Microsoft Sentinel high experimental kql

Theom - Financial data unencrypted

"Creates Sentinel incidents for critical/high Theom risks, associated with ruleId TRIS0003 (Financial data has been observed in unencrypted data stores. Encrypt data at rest to comply with this CIS requirement)"

View Source

Detection Logic

TheomAlerts_CL
| where customProps_RuleId_s == "TRIS0003" and (priority_s == "P1" or priority_s == "P2")

Field Validations

Loading…

Comments (0)

Loading comments...