Data Breach Scanner discovers data related to a member of your organization on the dark web.
kind: Scheduled
queryFrequency: 5m
name: NordPass - User data detected in breach
severity: High
incidentConfiguration:
  createIncident: false
queryPeriod: 5m
requiredDataConnectors:
- dataTypes:
  - NordPassEventLogs_CL
  connectorId: NordPass
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/NordPass/Analytics Rules/nordpass_user_data_detected_in_breach.yaml
relevantTechniques:
- T1020
tactics:
- Exfiltration

ARM