[EvidenceOps - OAuth token theft evidence]
description = Collects identity, OAuth, storage, and endpoint evidence for suspected token theft.
search = index=identity sourcetype=auth user=$user$ earliest=-24h \
  | eval signal="identity", evidence=src_ip . " / " . country \
  | table _time user signal evidence src_ip country \
  | append [ search index=cloud sourcetype=oauth user=$user$ earliest=-24h \
      scope IN ("offline_access", "files.read", "mail.read") \
      | eval signal="oauth", evidence=client_id . " requested " . scope \
      | table _time user signal evidence client_id scope src_ip asn ] \
  | append [ search index=storage sourcetype=file_activity user=$user$ earliest=-24h \
      action IN ("download", "export") \
      | stats sum(bytes) as total_bytes values(path) as paths by user session_id \
      | where total_bytes > 1000000000 \
      | eval signal="storage", evidence=tostring(round(total_bytes/1024/1024/1024, 2)) . " GB downloaded" \
      | table user signal evidence paths session_id total_bytes ] \
  | append [ search index=endpoint sourcetype=process user=$user$ earliest=-24h \
      process_name IN ("powershell.exe", "cmd.exe", "wscript.exe") \
      | eval signal="endpoint", evidence=process_name . " launched by " . parent_process \
      | table _time host user signal evidence process_name parent_process command_line ] \
  | sort 0 _time
dispatch.earliest_time = -24h
dispatch.latest_time = now
is_scheduled = 0

[EvidenceOps - Ransomware prelude evidence]
description = Correlates backup anomalies, endpoint process chains, and file server rename bursts.
search = index=backup OR index=endpoint OR index=file_server user=$user$ earliest=-24h \
  | eval signal=case(index=="backup","backup",index=="endpoint","endpoint",index=="file_server","file_server",true(),"other") \
  | eval evidence=coalesce(action, process_name, file_action, signature, "event") \
  | table _time host user signal evidence action process_name parent_process path bytes
dispatch.earliest_time = -24h
dispatch.latest_time = now
is_scheduled = 0

[EvidenceOps - Insider exfiltration evidence]
description = Correlates DLP, proxy, developer repository, and endpoint telemetry for insider data loss risk.
search = index=dlp OR index=proxy OR index=developer OR index=endpoint user=$user$ earliest=-7d \
  | eval signal=case(index=="dlp","dlp",index=="proxy","proxy",index=="developer","developer",index=="endpoint","endpoint",true(),"other") \
  | eval evidence=coalesce(rule, uri, repo, process_name, "event") \
  | table _time host user signal evidence dest uri repo process_name bytes severity
dispatch.earliest_time = -7d
dispatch.latest_time = now
is_scheduled = 0