[nadavgru]

Change(s):

• Filewall for Microsoft 365 solution 3.2.2.
• Analytic rules BlockedEmails and BlockedFiles (1.1.0) now alert by Filewall verdict, not on every block:
  • antivirus malware is High;
  • static-analysis or file-type-mismatch detections are Medium;
  • the severity is set per alert through alertSeverityColumnName;
  • policy blocks and CDR sanitization no longer alert.
• MITRE mapping: Exfiltration/T1048 is replaced with techniques the evidence supports. Inbound email attachments map to InitialAccess/T1566.001. SharePoint, OneDrive and Teams files map to LateralMovement/T1080.
• Entity mappings: Account (Name + UPNSuffix), Mailbox, MailMessage (Recipient, Sender, InternetMessageId), File, and FileHash for the original file's SHA256 and SHA1.
• Each alert has custom details (verdict, block reason, policy, original hash) and an AlertLink to the item in the Filewall console.
• Incident grouping by FileHash. The rules are enabled.
• New analytic rule BlockedFileSeenOnDevice (1.0.0). It correlates files Filewall blocked as malicious or suspicious with Defender for Endpoint DeviceFileEvents (connector MicrosoftThreatProtection).
• New hunting query SanitizedOriginalSeenOnDevice. It finds devices holding the original of a file Filewall sanitized.
• New parser FilewallM365EmailAttachmentEvent, one row per attachment.
• Parsers 1.1.0:
  • they keep the original and sanitized hashes in separate columns;
  • they add ThreatVerdict, EmailDirection, EmailInternetMessageId, EventReportUrl and IngestionTime;
  • EmailNetworkMessageId is replaced by FilewallMessageId. The underlying field was never the Exchange Online NetworkMessageId.
• New table/DCR columns: FilewallExchange_CL gains direction, source_folder, internet_message_id and report_url; FilewallFile_CL gains report_url. The KQL validation schemas are updated to match.
• Package regenerated with createSolutionV3_1.ps1 (ARM-TTK: 50 pass, 0 fail).

Reason for Change(s):

• To correlate with Microsoft Defender XDR, the alerts need hash and message entities and a severity that reflects the verdict. A policy block is not malware, and the previous rules raised High/Exfiltration for every block.

Version Updated:

• Yes. Solution 3.2.2; BlockedEmails and BlockedFiles 1.1.0; the new rule, hunting query and parser 1.0.0; parsers 1.1.0.

Testing Completed:

• KQL validation (.script/tests/KqlvalidationsTests) run locally: all 3 rules, 3 parsers and the hunting query pass.
• Detection template schema validation run locally: all Filewall rules pass.

Checked that the validations are passing and have addressed any issues that are present:

• Yes

🤖 Generated with Claude Code