Microsoft Sentinel high experimental kql

Theom - Healthcare data unencrypted

"Creates Sentinel incidents for critical/high Theom risks, associated with ruleId TRIS0004 (Healthcare data has been observed in unencrypted data stores. Encrypt data at rest to comply with this CIS requirement)"

View Source

Detection Logic

TheomAlerts_CL
| where customProps_RuleId_s == "TRIS0004" and (priority_s == "P1" or priority_s == "P2")

Field Validations

Loading…

Comments (0)

Loading comments...