ProofpointPOD - High risk message not discarded

Back


Id	c7cd6073-6d2c-4284-a5c8-da27605bdfde
Rulename	ProofpointPOD - High risk message not discarded
Description	Detects when email with high risk score was not rejected or discarded by filters.
Severity	Low
Tactics	InitialAccess
Techniques	T1566
Required data connectors	ProofpointPOD
Kind	Scheduled
Query frequency	10m
Query period	10m
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Proofpoint On demand(POD) Email Security/Analytic Rules/ProofpointPODHighRiskNotDiscarded.yaml
Version	1.0.1
Arm template	c7cd6073-6d2c-4284-a5c8-da27605bdfde.json

KQL

let lbtime = 10m;
ProofpointPOD
| where TimeGenerated > ago(lbtime)
| where EventType == 'message'
| where NetworkDirection == 'inbound'
| where FilterDisposition !in ('reject', 'discard')
| where FilterModulesSpamScoresOverall == '100'
| project SrcUserUpn, DstUserUpn
| extend AccountCustomEntity = SrcUserUpn

YAML

queryPeriod: 10m
query: |
  let lbtime = 10m;
  ProofpointPOD
  | where TimeGenerated > ago(lbtime)
  | where EventType == 'message'
  | where NetworkDirection == 'inbound'
  | where FilterDisposition !in ('reject', 'discard')
  | where FilterModulesSpamScoresOverall == '100'
  | project SrcUserUpn, DstUserUpn
  | extend AccountCustomEntity = SrcUserUpn  
name: ProofpointPOD - High risk message not discarded
entityMappings:
- fieldMappings:
  - columnName: AccountCustomEntity
    identifier: FullName
  entityType: Account
queryFrequency: 10m
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Proofpoint On demand(POD) Email Security/Analytic Rules/ProofpointPODHighRiskNotDiscarded.yaml
requiredDataConnectors:
- connectorId: ProofpointPOD
  dataTypes:
  - ProofpointPOD_message_CL
description: |
    'Detects when email with high risk score was not rejected or discarded by filters.'
kind: Scheduled
version: 1.0.1
status: Available
severity: Low
relevantTechniques:
- T1566
triggerOperator: gt
triggerThreshold: 0
tactics:
- InitialAccess
id: c7cd6073-6d2c-4284-a5c8-da27605bdfde

ARM