Skip to content

Commit c89656c

Browse files
v-atulyadavv-atulyadav
committed
Merge branch 'master' into dependabot/pip/Solutions/CiscoDuoSecurity/Data-Connectors/cryptography-46.0.6
2 parents bed1ca2 + fcd9ddf commit c89656c

36 files changed

Lines changed: 8619 additions & 297 deletions

‎.script/tests/detectionTemplateSchemaValidation/ValidConnectorIds.json‎

Lines changed: 297 additions & 296 deletions
Large diffs are not rendered by default.

‎Solutions/NetskopeWebTx/Analytic Rules/NetskopeWebtx_Rule1.yaml‎

Lines changed: 78 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,78 @@
1+
id: fa4c4f1c-3c5f-4c3a-a13f-924c30db56e9
2+
name: Netskope - Anomalous User Behavior (High Volume from Unmanaged Device)
3+
description: |
4+
Detects anomalous user behavior including high data volume transfers from unmanaged devices, unusual access patterns, and suspicious application usage.
5+
severity: Medium
6+
status: Available
7+
requiredDataConnectors:
8+
- connectorId: NetskopeWebTxConnector
9+
dataTypes:
10+
- NetskopeWebTransactions_CL
11+
queryFrequency: 1h
12+
queryPeriod: 1h
13+
triggerOperator: gt
14+
triggerThreshold: 0
15+
tactics:
16+
- Exfiltration
17+
- Collection
18+
relevantTechniques:
19+
- T1567
20+
- T1074
21+
query: |
22+
let highVolumeThresholdGB = 1;
23+
NetskopeWebTransactions_CL
24+
| where TimeGenerated > ago(1h)
25+
| where isnotempty(CsUsername)
26+
| summarize
27+
TotalBytes = sum(Bytes),
28+
UploadBytes = sum(CsBytes),
29+
DownloadBytes = sum(ScBytes),
30+
UniqueApps = dcount(XCsApp),
31+
Apps = make_set(XCsApp, 20),
32+
UniqueHosts = dcount(CsHost),
33+
Activities = make_set(XCsAppActivity),
34+
Countries = make_set(XCCountry),
35+
Devices = make_set(XCDevice),
36+
AccessMethods = make_set(XCsAccessMethod),
37+
EventCount = count()
38+
by CsUsername, XCDevice, XCsAccessMethod
39+
| extend
40+
TotalGB = round(TotalBytes / 1073741824.0, 3),
41+
UploadGB = round(UploadBytes / 1073741824.0, 3),
42+
DownloadGB = round(DownloadBytes / 1073741824.0, 3)
43+
| where TotalGB > highVolumeThresholdGB
44+
| extend IsUnmanagedDevice = XCDevice =~ 'unmanaged' or XCDevice =~ 'BYOD' or XCDevice =~ 'Personal' or XCDevice =~ 'Unknown' or XCsAccessMethod != 'Client'
45+
| where IsUnmanagedDevice or TotalGB > 5 or UniqueApps > 20
46+
| extend RiskIndicators = strcat_array(array_concat(
47+
iff(IsUnmanagedDevice, dynamic(['Unmanaged Device']), dynamic([])),
48+
iff(TotalGB > 5, dynamic(['High Data Volume']), dynamic([])),
49+
iff(UniqueApps > 20, dynamic(['Many Apps Accessed']), dynamic([])),
50+
iff(array_length(Countries) > 1, dynamic(['Multiple Countries']), dynamic([]))
51+
), ', ')
52+
| project
53+
TimeGenerated = now(),
54+
User = CsUsername,
55+
Device = XCDevice,
56+
AccessMethod = XCsAccessMethod,
57+
TotalDataGB = TotalGB,
58+
UploadGB,
59+
DownloadGB,
60+
UniqueApplications = UniqueApps,
61+
Applications = Apps,
62+
UniqueHosts,
63+
Activities,
64+
Countries,
65+
EventCount,
66+
IsUnmanagedDevice,
67+
RiskIndicators
68+
entityMappings:
69+
- entityType: Account
70+
fieldMappings:
71+
- identifier: Name
72+
columnName: User
73+
- entityType: Host
74+
fieldMappings:
75+
- identifier: HostName
76+
columnName: Device
77+
version: 1.0.0
78+
kind: Scheduled

‎Solutions/NetskopeWebTx/Analytic Rules/NetskopeWebtx_Rule10.yaml‎

Lines changed: 73 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,73 @@
1+
id: cdc01279-d6ea-41b1-a32d-49d726be95b8
2+
name: Netskope - Unsanctioned/Risky Cloud App Access (Shadow IT)
3+
description: |
4+
Alerts when users access unsanctioned or risky cloud applications based on Cloud Confidence Level (CCL) and app tags. Detects Shadow IT usage.
5+
severity: Medium
6+
status: Available
7+
requiredDataConnectors:
8+
- connectorId: NetskopeWebTxConnector
9+
dataTypes:
10+
- NetskopeWebTransactions_CL
11+
queryFrequency: 1h
12+
queryPeriod: 1h
13+
triggerOperator: gt
14+
triggerThreshold: 0
15+
tactics:
16+
- InitialAccess
17+
- Exfiltration
18+
relevantTechniques:
19+
- T1199
20+
- T1567
21+
query: |
22+
NetskopeWebTransactions_CL
23+
| where TimeGenerated > ago(1h)
24+
| where isnotempty(CsUsername) and isnotempty(XCsApp)
25+
| where XCsAppTags contains 'Unsanctioned'
26+
or XCsAppCcl =~ 'poor'
27+
or XCsAppCcl =~ 'low'
28+
or XCsAppCci < 50
29+
| summarize
30+
EventCount = count(),
31+
TotalBytesMB = round(sum(Bytes) / 1048576.0, 2),
32+
Activities = make_set(XCsAppActivity),
33+
FirstSeen = min(TimeGenerated),
34+
LastSeen = max(TimeGenerated)
35+
by
36+
CsUsername,
37+
XCsApp,
38+
XCsAppCategory,
39+
XCsAppCcl,
40+
XCsAppCci,
41+
XCsAppTags,
42+
XCCountry,
43+
XCDevice
44+
| extend RiskLevel = case(
45+
XCsAppCci < 30, 'Critical',
46+
XCsAppCci < 50, 'High',
47+
XCsAppCci < 70, 'Medium',
48+
'Low')
49+
| project
50+
TimeGenerated = LastSeen,
51+
User = CsUsername,
52+
RiskyApplication = XCsApp,
53+
AppCategory = XCsAppCategory,
54+
CloudConfidenceLevel = XCsAppCcl,
55+
CloudConfidenceIndex = XCsAppCci,
56+
AppTags = XCsAppTags,
57+
RiskLevel,
58+
Country = XCCountry,
59+
Device = XCDevice,
60+
Activities,
61+
EventCount,
62+
DataTransferMB = TotalBytesMB
63+
entityMappings:
64+
- entityType: Account
65+
fieldMappings:
66+
- identifier: Name
67+
columnName: User
68+
- entityType: CloudApplication
69+
fieldMappings:
70+
- identifier: Name
71+
columnName: RiskyApplication
72+
version: 1.0.0
73+
kind: Scheduled

‎Solutions/NetskopeWebTx/Analytic Rules/NetskopeWebtx_Rule2.yaml‎

Lines changed: 72 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,72 @@
1+
id: cf103180-cb81-4796-921d-3cc7eef4e817
2+
name: Netskope - Data Movement Tracking (Upload/Download Monitoring)
3+
description: |
4+
Tracks file uploads and downloads, monitoring data movement direction, size, and destination. Provides visibility into data flow patterns.
5+
severity: Informational
6+
status: Available
7+
requiredDataConnectors:
8+
- connectorId: NetskopeWebTxConnector
9+
dataTypes:
10+
- NetskopeWebTransactions_CL
11+
queryFrequency: 1h
12+
queryPeriod: 1h
13+
triggerOperator: gt
14+
triggerThreshold: 0
15+
tactics:
16+
- Exfiltration
17+
- Collection
18+
relevantTechniques:
19+
- T1567
20+
- T1074
21+
query: |
22+
let significantSizeMB = 50;
23+
NetskopeWebTransactions_CL
24+
| where TimeGenerated > ago(1h)
25+
| where isnotempty(CsUsername)
26+
| where CsBytes > 0 or ScBytes > 0 or XRsFileSize > 0
27+
| extend
28+
Direction = case(
29+
CsBytes > ScBytes, 'Upload',
30+
ScBytes > CsBytes, 'Download',
31+
'Unknown'),
32+
TransferSize = max_of(CsBytes, ScBytes, XRsFileSize)
33+
| summarize
34+
TotalUploadBytes = sumif(CsBytes, Direction == 'Upload'),
35+
TotalDownloadBytes = sumif(ScBytes, Direction == 'Download'),
36+
UploadCount = countif(Direction == 'Upload'),
37+
DownloadCount = countif(Direction == 'Download'),
38+
UniqueFiles = dcount(XCsAppObjectName),
39+
Files = make_set(XCsAppObjectName, 20),
40+
FileTypes = make_set(XRsFileType),
41+
Apps = make_set(XCsApp),
42+
Destinations = make_set(CsHost, 20)
43+
by CsUsername, XCDevice, XCCountry, bin(TimeGenerated, 1h)
44+
| extend
45+
TotalUploadMB = round(TotalUploadBytes / 1048576.0, 2),
46+
TotalDownloadMB = round(TotalDownloadBytes / 1048576.0, 2),
47+
TotalTransferMB = round((TotalUploadBytes + TotalDownloadBytes) / 1048576.0, 2)
48+
| where TotalTransferMB > significantSizeMB
49+
| extend DataFlowSummary = strcat('Upload: ', TotalUploadMB, ' MB (', UploadCount, ' ops), Download: ', TotalDownloadMB, ' MB (', DownloadCount, ' ops)')
50+
| project
51+
TimeGenerated,
52+
User = CsUsername,
53+
Device = XCDevice,
54+
Country = XCCountry,
55+
TotalUploadMB,
56+
TotalDownloadMB,
57+
TotalTransferMB,
58+
UploadOperations = UploadCount,
59+
DownloadOperations = DownloadCount,
60+
UniqueFiles,
61+
FilesSample = Files,
62+
FileTypes,
63+
Applications = Apps,
64+
Destinations,
65+
DataFlowSummary
66+
entityMappings:
67+
- entityType: Account
68+
fieldMappings:
69+
- identifier: Name
70+
columnName: User
71+
version: 1.0.0
72+
kind: Scheduled

‎Solutions/NetskopeWebTx/Analytic Rules/NetskopeWebtx_Rule3.yaml‎

Lines changed: 67 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,67 @@
1+
id: dd0ebd84-ffbe-45df-848b-0615ac446b04
2+
name: Netskope - Excessive Downloads Detection (Spike vs Baseline)
3+
description: |
4+
Detects users with excessive download activity compared to their 7-day baseline. Triggers when current download volume exceeds 3x the average.
5+
severity: Medium
6+
status: Available
7+
requiredDataConnectors:
8+
- connectorId: NetskopeWebTxConnector
9+
dataTypes:
10+
- NetskopeWebTransactions_CL
11+
queryFrequency: 1h
12+
queryPeriod: 7d
13+
triggerOperator: gt
14+
triggerThreshold: 0
15+
tactics:
16+
- Exfiltration
17+
- Collection
18+
relevantTechniques:
19+
- T1530
20+
- T1074
21+
query: |
22+
let lookbackPeriod = 7d;
23+
let currentPeriod = 1h;
24+
let threshold = 3;
25+
let baseline = NetskopeWebTransactions_CL
26+
| where TimeGenerated between (ago(lookbackPeriod) .. ago(currentPeriod))
27+
| where isnotempty(CsUsername)
28+
| where XCsAppActivity =~ 'Download' or ScBytes > 0
29+
| summarize
30+
BaselineAvgBytes = avg(ScBytes),
31+
BaselineTotalBytes = sum(ScBytes),
32+
BaselineCount = count()
33+
by CsUsername
34+
| extend BaselineDailyAvg = BaselineTotalBytes / 7;
35+
let current = NetskopeWebTransactions_CL
36+
| where TimeGenerated > ago(currentPeriod)
37+
| where isnotempty(CsUsername)
38+
| where XCsAppActivity =~ 'Download' or ScBytes > 0
39+
| summarize
40+
CurrentTotalBytes = sum(ScBytes),
41+
CurrentCount = count(),
42+
Apps = make_set(XCsApp),
43+
Files = make_set(XCsAppObjectName)
44+
by CsUsername;
45+
current
46+
| join kind=inner baseline on CsUsername
47+
| where CurrentTotalBytes > (BaselineDailyAvg * threshold)
48+
| extend
49+
SpikeMultiplier = round(CurrentTotalBytes / BaselineDailyAvg, 2),
50+
CurrentTotalMB = round(CurrentTotalBytes / 1048576.0, 2),
51+
BaselineDailyMB = round(BaselineDailyAvg / 1048576.0, 2)
52+
| project
53+
TimeGenerated = now(),
54+
User = CsUsername,
55+
CurrentDownloadMB = CurrentTotalMB,
56+
BaselineDailyAvgMB = BaselineDailyMB,
57+
SpikeMultiplier,
58+
DownloadCount = CurrentCount,
59+
ApplicationsUsed = Apps,
60+
FilesDownloaded = Files
61+
entityMappings:
62+
- entityType: Account
63+
fieldMappings:
64+
- identifier: Name
65+
columnName: User
66+
version: 1.0.0
67+
kind: Scheduled

‎Solutions/NetskopeWebTx/Analytic Rules/NetskopeWebtx_Rule4.yaml‎

Lines changed: 71 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,71 @@
1+
id: 272f9bca-5fd0-4413-b494-03b2d9f0bb9b
2+
name: Netskope - Heavy Personal Cloud Storage Usage (Shadow IT)
3+
description: |
4+
Detects heavy usage of personal cloud storage applications like personal Dropbox, Google Drive, OneDrive personal, etc. Indicates potential Shadow IT or data leakage risk.
5+
severity: Medium
6+
status: Available
7+
requiredDataConnectors:
8+
- connectorId: NetskopeWebTxConnector
9+
dataTypes:
10+
- NetskopeWebTransactions_CL
11+
queryFrequency: 1h
12+
queryPeriod: 1h
13+
triggerOperator: gt
14+
triggerThreshold: 0
15+
tactics:
16+
- Exfiltration
17+
- Collection
18+
relevantTechniques:
19+
- T1567
20+
- T1530
21+
query: |
22+
let heavyUsageThresholdMB = 500;
23+
NetskopeWebTransactions_CL
24+
| where TimeGenerated > ago(1h)
25+
| where isnotempty(CsUsername) and isnotempty(XCsApp)
26+
| where XCsApp has_any ('Dropbox', 'Google Drive', 'OneDrive', 'Box', 'iCloud', 'pCloud', 'MEGA', 'MediaFire', 'WeTransfer')
27+
| where XCsAppInstanceTag contains 'Personal'
28+
or XCsAppInstanceName contains 'Personal'
29+
or XCsAppTags contains 'Unsanctioned'
30+
or not(XCsAppTags contains 'Enterprise')
31+
| summarize
32+
TotalBytes = sum(Bytes),
33+
UploadBytes = sum(CsBytes),
34+
DownloadBytes = sum(ScBytes),
35+
FileCount = dcount(XCsAppObjectName),
36+
Files = make_set(XCsAppObjectName, 10),
37+
Activities = make_set(XCsAppActivity),
38+
EventCount = count()
39+
by CsUsername, XCsApp, XCsAppCategory, XCsAppInstanceName, XCsAppTags, XCDevice, XCCountry
40+
| extend
41+
TotalMB = round(TotalBytes / 1048576.0, 2),
42+
UploadMB = round(UploadBytes / 1048576.0, 2),
43+
DownloadMB = round(DownloadBytes / 1048576.0, 2)
44+
| where TotalMB > heavyUsageThresholdMB or FileCount > 50
45+
| project
46+
TimeGenerated = now(),
47+
User = CsUsername,
48+
CloudApplication = XCsApp,
49+
AppCategory = XCsAppCategory,
50+
AppInstance = XCsAppInstanceName,
51+
AppTags = XCsAppTags,
52+
TotalDataMB = TotalMB,
53+
UploadMB,
54+
DownloadMB,
55+
FileCount,
56+
Files,
57+
Activities,
58+
Device = XCDevice,
59+
Country = XCCountry,
60+
EventCount
61+
entityMappings:
62+
- entityType: Account
63+
fieldMappings:
64+
- identifier: Name
65+
columnName: User
66+
- entityType: CloudApplication
67+
fieldMappings:
68+
- identifier: Name
69+
columnName: CloudApplication
70+
version: 1.0.0
71+
kind: Scheduled

0 commit comments

Comments
 (0)