detection.wiki

Detection rules › Kusto

Mimecast Secure Email Gateway - Spam Event Thread

Status
available
Severity
low
Time window
15m
Source
github.com/Azure/Azure-Sentinel

'Detects threat from spam event thread protection logs.'

MITRE ATT&CK coverage

TacticTechniques
Discovery

Rule body

id: 0cda82c8-e8f0-4117-896e-a10f1b43e64a
name: Mimecast Secure Email Gateway - Spam Event Thread
description: |
  'Detects threat from spam event thread protection logs.'
severity: Low
status: Available
requiredDataConnectors:
  - connectorId: MimecastSEGAPI
    dataTypes:
      - MimecastCG
enabled: true
queryFrequency: 15m
queryPeriod: 15m
triggerOperator: gt
triggerThreshold: 0
tactics:
- Discovery
relevantTechniques:
- T1083
query: |
  MimecastCG
  | where Type == "email_spam"
  | extend  SenderEnvelope = ['Sender Envelope'] 
suppressionDuration: 5h
suppressionEnabled: false
incidentConfiguration:
  createIncident: true
  groupingConfiguration:
    enabled: true
    reopenClosedIncident: false
    lookbackDuration: P7D
    matchingMethod: AllEntities
eventGroupingSettings:
  aggregationKind: AlertPerResult
entityMappings:
- entityType: MailMessage
  fieldMappings:
  - identifier: Sender
    columnName: SenderEnvelope
  - identifier: Recipient
    columnName: Recipients
  - identifier: Subject
    columnName: Subject
version: 1.0.0
kind: Scheduled

Stages and Predicates

Stage 1: source

MimecastCG

Stage 2: where

| where Type == "email_spam"

Stage 3: extend

| extend  SenderEnvelope = ['Sender Envelope']

Indicators

These rows show field, operator, and value matches.

FieldKindValuesSearch
Typeeq
  • email_spam
field:"Type" kind:eq value:"email_spam"

Output fields

These fields are emitted when the rule matches.

FieldSource
SenderEnvelopeextend