Microsoft Sentinel medium experimental kql

Cisco SEG - DLP policy violation

'Detects DLP policy violation.'

View Source

Detection Logic

CiscoSEGEvent
| where NetworkDirection =~ 'Outgoing'
| where tostring(AdditionalFields) has 'ESADLPVerdict'
| extend dlp_verdict = extract(@'ESADLPVerdict":"(NOT_EVALUATED
| NO TRIGGER
| VIOLATION
| NO VIOLATION)"', 1, tostring(AdditionalFields))
| where dlp_verdict =~ 'VIOLATION'
| extend AccountCustomEntity = SrcUserName

Field Validations

Loading…

Comments (0)

Loading comments...