File download events in the last 7 days

Description

This query looks for file download events identified by Microsoft Defender for Cloud Apps. It will require an corresponding app connector in Microsoft Defender for Cloud Apps. Reference - https://learn.microsoft.com/defender-cloud-apps/enable-instant-visibility-protection-and-governance-actions-for-your-apps

Query · kql

let LookBack = 7d; CloudAppEvents | where ActionType == "FileDownloaded" and Timestamp > ago(LookBack) | extend FileName = RawEventData.SourceFileName | extend Site = RawEventData.SiteUrl | extend FileLabel = RawEventData.SensitivityLabelId | extend SiteLabel = RawEventData.SiteSensitivityLabelId | project Timestamp,AccountObjectId,AccountDisplayName,ActionType,Application,FileName,Site,FileLabel,SiteLabel
Raw source File download events in the last 7 days · KQL
Esc
Published by Azure/Azure-Sentinel ↗, licensed under MIT ↗. Reproduced here unmodified. 
id: f8f8d4a5-7d7d-4c5d-9b5c-9c5d7d8f8f8f
name: File download events in the last 7 days
description: |
  This query looks for file download events identified by Microsoft Defender for Cloud Apps. It will require an corresponding app connector in Microsoft Defender for Cloud Apps.
  Reference - https://learn.microsoft.com/defender-cloud-apps/enable-instant-visibility-protection-and-governance-actions-for-your-apps
requiredDataConnectors:
- connectorId: MicrosoftThreatProtection
  dataTypes:
  - CloudAppEvents
tactics:
- Exfiltration
query: >
  let LookBack = 7d;
  CloudAppEvents
  | where ActionType == "FileDownloaded" and Timestamp > ago(LookBack)
  | extend FileName = RawEventData.SourceFileName
  | extend Site = RawEventData.SiteUrl
  | extend FileLabel = RawEventData.SensitivityLabelId
  | extend SiteLabel = RawEventData.SiteSensitivityLabelId
  | project Timestamp,AccountObjectId,AccountDisplayName,ActionType,Application,FileName,Site,FileLabel,SiteLabel
entityMappings:
  - entityType: Account
    fieldMappings:
      - identifier: ObjectGuid
        columnName: AccountObjectId
      - identifier: DisplayName
        columnName: AccountDisplayName
version: 1.0.0

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.