Detection rules › Kusto
Mimecast Data Leak Prevention - Notifications
Detects threat for data leak when action is notification
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Exfiltration |
Rule body
id: cfd67598-ad0d-430a-a793-027eb4dbe967
name: Mimecast Data Leak Prevention - Notifications
description: Detects threat for data leak when action is notification
severity: High
requiredDataConnectors:
- connectorId: MimecastSEGAPI
dataTypes:
- MimecastDLP
enabled: true
query: |
MimecastDLP
| where Action == "notification"
| extend SenderAddress = ['Sender Address'] ,RecipientAddress = ['Recipient Address']
queryFrequency: 15m
queryPeriod: 15m
triggerOperator: gt
triggerThreshold: 0
suppressionDuration: 5h
suppressionEnabled: false
tactics:
- Exfiltration
relevantTechniques:
- T1030
alertRuleTemplateName:
incidentConfiguration:
createIncident: true
groupingConfiguration:
enabled: true
reopenClosedIncident: false
lookbackDuration: P7D
matchingMethod: AllEntities
eventGroupingSettings:
aggregationKind: SingleAlert
entityMappings:
- entityType: MailMessage
fieldMappings:
- identifier: Sender
columnName: SenderAddress
- identifier: Recipient
columnName: RecipientAddress
- identifier: DeliveryAction
columnName: Action
version: 1.0.0
kind: Scheduled
Stages and Predicates
Stage 1: source
MimecastDLP
Stage 2: where
| where Action == "notification"
Stage 3: extend
| extend SenderAddress = ['Sender Address'] ,RecipientAddress = ['Recipient Address']
Indicators
These rows show field, operator, and value matches.
| Field | Kind | Values | Search |
|---|---|---|---|
Action | eq |
| field:"Action" kind:eq value:"notification" |
Output fields
These fields are emitted when the rule matches.
| Field | Source |
|---|---|
RecipientAddress | extend |
SenderAddress | extend |