Detection rules › Kusto

Mimecast Data Leak Prevention - Hold

Severity
informational
Time window
15m
Source
github.com/Azure/Azure-Sentinel

Detects threat for data leak when action is hold

MITRE ATT&CK coverage

TacticTechniques
ExfiltrationT1030 Data Transfer Size Limits

Rule body kusto

id: 8e52bcf1-4f50-4c39-8678-d9efad64e379
name: Mimecast Data Leak Prevention - Hold
description: Detects threat for data leak when action is hold
severity: Informational
requiredDataConnectors:
  - connectorId: MimecastSEGAPI
    dataTypes:
      - MimecastDLP
enabled: true
query: |
  MimecastDLP 
  | where Action == "hold"
  | extend SenderAddress = ['Sender Address'] ,RecipientAddress = ['Recipient Address']
queryFrequency: 15m
queryPeriod: 15m
triggerOperator: gt
triggerThreshold: 0
suppressionDuration: 5h
suppressionEnabled: false
tactics:
- Exfiltration
relevantTechniques:
- T1030
incidentConfiguration:
  createIncident: true
  groupingConfiguration:
    enabled: true
    reopenClosedIncident: false
    lookbackDuration: P7D
    matchingMethod: AllEntities
eventGroupingSettings:
  aggregationKind: SingleAlert
entityMappings:
- entityType: MailMessage
  fieldMappings:
  - identifier: Sender
    columnName: SenderAddress
  - identifier: Recipient
    columnName: RecipientAddress
  - identifier: DeliveryAction
    columnName: Action
version: 1.0.0
kind: Scheduled

Stages and Predicates

Stage 1: source

MimecastDLP

Stage 2: where

| where Action == "hold"

Stage 3: extend

| extend SenderAddress = ['Sender Address'] ,RecipientAddress = ['Recipient Address']

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

FieldKindValues
Actioneq
  • hold transforms: cased

Output fields

Fields the rule emits when it matches. Chronicle authors list these in the outcome block; they appear on the detection and $risk_score drives alerting. Sentinel / Defender XDR rules build them up through project / summarize / extend stages. Sentinel maps these into alert fields via entityMappings and customDetails; Defender XDR custom detections surface them as alert fields directly.

FieldSource
RecipientAddressextend
SenderAddressextend