MDCA: Monitor Sensitive Label Downgrading Near Real-Time

Use Case

The client wants to keep their private information safe when people from inside or outside the company access it — with visibility into strictly confidential documents that get downgraded to a lower label.

When a label downgrade happens, they want to get an alert as quickly as possible.

Solution

To accommodate the use case, we'll create a Kusto Query Language (KQL) query in Advanced Hunting and a custom detection rule. The query is designed to run continuously, so we get the alarm in near real-time.

Prerequisites

Implementation

1) Getting label IDs

First we need to grab the IDs from our Information Protection labels.

1. Go to Graph Explorer and sign in with a Global Admin account.
2. Go to Modify permissions and grant consent for InformationProtectionPolicy.Read.
3. Paste the URL and run the query.
4. Go through all the results and copy each label ID for later use.
5. Save all your IDs and label names for later use.

2) Creating the Advanced Hunting query

1. Go to security.microsoft.com → Hunting → Advanced Hunting.
2. Create a new query.
3. Copy the query from my GitHub repo: mdca-label-downgrade-query.kql.
4. Paste it into your newly created Advanced Hunting query.
5. (Important) Replace listLabelNames with your saved label IDs and friendly names (from step 1).
6. (Important) Modify the two lines (Source & Destination) with your Strictly Confidential label IDs.
7. Click Save as and select my-queries as the location.
8. Without closing the query, proceed to step 3 below.

3) Creating the custom detection rule

1. Within the query, click Create Custom Detection Rule.
2. Alert details: fill in name, frequency, title, severity, category and description.
3. Impacted entities: select AccountId.
4. Actions: skip this or leave it default.
5. Submit and create the detection rule.

4) Testing: generate an alert

1. Find a test user or use your current admin account.
2. Go to a SharePoint site and create a new document.
3. Give it a name, title and some content.
4. Select your version of the Strictly Confidential label (Source).
5. Refresh the browser inside the document.
6. Downgrade the label to lower than Strictly Confidential (Destination).

5) Testing: wait for the alert

After a couple of minutes the alert appeared. This detection rule is NRT (near real-time), so it should show up quickly.

Conclusion

Advanced Hunting with a custom detection rule is very useful for monitoring CloudAppEvents near real-time. This label downgrade can also be monitored through Sentinel or Insider Risk Management.

Let me know if you have questions or need help.