Microsoft Sentinel high experimental kql

Theom - Shadow DB large datastore value

"Creates Sentinel incidents for critical/high Theom risks, associated with ruleId TRIS0035 (Theom has observed shadow (or clone) databases/tables with large financial value. As per this requirement, use this information to apply data access control lists or access permissions and enforce data retention policies)"

View Source

Detection Logic

TheomAlerts_CL
| where customProps_RuleId_s == "TRIS0035" and (priority_s == "P1" or priority_s == "P2")

Field Validations

Loading…

Comments (0)

Loading comments...