Detection rules › Kusto
ProofpointPOD - High risk message not discarded
'Detects when email with high risk score was not rejected or discarded by filters.'
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Initial Access |
Rule body
id: c7cd6073-6d2c-4284-a5c8-da27605bdfde
name: ProofpointPOD - High risk message not discarded
description: |
'Detects when email with high risk score was not rejected or discarded by filters.'
severity: Low
status: Available
requiredDataConnectors:
- connectorId: ProofpointPOD
dataTypes:
- ProofpointPOD_message_CL
queryFrequency: 10m
queryPeriod: 10m
triggerOperator: gt
triggerThreshold: 0
tactics:
- InitialAccess
relevantTechniques:
- T1566
query: |
let lbtime = 10m;
ProofpointPOD
| where TimeGenerated > ago(lbtime)
| where EventType == 'message'
| where NetworkDirection == 'inbound'
| where FilterDisposition !in ('reject', 'discard')
| where FilterModulesSpamScoresOverall == '100'
| project SrcUserUpn, DstUserUpn
| extend AccountCustomEntity = SrcUserUpn
entityMappings:
- entityType: Account
fieldMappings:
- identifier: FullName
columnName: AccountCustomEntity
version: 1.0.1
kind: Scheduled
Stages and Predicates
Parameters
let lbtime = 10m;
Stage 1: source
ProofpointPOD
Stage 2: where
| where TimeGenerated > ago(lbtime)
Stage 3: where
| where EventType == 'message'
Stage 4: where
| where NetworkDirection == 'inbound'
Stage 5: where
| where FilterDisposition !in ('reject', 'discard')
Stage 6: where
| where FilterModulesSpamScoresOverall == '100'
Stage 7: project
| project SrcUserUpn, DstUserUpn
Stage 8: extend
| extend AccountCustomEntity = SrcUserUpn
Exclusions
The rule actively suppresses these predicates.
| Field | Kind | Excluded values | Search |
|---|---|---|---|
FilterDisposition | in | discard, reject | excludes:FilterDisposition field:"FilterDisposition" value:"discard" field:"FilterDisposition" value:"reject" |
Indicators
These rows show field, operator, and value matches.
Output fields
These fields are emitted when the rule matches.
| Field | Source |
|---|---|
DstUserUpn | project |
SrcUserUpn | project |
AccountCustomEntity | extend |