Email SIT Finder Update: All Credentials Bundled Entity

Found this nugget buried in the Purview Blueprints Github repo. Figured I'd take a crack at integrating credential SITs into my EXO SIT Finder. The "All Credentials" Bundled SIT is multitudinous and complex, as you can see in the linked Learn Doc below. Current SITs being scanned via the script are:

→U.S. SSN

→Credit Card Number

→U.S. Bank Account

→GitHub PAT

→Google API Key

→Slack Token

→Azure Storage SAS

→Azure Storage Account Key

→JWT Bearer Token

→Azure SQL Connection String

→Generic Client Secret / API Key

→General Password

False positives were of course a big concern of mine with this particular update; however, confidence scoring helps with that, and decoupling the deletion script from the reporting script allows you to report on alleged matches without the risk of accidental data deletion.

I know some of you have asked for country-specific SITs, and I promise those are coming. Just got a little distracted 👀

All credentials entity definition

All credentials sensitive information type entity definition.

Microsoft Learnchrfox

Previous blogs on this topic:

Recap: Finding SITs in Exchange Mail at Rest

I didn’t have much of a following when I initially wrote about SIT-search limitations in mailbox data-at-rest. Since then, I’ve spoken with multiple clients and data security professionals who were under the mistaken impression that Purview could find that data. Since this limitation still exists, and since it’s still an

SeverianMatthew Silcox

GitHub Repo:

GitHub - MatthewSilcox/Purview_SIT_Email_Scanner: This PowerShell script scans Exchange Online user mailboxes for U.S. Social Security Numbers (SSNs) using the Microsoft Graph API. It applies confidence scoring based on contextual keyword proximity and regex patterns, exports results to a CSV for review, and provides optional deletion capabilities.

This PowerShell script scans Exchange Online user mailboxes for U.S. Social Security Numbers (SSNs) using the Microsoft Graph API. It applies confidence scoring based on contextual keyword proximit…

GitHubMatthewSilcox