Forum Discussion
Solved
Automating label downgrade email notifications
I've been asked to investigate scheduling a query to run once a day that searches for label downgrade activities and sends an email with a list of events to the user's manager (according to the AD at...
You will need to use the Playbook to extract the Entity details, and the email for the user, you can then pass that to the "Send an Email" step or use IdentityInfo which has the manager details (assuming you have UEBA enabled), so once you have the user, you can lookup the manager
IdentityInfo
| where AccountUPN == "< insert name >"
| project AccountName, ManagerSupported triggers and actions in Microsoft Sentinel playbooks | Microsoft Learn
Please can you send this KQL query that you're using?
Sure, we wanted to be alerted if any label that was Confidential or higher was downgraded.
Here is the query we are using, you just need to substitute your own label's and corresponding GUID's.
let labelsMap = parse_json('{' '"<Label GUID>": "Public",' '"<Label GUID>": "Internal",' '"<Label GUID>": "Confidential",' '"<Label GUID>": "Highly Confidential",' '}'); MicrosoftPurviewInformationProtection | where LabelEventType == "LabelDowngraded" | extend NewSensitivityLabelName = iif(isnotempty(SensitivityLabelId), tostring(labelsMap[tostring(SensitivityLabelId)]), "") | extend OldSensitivityLabelName = iif(isnotempty(OldSensitivityLabelId), tostring(labelsMap[tostring(OldSensitivityLabelId)]), "") | where OldSensitivityLabelName contains "Confidential" | extend Object = url_decode(ObjectId) | extend FileName = extract(@'.*[\\\/](.*)$', 1, Object) | project TimeGenerated, UserId, FileName, OldSensitivityLabelName, NewSensitivityLabelName, JustificationText
