ProofpointPOD - High risk message not discarded

Back


Id	c7cd6073-6d2c-4284-a5c8-da27605bdfde
Rulename	ProofpointPOD - High risk message not discarded
Description	Detects when email with high risk score was not rejected or discarded by filters.
Severity	Low
Tactics	InitialAccess
Techniques	T1566
Required data connectors	ProofpointPOD
Kind	Scheduled
Query frequency	10m
Query period	10m
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Proofpoint On demand(POD) Email Security/Analytic Rules/ProofpointPODHighRiskNotDiscarded.yaml
Version	1.0.1
Arm template	c7cd6073-6d2c-4284-a5c8-da27605bdfde.json

KQL

let lbtime = 10m;
ProofpointPOD
| where TimeGenerated > ago(lbtime)
| where EventType == 'message'
| where NetworkDirection == 'inbound'
| where FilterDisposition !in ('reject', 'discard')
| where FilterModulesSpamScoresOverall == '100'
| project SrcUserUpn, DstUserUpn
| extend AccountCustomEntity = SrcUserUpn

YAML

requiredDataConnectors:
- connectorId: ProofpointPOD
  dataTypes:
  - ProofpointPOD_message_CL
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Proofpoint On demand(POD) Email Security/Analytic Rules/ProofpointPODHighRiskNotDiscarded.yaml
triggerThreshold: 0
status: Available
relevantTechniques:
- T1566
queryPeriod: 10m
name: ProofpointPOD - High risk message not discarded
entityMappings:
- entityType: Account
  fieldMappings:
  - columnName: AccountCustomEntity
    identifier: FullName
queryFrequency: 10m
triggerOperator: gt
kind: Scheduled
description: |
    'Detects when email with high risk score was not rejected or discarded by filters.'
tactics:
- InitialAccess
severity: Low
version: 1.0.1
query: |
  let lbtime = 10m;
  ProofpointPOD
  | where TimeGenerated > ago(lbtime)
  | where EventType == 'message'
  | where NetworkDirection == 'inbound'
  | where FilterDisposition !in ('reject', 'discard')
  | where FilterModulesSpamScoresOverall == '100'
  | project SrcUserUpn, DstUserUpn
  | extend AccountCustomEntity = SrcUserUpn  
id: c7cd6073-6d2c-4284-a5c8-da27605bdfde

ARM