MailGuard 365 Sentinel Solution

.script/tests/KqlvalidationsTests/CustomTables/MailGuard365_Threats_CL.json

@@ -0,0 +1,133 @@
+{
+    "Name": "MailGuard365_Threats_CL",
+    "Properties": [
+        {
+            "Name": "TenantId",
+            "Type": "String"
+        },
+        {
+            "Name": "SourceSystem",
+            "Type": "String"
+        },
+        {
+            "Name": "TimeGenerated",
+            "Type": "DateTime"
+        },
+        {
+            "Name": "MessageId_s",
+            "Type": "String"
+        },
+        {
+            "Name": "HeaderMessageId_s",
+            "Type": "String"
+        },
+        {
+            "Name": "UserId_g",
+            "Type": "String"
+        },
+        {
+            "Name": "CustomerTenantId_g",
+            "Type": "String"
+        },
+        {
+            "Name": "Score_d",
+            "Type": "Real"
+        },
+        {
+            "Name": "Virus_b",
+            "Type": "Bool"
+        },
+        {
+            "Name": "Category",
+            "Type": "String"
+        },
+        {
+            "Name": "Attachments_s",
+            "Type": "String"
+        },
+        {
+            "Name": "Sender_Email_s",
+            "Type": "Double"
+        },
+        {
+            "Name": "Sender_Domain_s",
+            "Type": "DateTime"
+        },
+        {
+            "Name": "Recipients_s",
+            "Type": "String"
+        },
+        {
+            "Name": "ReceivedHeaders_s",
+            "Type": "String"
+        },
+        {
+            "Name": "SenderHeader_s",
+            "Type": "String"
+        },
+        {
+            "Name": "ToHeader_s",
+            "Type": "Guid"
+        },
+        {
+            "Name": "CcHeader_s",
+            "Type": "String"
+        },
+        {
+            "Name": "Subject_s",
+            "Type": "String"
+        },
+        {
+            "Name": "OriginCountry_s",
+            "Type": "String"
+        },
+        {
+            "Name": "MessageDate_t",
+            "Type": "DateTime"
+        },
+        {
+            "Name": "MessageSize_d",
+            "Type": "Real"
+        },
+        {
+            "Name": "Action_s",
+            "Type": "String"
+        },
+        {
+            "Name": "ReceivedDateTime_d",
+            "Type": "Real"
+        },
+        {
+            "Name": "ForefrontAntiSpam_s",
+            "Type": "String"
+        },
+        {
+            "Name": "MicrosoftAntiSpam_s",
+            "Type": "String"
+        },
+        {
+            "Name": "IsInWhiteList_b",
+            "Type": "Bool"
+        },
+        {
+            "Name": "IsInBlackList_b",
+            "Type": "Bool"
+        },
+        {
+            "Name": "Email_s",
+            "Type": "String"
+        },
+        {
+            "Name": "HasAttachment_b",
+            "Type": "Bool"
+        },
+        {
+            "Name": "HasImage_b",
+            "Type": "Bool"
+        },
+        {
+            "Name": "Type",
+            "Type": "String"
+        }
+    ]
+}

Solutions/MailGuard 365/Data Connectors/MailGuard365.json

@@ -0,0 +1,108 @@
+{
+    "id": "MailGuard365",
+    "title": "MailGuard 365",
+    "publisher": "MailGuard365",
+    "descriptionMarkdown": "MailGuard 365 Enhanced Email Security for Microsoft 365. Exclusive to the Microsoft marketplace, MailGuard 365 is integrated with Microsoft 365 security (incl. Defender) for enhanced protection against advanced email threats like phishing, ransomware and sophisticated BEC attacks.",
+    "graphQueries": [
+        {
+            "metricName": "Total data received",
+            "legend": "MailGuard365_Threats_CL",
+            "baseQuery": "MailGuard365_Threats_CL"
+        }
+    ],
+    "sampleQueries": [
+        {
+            "description" : "All phishing threats stopped by MailGuard 365",
+            "query": "MailGuard365_Threats_CL \n | where where Category == \"Phishing\""
+        },
+        {
+            "description" : "All threats summarized by sender email address",
+            "query": "MailGuard365_Threats_CL \n | summarize count() by Sender_Email_s"
+        },
+        {
+            "description" : "All threats summarized by category",
+            "query": "MailGuard365_Threats_CL \n | summarize count() by Category"
+        }
+    ],
+    "dataTypes": [
+        {
+            "name": "MailGuard365_Threats_CL",
+            "lastDataReceivedQuery": "MailGuard365_Threats_CL\n            | summarize Time = max(TimeGenerated)\n            | where isnotempty(Time)"
+        }
+    ],
+    "connectivityCriterias": [
+        {
+            "type": "IsConnectedQuery",
+            "value": [
+                "MailGuard365_Threats_CL\n            | summarize LastLogReceived = max(TimeGenerated)\n            | project IsConnected = LastLogReceived > ago(30d)"
+            ]
+        }
+    ],
+    "availability": {
+        "status": 1,
+        "isPreview": false
+    },
+    "permissions": {
+        "resourceProvider": [
+            {
+                "provider": "Microsoft.OperationalInsights/workspaces",
+                "permissionsDisplayText": "read and write permissions are required.",
+                "providerDisplayName": "Workspace",
+                "scope": "Workspace",
+                "requiredPermissions": {
+                    "write": true,
+                    "read": true,
+                    "delete": true
+                }
+            },
+            {
+                "provider": "Microsoft.OperationalInsights/workspaces/sharedKeys",
+                "permissionsDisplayText": "read permissions to shared keys for the workspace are required. [See the documentation to learn more about workspace keys](https://docs.microsoft.com/azure/azure-monitor/platform/agent-windows#obtain-workspace-id-and-key).",
+                "providerDisplayName": "Keys",
+                "scope": "Workspace",
+                "requiredPermissions": {
+                    "action": true
+                }
+            }
+        ]
+    },
+    "instructionSteps": [
+        {
+            "title": "Configure and connect MailGuard 365",
+            "description": "1. In the MailGuard 365 Console, click **Settings** on the navigation bar.\n2. Click the **Integrations** tab.\n3. Click the **Enable Microsoft Sentinel**.\n  - Enter your workspace id and primary key from the fields below, click **Finish**.\n5. For additional instructions, please contact MailGuard 365 support.",
+            "instructions": [
+                {
+                    "parameters": {
+                        "fillWith": [
+                            "WorkspaceId"
+                        ],
+                        "label": "Workspace ID"
+                    },
+                    "type": "CopyableLabel"
+                },
+                {
+                    "parameters": {
+                        "fillWith": [
+                        "PrimaryKey"
+                        ],
+                        "label": "Primary Key"
+                    },
+                    "type": "CopyableLabel"
+                }
+            ]
+        }
+    ],
+    "metadata": {
+        "id": "310bcb08-38be-4257-b4d5-035e1ae3f256",
+        "version": "1.0.0",
+        "kind": "dataConnector",
+        "author": {
+            "name": "MailGuard 365"
+        },
+        "support": {
+            "name": "MailGuard 365",
+            "link": "https://www.mailguard365.com/support",
+            "tier": "developer"
+        }
+    }
+}

Solutions/MailGuard 365/Hunting Queries/MailGuard365HighConfidenceThreats.yaml

@@ -0,0 +1,23 @@
+id: 5e3aa1a5-5b69-421e-a3ac-32b04cb10353
+name: MailGuard 365 - High Confidence Threats
+description: |
+  'Query searches for high confidence threats stopped by MailGuard 365.'
+severity: Medium
+requiredDataConnectors:
+  - connectorId: MailGuard365
+    dataTypes:
+      - MailGuard365
+tactics:
+  - Reconnaissance
+relevantTechniques:
+  - T1598
+query: |
+  MailGuard365_Threats_CL
+  | where Score_d > 20
+entityMappings:
+  - entityType: Mail message
+    fieldMappings:
+      - identifier: NetworkMessageId
+        columnName: MessageId_s
+      - identifier: Recipient
+        columnName: Email_s

Solutions/MailGuard 365/Hunting Queries/MailGuard365MalwareThreats.yaml

@@ -0,0 +1,29 @@
+id: daaae6ad-1fd0-4efa-b571-116689e67a20
+name: MailGuard 365 - Malware Threats
+description: |
+  'Query searches for malware threats stopped by MailGuard 365.'
+severity: High
+requiredDataConnectors:
+  - connectorId: MailGuard365
+    dataTypes:
+      - MailGuard365
+tactics:
+  - InitialAccess
+  - Reconnaissance
+relevantTechniques:
+  - T1592
+  - T1589
+  - T1590
+  - T1591
+  - T1189
+  - T1190
+query: |
+  MailGuard365_Threats_CL
+  | where Category == "Malicious Documents"
+entityMappings:
+  - entityType: Mail message
+    fieldMappings:
+      - identifier: NetworkMessageId
+        columnName: MessageId_s
+      - identifier: Recipient
+        columnName: Email_s

Solutions/MailGuard 365/Hunting Queries/MailGuard365PhishingThreats.yaml

@@ -0,0 +1,26 @@
+id: ee15ed10-d355-474e-b8ad-a8bbb76f6d38
+name: MailGuard 365 - Phishing Threats
+description: |
+  'Query searches for phishing threats stopped by MailGuard 365.'
+severity: Medium
+requiredDataConnectors:
+  - connectorId: MailGuard365
+    dataTypes:
+      - MailGuard365
+tactics:
+  - InitialAccess
+  - Reconnaissance
+  - Credential Access
+relevantTechniques:
+  - T1598
+  - T1566
+query: |
+  MailGuard365_Threats_CL
+  | where Category == "Phishing"
+entityMappings:
+  - entityType: Mail message
+    fieldMappings:
+      - identifier: NetworkMessageId
+        columnName: MessageId_s
+      - identifier: Recipient
+        columnName: Email_s