ProofpointPOD - High risk message not discarded

Back


Id	c7cd6073-6d2c-4284-a5c8-da27605bdfde
Rulename	ProofpointPOD - High risk message not discarded
Description	Detects when email with high risk score was not rejected or discarded by filters.
Severity	Low
Tactics	InitialAccess
Techniques	T1566
Required data connectors	ProofpointPOD
Kind	Scheduled
Query frequency	10m
Query period	10m
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Proofpoint On demand(POD) Email Security/Analytic Rules/ProofpointPODHighRiskNotDiscarded.yaml
Version	1.0.1
Arm template	c7cd6073-6d2c-4284-a5c8-da27605bdfde.json

KQL

let lbtime = 10m;
ProofpointPOD
| where TimeGenerated > ago(lbtime)
| where EventType == 'message'
| where NetworkDirection == 'inbound'
| where FilterDisposition !in ('reject', 'discard')
| where FilterModulesSpamScoresOverall == '100'
| project SrcUserUpn, DstUserUpn
| extend AccountCustomEntity = SrcUserUpn

YAML

OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Proofpoint On demand(POD) Email Security/Analytic Rules/ProofpointPODHighRiskNotDiscarded.yaml
queryFrequency: 10m
name: ProofpointPOD - High risk message not discarded
severity: Low
triggerThreshold: 0
query: |
  let lbtime = 10m;
  ProofpointPOD
  | where TimeGenerated > ago(lbtime)
  | where EventType == 'message'
  | where NetworkDirection == 'inbound'
  | where FilterDisposition !in ('reject', 'discard')
  | where FilterModulesSpamScoresOverall == '100'
  | project SrcUserUpn, DstUserUpn
  | extend AccountCustomEntity = SrcUserUpn  
requiredDataConnectors:
- dataTypes:
  - ProofpointPOD_message_CL
  connectorId: ProofpointPOD
relevantTechniques:
- T1566
status: Available
triggerOperator: gt
queryPeriod: 10m
description: |
    'Detects when email with high risk score was not rejected or discarded by filters.'
id: c7cd6073-6d2c-4284-a5c8-da27605bdfde
version: 1.0.1
entityMappings:
- fieldMappings:
  - columnName: AccountCustomEntity
    identifier: FullName
  entityType: Account
kind: Scheduled
tactics:
- InitialAccess

ARM