Digital Guardian Data Loss Prevention Solution

Solution: Digital Guardian Data Loss Prevention

Digital Guardian Data Loss Prevention Logo

Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · 📊

↑ Back to Solutions Index

Attribute Value
Publisher Microsoft Corporation
Support Tier Microsoft
Support Link https://support.microsoft.com
Categories domains
Version 3.0.2
Author Microsoft - support@microsoft.com
First Published 2021-07-23
Solution Folder Digital Guardian Data Loss Prevention
Marketplace Azure Marketplace · Popularity: 🔵 Medium (58%)
Pre-requisites Syslog

The Digital Guardian Data Loss Prevention (DLP) data connector provides the capability to ingest Digital Guardian DLP logs into Microsoft Sentinel.

This solution is dependent on the Syslog solution containing the Syslog via AMA connector to collect the logs. The Syslog solution will be installed as part of this solution installation.

NOTE: Microsoft recommends installation of Syslog via AMA Connector.Legacy connector uses the Log Analytics agent which were deprecated on Aug 31, 2024. Using MMA and AMA on same machine can cause log duplication and extra ingestion cost more details.

Contents

Pre-requisites

This solution depends on 1 other solution(s):

Solution
Syslog

Data Connectors

This solution has 1 discovered data connector(s)⚠️ (not in Solution definition):

Connectors from dependency solutions:

🔍 Discovered: This item was discovered by scanning the solution folder but is not listed in the Solution JSON file.

Tables Used

This solution uses 1 table(s):

Table Used By Connectors Used By Content
Syslog Syslog via AMA (dependency), Syslog via Legacy Agent (dependency), [Deprecated] Digital Guardian Data Loss Prevention Analytics, Hunting, Workbooks

Content Items

This solution includes 22 content item(s):

Content Type Count
Analytic Rules 10
Hunting Queries 10
Workbooks 1
Parsers 1

Analytic Rules

Name Severity Tactics Tables Used
Digital Guardian - Bulk exfiltration to external domain Medium Exfiltration Syslog
Digital Guardian - Exfiltration to external domain Medium Exfiltration Syslog
Digital Guardian - Exfiltration to online fileshare High Exfiltration Syslog
Digital Guardian - Exfiltration to private email High Exfiltration Syslog
Digital Guardian - Exfiltration using DNS protocol High Exfiltration Syslog
Digital Guardian - Incident with not blocked action High Exfiltration Syslog
Digital Guardian - Multiple incidents from user High Exfiltration Syslog
Digital Guardian - Possible SMTP protocol abuse High Exfiltration Syslog
Digital Guardian - Sensitive data transfer over insecure channel Medium Exfiltration Syslog
Digital Guardian - Unexpected protocol High Exfiltration Syslog

Hunting Queries

Name Tactics Tables Used
Digital Guardian - Files sent by users Exfiltration Syslog
Digital Guardian - Incident domains Exfiltration Syslog
Digital Guardian - Insecure file transfer sources Exfiltration Syslog
Digital Guardian - Inspected files Exfiltration Syslog
Digital Guardian - New incidents Exfiltration Syslog
Digital Guardian - Rare Urls Exfiltration Syslog
Digital Guardian - Rare destination ports Exfiltration Syslog
Digital Guardian - Rare network protocols Exfiltration Syslog
Digital Guardian - Urls used Exfiltration Syslog
Digital Guardian - Users' incidents Exfiltration Syslog

Workbooks

Name Tables Used
DigitalGuardian Syslog

Parsers

Name Description Tables Used
DigitalGuardianDLPEvent - Syslog (read)

Release Notes

Version Date Modified (DD-MM-YYYY) Change History
3.0.2 26-12-2024 Removed Deprecated Data connector
3.0.1 25-07-2024 Deprecating data connectors
3.0.0 09-10-2023 Fixed KQL validation failure in Hunting Query (Digital Guardian - Users incidents)

Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · 📊

↑ Back to Solutions Index