Filewall for Microsoft 365 3.2.2: verdict-based alerts, XDR entities and Defender for Endpoint correlation

.script/tests/KqlvalidationsTests/CustomFunctions/FilewallM365EmailAttachmentEvent.json

@@ -0,0 +1,42 @@
+{
+  "FunctionName": "FilewallM365EmailAttachmentEvent",
+  "FunctionParameters": [],
+  "FunctionResultColumns": [
+    { "Name": "TimeGenerated", "Type": "DateTime" },
+    { "Name": "IngestionTime", "Type": "DateTime" },
+    { "Name": "EventStartTime", "Type": "DateTime" },
+    { "Name": "EventEndTime", "Type": "DateTime" },
+    { "Name": "EventUid", "Type": "String" },
+    { "Name": "EventType", "Type": "String" },
+    { "Name": "EventOriginalType", "Type": "String" },
+    { "Name": "EventResult", "Type": "String" },
+    { "Name": "EventSeverity", "Type": "String" },
+    { "Name": "ThreatVerdict", "Type": "String" },
+    { "Name": "EventVendor", "Type": "String" },
+    { "Name": "EventProduct", "Type": "String" },
+    { "Name": "User", "Type": "String" },
+    { "Name": "ActorUsername", "Type": "String" },
+    { "Name": "EmailSubject", "Type": "String" },
+    { "Name": "EmailSenderFrom", "Type": "String" },
+    { "Name": "EmailRecipientTo", "Type": "String" },
+    { "Name": "EmailDirection", "Type": "String" },
+    { "Name": "EmailInternetMessageId", "Type": "String" },
+    { "Name": "FilewallMessageId", "Type": "String" },
+    { "Name": "EventReportUrl", "Type": "String" },
+    { "Name": "AlertPolicyId", "Type": "String" },
+    { "Name": "AlertPolicyName", "Type": "String" },
+    { "Name": "AttachmentName", "Type": "String" },
+    { "Name": "AttachmentFileType", "Type": "String" },
+    { "Name": "AttachmentSize", "Type": "String" },
+    { "Name": "AttachmentStatus", "Type": "String" },
+    { "Name": "AttachmentBlockReason", "Type": "String" },
+    { "Name": "AttachmentSummary", "Type": "String" },
+    { "Name": "OriginalFileSha256", "Type": "String" },
+    { "Name": "OriginalFileSha1", "Type": "String" },
+    { "Name": "SanitizedFileSha256", "Type": "String" },
+    { "Name": "SanitizedFileSha1", "Type": "String" },
+    { "Name": "application", "Type": "String" },
+    { "Name": "event_id", "Type": "String" },
+    { "Name": "timestamp", "Type": "DateTime" }
+  ]
+}

.script/tests/KqlvalidationsTests/CustomFunctions/FilewallM365ExchangeEvent.json

@@ -3,6 +3,7 @@
   "FunctionParameters": [],
   "FunctionResultColumns": [
     { "Name": "TimeGenerated", "Type": "DateTime" },
+    { "Name": "IngestionTime", "Type": "DateTime" },
     { "Name": "EventStartTime", "Type": "DateTime" },
     { "Name": "EventEndTime", "Type": "DateTime" },
     { "Name": "EventUid", "Type": "String" },
@@ -11,36 +12,35 @@
     { "Name": "EventResult", "Type": "String" },
     { "Name": "EventOriginalResultDetails", "Type": "String" },
     { "Name": "EventSeverity", "Type": "String" },
+    { "Name": "ThreatVerdict", "Type": "String" },
     { "Name": "EventVendor", "Type": "String" },
     { "Name": "EventProduct", "Type": "String" },
     { "Name": "EventSchema", "Type": "String" },
     { "Name": "EventSchemaVersion", "Type": "String" },
     { "Name": "EventCount", "Type": "Int" },
-
     { "Name": "Dvc", "Type": "String" },
     { "Name": "DvcHostname", "Type": "String" },
-
     { "Name": "User", "Type": "String" },
     { "Name": "ActorUsername", "Type": "String" },
-
     { "Name": "EmailSubject", "Type": "String" },
     { "Name": "EmailSenderFrom", "Type": "String" },
     { "Name": "EmailRecipientTo", "Type": "String" },
-    { "Name": "EmailNetworkMessageId", "Type": "String" },
-
+    { "Name": "EmailDirection", "Type": "String" },
+    { "Name": "EmailInternetMessageId", "Type": "String" },
+    { "Name": "FilewallMessageId", "Type": "String" },
+    { "Name": "EventReportUrl", "Type": "String" },
     { "Name": "AlertPolicyId", "Type": "String" },
     { "Name": "AlertPolicyName", "Type": "String" },
-
     { "Name": "application", "Type": "String" },
     { "Name": "event_id", "Type": "String" },
     { "Name": "timestamp", "Type": "DateTime" },
-
     { "Name": "status", "Type": "String" },
     { "Name": "state", "Type": "String" },
     { "Name": "summary", "Type": "String" },
-
     { "Name": "attachments", "Type": "Dynamic" },
-
+    { "Name": "EmailAttachments", "Type": "Dynamic" },
+    { "Name": "direction", "Type": "String" },
+    { "Name": "source_folder", "Type": "String" },
     { "Name": "release_timestamp", "Type": "DateTime" },
     { "Name": "release_by_admin", "Type": "Bool" },
     { "Name": "release_reason", "Type": "String" }

.script/tests/KqlvalidationsTests/CustomFunctions/FilewallM365FileEvent.json

@@ -3,56 +3,53 @@
   "FunctionParameters": [],
   "FunctionResultColumns": [
     { "Name": "TimeGenerated", "Type": "DateTime" },
+    { "Name": "IngestionTime", "Type": "DateTime" },
     { "Name": "EventStartTime", "Type": "DateTime" },
     { "Name": "EventEndTime", "Type": "DateTime" },
-
     { "Name": "EventType", "Type": "String" },
     { "Name": "EventOriginalType", "Type": "String" },
     { "Name": "EventResult", "Type": "String" },
     { "Name": "EventOriginalResultDetails", "Type": "String" },
     { "Name": "EventSeverity", "Type": "String" },
+    { "Name": "ThreatVerdict", "Type": "String" },
     { "Name": "EventVendor", "Type": "String" },
     { "Name": "EventProduct", "Type": "String" },
     { "Name": "EventSchema", "Type": "String" },
     { "Name": "EventSchemaVersion", "Type": "String" },
     { "Name": "EventCount", "Type": "Int" },
-
     { "Name": "Dvc", "Type": "String" },
     { "Name": "DvcHostname", "Type": "String" },
-
     { "Name": "ActorUsername", "Type": "String" },
     { "Name": "ActorUserType", "Type": "String" },
     { "Name": "User", "Type": "String" },
-
     { "Name": "TargetFileName", "Type": "String" },
     { "Name": "TargetFilePath", "Type": "String" },
+    { "Name": "TargetFileDirectory", "Type": "String" },
     { "Name": "TargetFilePathType", "Type": "String" },
     { "Name": "TargetFileExtension", "Type": "String" },
     { "Name": "TargetFileSize", "Type": "Long" },
     { "Name": "TargetFileHashSha1", "Type": "String" },
     { "Name": "TargetFileHashSha256", "Type": "String" },
-
+    { "Name": "OriginalFileSha256", "Type": "String" },
+    { "Name": "OriginalFileSha1", "Type": "String" },
+    { "Name": "SanitizedFileSha256", "Type": "String" },
+    { "Name": "SanitizedFileSha1", "Type": "String" },
+    { "Name": "EventReportUrl", "Type": "String" },
     { "Name": "application", "Type": "String" },
     { "Name": "event_id", "Type": "String" },
     { "Name": "timestamp", "Type": "DateTime" },
-
     { "Name": "status", "Type": "String" },
     { "Name": "state", "Type": "String" },
-
     { "Name": "policy_id", "Type": "String" },
     { "Name": "policy_name", "Type": "String" },
     { "Name": "block_reason", "Type": "String" },
-
     { "Name": "summary", "Type": "String" },
-
     { "Name": "drive_name", "Type": "String" },
     { "Name": "site_name", "Type": "String" },
-
     { "Name": "new_sha1", "Type": "String" },
     { "Name": "original_sha1", "Type": "String" },
     { "Name": "new_sha256", "Type": "String" },
     { "Name": "original_sha256", "Type": "String" },
-
     { "Name": "version", "Type": "String" }
   ]
-}
+}

.script/tests/KqlvalidationsTests/CustomTables/FilewallExchange_CL.json

@@ -108,6 +108,30 @@
           "type": "dynamic",
           "isDefaultDisplay": false,
           "isHidden": false
+        },
+        {
+          "name": "direction",
+          "type": "string",
+          "isDefaultDisplay": false,
+          "isHidden": false
+        },
+        {
+          "name": "source_folder",
+          "type": "string",
+          "isDefaultDisplay": false,
+          "isHidden": false
+        },
+        {
+          "name": "internet_message_id",
+          "type": "string",
+          "isDefaultDisplay": false,
+          "isHidden": false
+        },
+        {
+          "name": "report_url",
+          "type": "string",
+          "isDefaultDisplay": false,
+          "isHidden": false
         }
     ]
   }

.script/tests/KqlvalidationsTests/CustomTables/FilewallFile_CL.json

@@ -156,6 +156,12 @@
           "type": "string",
           "isDefaultDisplay": false,
           "isHidden": false
+        },
+        {
+          "name": "report_url",
+          "type": "string",
+          "isDefaultDisplay": false,
+          "isHidden": false
         }
     ]
   }

Solutions/Filewall for Microsoft 365/Analytic Rules/BlockedEmails.yaml

@@ -1,45 +1,94 @@
 id: 9b784b65-2d16-4c9f-9f59-2a5d4c659f42
-name: Filewall - Blocked emails
-description: Identifies emails blocked by Filewall for Microsoft 365 (Exchange).
+name: Filewall - Malicious or suspicious email attachment blocked
+description: |
+  'Identifies attachments in inbound email that Filewall for Microsoft 365 blocked because an antivirus engine found malware (High severity), or because static analysis flagged the file or its content does not match its file type (Medium severity).
+  Attachments blocked only by a policy rule (file type, size or encryption) and attachments sanitized by CDR are not malware verdicts and do not raise this alert; they stay available in the FilewallM365EmailAttachmentEvent parser.
+  The alert maps the recipient, the message and the original file hashes, so Microsoft Defender XDR can correlate it with other evidence for the same file or user, and it links to the message in the Filewall console.'
 severity: High
 status: Available
-kind: Scheduled
-query: | 
-  FilewallM365ExchangeEvent()
-  | where EventVendor == 'ODI-X' and EventProduct == 'Filewall for Microsoft 365'
-  | where EventType == 'ThreatInfo' and EventResult == 'Blocked'
+requiredDataConnectors:
+  - connectorId: FilewallM365
+    dataTypes:
+      - FilewallExchange_CL
 queryFrequency: 5m
-queryPeriod: 5m
+queryPeriod: 1h
 triggerOperator: gt
 triggerThreshold: 0
-relevantTechniques:
-- T1048
 tactics:
-- Exfiltration
+  - InitialAccess
+relevantTechniques:
+  - T1566.001
+query: |
+  // TimeGenerated is the email's received time, which can be well before Filewall finished with it,
+  // so the rule looks back an hour and takes each attachment once, by when it was ingested.
+  FilewallM365EmailAttachmentEvent()
+  | where IngestionTime > ago(5m)
+  | where ThreatVerdict in ("Malicious", "Suspicious")
+  | where EmailDirection != "Outbound"
+  | extend RecipientAccountName = tostring(split(EmailRecipientTo, "@")[0]), RecipientUPNSuffix = tostring(split(EmailRecipientTo, "@")[1])
+  | extend Sha256Algorithm = "SHA256", Sha1Algorithm = "SHA1"
+  | project TimeGenerated, ThreatVerdict, EventSeverity, AttachmentName, AttachmentFileType, AttachmentBlockReason, AttachmentSummary, OriginalFileSha256, OriginalFileSha1, Sha256Algorithm, Sha1Algorithm, EmailSubject, EmailSenderFrom, EmailRecipientTo, RecipientAccountName, RecipientUPNSuffix, EmailDirection, EmailInternetMessageId, FilewallMessageId, AlertPolicyName, EventReportUrl
 eventGroupingSettings:
   aggregationKind: AlertPerResult
+entityMappings:
+  - entityType: Account
+    fieldMappings:
+      - identifier: Name
+        columnName: RecipientAccountName
+      - identifier: UPNSuffix
+        columnName: RecipientUPNSuffix
+  - entityType: Mailbox
+    fieldMappings:
+      - identifier: MailboxPrimaryAddress
+        columnName: EmailRecipientTo
+  - entityType: MailMessage
+    fieldMappings:
+      - identifier: Recipient
+        columnName: EmailRecipientTo
+      - identifier: Sender
+        columnName: EmailSenderFrom
+      - identifier: InternetMessageId
+        columnName: EmailInternetMessageId
+  - entityType: File
+    fieldMappings:
+      - identifier: Name
+        columnName: AttachmentName
+  - entityType: FileHash
+    fieldMappings:
+      - identifier: Algorithm
+        columnName: Sha256Algorithm
+      - identifier: Value
+        columnName: OriginalFileSha256
+  - entityType: FileHash
+    fieldMappings:
+      - identifier: Algorithm
+        columnName: Sha1Algorithm
+      - identifier: Value
+        columnName: OriginalFileSha1
+customDetails:
+  Verdict: ThreatVerdict
+  BlockReason: AttachmentBlockReason
+  Detail: AttachmentSummary
+  PolicyName: AlertPolicyName
+  Subject: EmailSubject
+  OriginalSHA256: OriginalFileSha256
+  FilewallMessageId: FilewallMessageId
+  FilewallReport: EventReportUrl
+alertDetailsOverride:
+  alertDisplayNameFormat: 'Filewall blocked a {{ThreatVerdict}} email attachment - {{AttachmentName}}'
+  alertDescriptionFormat: 'Filewall for Microsoft 365 blocked the attachment {{AttachmentName}} in an email to {{EmailRecipientTo}}, block reason {{AttachmentBlockReason}}. The custom details hold the original file hash and policy, and the alert link opens the message in the Filewall console.'
+  alertSeverityColumnName: EventSeverity
+  alertDynamicProperties:
+    - alertProperty: AlertLink
+      value: EventReportUrl
 incidentConfiguration:
   createIncident: true
   groupingConfiguration:
-    matchingMethod: AllEntities
+    enabled: true
     reopenClosedIncident: false
-    enabled: false
-    lookbackDuration: PT1H
-entityMappings:
-- entityType: Account
-  fieldMappings:
-  - identifier: FullName
-    columnName: ActorUsername
-- entityType: MailMessage
-  fieldMappings:
-  - identifier: Recipient
-    columnName: EmailRecipientTo
-  - identifier: Subject
-    columnName: EmailSubject
-  - identifier: Sender
-    columnName: EmailSenderFrom
-requiredDataConnectors:
-- dataTypes:
-  - FilewallExchange_CL
-  connectorId: FilewallM365
-version: 1.0.0
+    lookbackDuration: PT5H
+    matchingMethod: Selected
+    groupByEntities:
+      - FileHash
+kind: Scheduled
+version: 1.1.0