Incidents from Custom Detection Rules never have Emails for Evidence

I’ve got the above query saved as a detection rule, which works fine except for one thing – the emails are never present in the Evidence tab of the generated incidents. Meanwhile the Recipients show up in the Mailbox and User assets as I’m using Entity mapping to mapping the RecipientEmailAddress / RecipientObjectId to those 2 entity types. The only thing I can find about Emails is that for Actions to be possible on the Emails in the query results – “The columns NetworkMessageId and RecipientEmailAddress must be present in the output results of the query to apply actions to email messages.” (ref) – which is being satisfied.

The Evidence available is the IP of the sender, and an empty email cluster, like this:

In the incident above there are 2 emails, and the 4 assets are the user and mailbox for each of the 2 emails’ Recipient. I can successfully just use the query manually to find and manage those emails, but a big part of the goal with these detection rules, at least in my opinion, is to be able to easily manage the evidence. In this exact case, I’m looking for inbound emails coming from our own Accepted Domains in the SenderFromAddress, which pass DMARC, but are in Quarantine, detected as Phish. The idea is to watch out for false positives due to URL detonation reputation since most of the messages fitting this criteria are coming in from various emailing services (e.g., Constant Contact, MailChimp, SendGrid, etc.) and these services tend to end up on the reputation lists a few times per month.

Just wondering if there are any tricks anyone knows about to help me populate the emails into my resulting incidents.

let ignoreAddresses = datatable(address:string) [@’email address removed for privacy reasons’,@’email address removed for privacy reasons’];
let ignoreSpamSubjects = datatable(address:string) [@’ignored subject 1′,@’ignored subject 2′];
// Time range needs to be set in the UI dropdown in order for LatestDeliveryLocation filter to work (i.e., live table vs streaming API).
EmailEvents
| where SenderFromDomain in~ (_getEXOAcceptedDomains)
| where DetectionMethods has_any(‘URL detonation reputation’, ‘URL malicious reputation’) and not(RecipientEmailAddress in~ (ignoreAddresses) or SenderFromAddress in~ (ignoreAddresses))
| where not (Subject has_any (ignoreSpamSubjects))
| where (parse_json( AuthenticationDetails).DMARC =~ ‘Pass’ and EmailDirection =~ ‘Inbound’) or (EmailDirection =~ ‘Intra-org’)
| where (LatestDeliveryLocation in~ (‘Quarantine’, ‘Junk folder’) and not (LatestDeliveryAction =~ ‘Quarantine release’)) and parse_json(ConfidenceLevel).Phish in~ (‘Normal’,’High’)
| join kind=inner (
EmailUrlInfo
| summarize Urls = make_list(Url) by NetworkMessageId
) on NetworkMessageIdI’ve got the above query saved as a detection rule, which works fine except for one thing – the emails are never present in the Evidence tab of the generated incidents. Meanwhile the Recipients show up in the Mailbox and User assets as I’m using Entity mapping to mapping the RecipientEmailAddress / RecipientObjectId to those 2 entity types. The only thing I can find about Emails is that for Actions to be possible on the Emails in the query results – “The columns NetworkMessageId and RecipientEmailAddress must be present in the output results of the query to apply actions to email messages.” (ref) – which is being satisfied. The Evidence available is the IP of the sender, and an empty email cluster, like this:In the incident above there are 2 emails, and the 4 assets are the user and mailbox for each of the 2 emails’ Recipient. I can successfully just use the query manually to find and manage those emails, but a big part of the goal with these detection rules, at least in my opinion, is to be able to easily manage the evidence. In this exact case, I’m looking for inbound emails coming from our own Accepted Domains in the SenderFromAddress, which pass DMARC, but are in Quarantine, detected as Phish. The idea is to watch out for false positives due to URL detonation reputation since most of the messages fitting this criteria are coming in from various emailing services (e.g., Constant Contact, MailChimp, SendGrid, etc.) and these services tend to end up on the reputation lists a few times per month. Just wondering if there are any tricks anyone knows about to help me populate the emails into my resulting incidents. Read More

Cart

Cart