Detection rules › Kusto
Filewall - Blocked files
Identifies files blocked by Filewall for Microsoft 365 (SharePoint/OneDrive/Teams).
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Exfiltration |
Rule body
id: 86e7f6fd-5c29-4a3a-bced-3eca3fb0c621
name: Filewall - Blocked files
description: Identifies files blocked by Filewall for Microsoft 365 (SharePoint/OneDrive/Teams).
severity: High
status: Available
kind: Scheduled
query: |
FilewallM365FileEvent()
| where EventVendor == 'ODI-X' and EventProduct == 'Filewall for Microsoft 365'
| where EventType == 'FileBlocked'
queryFrequency: 5m
queryPeriod: 5m
triggerOperator: gt
triggerThreshold: 0
relevantTechniques:
- T1048
tactics:
- Exfiltration
eventGroupingSettings:
aggregationKind: AlertPerResult
incidentConfiguration:
createIncident: true
groupingConfiguration:
matchingMethod: AllEntities
reopenClosedIncident: false
enabled: false
lookbackDuration: PT1H
entityMappings:
- entityType: Account
fieldMappings:
- identifier: FullName
columnName: ActorUsername
- entityType: File
fieldMappings:
- identifier: Name
columnName: TargetFileName
- identifier: Directory
columnName: TargetFilePath
requiredDataConnectors:
- dataTypes:
- FilewallFile_CL
connectorId: FilewallM365
version: 1.0.0
Stages and Predicates
Stage 1: source
FilewallM365FileEvent()
Stage 2: where
| where EventVendor == 'ODI-X' and EventProduct == 'Filewall for Microsoft 365'
Stage 3: where
| where EventType == 'FileBlocked'
Indicators
These rows show field, operator, and value matches.
| Field | Kind | Values | Search |
|---|---|---|---|
EventProduct | eq |
| field:"EventProduct" kind:eq value:"Filewall for Microsoft 365" |
EventType | eq |
| field:"EventType" kind:eq value:"FileBlocked" |
EventVendor | eq |
| field:"EventVendor" kind:eq value:"ODI-X" |