Re: Microsoft Purview Advanced Data Loss Prevention (DLP) Incident Search (2023)

1. Introduction

Microsoft 365 Defender is the Microsoft recommended experience for investigating and remediatingMicrosoft Purview Data Loss Prevention(DLP) incidents. See the previously published step-by-step guide forlearn how to investigate the Microsoft Purview Data Loss Prevention alert in Microsoft 365 Defender.

As part of the investigative capabilities available in Microsoft 365 Defender,advanced huntingProvides the ability to query raw compliance and security data signals generated by Microsoft 365 to proactively detect known and potential risks in your organization, as well as visualize the attack chain.Advanced search can jumpstart your investigation workflow and help you learn more about the types of alerts you receive on your property. This blog provides guidance on how to get started and take advantage of advanced search for Microsoft Purview DLP investigations. We're sharing example queries for high-value scenarios to help you get started.

2. Introduction

Prerequisite: Get the required CloudAppEvents table, which contains the Microsoft Purview data, to appear in Advanced Hunting byfollowing these steps to integratecom Microsoft 365.

1. To access advanced search, go tohttps://security.microsoft.comand click onadvanced huntingin the left navigation pane.

2. Under Advanced Hunting, select the time range for the query.

3. On the left side you have all available tables, the details of each of these tables areavailable here. In this post, we provide examples of what you can do withCloudAppEventsmesa.
4. Queries in advanced search are based on the KUSTO query language. for an introductionread this.
5. After entering the query click,run query.
6. There isintegrated viewswithin the product, to make the data easier to consume. In the example below, we aresummarizing alerts based onconfidentialInformationtypesand rendering the results as a pie chart. Views like this can help you quickly tell if any of your SITs are over-represented in the alert flow (see command | render pie chart).

3. Scenarios/Samples using advanced search

Get DLP alerts for a given user (summarized by document, subject and sensitive information type match)

This query will return DLP alerts for a user and summarize them based on the affected content. This can be used to understand risky activities. Is the user actively trying to defeat the controls by sending the content in different ways?

Replace username.

let user = ('user@dom.com');CloudAppEvents| onde ActionType tem "DLPRuleMatch" ou ActionType tem "DLPRuleUndo"| onde tolower(usuário) == tolower(RawEventData.UserId) | extend PolicyName_ = tostring(parse_json(tostring(RawEventData.PolicyDetails))[0].PolicyName)| extend SensitiveInformationTypeName_ = tostring(parse_json(tostring(parse_json(tostring(parse_json(tostring(parse_json(tostring(RawEventData.PolicyDetails))[0].Rules))[0].ConditionsMatched)).SensitiveInformation))[0].SensitiveInformationTypeName) | extend FileName_ = tostring(parse_json(tostring(RawEventData.SharePointMetaData)).FileName)| extend RuleName_ = tostring(parse_json(tostring(parse_json(tostring(RawEventData.PolicyDetails))[0].Rules))[0].RuleName)| extend Severity_ = tostring(parse_json(tostring(parse_json(tostring(RawEventData.PolicyDetails))[0].Rules))[0].Severity)| extend Attachments_ = tostring(parse_json(tostring(RawEventData.Item)).Attachments)| extend Recipients = strcat("To:",RawEventData.ExchangeMetaData.To, " CC:",RawEventData.ExchangeMetaData.CC," BCC:",RawEventData.ExchangeMetaData.BCC) | extend SharePointMetaData_SiteCollectionUrl_s = tostring(parse_json(tostring(RawEventData.SharePointMetaData)).SiteCollectionUrl)| extend Documents = iff(isempty(FileName_), Attachments_, FileName_) | join kind = leftouter ( CloudAppEvents | where RawEventData.Operation == "SecureLinkUsed" ou RawEventData.Operation == "AddedToSecureLink" | extend SourceFileName = tostring(RawEventData.SourceFileName) | extend SharePointMetaData_SiteCollectionUrl_s = tostring(RawEventData.SiteUrl)| extend UserId = tostring (RawEventData.UserId) | estender TargetUserOrGroupName = tostring(RawEventData.TargetUserOrGroupName) | resumir por SharePointMetaData_SiteCollectionUrl_s,SourceFileName,TargetUserOrGroupName | resumir TargetUserOrGroupName = make_list(strcat(TargetUserOrGroupName)) por SharePointMetaData_SiteCollectionUrl_s,Sou rceFileName | resumir take_any(TargetUserOrGroupName) por SourceFileName,SharePointMetaData_SiteCollectionUrl_s|project SourceFileName, SharePointMetaData_SiteCollectionUrl_s, TargetUserOrGroupName ) em SharePointMetaData_SiteCollectionUrl_s | extend TargetUsers = iff(isnotempty(tostring(TargetUserOrGroupName)), tostring(TargetUserOrGroupName), Destinatários)| extend Subject = tostring(parse_json(tostring(RawEventData.ExchangeMetaData)).Subject)| extend PolicyName_EndPoint = tostring(parse_json(tostring(RawEventData.PolicyDetails))[0].PolicyName)| extend PolicyName = iff(isempty(PolicyName_), PolicyName_EndPoint, PolicyName_) | extend Workload = tostring(RawEventData.Workload)| extend Object = tostring(RawEventData.ObjectId)| join kind=leftouter(CloudAppEvents| onde ActionType tem "DLPRuleMatch" ou ActionType tem "DLPRuleUndo"| onde RawEventData.Workload tem "Endpoint"| extend SensitiveInfoTypeName_ = tostring(parse_json(tostring(parse_json(tostring(RawEventData.EndpointMetaData)).SensitiveInfoTypeData) )[0].SensitiveInfoTypeName)| extend EndPointFile = tostring(RawEventData.ObjectId)| project EndPointFile,SensitiveInfoTypeName_)on $left.Object == $right.EndPointFile| extend Documents = iff(isempty(Documents), EndPointFile, Documents) | extend SensitiveInformationType = iff(isempty(SensitiveInformationTypeName_), SensitiveInfoTypeName_, SensitiveInformationTypeName_) | extend EndpointOperation_ = tostring(parse_json(tostring(RawEventData.EndpointMetaData)).EndpointOperation)| extend TargetDomain = tostring(parse_json(tostring(RawEventData.EndpointMetaData)).TargetDomain)| extend Target = iff(isempty(tostring(TargetDomain)), TargetUsers, tostring(TargetDomain)) | projeto Timestamp,ActionType,Workload,PolicyName,SensitiveInformationType,Documents,Target,Subject,EndpointOperation_,Severity_| resumir arg_max(Timestamp, *) por Workload,PolicyName,SensitiveInformationType,Documents,Target| projeto Timestamp,ActionType,Workload,PolicyName,SensitiveInformationType,Documents,Target,Subject,EndpointOperation_,Severity_| classificar por carimbo de data/hora

Identify who has access or has accessed a document in SharePoint or OneDrive for Business

This query will return information from SharePoint Online and OneDrive for Business based on the time range defined in the advanced search. It will return external accessand file sharing historyeyou canto chooseowith whom certain files were shared for SharePoint and OneDrive DLP alerts.

Replace the user account with the account that triggered the DLP Policy, replace the file name with the document name.

deixe documento = "nome do arquivo"; deixe o usuário = ('useraccount'); let DLP = ( CloudAppEvents | where RawEventData.Workload in ('SharePoint', 'OneDrive') | where ActionType == "DLPRuleMatch" | extend FilePathUrl_ = url_decode(tostring(RawEventData.SharePointMetaData.FilePathUrl)) | extend path = parse_path(FilePathUrl_ ) | where path.Filename has document | extend DirectoryPath = tostring(path.DirectoryPath) | resumir por DirectoryPath );let officedata = ( CloudAppEvents | where RawEventData.Operation == "SecureLinkUsed" or RawEventData.Operation == "AddedToSecureLink" | extend ObjectId_ = tostring(RawEventData.ObjectId) | where ObjectId_ has_any (DLP) | estender SharePointMetaData_SiteCollectionUrl = tostring(RawEventData.SiteUrl) | estender SharePointMetaData_FileName = tostring((RawEventData.SourceFileName)) | estender Conta = tostring(RawEventData.UserId) | estender Targetsplit = split(Account, "#") | extend TargetUserOrGroupName = iff(isempty(RawEventData.TargetUserOrGroupName), Targetsplit[1], RawEventData.TargetUserOrGroupName) //Excluir domínios internos se necessário //| onde TargetUserOrGroupName !tem "mydom1.com" | estender TargetUserOrGroupName = tolower(TargetUserOrGroupName) | resumir por SharePointMetaData_FileName, SharePointMetaData_SiteCollectionUrl, TargetUserOrGroupName, ObjectId_, Account);let dlpmain = ( CloudAppEvents | where ActionType == "DLPRuleMatch" | where RawEventData.Workload == "OneDrive" or RawEventData.Workload == "SharePoint" | estender FilePathUrl_ = url_decode (tostring(RawEventData.SharePointMetaData.FilePathUrl)) | extend path = parse_path(FilePathUrl_) | onde path.Filename tem documento | extend Account = tostring(RawEventData.UserId) | onde Account tem usuário | extend ObjectId_ = url_decode(tostring(ObjectName) ) | extend SharePointMetaData_SiteCollectionUrl = tostring((RawEventData.SharePointMetaData.SiteCollectionUrl)) | where tolower(RawEventData.UserId) == tolower(Account) | where RawEventData.Workload in ('SharePoint', 'OneDrive') | extend SourceFileName = tostring( RawEventData.SourceFileName) );let folder = (dlpmain | tipo de junção = leftouter (officedata | resumo por SharePointMetaData_SiteCollectionUrl, SharePointMetaData_FileName, TargetUserOrGroupName, ObjectId_ | resumir TargetUserOrGroupName = make_list(strcat(TargetUserOrGroupName)) por ObjectId_, SharePointMetaData_SiteCollectionUrl, SharePointMetaData_FileName | resumir take_any(TargetUserOrGroupName) por ObjectId_, SharePointMetaData_SiteCollectionUrl, SharePointMetaData_FileName | join kind = leftouter ( officedata | resumir por SharePointMetaData_SiteCollectionUrl, SharePointMetaData_FileName, TargetUserOrGroupName, ObjectId_ | estender Domsplit = split(TargetUserOrGroupName, "@") | estender domínio = Domsplit[1] | resumir TargetDomain = make_list(strcat(domínio)) por SharePointMetaData_FileName, ObjectId_ | resumir take_any(TargetDomain) por SharePointMetaData_FileName, ObjectId_ ) em ObjectId_ ) em ObjectId_ );let files = (pasta //| where TargetUserOrGroupName == "" | join kind = leftouter (officedata | resumir TargetUserOrGroupName = make_list(strcat(TargetUserOrGroupName) ) por SharePointMetaData_FileName, SharePointMetaData_SiteCollectionUrl | resumir take_any(TargetUserOrGroupName) por SharePointMetaData_FileName, SharePointMetaData_SiteCollectionUrl | join kind = leftouter ( officedata | resumir por SharePointMetaData_SiteCollectionUrl, SharePointMetaData_FileName, TargetUserOrGroupName | estender Domsplit = split(TargetUserOrG roupName, "@") | estender domínio = Domsplit[1] | resumir TargetDomain = make_list(strcat(domain)) por SharePointMetaData_FileName | resumir take_any(TargetDomain) por SharePointMetaData_FileName ) em SharePointMetaData_FileName ) em SharePointMetaData_FileName, SharePointMetaData_SiteCollectionUrl | estender TargetUserOrGroupName = TargetUserOrGroupName1 | estender TargetDomain = TargetDomain1 | onde TargetUserOrGroupName != "" ); pasta de união, arquivos| extend FileName = tostring(parse_json(tostring(RawEventData.SharePointMetaData)).FileName)| resumir arg_max(Timestamp, *) por ObjectId_, Conta, tostring(RawEventData.Id)| extend FileNameEncoded = url_encode(FileName)| extend MDALink = (strcat('https://security.microsoft.com/cloudapps/files?filename=eq(',FileNameEncoded,')')) //Use este link para visualizar operações mais antigas diretamente do Microsoft Defender for Cloud Apps | timestamp do projeto,FileName,Target= TargetUserOrGroupName,SPOD_Path = ObjectId_,RawEventData,MDALink| classificar por carimbo de data/hora

Understand the applications, devices used by the user in relation to the sensitive data processed

This query will return endpoint events generated by a specific user. It provides a more complete picture when investigating an endpoint DLP event. Update the query by replacing the user's email.

let User = ("user@dom.com");let AppEvents = (CloudAppEvents| where parse_json(tostring(RawEventData.SensitiveInfoTypeData)) != ""| where parse_json(tostring(RawEventData.SensitiveInfoTypeData)) != "[]" | extend sit = parse_json(tostring(RawEventData.SensitiveInfoTypeData))| mv-expand sit| extend UserId = tolower(RawEventData.UserId)| extend SensitiveInfoTypeName = tostring(sit.SensitiveInfoTypeName)| extend document = tostring(RawEventData.ObjectId)); AppEvents| onde UserId == Usuário| extend ObjectId = tostring(RawEventData.ObjectId)| extend DeviceName = tostring(RawEventData.DeviceName)| extend Application = tostring(RawEventData.Application)| resumir count = count() por documento,Aplicativo,SensitiveInfoTypeName,ActionType,DeviceName|ordem por ActionType

Identify what actions were performed on a document and the associated sensitivity label.

This query will return all activities on the endpoint, SharePoint, Exchange for your document. Also returns the guid of the label applied to the content. Since the same filename can be used for different documents, you may need to add additional filters to ensure you only return your file. Update the query by adding the file name.

deixe document = "sample.txt";CloudAppEvents// para acelerar a execução da consulta e remover possíveis correspondências falsas, use os filtros abaixo.//| where tolower(RawEventData.UserId) == "seuusuário@seudom.com"//| onde RawEventData.Sha256 == "52eb73d06b265f3e6cfeca5477ea22efc300ab42514635ed20d18e77272ff125"//| onde RawEventData.ListItemUniqueId == "6c8306d8-2e84-40a4-b39a-4841bfac1c82"| pesquisar documento| extend Users = tostring(RawEventData.UserId) | extend LabelGUID1 = parse_json(tostring(RawEventData.SensitivityLabelEventData)).SensitivityLabelId | estender LabelGUID2 = iff(isempty(tostring(RawEventData.LabelId)), LabelGUID1, tostring(RawEventData.LabelId)) | extend LabelGUID3 = iff(isempty(tostring(RawEventData.SensitivityLabelId)), LabelGUID2, tostring(RawEventData.SensitivityLabelId)) | extend OldSensitivityLabelId = tostring(parse_json(tostring(RawEventData.SensitivityLabelEventData)).OldSensitivityLabelId) | extend LabelGUID = iff(isempty(tostring(LabelGUID3)),OldSensitivityLabelId, tostring(LabelGUID3)) | projeto Timestamp,ActionType,Usuários,CountryCode,LabelGUID,ReportId,RawEventData| classificar por carimbo de data/hora

Identify people who joined a Teams meeting that violated a policy

This query will return the list of people who joined the team meeting you specify. Teams results can sometimes arrive a few hours after completion. Replace the subject.

//Atualizar o Assunto da reunião let subject = ("Reunião Super Secreta"); CloudAppEvents //| onde RawEventData.Operation == "MeetingParticipantDetail" | onde ActionType == "Mensagem enviada" | extend ChatName_ = tostring(RawEventData.ChatName) | onde ChatName_ tem assunto| estender ChatThreadId_ = tostring(RawEventData.ChatThreadId) | join kind=inner ( CloudAppEvents | where RawEventData.Operation == "MeetingDetail" | extend ChatThreadId_ = tostring(RawEventData.ChatThreadId) | extend meetid = tostring(RawEventData.Id) ) em ChatThreadId_ | extend Meeting = tostring(parse_json(tostring(parse_json(tostring(RawEventData.ExchangeMetaData)).To))[0]) | extend HasForeignTenantUsers_ = tostring(parse_json(tostring(RawEventData.ParticipantInfo)))| projeto meetid,ChatName_,HasForeignTenantUsers_| join kind=inner ( CloudAppEvents | where RawEventData.Operation == "MeetingParticipantDetail" | estender meetid = tostring(RawEventData.MeetingDetailId) ) em meetid| extend UPN = tostring(parse_json(tostring(RawEventData.Attendees))[0].UPN)| extend RecipientType = tostring(parse_json(tostring(RawEventData.Attendees))[0].RecipientType)| resumir por UPN,AccountDisplayName,RecipientType,ChatName_,Timestamp,HasForeignTenantUsers_

Identify external user access to the Teams channel that violated the DLP policy

This query will return the details of a Teams channel. It will also let you know if there are external users associated with the channel. Update the query by substituting the Teams name.

//Atualizar a equipe usada pelo Teamvarlet Teamvar = ("The eDiscovery Team");CloudAppEvents| onde Aplicativo == "Microsoft Teams"| extend TeamName = tostring(RawEventData.TeamName)| onde TeamName == Teamvar| extend UPN_ = tostring(parse_json(tostring(RawEventData.Members))[0].UPN)| extend GroupId = tostring(RawEventData.AADGroupId)//adicione abaixo para incluir a adição de usuários//| onde ActionType == "MemberAdded"| extend HasGuestUsers = tostring(parse_json(tostring(RawEventData.ParticipantInfo)).HasGuestUsers)| extend HasUnauthenticatedUsers = tostring(parse_json(tostring(RawEventData.ParticipantInfo)).HasUnauthenticatedUsers)| resumir por TeamName,ActionType,HasGuestUsers,HasUauthenticatedUsers,UPN_

Type of data processed in different regions

If you have a type of sensitive information that should only be processed in a specific geographic region, you can use this query to identify. We are using location data coming from Microsoft Defender for Cloud Apps. You can also set up an alert based on this.

let AppEvents = (CloudAppEvents| where parse_json(tostring(RawEventData.SensitiveInfoTypeData)) != ""| where parse_json(tostring(RawEventData.SensitiveInfoTypeData)) != "[]"| extend sit = parse_json(tostring(RawEventData.SensitiveInfoTypeData)) //Expand all sensitive information types on separate lines| mv-expand sit| extend SensitiveInfoTypeName = tostring(sit.SensitiveInfoTypeName)| extend document = tostring(RawEventData.ObjectId)); AppEvents | extend city = City | extend country = CountryCode | extend Level = SensitiveInfoTypeName| summarize count() by level, city, country

Translation table for sensitivity labels for reporting richness

When working with SharePoint and OneDrive cases, it can be nice to be able to add the labels or label changes made to a document. This example lets you convert the GUIDs to the actual names of the labels. It takes a little more work to get the GUIDs.

1. Conecte-se ao SCC PowerShell (Connect-IPPSsession)
   1. Executar get-label | selecione immutableid,DisplayName,"," | convertto-csv
   2. copy the output

2. Replace your output with the example below in the data table. This allows you to go a little deeper and identify the output of the labeled content with the actual label name. Update the document variable below for the document you are investigating.

let document = "doc";let Labels = datatable(LabelGuid:string,LabelName:string)["defa4170-0d19-0005-0000-bc88714345d2","Personal","defa4170-0d19-0005-0001-bc88714345d2"," Public","defa4170-0d19-0005-0002-bc88714345d2","General","defa4170-0d19-0005-0003-bc88714345d2","Anyone (no restrictions)","defa4170-0d19-0005-0004-bc88714345d 2", "All Employees (No Restrictions)","defa4170-0d19-0005-0005-bc88714345d2","Confidential","defa4170-0d19-0005-0006-bc88714345d2","Anyone (No Restrictions)", "defa4170-0d19-0005- 0007-bc88714345d2","All Employees","defa4170-0d19-0005-0008-bc88714345d2","Trusted Persons","6a6067cf-b972-45c0-a5ee-1ac16535698b"," finance ","defa4170-0d19-0005 - 0009-bc88714345d2","Highly Confidential","defa4170-0d19-0005-000a-bc88714345d2","All Employees","defa4170-0d19-0005-000b-bc88714345d2"," Specified Persons","44867fba-10b9- 43b0 -a00b-2672e310b2e3","DKE1",];CloudAppEvents| search document| extend Users = tostring(RawEventData.UserId) | extend LabelGUID1 = parse_json(tostring(RawEventData.SensitivityLabelEventData)).SensitivityLabelId | extend LabelGUID2 = iff(isempty(tostring(RawEventData.LabelId)), LabelGUID1, tostring(RawEventData.LabelId)) | extend LabelGUID3 = iff(isempty(tostring(RawEventData.SensitivityLabelId)), LabelGUID2, tostring(RawEventData.SensitivityLabelId)) | extend OldSensitivityLabelId = tostring(parse_json(tostring(RawEventData.SensitivityLabelEventData)).OldSensitivityLabelId) | extend LabelGuid = iff(isempty(tostring(LabelGUID3)),OldSensitivityLabelId, tostring(LabelGUID3)) | join kind= inner(Labels)on LabelGuid| project Timestamp,ActionType,Users,CountryCode,ReportId,RawEventData,LabelName,RawEventData.ObjectId| sort by timestamp

You can configure an alert based on the volume of a specific label to determine if a user is moving a large amount of externally labeled data as an example.Parameters to consider are the type of activity (eg file upload or file print), number of activities, file size and time interval.

Use built-in advanced functions to understand anomalies in your DLP data

Foranomaly detection and predictionemachine learningKusto also built this. It can help you analyze irregular patterns and trigger alerts based on that. It can also be used to validate that services are behaving as expected. In the example below, we are identifying anomalies in the number of DLP alerts. You can do the same with using sensitive content and labels to find outliers in your processing.

let data = (CloudAppEvents| where ActionType == "DlpRuleMatch"| extend UserId = tostring(RawEventData.UserId)| resumir EventCount=count() by UserId, bin(Timestamp,30m)| order by Timestamp| resumir EventCount=make_list(EventCount ),TimeGenerated=make_list(Timestamp) by UserId| extend outliers=series_decompose_anomalies(EventCount)| mv-expand TimeGenerated, EventCount, outliers| onde outliers == 1| distinto UserId);CloudAppEvents| extend UserId = tostring(RawEventData.UserId)| onde UserId em (dados)| extend ChartName = strcat(UserId)| resumir EventCount=count() por ChartName,bin(Timestamp, 30m)| gráfico de tempo de renderização

4. Conclusion

AdvancedhgraduallyIt isa powerful tool that can support yourday by dayinvestigations. These examples of complaintseshe canhelp you get started. You cancustomize these queries tosuityouroperational environment. To useyour knowledge to createcustom detection ruleseuse the built-depending onsforhunt andlearn more aboutriskstandardsin your environment.

Additional Resources:

• Learn More About Data Loss Prevention - Microsoft Purview (Compliance) | Microsoft Learn
• Investigate data loss incidents with Microsoft 365 Defender | Microsoft Learn
• Overview - Advanced Hunting | Microsoft Learn
• Guidance for investigating Microsoft Purview data loss prevention incidents - Microsoft Community Hu...
• Learn how to investigate Microsoft Purview Data Loss Prevention alerts in Microsoft 365 Defender - M...

As always, we look forward to your feedback!

Thanks,

Equipe Microsoft Purview Data Loss Prevention.