Microsoft Sentinel high experimental kql

Theom - Shadow DB with atypical accesses

"Creates Sentinel incidents for critical/high Theom risks, associated with ruleId TRIS0036 (Theom has observed shadow or clone databases/tables. Additionally, it has observed atypical accesses to these data stores. As per this requirement, use this information to apply data access control lists or access permissions and enforce data retention policies)"

View Source

Detection Logic

TheomAlerts_CL
| where customProps_RuleId_s == "TRIS0036" and (priority_s == "P1" or priority_s == "P2")

Field Validations

Loading…

Comments (0)

Loading comments...