SCC_Insider_Risk_Management
ID: 100243
Description:
Security Compliance Center Insider Risk Management
Repository: Group: Office365 Type: event
Default Status:
Enabled
| Tags: | ||
|---|---|---|
| SCC | SecurityComplianceCenter | O365 |
Selector:
Query:
Filters:
| Field | MUST hit |
|---|---|
| @source | Audit.General |
| @fields.Workload | SecurityComplianceCenter |
| @fields.Category | InsiderRiskManagement |
| Field | MUST NOT hit |
|---|---|
Behavior Rule:
| Key | Type | Behavior Category |
|---|---|---|
| @fields.InsightData.Details.Name | username | application activity |
Risks:
| Risks | Base Score | Dimension |
|---|---|---|
| Timeline | 0 | - |
Attributes:
| Alias | Key |
|---|---|
| Category | @fields.Category |
| Operation | @fields.Operation |
| InsightValue | @fields.AdditionalData.Value |
| InsightDescription | @fields.Description |
| Username | @fields.InsightData.Details.Name |
| RecordType | @fields.RecordType |
| UserType | @fields.UserType |
| Severity | @fields.Severity |
| Customer | @customer |
Correlation Rules:
History:
| User | Date |
|---|---|
| em*n@fluencysecurity.com | 2021 Jan 11 21:37:54 EST |
| al*r@fluencysecurity.com | 2021 Feb 18 11:42:46 EST |
This page was automatically created/formatted on Wed, 2022 May 4 21:43:53 EDT, from rule_dump.json (4d88bffdfb1cea26b3985f2193033606)