Detection rules › Kusto

Sensitive Data Discovered in the Last 24 Hours

Severity
informational
Time window
1d
Source
github.com/Azure/Azure-Sentinel

'Identifies all classifications that have been detected on assets during a scan by Microsoft Purview within the last 24 hours.'

MITRE ATT&CK coverage

TacticTechniques
DiscoveryT1087 Account Discovery

Rule body kusto

id: 7ae7e8b0-07e9-43cb-b783-b04082f09060
name: Sensitive Data Discovered in the Last 24 Hours  
description: |
  'Identifies all classifications that have been detected on assets during a scan by Microsoft Purview within the last 24 hours.'
severity: Informational
requiredDataConnectors:
  - connectorId: MicrosoftAzurePurview
    dataTypes:
      - PurviewDataSensitivityLogs
queryFrequency: 1d
queryPeriod: 1d
triggerOperator: gt
triggerThreshold: 0
tactics:
  - Discovery
relevantTechniques:
  - T1087
query: |
  PurviewDataSensitivityLogs
  | where Classification != "[]" 
  | where TimeGenerated > ago(24h)
entityMappings:
  - entityType: AzureResource
    fieldMappings:
      - identifier: ResourceId
        columnName: SourcePath
  - entityType: File
    fieldMappings:
      - identifier: Name
        columnName: AssetName
  - entityType: Account
    fieldMappings:
      - identifier: Name
        columnName: PurviewAccountName
customDetails:
  AssetName: AssetName
  Classification: Classification
  AssetPath: AssetPath
  SourceRegion: SourceRegion
  PurviewAccount: PurviewAccountName
  LastScanTime: AssetLastScanTime
alertDetailsOverride:
  alertDisplayNameFormat: 'Sensitive Data Discovered in the Last 24 Hours by Microsoft Purview'
  alertDescriptionFormat: 'Within the last 24 hours, Microsoft Purview scanned assets that contained classifications. The classifications discovered include {{Classification}}.'
version: 1.0.1
kind: Scheduled

Stages and Predicates

Stage 1: source

PurviewDataSensitivityLogs

Stage 2: where

| where Classification != "[]"

Stage 3: where

| where TimeGenerated > ago(24h)

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

FieldKindValues
Classificationne
  • [] transforms: cased