SCC_Threat_Management
ID: 100248
Description:
Security Compliance Center Threat Management
Repository: Group: SCC Type: event
Default Status:
Enabled
| Tags: | ||
|---|---|---|
| SCC | SecurityComplianceCenter | Office365 |
Selector:
Query:
Filters:
| Field | MUST hit |
|---|---|
| @source | Audit General |
| @fields.Workload | SecurityComplianceCenter |
| @fields.Category | ThreatManagement |
| Field | MUST NOT hit |
|---|---|
Behavior Rule:
| Key | Type | Behavior Category |
|---|---|---|
| @fields.InsightData.Details.Name | username | application activity |
Risks:
| Risks | Base Score | Dimension |
|---|---|---|
| Timeline | 0 | - |
Attributes:
| Alias | Key |
|---|---|
| Operation | @fields.Operation |
| RecordType | @fields.RecordType |
| UserType | @fields.UserType |
| Category | @fields.Category |
| InsightValue | @fields.AdditionalData.Value |
| Description | @fields.Description |
| Username | @fields.InsightData.Details.Name |
| Severity | @fields.Severity |
| Customer | @customer |
Correlation Rules:
History:
| User | Date |
|---|---|
| em*n@fluencysecurity.com | 2021 Jan 11 19:20:13 EST |
| al*r@fluencysecurity.com | 2021 Feb 18 11:44:26 EST |
This page was automatically created/formatted on Wed, 2022 May 4 21:43:53 EDT, from rule_dump.json (4d88bffdfb1cea26b3985f2193033606)