Microsoft Sentinel high experimental kql

Theom - Healthcare data exposed

"Creates Sentinel incidents for critical/high Theom risks, associated with ruleId TRIS0015 (Theom has observed healthcare data in a data store that is publicly exposed. As per this requirement, use this information to apply data access control lists or access permissions to secure your data)"

View Source

Detection Logic

TheomAlerts_CL
| where customProps_RuleId_s == "TRIS0015" and (priority_s == "P1" or priority_s == "P2")

Field Validations

Loading…

Comments (0)

Loading comments...