Detection rules › Kusto
Mimecast Data Leak Prevention - Hold
Detects threat for data leak when action is hold
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Exfiltration |
Rule body
id: 3e12b7b1-75e5-497c-ba01-b6cb30b60d7f
name: Mimecast Data Leak Prevention - Hold
description: Detects threat for data leak when action is hold
severity: Informational
requiredDataConnectors:
- connectorId: MimecastSIEMAPI
dataTypes:
- MimecastDLP_CL
enabled: true
query: MimecastDLP_CL| where action_s == "hold";
queryFrequency: 5m
queryPeriod: 15m
triggerOperator: gt
triggerThreshold: 0
suppressionDuration: 5h
suppressionEnabled: false
tactics:
- Exfiltration
relevantTechniques:
- T1030
incidentConfiguration:
createIncident: true
groupingConfiguration:
enabled: true
reopenClosedIncident: false
lookbackDuration: 1d
matchingMethod: AllEntities
eventGroupingSettings:
aggregationKind: SingleAlert
entityMappings:
- entityType: MailMessage
fieldMappings:
- identifier: Sender
columnName: senderAddress_s
- identifier: Recipient
columnName: recipientAddress_s
- identifier: DeliveryAction
columnName: action_s
version: 1.0.0
kind: Scheduled
Stages and Predicates
Stage 1: source
MimecastDLP_CL
Stage 2: where
| where action_s == "hold";
Indicators
These rows show field, operator, and value matches.
| Field | Kind | Values | Search |
|---|---|---|---|
action_s | eq |
| field:"action_s" kind:eq value:"hold" |