GTI - Data Leak Alert Detected | Microsoft Sentinel Analytic Rules

Back


Id	d4e5f6a7-b8c9-0123-defa-234567890124
Rulename	GTI - Data Leak Alert Detected
Description	Triggers an incident when a GTI Relevance System Alert of type data_leak is ingested. Data Leak alerts indicate that sensitive organisational data (credentials, PII, intellectual property, source code, databases, etc.) has been found exposed on the dark web, paste sites, or underground forums and matches your organisation profile. Each unique Alert ID is grouped into a single incident.
Severity	High
Tactics	Exfiltration Impact CredentialAccess Collection
Techniques	T1567 T1530 T1552 T1485
Required data connectors	GoogleThreatIntelligenceRelevanceSystemAlertsAPI
Kind	Scheduled
Query frequency	5m
Query period	5m
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Google%20Threat%20Intelligence/Analytic%20Rules/RelevanceSystemAlerts/GTI_DataLeakAlerts.yaml
Version	1.0.0
Arm template	d4e5f6a7-b8c9-0123-defa-234567890124.json

KQL

GTIRelevanceSystemAlerts
| where DetailType == "data_leak"
| project
    TimeGenerated,
    AlertId,
    AlertName          = DisplayName,
    AlertState         = State,
    LeakSeverity       = DataLeakSeverity,
    DiscoveryDocuments = DataLeakDiscoveryDocumentIds,
    PriorityLevel,
    PriorityReasoning,
    SeverityLevel,
    SeverityConfidence,
    SeverityReasoning,
    RelevanceLevel,
    RelevanceConfidence,
    RelevanceReasoning,
    FindingCount,
    AiSummary,
    CommonThemes       = RelevanceEvidenceCommonThemes,
    DistinctThemes     = RelevanceEvidenceDistinctThemes,
    AuditCreateTime,
    AuditUpdateTime

YAML

queryFrequency: 5m
incidentConfiguration:
  createIncident: true
  groupingConfiguration:
    reopenClosedIncident: false
    matchingMethod: Selected
    lookbackDuration: P5D
    enabled: true
    groupByCustomDetails:
    - AlertId
triggerThreshold: 0
triggerOperator: gt
severity: High
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Google%20Threat%20Intelligence/Analytic%20Rules/RelevanceSystemAlerts/GTI_DataLeakAlerts.yaml
eventGroupingSettings:
  aggregationKind: AlertPerResult
alertDetailsOverride:
  alertDisplayNameFormat: 'GTI Data Leak: {{AlertName}}'
  alertDescriptionFormat: |
    Leak Severity: {{LeakSeverity}} | Priority: {{PriorityLevel}}

    Summary: {{AiSummary}}
query: |
  GTIRelevanceSystemAlerts
  | where DetailType == "data_leak"
  | project
      TimeGenerated,
      AlertId,
      AlertName          = DisplayName,
      AlertState         = State,
      LeakSeverity       = DataLeakSeverity,
      DiscoveryDocuments = DataLeakDiscoveryDocumentIds,
      PriorityLevel,
      PriorityReasoning,
      SeverityLevel,
      SeverityConfidence,
      SeverityReasoning,
      RelevanceLevel,
      RelevanceConfidence,
      RelevanceReasoning,
      FindingCount,
      AiSummary,
      CommonThemes       = RelevanceEvidenceCommonThemes,
      DistinctThemes     = RelevanceEvidenceDistinctThemes,
      AuditCreateTime,
      AuditUpdateTime
tactics:
- Exfiltration
- Impact
- CredentialAccess
- Collection
queryPeriod: 5m
customDetails:
  FindingCount: FindingCount
  RelevanceLevel: RelevanceLevel
  PriorityLevel: PriorityLevel
  AlertId: AlertId
  LeakSeverity: LeakSeverity
  SeverityLevel: SeverityLevel
  AlertState: AlertState
relevantTechniques:
- T1567
- T1530
- T1552
- T1485
requiredDataConnectors:
- connectorId: GoogleThreatIntelligenceRelevanceSystemAlertsAPI
  dataTypes:
  - RelevanceSystemAlerts_CL
id: d4e5f6a7-b8c9-0123-defa-234567890124
kind: Scheduled
version: 1.0.0
description: |
  Triggers an incident when a GTI Relevance System Alert of type data_leak is ingested.
  Data Leak alerts indicate that sensitive organisational data (credentials, PII, intellectual property,
  source code, databases, etc.) has been found exposed on the dark web, paste sites, or underground
  forums and matches your organisation profile.
  Each unique Alert ID is grouped into a single incident.
status: Available
name: GTI - Data Leak Alert Detected

ARM

{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "workspace": {
      "type": "String"
    }
  },
  "resources": [
    {
      "apiVersion": "2024-01-01-preview",
      "id": "[concat(resourceId('Microsoft.OperationalInsights/workspaces/providers', parameters('workspace'), 'Microsoft.SecurityInsights'),'/alertRules/d4e5f6a7-b8c9-0123-defa-234567890124')]",
      "kind": "Scheduled",
      "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/d4e5f6a7-b8c9-0123-defa-234567890124')]",
      "properties": {
        "alertDetailsOverride": {
          "alertDescriptionFormat": "Leak Severity: {{LeakSeverity}} | Priority: {{PriorityLevel}}\n\nSummary: {{AiSummary}}\n",
          "alertDisplayNameFormat": "GTI Data Leak: {{AlertName}}"
        },
        "alertRuleTemplateName": "d4e5f6a7-b8c9-0123-defa-234567890124",
        "customDetails": {
          "AlertId": "AlertId",
          "AlertState": "AlertState",
          "FindingCount": "FindingCount",
          "LeakSeverity": "LeakSeverity",
          "PriorityLevel": "PriorityLevel",
          "RelevanceLevel": "RelevanceLevel",
          "SeverityLevel": "SeverityLevel"
        },
        "description": "Triggers an incident when a GTI Relevance System Alert of type data_leak is ingested.\nData Leak alerts indicate that sensitive organisational data (credentials, PII, intellectual property,\nsource code, databases, etc.) has been found exposed on the dark web, paste sites, or underground\nforums and matches your organisation profile.\nEach unique Alert ID is grouped into a single incident.\n",
        "displayName": "GTI - Data Leak Alert Detected",
        "enabled": true,
        "entityMappings": null,
        "eventGroupingSettings": {
          "aggregationKind": "AlertPerResult"
        },
        "incidentConfiguration": {
          "createIncident": true,
          "groupingConfiguration": {
            "enabled": true,
            "groupByCustomDetails": [
              "AlertId"
            ],
            "lookbackDuration": "P5D",
            "matchingMethod": "Selected",
            "reopenClosedIncident": false
          }
        },
        "OriginalUri": "https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Google%20Threat%20Intelligence/Analytic%20Rules/RelevanceSystemAlerts/GTI_DataLeakAlerts.yaml",
        "query": "GTIRelevanceSystemAlerts\n| where DetailType == \"data_leak\"\n| project\n    TimeGenerated,\n    AlertId,\n    AlertName          = DisplayName,\n    AlertState         = State,\n    LeakSeverity       = DataLeakSeverity,\n    DiscoveryDocuments = DataLeakDiscoveryDocumentIds,\n    PriorityLevel,\n    PriorityReasoning,\n    SeverityLevel,\n    SeverityConfidence,\n    SeverityReasoning,\n    RelevanceLevel,\n    RelevanceConfidence,\n    RelevanceReasoning,\n    FindingCount,\n    AiSummary,\n    CommonThemes       = RelevanceEvidenceCommonThemes,\n    DistinctThemes     = RelevanceEvidenceDistinctThemes,\n    AuditCreateTime,\n    AuditUpdateTime\n",
        "queryFrequency": "PT5M",
        "queryPeriod": "PT5M",
        "severity": "High",
        "status": "Available",
        "subTechniques": [],
        "suppressionDuration": "PT1H",
        "suppressionEnabled": false,
        "tactics": [
          "Collection",
          "CredentialAccess",
          "Exfiltration",
          "Impact"
        ],
        "techniques": [
          "T1485",
          "T1530",
          "T1552",
          "T1567"
        ],
        "templateVersion": "1.0.0",
        "triggerOperator": "GreaterThan",
        "triggerThreshold": 0
      },
      "type": "Microsoft.OperationalInsights/workspaces/providers/alertRules"
    }
  ]
}