NordPass - User data detected in breach

Back


Id	c4d2eb42-a4ab-4db6-a270-3d2ed7e057a0
Rulename	NordPass - User data detected in breach
Description	This will alert you when Data Breach Scanner discovers data related to a member of your organization on the dark web.
Severity	High
Tactics	Exfiltration
Techniques	T1020
Required data connectors	NordPass
Kind	Scheduled
Query frequency	5m
Query period	5m
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/NordPass/Analytics Rules/nordpass_user_data_detected_in_breach.yaml
Version	1.0.0
Arm template	c4d2eb42-a4ab-4db6-a270-3d2ed7e057a0.json

KQL

NordPassEventLogs_CL
| where event_type == "breach"
| where action == "email_breached"
| extend TargetEmail = user_email

YAML

tactics:
- Exfiltration
relevantTechniques:
- T1020
triggerOperator: gt
name: NordPass - User data detected in breach
id: c4d2eb42-a4ab-4db6-a270-3d2ed7e057a0
displayName: User data detected in breach
incidentConfiguration:
  createIncident: false
queryFrequency: 5m
description: |
    This will alert you when Data Breach Scanner discovers data related to a member of your organization on the dark web.
entityMappings:
- fieldMappings:
  - identifier: MailboxPrimaryAddress
    columnName: TargetEmail
  entityType: Mailbox
severity: High
query: |
  NordPassEventLogs_CL
  | where event_type == "breach"
  | where action == "email_breached"
  | extend TargetEmail = user_email  
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/NordPass/Analytics Rules/nordpass_user_data_detected_in_breach.yaml
queryPeriod: 5m
triggerThreshold: 0
kind: Scheduled
version: 1.0.0
requiredDataConnectors:
- dataTypes:
  - NordPassEventLogs_CL
  connectorId: NordPass

ARM