Detection rules › Kusto
Mimecast Secure Email Gateway - Spam Event Thread
Detects threat from spam event thread protection logs
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Discovery |
Rule body
id: df1b9377-5c29-4928-872f-9934a6b4f611
name: Mimecast Secure Email Gateway - Spam Event Thread
description: Detects threat from spam event thread protection logs
severity: Low
requiredDataConnectors:
- connectorId: MimecastSIEMAPI
dataTypes:
- MimecastSIEM_CL
enabled: true
query: MimecastSIEM_CL| where mimecastEventId_s=="mail_spameventthread"
queryFrequency: 5m
queryPeriod: 15m
triggerOperator: gt
triggerThreshold: 0
suppressionDuration: 5h
suppressionEnabled: false
tactics:
- Discovery
relevantTechniques:
- T1083
incidentConfiguration:
createIncident: true
groupingConfiguration:
enabled: true
reopenClosedIncident: false
lookbackDuration: 1d
matchingMethod: AllEntities
eventGroupingSettings:
aggregationKind: SingleAlert
customDetails:
MsgId_s: MsgId_s
headerFrom: headerFrom_s
Route: Route_s
SourceIP: SourceIP
SenderDomain: SenderDomain_s
entityMappings:
- entityType: MailMessage
fieldMappings:
- identifier: Sender
columnName: Sender_s
- identifier: Recipient
columnName: Recipient_s
- identifier: Subject
columnName: Subject_s
version: 1.0.1
kind: Scheduled
Stages and Predicates
Stage 1: source
MimecastSIEM_CL
Stage 2: where
| where mimecastEventId_s=="mail_spameventthread"
Indicators
These rows show field, operator, and value matches.
| Field | Kind | Values | Search |
|---|---|---|---|
mimecastEventId_s | eq |
| field:"mimecastEventId_s" kind:eq value:"mail_spameventthread" |