Detection rules › Kusto
Sensitive Data Discovered in the Last 24 Hours
'Identifies all classifications that have been detected on assets during a scan by Microsoft Purview within the last 24 hours.'
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Discovery | T1087 Account Discovery |
Rule body kusto
id: 7ae7e8b0-07e9-43cb-b783-b04082f09060
name: Sensitive Data Discovered in the Last 24 Hours
description: |
'Identifies all classifications that have been detected on assets during a scan by Microsoft Purview within the last 24 hours.'
severity: Informational
requiredDataConnectors:
- connectorId: MicrosoftAzurePurview
dataTypes:
- PurviewDataSensitivityLogs
queryFrequency: 1d
queryPeriod: 1d
triggerOperator: gt
triggerThreshold: 0
tactics:
- Discovery
relevantTechniques:
- T1087
query: |
PurviewDataSensitivityLogs
| where Classification != "[]"
| where TimeGenerated > ago(24h)
entityMappings:
- entityType: AzureResource
fieldMappings:
- identifier: ResourceId
columnName: SourcePath
- entityType: File
fieldMappings:
- identifier: Name
columnName: AssetName
- entityType: Account
fieldMappings:
- identifier: Name
columnName: PurviewAccountName
customDetails:
AssetName: AssetName
Classification: Classification
AssetPath: AssetPath
SourceRegion: SourceRegion
PurviewAccount: PurviewAccountName
LastScanTime: AssetLastScanTime
alertDetailsOverride:
alertDisplayNameFormat: 'Sensitive Data Discovered in the Last 24 Hours by Microsoft Purview'
alertDescriptionFormat: 'Within the last 24 hours, Microsoft Purview scanned assets that contained classifications. The classifications discovered include {{Classification}}.'
version: 1.0.1
kind: Scheduled
Stages and Predicates
Stage 1: source
PurviewDataSensitivityLogs
Stage 2: where
| where Classification != "[]"
Stage 3: where
| where TimeGenerated > ago(24h)
Indicators
Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.
| Field | Kind | Values |
|---|---|---|
Classification | ne |
|