detection.wiki

Detection rules › Kusto

Mimecast Data Leak Prevention - Notifications

Severity
high
Time window
15m
Source
github.com/Azure/Azure-Sentinel

Detects threat for data leak when action is notification

MITRE ATT&CK coverage

TacticTechniques
Exfiltration

Rule body

id: 1818aeaa-4cc8-426b-ba54-539de896d299
name: Mimecast Data Leak Prevention - Notifications
description: Detects threat for data leak when action is notification
severity: High
requiredDataConnectors:
  - connectorId: MimecastSIEMAPI
    dataTypes:
      - MimecastDLP_CL
enabled: true
query: MimecastDLP_CL| where action_s == "notification";
queryFrequency: 5m
queryPeriod: 15m
triggerOperator: gt
triggerThreshold: 0
suppressionDuration: 5h
suppressionEnabled: false
tactics:
- Exfiltration
relevantTechniques:
- T1030
alertRuleTemplateName:
incidentConfiguration:
  createIncident: true
  groupingConfiguration:
    enabled: true
    reopenClosedIncident: false
    lookbackDuration: 1d
    matchingMethod: AllEntities
eventGroupingSettings:
  aggregationKind: SingleAlert
entityMappings:
- entityType: MailMessage
  fieldMappings:
  - identifier: Sender
    columnName: senderAddress_s
  - identifier: Recipient
    columnName: recipientAddress_s
  - identifier: DeliveryAction
    columnName: action_s
version: 1.0.0
kind: Scheduled

Stages and Predicates

Stage 1: source

MimecastDLP_CL

Stage 2: where

| where action_s == "notification";

Indicators

These rows show field, operator, and value matches.

FieldKindValuesSearch
action_seq
  • notification
field:"action_s" kind:eq value:"notification"