Detection rules › Kusto

Digital Guardian - Incident with not blocked action

Status
available
Severity
high
Time window
1h
Source
github.com/Azure/Azure-Sentinel

'Detects when incident has not block action.'

MITRE ATT&CK coverage

Rule body

id: 07bca129-e7d6-4421-b489-32abade0b6a7
name: Digital Guardian - Incident with not blocked action
description: |
  'Detects when incident has not block action.'
severity: High
status: Available
requiredDataConnectors:
  - connectorId: SyslogAma
    datatypes:
      - Syslog
queryFrequency: 1h
queryPeriod: 1h
triggerOperator: gt
triggerThreshold: 0
tactics:
  - Exfiltration
relevantTechniques:
  - T1048
query: |
  DigitalGuardianDLPEvent
  | where isnotempty(IncidentStatus)
  | extend inc_act = split(IncidentStatus, ',')
  | where inc_act has 'New'
  | where inc_act !contains 'Block'
  | extend AccountCustomEntity = SrcUserName
entityMappings:
  - entityType: Account
    fieldMappings:
      - identifier: Name
        columnName: AccountCustomEntity
version: 1.0.2
kind: Scheduled

Stages and Predicates

Stage 1: source

DigitalGuardianDLPEvent

Stage 2: where

| where isnotempty(IncidentStatus)

Stage 3: extend

| extend inc_act = split(IncidentStatus, ',')

Stage 4: where

| where inc_act has 'New'

Stage 5: where

| where inc_act !contains 'Block'

Stage 6: extend

| extend AccountCustomEntity = SrcUserName

Exclusions

The rule actively suppresses these predicates.

FieldKindExcluded valuesSearch
inc_actcontainsBlockexcludes:inc_act field:"inc_act" value:"Block"

Indicators

These rows show field, operator, and value matches.

FieldKindValuesSearch
IncidentStatusis_not_null
  • (no value, null check)
field:"IncidentStatus" kind:is_not_null
inc_actmatch
  • New transforms: term
field:"inc_act" kind:match value:"New"

Output fields

These fields are emitted when the rule matches.

FieldSource
inc_actextend
AccountCustomEntityextend