Microsoft Sentinel high experimental kql

Theom - Financial data exposed

"Creates Sentinel incidents for critical/high Theom risks, associated with ruleId TRIS0026 (Theom has observed financial data in a data store that is publicly exposed. As per this requirement, use this information to apply data access control lists or access permissions to secure your data)"

View Source

Detection Logic

TheomAlerts_CL
| where customProps_RuleId_s == "TRIS0026" and (priority_s == "P1" or priority_s == "P2")

Field Validations

Loading…

Comments (0)

Loading comments...