Detection rules › Kusto
Mimecast Data Leak Prevention - Hold
Detects threat for data leak when action is hold
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Exfiltration | T1030 Data Transfer Size Limits |
Rule body kusto
id: 3e12b7b1-75e5-497c-ba01-b6cb30b60d7f
name: Mimecast Data Leak Prevention - Hold
description: Detects threat for data leak when action is hold
severity: Informational
requiredDataConnectors:
- connectorId: MimecastSIEMAPI
dataTypes:
- MimecastDLP_CL
enabled: true
query: MimecastDLP_CL| where action_s == "hold";
queryFrequency: 5m
queryPeriod: 15m
triggerOperator: gt
triggerThreshold: 0
suppressionDuration: 5h
suppressionEnabled: false
tactics:
- Exfiltration
relevantTechniques:
- T1030
incidentConfiguration:
createIncident: true
groupingConfiguration:
enabled: true
reopenClosedIncident: false
lookbackDuration: 1d
matchingMethod: AllEntities
eventGroupingSettings:
aggregationKind: SingleAlert
entityMappings:
- entityType: MailMessage
fieldMappings:
- identifier: Sender
columnName: senderAddress_s
- identifier: Recipient
columnName: recipientAddress_s
- identifier: DeliveryAction
columnName: action_s
version: 1.0.0
kind: Scheduled
Stages and Predicates
Stage 1: source
MimecastDLP_CL
Stage 2: where
| where action_s == "hold";
Indicators
Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.
| Field | Kind | Values |
|---|---|---|
action_s | eq |
|