Plugins/Community Based Plugins/Microsoft Defender XDR Custom Plugin Scenarios/EnrichmentPlugins/PurviewEnrichment.yaml [107:131]:
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
            | extend SensitiveInformationTypeName_ = tostring(parse_json(tostring(parse_json(tostring(parse_json(tostring(parse_json(tostring(RawEventData.PolicyDetails))[0].Rules))[0].ConditionsMatched)).SensitiveInformation))[0].SensitiveInformationTypeName)
            | extend FileName_ = tostring(parse_json(tostring(RawEventData.SharePointMetaData)).FileName)
            | extend RuleName_ = tostring(parse_json(tostring(parse_json(tostring(RawEventData.PolicyDetails))[0].Rules))[0].RuleName)
            | extend Severity_ = tostring(parse_json(tostring(parse_json(tostring(RawEventData.PolicyDetails))[0].Rules))[0].Severity)
            | extend Attachments_ = tostring(parse_json(tostring(RawEventData.Item)).Attachments)
            | extend Recipients = strcat('To:',RawEventData.ExchangeMetaData.To, ' CC:',RawEventData.ExchangeMetaData.CC,' BCC:',RawEventData.ExchangeMetaData.BCC)
            | extend SharePointMetaData_SiteCollectionUrl_s  = tostring(parse_json(tostring(RawEventData.SharePointMetaData)).SiteCollectionUrl)
            | extend Documents = iff(isempty(FileName_), Attachments_, FileName_)
            | extend endpointdata = (parse_json(RawEventData.EndpointMetaData))
            | extend EndPointAction = toint(RawEventData.EnforcementMode)
            | extend EndPointFile = tostring(RawEventData.ObjectId)
            | join kind= leftouter
                (
                EndPointAction
                )
                on $left.EndPointAction==$right.Action
                | extend Action = iff(isempty(Action), tolower(ActionName), Action)
                | extend endpointclassifiermatch = endpointdata.SensitiveInfoTypeData
                | extend Documents = iff(isempty(Documents), EndPointFile, Documents)
                | mv-expand RawEventData.SensitiveInfoTypeData
                | extend SensitiveInfoTypeName_ = tostring(RawEventData_SensitiveInfoTypeData.SensitiveInfoTypeName)
            | extend SensitiveInformationType = iff(isempty(SensitiveInformationTypeName_), SensitiveInfoTypeName_, SensitiveInformationTypeName_)
            | extend EndpointOperation_ = ActionType
            | extend TargetDomain = tostring(parse_json(tostring(RawEventData.EndpointMetaData)).TargetDomain)
            | extend Subject = tostring(parse_json(tostring(RawEventData.ExchangeMetaData)).Subject)
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -



Plugins/Community Based Plugins/Microsoft Defender XDR Custom Plugin Scenarios/EnrichmentPlugins/PurviewEnrichment.yaml [171:195]:
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
            | extend SensitiveInformationTypeName_ = tostring(parse_json(tostring(parse_json(tostring(parse_json(tostring(parse_json(tostring(RawEventData.PolicyDetails))[0].Rules))[0].ConditionsMatched)).SensitiveInformation))[0].SensitiveInformationTypeName)
            | extend FileName_ = tostring(parse_json(tostring(RawEventData.SharePointMetaData)).FileName)
            | extend RuleName_ = tostring(parse_json(tostring(parse_json(tostring(RawEventData.PolicyDetails))[0].Rules))[0].RuleName)
            | extend Severity_ = tostring(parse_json(tostring(parse_json(tostring(RawEventData.PolicyDetails))[0].Rules))[0].Severity)
            | extend Attachments_ = tostring(parse_json(tostring(RawEventData.Item)).Attachments)
            | extend Recipients = strcat('To:',RawEventData.ExchangeMetaData.To, ' CC:',RawEventData.ExchangeMetaData.CC,' BCC:',RawEventData.ExchangeMetaData.BCC)
            | extend SharePointMetaData_SiteCollectionUrl_s  = tostring(parse_json(tostring(RawEventData.SharePointMetaData)).SiteCollectionUrl)
            | extend Documents = iff(isempty(FileName_), Attachments_, FileName_)
            | extend endpointdata = (parse_json(RawEventData.EndpointMetaData))
            | extend EndPointAction = toint(RawEventData.EnforcementMode)
            | extend EndPointFile = tostring(RawEventData.ObjectId)
            | join kind= leftouter
                (
                EndPointAction
                )
                on $left.EndPointAction==$right.Action
                | extend Action = iff(isempty(Action), tolower(ActionName), Action)
                | extend endpointclassifiermatch = endpointdata.SensitiveInfoTypeData
                | extend Documents = iff(isempty(Documents), EndPointFile, Documents)
                | mv-expand RawEventData.SensitiveInfoTypeData
                | extend SensitiveInfoTypeName_ = tostring(RawEventData_SensitiveInfoTypeData.SensitiveInfoTypeName)
            | extend SensitiveInformationType = iff(isempty(SensitiveInformationTypeName_), SensitiveInfoTypeName_, SensitiveInformationTypeName_)
            | extend EndpointOperation_ = ActionType
            | extend TargetDomain = tostring(parse_json(tostring(RawEventData.EndpointMetaData)).TargetDomain)
            | extend Subject = tostring(parse_json(tostring(RawEventData.ExchangeMetaData)).Subject)
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -



