Detection rules › Kusto
Mimecast Secure Email Gateway - Internal Email Protect
'Detects threats from internal email threat protection.'
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Persistence | |
| Lateral Movement |
Rule body
id: d3bd7640-3600-49f9-8d10-6fe312e68b4f
name: Mimecast Secure Email Gateway - Internal Email Protect
description: |
'Detects threats from internal email threat protection.'
severity: High
status: Available
requiredDataConnectors:
- connectorId: MimecastSEGAPI
dataTypes:
- MimecastCG
enabled: true
queryFrequency: 15m
queryPeriod: 15m
triggerOperator: gt
triggerThreshold: 0
tactics:
- LateralMovement
- Persistence
- Exfiltration
relevantTechniques:
- T1534
- T1546
query: |
MimecastCG
| where Type == "email_iep"
| extend SenderEnvelope = ['Sender Envelope'] , MessageId = ['Message ID']
suppressionDuration: 5h
suppressionEnabled: false
incidentConfiguration:
createIncident: true
groupingConfiguration:
enabled: true
reopenClosedIncident: false
lookbackDuration: P7D
matchingMethod: AllEntities
eventGroupingSettings:
aggregationKind: AlertPerResult
entityMappings:
- entityType: MailMessage
fieldMappings:
- identifier: Sender
columnName: SenderEnvelope
- identifier: Recipient
columnName: Recipients
- identifier: InternetMessageId
columnName: MessageId
version: 1.0.0
kind: Scheduled
Stages and Predicates
Stage 1: source
MimecastCG
Stage 2: where
| where Type == "email_iep"
Stage 3: extend
| extend SenderEnvelope = ['Sender Envelope'] , MessageId = ['Message ID']
Indicators
These rows show field, operator, and value matches.
| Field | Kind | Values | Search |
|---|---|---|---|
Type | eq |
| field:"Type" kind:eq value:"email_iep" |
Output fields
These fields are emitted when the rule matches.
| Field | Source |
|---|---|
MessageId | extend |
SenderEnvelope | extend |