-
Notifications
You must be signed in to change notification settings - Fork 3k
/
EmailEntity_AzureActivity.yaml
40 lines (39 loc) · 1.65 KB
/
EmailEntity_AzureActivity.yaml
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
id: cca3b4d9-ac39-4109-8b93-65bb284003e6
name: (Preview) TI map Email entity to AzureActivity
description: |
'Identifies a match in AzureActivity table from any Email IOC from TI'
severity: Medium
requiredDataConnectors:
- connectorId: AzureActivity
dataTypes:
- AzureActivity
- connectorId: ThreatIntelligence
dataTypes:
- ThreatIntelligenceIndicator
queryFrequency: 1h
queryPeriod: 14d
triggerOperator: gt
triggerThreshold: 0
tactics:
- Impact
query: |
let dt_lookBack = 1h;
let ioc_lookBack = 14d;
let emailregex = @'^[a-zA-Z0-9_.+-]+@[a-zA-Z0-9-]+\.[a-zA-Z0-9-.]+$';
ThreatIntelligenceIndicator
| where TimeGenerated >= ago(ioc_lookBack) and ExpirationDateTime > now()
| where Active == true
//Filtering the table for Email related IOCs
| where isnotempty(EmailRecipient)
| join (
AzureActivity | where TimeGenerated >= ago(dt_lookBack) and isnotempty(Caller)
| extend Caller = tolower(Caller)
| where Caller matches regex emailregex
| extend AzureActivity_TimeGenerated = TimeGenerated
)
on $left.EmailRecipient == $right.Caller
| summarize LatestIndicatorTime = arg_max(TimeGenerated, *) by IndicatorId
| project LatestIndicatorTime, Description, ActivityGroupNames, IndicatorId, ThreatType, ExpirationDateTime, ConfidenceScore, AzureActivity_TimeGenerated,
EmailSenderName, EmailSourceDomain, EmailSourceIpAddress, EmailSubject, FileHashValue, FileHashType, Caller, Level, CallerIpAddress, Category, OperationName,
OperationNameValue, ActivityStatus, ResourceGroup, SubscriptionId
| extend timestamp = AzureActivity_TimeGenerated, AccountCustomEntity = Caller, IPCustomEntity = CallerIpAddress