Skip to content

Update ProofpointPOD analytic rules, hunting queries and workbook metadata to reference CCF connector ProofpointCCPDefinition #15505

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
mht-gthb wants to merge 1 commit into
base: master
Choose a base branch
from
Open

Update ProofpointPOD analytic rules, hunting queries and workbook metadata to reference CCF connector ProofpointCCPDefinition #15505

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 3 additions & 3 deletions ...ofpoint On demand(POD) Email Security/Analytic Rules/ProofpointPODBinaryInAttachment.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,9 +5,9 @@ description: |
severity: Medium
status: Available
requiredDataConnectors:
- connectorId: ProofpointPOD
- connectorId: ProofpointCCPDefinition
dataTypes:
- ProofpointPOD_message_CL
- ProofpointPODMessage_CL
queryFrequency: 10m
queryPeriod: 10m
triggerOperator: gt
Expand Down Expand Up @@ -35,5 +35,5 @@ entityMappings:
columnName: Name
- identifier: UPNSuffix
columnName: UPNSuffix
version: 1.0.3
version: 1.0.4
kind: Scheduled
6 changes: 3 additions & 3 deletions ...emand(POD) Email Security/Analytic Rules/ProofpointPODDataExfiltrationToPrivateEmail.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,9 +5,9 @@ description: |
severity: Medium
status: Available
requiredDataConnectors:
- connectorId: ProofpointPOD
- connectorId: ProofpointCCPDefinition
dataTypes:
- ProofpointPOD_message_CL
- ProofpointPODMessage_CL
queryFrequency: 10m
queryPeriod: 10m
triggerOperator: gt
Expand Down Expand Up @@ -36,5 +36,5 @@ entityMappings:
fieldMappings:
- identifier: FullName
columnName: AccountCustomEntity
version: 1.0.1
version: 1.0.2
kind: Scheduled
6 changes: 3 additions & 3 deletions ...oint On demand(POD) Email Security/Analytic Rules/ProofpointPODEmailSenderIPinTIList.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -10,9 +10,9 @@ requiredDataConnectors:
- connectorId: ThreatIntelligenceTaxii
dataTypes:
- ThreatIntelligenceIndicator
- connectorId: ProofpointPOD
- connectorId: ProofpointCCPDefinition
dataTypes:
- ProofpointPOD_maillog_CL
- ProofpointPODMailLog_CL
queryFrequency: 1d
queryPeriod: 14d
triggerOperator: gt
Expand Down Expand Up @@ -56,5 +56,5 @@ entityMappings:
fieldMappings:
- identifier: Address
columnName: ClientIP
version: 1.1.1
version: 1.1.2
kind: Scheduled
6 changes: 3 additions & 3 deletions ...fpoint On demand(POD) Email Security/Analytic Rules/ProofpointPODEmailSenderInTIList.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -10,9 +10,9 @@ requiredDataConnectors:
- connectorId: ThreatIntelligenceTaxii
dataTypes:
- ThreatIntelligenceIndicator
- connectorId: ProofpointPOD
- connectorId: ProofpointCCPDefinition
dataTypes:
- ProofpointPOD_maillog_CL
- ProofpointPODMailLog_CL
queryFrequency: 1d
queryPeriod: 14d
triggerOperator: gt
Expand Down Expand Up @@ -48,5 +48,5 @@ entityMappings:
fieldMappings:
- identifier: FullName
columnName: ClientEmail
version: 1.1.2
version: 1.1.3
kind: Scheduled
6 changes: 3 additions & 3 deletions ...point On demand(POD) Email Security/Analytic Rules/ProofpointPODHighRiskNotDiscarded.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,9 +5,9 @@ description: |
severity: Low
status: Available
requiredDataConnectors:
- connectorId: ProofpointPOD
- connectorId: ProofpointCCPDefinition
dataTypes:
- ProofpointPOD_message_CL
- ProofpointPODMessage_CL
queryFrequency: 10m
queryPeriod: 10m
triggerOperator: gt
Expand All @@ -31,5 +31,5 @@ entityMappings:
fieldMappings:
- identifier: FullName
columnName: AccountCustomEntity
version: 1.0.1
version: 1.0.2
kind: Scheduled
6 changes: 3 additions & 3 deletions ...mail Security/Analytic Rules/ProofpointPODMultipleArchivedAttachmentsToSameRecipient.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,9 +5,9 @@ description: |
severity: Medium
status: Available
requiredDataConnectors:
- connectorId: ProofpointPOD
- connectorId: ProofpointCCPDefinition
dataTypes:
- ProofpointPOD_message_CL
- ProofpointPODMessage_CL
queryFrequency: 30m
queryPeriod: 30m
triggerOperator: gt
Expand All @@ -34,5 +34,5 @@ entityMappings:
fieldMappings:
- identifier: FullName
columnName: AccountCustomEntity
version: 1.0.2
version: 1.0.3
kind: Scheduled
6 changes: 3 additions & 3 deletions ...d(POD) Email Security/Analytic Rules/ProofpointPODMultipleLargeEmailsToSameRecipient.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,9 +5,9 @@ description: |
severity: Medium
status: Available
requiredDataConnectors:
- connectorId: ProofpointPOD
- connectorId: ProofpointCCPDefinition
dataTypes:
- ProofpointPOD_message_CL
- ProofpointPODMessage_CL
queryFrequency: 30m
queryPeriod: 30m
triggerOperator: gt
Expand All @@ -33,5 +33,5 @@ entityMappings:
fieldMappings:
- identifier: FullName
columnName: AccountCustomEntity
version: 1.0.1
version: 1.0.2
kind: Scheduled
6 changes: 3 additions & 3 deletions ...Email Security/Analytic Rules/ProofpointPODMultipleProtectedEmailsToUnknownRecipient.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,9 +5,9 @@ description: |
severity: Medium
status: Available
requiredDataConnectors:
- connectorId: ProofpointPOD
- connectorId: ProofpointCCPDefinition
dataTypes:
- ProofpointPOD_message_CL
- ProofpointPODMessage_CL
queryFrequency: 30m
queryPeriod: 30m
triggerOperator: gt
Expand Down Expand Up @@ -45,5 +45,5 @@ entityMappings:
fieldMappings:
- identifier: FullName
columnName: AccountCustomEntity
version: 1.1.1
version: 1.1.2
kind: Scheduled
6 changes: 3 additions & 3 deletions ...point On demand(POD) Email Security/Analytic Rules/ProofpointPODSuspiciousAttachment.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,9 +5,9 @@ description: |
severity: Medium
status: Available
requiredDataConnectors:
- connectorId: ProofpointPOD
- connectorId: ProofpointCCPDefinition
dataTypes:
- ProofpointPOD_message_CL
- ProofpointPODMessage_CL
queryFrequency: 10m
queryPeriod: 10m
triggerOperator: gt
Expand All @@ -32,5 +32,5 @@ entityMappings:
fieldMappings:
- identifier: FullName
columnName: AccountCustomEntity
version: 1.0.2
version: 1.0.3
kind: Scheduled
6 changes: 3 additions & 3 deletions ...ons/Proofpoint On demand(POD) Email Security/Analytic Rules/ProofpointPODWeakCiphers.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,9 +5,9 @@ description: |
severity: Low
status: Available
requiredDataConnectors:
- connectorId: ProofpointPOD
- connectorId: ProofpointCCPDefinition
dataTypes:
- ProofpointPOD_message_CL
- ProofpointPODMessage_CL
queryFrequency: 1h
queryPeriod: 1h
triggerOperator: gt
Expand All @@ -28,5 +28,5 @@ entityMappings:
fieldMappings:
- identifier: Address
columnName: IPCustomEntity
version: 1.0.3
version: 1.0.4
kind: Scheduled
2 changes: 1 addition & 1 deletion Solutions/Proofpoint On demand(POD) Email Security/Data/Solution_ProofPointPOD.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -37,7 +37,7 @@
"Data Connectors/ProofPointEmailSecurity_CCP/ProofpointPOD_Definaton.json"
],
"BasePath": "C:\\GitHub\\Azure-Sentinel\\solutions\\Proofpoint On demand(POD) Email Security",
"Version": "3.1.4",
"Version": "3.1.5",
"Metadata": "SolutionMetadata.json",
"TemplateSpec": true,
"Is1PConnector": false
Expand Down
4 changes: 2 additions & 2 deletions ...point On demand(POD) Email Security/Hunting Queries/ProofpointPODHighScoreAdultValue.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,9 +3,9 @@ name: ProofpointPOD - Emails with high score of 'adult' filter classifier value
description: |
'Search for emails with high score of 'adult' filter classifier value.'
requiredDataConnectors:
- connectorId: ProofpointPOD
- connectorId: ProofpointCCPDefinition
dataTypes:
- ProofpointPOD_message_CL
- ProofpointPODMessage_CL
tactics:
- InitialAccess
query: |
Expand Down
4 changes: 2 additions & 2 deletions ...int On demand(POD) Email Security/Hunting Queries/ProofpointPODHighScoreMalwareValue.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,9 +3,9 @@ name: ProofpointPOD - Emails with high score of 'malware' filter classifier valu
description: |
'Search for emails with high score of 'malware' filter classifier value.'
requiredDataConnectors:
- connectorId: ProofpointPOD
- connectorId: ProofpointCCPDefinition
dataTypes:
- ProofpointPOD_message_CL
- ProofpointPODMessage_CL
tactics:
- InitialAccess
query: |
Expand Down
4 changes: 2 additions & 2 deletions ...point On demand(POD) Email Security/Hunting Queries/ProofpointPODHighScorePhishValue.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,9 +3,9 @@ name: ProofpointPOD - Emails with high score of 'phish' filter classifier value
description: |
'Search for emails with high score of 'phish' filter classifier value.'
requiredDataConnectors:
- connectorId: ProofpointPOD
- connectorId: ProofpointCCPDefinition
dataTypes:
- ProofpointPOD_message_CL
- ProofpointPODMessage_CL
tactics:
- InitialAccess
query: |
Expand Down
4 changes: 2 additions & 2 deletions ...fpoint On demand(POD) Email Security/Hunting Queries/ProofpointPODHighScoreSpamValue.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,9 +3,9 @@ name: ProofpointPOD - Emails with high score of 'spam' filter classifier value
description: |
'Search for emails with high score of 'spam' filter classifier value.'
requiredDataConnectors:
- connectorId: ProofpointPOD
- connectorId: ProofpointCCPDefinition
dataTypes:
- ProofpointPOD_message_CL
- ProofpointPODMessage_CL
tactics:
- InitialAccess
query: |
Expand Down
4 changes: 2 additions & 2 deletions ...int On demand(POD) Email Security/Hunting Queries/ProofpointPODHighScoreSuspectValue.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,9 +3,9 @@ name: ProofpointPOD - Emails with high score of 'suspect' filter classifier valu
description: |
'Search for emails with high score of 'suspect' filter classifier value.'
requiredDataConnectors:
- connectorId: ProofpointPOD
- connectorId: ProofpointCCPDefinition
dataTypes:
- ProofpointPOD_message_CL
- ProofpointPODMessage_CL
tactics:
- InitialAccess
query: |
Expand Down
4 changes: 2 additions & 2 deletions ...point On demand(POD) Email Security/Hunting Queries/ProofpointPODLargeOutboundEmails.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,9 +3,9 @@ name: ProofpointPOD - Large size outbound emails
description: |
'Search for emails which size is 2 times grater than average size of outbound email for user.'
requiredDataConnectors:
- connectorId: ProofpointPOD
- connectorId: ProofpointCCPDefinition
dataTypes:
- ProofpointPOD_message_CL
- ProofpointPODMessage_CL
tactics:
- Exfiltration
query: |
Expand Down
4 changes: 2 additions & 2 deletions ...d(POD) Email Security/Hunting Queries/ProofpointPODRecipientsHighNumberDiscardReject.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,9 +3,9 @@ name: ProofpointPOD - Recipients with high number of discarded or rejected email
description: |
'Search for recipients with high number of discarded or rejected emails.'
requiredDataConnectors:
- connectorId: ProofpointPOD
- connectorId: ProofpointCCPDefinition
dataTypes:
- ProofpointPOD_message_CL
- ProofpointPODMessage_CL
tactics:
- InitialAccess
query: |
Expand Down
4 changes: 2 additions & 2 deletions ...) Email Security/Hunting Queries/ProofpointPODRecipientsLargeNumberOfCorruptedEmails.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,9 +3,9 @@ name: ProofpointPOD - Recipients with large number of corrupted emails
description: |
'Search for recipients with large number of corrupted emails.'
requiredDataConnectors:
- connectorId: ProofpointPOD
- connectorId: ProofpointCCPDefinition
dataTypes:
- ProofpointPOD_message_CL
- ProofpointPODMessage_CL
tactics:
- InitialAccess
query: |
Expand Down
4 changes: 2 additions & 2 deletions ...POD) Email Security/Hunting Queries/ProofpointPODSendersLargeNumberOfCorruptedEmails.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,9 +3,9 @@ name: ProofpointPOD - Senders with large number of corrupted messages
description: |
'Search for senders with large number of corrupted messages.'
requiredDataConnectors:
- connectorId: ProofpointPOD
- connectorId: ProofpointCCPDefinition
dataTypes:
- ProofpointPOD_message_CL
- ProofpointPODMessage_CL
tactics:
- InitialAccess
query: |
Expand Down
4 changes: 2 additions & 2 deletions ...nd(POD) Email Security/Hunting Queries/ProofpointPODSuspiciousFileTypesInAttachments.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,9 +3,9 @@ name: ProofpointPOD - Suspicious file types in attachments
description: |
'Hunting for suspicious file types in attachments.'
requiredDataConnectors:
- connectorId: ProofpointPOD
- connectorId: ProofpointCCPDefinition
dataTypes:
- ProofpointPOD_message_CL
- ProofpointPODMessage_CL
tactics:
- InitialAccess
query: |
Expand Down
Binary file added Solutions/Proofpoint On demand(POD) Email Security/Package/3.1.5.zip
View file
Open in desktop
Binary file not shown.
Loading
Loading