Netskope - Heavy Personal Cloud Storage Usage Shadow IT

let heavyUsageThresholdMB = 500;
NetskopeWebTransactions_CL
| where TimeGenerated > ago(1h)
| where isnotempty(CsUsername) and isnotempty(XCsApp)
| where XCsApp has_any ('Dropbox', 'Google Drive', 'OneDrive', 'Box', 'iCloud', 'pCloud', 'MEGA', 'MediaFire', 'WeTransfer')
| where XCsAppInstanceTag contains 'Personal' 
    or XCsAppInstanceName contains 'Personal'
    or XCsAppTags contains 'Unsanctioned'
    or not(XCsAppTags contains 'Enterprise')
| summarize 
    TotalBytes = sum(Bytes),
    UploadBytes = sum(CsBytes),
    DownloadBytes = sum(ScBytes),
    FileCount = dcount(XCsAppObjectName),
    Files = make_set(XCsAppObjectName, 10),
    Activities = make_set(XCsAppActivity),
    EventCount = count()
    by CsUsername, XCsApp, XCsAppCategory, XCsAppInstanceName, XCsAppTags, XCDevice, XCCountry
| extend 
    TotalMB = round(TotalBytes / 1048576.0, 2),
    UploadMB = round(UploadBytes / 1048576.0, 2),
    DownloadMB = round(DownloadBytes / 1048576.0, 2)
| where TotalMB > heavyUsageThresholdMB or FileCount > 50
| project 
    TimeGenerated = now(),
    User = CsUsername,
    CloudApplication = XCsApp,
    AppCategory = XCsAppCategory,
    AppInstance = XCsAppInstanceName,
    AppTags = XCsAppTags,
    TotalDataMB = TotalMB,
    UploadMB,
    DownloadMB,
    FileCount,
    Files,
    Activities,
    Device = XCDevice,
    Country = XCCountry,
    EventCount

name: Netskope - Heavy Personal Cloud Storage Usage (Shadow IT)
triggerOperator: gt
query: |
  let heavyUsageThresholdMB = 500;
  NetskopeWebTransactions_CL
  | where TimeGenerated > ago(1h)
  | where isnotempty(CsUsername) and isnotempty(XCsApp)
  | where XCsApp has_any ('Dropbox', 'Google Drive', 'OneDrive', 'Box', 'iCloud', 'pCloud', 'MEGA', 'MediaFire', 'WeTransfer')
  | where XCsAppInstanceTag contains 'Personal' 
      or XCsAppInstanceName contains 'Personal'
      or XCsAppTags contains 'Unsanctioned'
      or not(XCsAppTags contains 'Enterprise')
  | summarize 
      TotalBytes = sum(Bytes),
      UploadBytes = sum(CsBytes),
      DownloadBytes = sum(ScBytes),
      FileCount = dcount(XCsAppObjectName),
      Files = make_set(XCsAppObjectName, 10),
      Activities = make_set(XCsAppActivity),
      EventCount = count()
      by CsUsername, XCsApp, XCsAppCategory, XCsAppInstanceName, XCsAppTags, XCDevice, XCCountry
  | extend 
      TotalMB = round(TotalBytes / 1048576.0, 2),
      UploadMB = round(UploadBytes / 1048576.0, 2),
      DownloadMB = round(DownloadBytes / 1048576.0, 2)
  | where TotalMB > heavyUsageThresholdMB or FileCount > 50
  | project 
      TimeGenerated = now(),
      User = CsUsername,
      CloudApplication = XCsApp,
      AppCategory = XCsAppCategory,
      AppInstance = XCsAppInstanceName,
      AppTags = XCsAppTags,
      TotalDataMB = TotalMB,
      UploadMB,
      DownloadMB,
      FileCount,
      Files,
      Activities,
      Device = XCDevice,
      Country = XCCountry,
      EventCount
queryFrequency: 1h
description: |
  Detects heavy usage of personal cloud storage applications like personal Dropbox, Google Drive, OneDrive personal, etc. Indicates potential Shadow IT or data leakage risk.
id: 272f9bca-5fd0-4413-b494-03b2d9f0bb9b
triggerThreshold: 0
queryPeriod: 1h
version: 1.0.0
kind: Scheduled
status: Available
severity: Medium
requiredDataConnectors:
- connectorId: NetskopeWebTxConnector
  dataTypes:
  - NetskopeWebTransactions_CL
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/NetskopeWebTx/Analytic%20Rules/NetskopeWebtx_Rule4.yaml
relevantTechniques:
- T1567
- T1530
tactics:
- Exfiltration
- Collection
entityMappings:
- fieldMappings:
  - identifier: Name
    columnName: User
  entityType: Account
- fieldMappings:
  - identifier: Name
    columnName: CloudApplication
  entityType: CloudApplication

{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "workspace": {
      "type": "String"
    }
  },
  "resources": [
    {
      "apiVersion": "2024-01-01-preview",
      "id": "[concat(resourceId('Microsoft.OperationalInsights/workspaces/providers', parameters('workspace'), 'Microsoft.SecurityInsights'),'/alertRules/272f9bca-5fd0-4413-b494-03b2d9f0bb9b')]",
      "kind": "Scheduled",
      "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/272f9bca-5fd0-4413-b494-03b2d9f0bb9b')]",
      "properties": {
        "alertRuleTemplateName": "272f9bca-5fd0-4413-b494-03b2d9f0bb9b",
        "customDetails": null,
        "description": "Detects heavy usage of personal cloud storage applications like personal Dropbox, Google Drive, OneDrive personal, etc. Indicates potential Shadow IT or data leakage risk.\n",
        "displayName": "Netskope - Heavy Personal Cloud Storage Usage (Shadow IT)",
        "enabled": true,
        "entityMappings": [
          {
            "entityType": "Account",
            "fieldMappings": [
              {
                "columnName": "User",
                "identifier": "Name"
              }
            ]
          },
          {
            "entityType": "CloudApplication",
            "fieldMappings": [
              {
                "columnName": "CloudApplication",
                "identifier": "Name"
              }
            ]
          }
        ],
        "OriginalUri": "https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/NetskopeWebTx/Analytic%20Rules/NetskopeWebtx_Rule4.yaml",
        "query": "let heavyUsageThresholdMB = 500;\nNetskopeWebTransactions_CL\n| where TimeGenerated > ago(1h)\n| where isnotempty(CsUsername) and isnotempty(XCsApp)\n| where XCsApp has_any ('Dropbox', 'Google Drive', 'OneDrive', 'Box', 'iCloud', 'pCloud', 'MEGA', 'MediaFire', 'WeTransfer')\n| where XCsAppInstanceTag contains 'Personal' \n    or XCsAppInstanceName contains 'Personal'\n    or XCsAppTags contains 'Unsanctioned'\n    or not(XCsAppTags contains 'Enterprise')\n| summarize \n    TotalBytes = sum(Bytes),\n    UploadBytes = sum(CsBytes),\n    DownloadBytes = sum(ScBytes),\n    FileCount = dcount(XCsAppObjectName),\n    Files = make_set(XCsAppObjectName, 10),\n    Activities = make_set(XCsAppActivity),\n    EventCount = count()\n    by CsUsername, XCsApp, XCsAppCategory, XCsAppInstanceName, XCsAppTags, XCDevice, XCCountry\n| extend \n    TotalMB = round(TotalBytes / 1048576.0, 2),\n    UploadMB = round(UploadBytes / 1048576.0, 2),\n    DownloadMB = round(DownloadBytes / 1048576.0, 2)\n| where TotalMB > heavyUsageThresholdMB or FileCount > 50\n| project \n    TimeGenerated = now(),\n    User = CsUsername,\n    CloudApplication = XCsApp,\n    AppCategory = XCsAppCategory,\n    AppInstance = XCsAppInstanceName,\n    AppTags = XCsAppTags,\n    TotalDataMB = TotalMB,\n    UploadMB,\n    DownloadMB,\n    FileCount,\n    Files,\n    Activities,\n    Device = XCDevice,\n    Country = XCCountry,\n    EventCount\n",
        "queryFrequency": "PT1H",
        "queryPeriod": "PT1H",
        "severity": "Medium",
        "status": "Available",
        "subTechniques": [],
        "suppressionDuration": "PT1H",
        "suppressionEnabled": false,
        "tactics": [
          "Collection",
          "Exfiltration"
        ],
        "techniques": [
          "T1530",
          "T1567"
        ],
        "templateVersion": "1.0.0",
        "triggerOperator": "GreaterThan",
        "triggerThreshold": 0
      },
      "type": "Microsoft.OperationalInsights/workspaces/providers/alertRules"
    }
  ]
}