SFTP File transfer folder count above threshold

id: 7355434e-09d5-4401-b56d-e03e9379dfb1
name: SFTP File transfer folder count above threshold
description: |
  'Identifies SFTP File Transfers with distinct folder count above certain threshold in a 15min time period.
   It requires SFTP VERBOSE loglevel to be enabled.
   Please note that entity mapping for arrays is not supported, so when there is a single value in an array, we will pull that value from the array as a single string to populate the entity to support entity mapping features within Sentinel. Additionally, if the array is multivalued, we will input a string to indicate this with a unique hash so that matching will not occur.'
severity: Medium
requiredDataConnectors:
  - connectorId: Syslog
    dataTypes:
      - Syslog
  - connectorId: SyslogAma
    dataTypes: 
      - Syslog
queryFrequency: 15m
queryPeriod: 15m
triggerOperator: gt
triggerThreshold: 0
tactics:
  - Exfiltration
relevantTechniques:
  - T1020
query: |
  let threshold = 10;
  Syslog
  | where ProcessName has "sftp"
      and SyslogMessage has "close "
      and SyslogMessage has " bytes read "
  | parse SyslogMessage with "close \"" filepath "\" bytes read " readbytes: int " written " writtenbytes: int
  | parse kind=regex filepath with dirpath:string "/" filename:string
  | join kind=leftouter (
      Syslog
      | where ProcessName has "sftp" and SyslogMessage has "session opened for"
      | parse SyslogMessage with "session opened for local user " username: string " from [" src_ip "]"
      | project username, src_ip, ProcessID
      )
      on ProcessID
  | project-away ProcessID1
  | summarize count_distinct_dirpath=dcount(dirpath), dirlist=make_set(dirpath) by Computer, username, src_ip, bin(TimeGenerated, 15m)
  | where count_distinct_dirpath >= threshold
  | extend DirSample = iff(array_length(dirlist) == 1, tostring(dirlist[0]), strcat("SeeDirListField","_", tostring(hash(tostring(dirlist)))))
entityMappings:
  - entityType: Account
    fieldMappings:
      - identifier: Name
        columnName: username
  - entityType: IP
    fieldMappings:
      - identifier: Address
        columnName: src_ip
  - entityType: Host
    fieldMappings:
      - identifier: HostName
        columnName: Computer
  - entityType: File
    fieldMappings:
      - identifier: Name
        columnName: DirSample
customDetails:
  TransferCount: count_distinct_dirpath
  FilesList: dirlist
incidentConfiguration:
  createIncident: true
  groupingConfiguration:
    enabled: true
    reopenClosedIncident: false
    lookbackDuration: 5h
    matchingMethod: Selected
    groupByEntities:
    - Account
    - Host
    groupByAlertDetails: []
    groupByCustomDetails: []
version: 1.0.2
kind: Scheduled