Microsoft Sentinel high experimental kql

Theom - Overprovisioned Roles Shadow DB

"Creates Sentinel incidents for critical/high Theom risks, associated with ruleId TRIS0034 (Theom has observed shadow (or clone) databases/tables. Additionally, it has observed roles that are overprovisioned for these data stores. As per this requirement, use this information to apply data access control lists or access permissions and enforce data retention policies)"

View Source

Detection Logic

TheomAlerts_CL
| where customProps_RuleId_s == "TRIS0034" and (priority_s == "P1" or priority_s == "P2")

Field Validations

Loading…

Comments (0)

Loading comments...