Ransom Protect User Blocked

id: d5d4766b-e547-44da-9d85-48ff393db201
name: Ransom Protect User Blocked
description: 'Detects malicious users blocked by CTERA Ransom Protect AI engine.'
status: Available
severity: High
kind: NRT
requiredDataConnectors:
  - connectorId: CTERA
    dataTypes:
      - Syslog
tactics:
    - Impact
relevantTechniques:
    - T1486
query: |
    Syslog
    | where SyslogMessage contains "Ransom Protect mechanism blocked"
    | extend 
        Portal = extract("portal:(\\w+)", 1, SyslogMessage),
        EdgeFiler = extract("Edge Filer:(\\w+-\\d+)", 1, SyslogMessage),
        IP = extract("IP:([0-9.]+)", 1, SyslogMessage),
        User = extract("user:(\\w+)", 1, SyslogMessage),
        BlockedTime = extract("at ([^ ]+)", 1, SyslogMessage)
    | project TimeGenerated, Portal, EdgeFiler, IP, User, BlockedTime
suppressionDuration: PT5H
suppressionEnabled: false
incidentConfiguration:
    createIncident: true
    groupingConfiguration:
        enabled: false
        reopenClosedIncident: false
        lookbackDuration: PT5H
        matchingMethod: AllEntities
eventGroupingSettings:
    aggregationKind: SingleAlert
alertDetailsOverride: 
    alertnameFormat: 'CTERA Ransom Protect User Blocked'
    alertDescriptionFormat: CTERA Ransom Protect blocked a malicious user at {{TimeGenerated}}.
customDetails:
    EdgeFiler: EdgeFiler
entityMappings:
- entityType: Account
  fieldMappings:
      - identifier: FullName
        columnName: User
- entityType: IP
  fieldMappings:
      - identifier: Address
        columnName: IP
version: 1.0.2