GTI - Data Leak Alert Detected

id: d4e5f6a7-b8c9-0123-defa-234567890124
name: GTI - Data Leak Alert Detected
description: |
  Triggers an incident when a GTI Relevance System Alert of type data_leak is ingested.
  Data Leak alerts indicate that sensitive organisational data (credentials, PII, intellectual property,
  source code, databases, etc.) has been found exposed on the dark web, paste sites, or underground
  forums and matches your organisation profile.
  Each unique Alert ID is grouped into a single incident.
severity: High
status: Available
requiredDataConnectors:
  - connectorId: GoogleThreatIntelligenceRelevanceSystemAlertsAPI
    dataTypes:
      - RelevanceSystemAlerts_CL
queryFrequency: 5m
queryPeriod: 5m
triggerOperator: gt
triggerThreshold: 0
tactics:
  - Exfiltration
  - Impact
  - CredentialAccess
  - Collection
relevantTechniques:
  - T1567
  - T1530
  - T1552
  - T1485
query: |
  GTIRelevanceSystemAlerts
  | where DetailType == "data_leak"
  | project
      TimeGenerated,
      AlertId,
      AlertName          = DisplayName,
      AlertState         = State,
      LeakSeverity       = DataLeakSeverity,
      DiscoveryDocuments = DataLeakDiscoveryDocumentIds,
      PriorityLevel,
      PriorityReasoning,
      SeverityLevel,
      SeverityConfidence,
      SeverityReasoning,
      RelevanceLevel,
      RelevanceConfidence,
      RelevanceReasoning,
      FindingCount,
      AiSummary,
      CommonThemes       = RelevanceEvidenceCommonThemes,
      DistinctThemes     = RelevanceEvidenceDistinctThemes,
      AuditCreateTime,
      AuditUpdateTime
alertDetailsOverride:
  alertDisplayNameFormat: 'GTI Data Leak: {{AlertName}}'
  alertDescriptionFormat: |
    Leak Severity: {{LeakSeverity}} | Priority: {{PriorityLevel}}

    Summary: {{AiSummary}}
customDetails:
  AlertId: AlertId
  AlertState: AlertState
  LeakSeverity: LeakSeverity
  PriorityLevel: PriorityLevel
  SeverityLevel: SeverityLevel
  RelevanceLevel: RelevanceLevel
  FindingCount: FindingCount
incidentConfiguration:
  createIncident: true
  groupingConfiguration:
    enabled: true
    reopenClosedIncident: false
    lookbackDuration: P5D
    matchingMethod: Selected
    groupByCustomDetails:
      - AlertId
eventGroupingSettings:
  aggregationKind: AlertPerResult
version: 1.0.0
kind: Scheduled