Netskope - High Severity DLP Alert

NetskopeAlerts_CL
| where TimeGenerated > ago(1h)
| where alert_type =~ "dlp"
| where severity has_any ("high", "critical")
| summarize
    AlertCount = count(),
    DlpRules = make_set(dlp_rule, 20),
    DlpProfiles = make_set(dlp_profile, 20),
    Apps = make_set(app, 20),
    FilePaths = make_set(file_path, 20),
    FirstSeen = min(TimeGenerated),
    LastSeen = max(TimeGenerated)
    by User = user, UserIp = userip, HostName = hostname, AlertName = alert_name, Severity = severity
| order by AlertCount desc
| project
    LastSeen,
    AlertName,
    Severity,
    User,
    UserIp,
    HostName,
    AlertCount,
    Apps,
    DlpRules,
    DlpProfiles,
    FilePaths,
    FirstSeen

queryFrequency: 1h
entityMappings:
- fieldMappings:
  - columnName: User
    identifier: Name
  entityType: Account
- fieldMappings:
  - columnName: UserIp
    identifier: Address
  entityType: IP
- fieldMappings:
  - columnName: HostName
    identifier: HostName
  entityType: Host
triggerThreshold: 0
triggerOperator: gt
severity: High
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Netskopev2/Analytic%20Rules/NetskopeAlertsEvents_HighSeverityDLPAlert.yaml
query: |
  NetskopeAlerts_CL
  | where TimeGenerated > ago(1h)
  | where alert_type =~ "dlp"
  | where severity has_any ("high", "critical")
  | summarize
      AlertCount = count(),
      DlpRules = make_set(dlp_rule, 20),
      DlpProfiles = make_set(dlp_profile, 20),
      Apps = make_set(app, 20),
      FilePaths = make_set(file_path, 20),
      FirstSeen = min(TimeGenerated),
      LastSeen = max(TimeGenerated)
      by User = user, UserIp = userip, HostName = hostname, AlertName = alert_name, Severity = severity
  | order by AlertCount desc
  | project
      LastSeen,
      AlertName,
      Severity,
      User,
      UserIp,
      HostName,
      AlertCount,
      Apps,
      DlpRules,
      DlpProfiles,
      FilePaths,
      FirstSeen
tactics:
- Exfiltration
- Collection
queryPeriod: 1h
relevantTechniques:
- T1567
- T1005
requiredDataConnectors:
- connectorId: NetskopeAlertsEvents
  dataTypes:
  - NetskopeAlerts_CL
id: 04e36dfa-05b3-45bd-b39f-28b6fac71337
kind: Scheduled
version: 1.0.0
description: |
  Detects Netskope DLP (Data Loss Prevention) alerts raised with high or critical severity.
  These alerts indicate sensitive data (e.g. PII, source code, financial records) matched a
  DLP policy during upload, download, or sharing and may represent data exfiltration.
status: Available
name: Netskope - High Severity DLP Alert

{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "workspace": {
      "type": "String"
    }
  },
  "resources": [
    {
      "apiVersion": "2024-01-01-preview",
      "id": "[concat(resourceId('Microsoft.OperationalInsights/workspaces/providers', parameters('workspace'), 'Microsoft.SecurityInsights'),'/alertRules/04e36dfa-05b3-45bd-b39f-28b6fac71337')]",
      "kind": "Scheduled",
      "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/04e36dfa-05b3-45bd-b39f-28b6fac71337')]",
      "properties": {
        "alertRuleTemplateName": "04e36dfa-05b3-45bd-b39f-28b6fac71337",
        "customDetails": null,
        "description": "Detects Netskope DLP (Data Loss Prevention) alerts raised with high or critical severity.\nThese alerts indicate sensitive data (e.g. PII, source code, financial records) matched a\nDLP policy during upload, download, or sharing and may represent data exfiltration.\n",
        "displayName": "Netskope - High Severity DLP Alert",
        "enabled": true,
        "entityMappings": [
          {
            "entityType": "Account",
            "fieldMappings": [
              {
                "columnName": "User",
                "identifier": "Name"
              }
            ]
          },
          {
            "entityType": "IP",
            "fieldMappings": [
              {
                "columnName": "UserIp",
                "identifier": "Address"
              }
            ]
          },
          {
            "entityType": "Host",
            "fieldMappings": [
              {
                "columnName": "HostName",
                "identifier": "HostName"
              }
            ]
          }
        ],
        "OriginalUri": "https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Netskopev2/Analytic%20Rules/NetskopeAlertsEvents_HighSeverityDLPAlert.yaml",
        "query": "NetskopeAlerts_CL\n| where TimeGenerated > ago(1h)\n| where alert_type =~ \"dlp\"\n| where severity has_any (\"high\", \"critical\")\n| summarize\n    AlertCount = count(),\n    DlpRules = make_set(dlp_rule, 20),\n    DlpProfiles = make_set(dlp_profile, 20),\n    Apps = make_set(app, 20),\n    FilePaths = make_set(file_path, 20),\n    FirstSeen = min(TimeGenerated),\n    LastSeen = max(TimeGenerated)\n    by User = user, UserIp = userip, HostName = hostname, AlertName = alert_name, Severity = severity\n| order by AlertCount desc\n| project\n    LastSeen,\n    AlertName,\n    Severity,\n    User,\n    UserIp,\n    HostName,\n    AlertCount,\n    Apps,\n    DlpRules,\n    DlpProfiles,\n    FilePaths,\n    FirstSeen\n",
        "queryFrequency": "PT1H",
        "queryPeriod": "PT1H",
        "severity": "High",
        "status": "Available",
        "subTechniques": [],
        "suppressionDuration": "PT1H",
        "suppressionEnabled": false,
        "tactics": [
          "Collection",
          "Exfiltration"
        ],
        "techniques": [
          "T1005",
          "T1567"
        ],
        "templateVersion": "1.0.0",
        "triggerOperator": "GreaterThan",
        "triggerThreshold": 0
      },
      "type": "Microsoft.OperationalInsights/workspaces/providers/alertRules"
    }
  ]
}