Zscaler - Unexpected event count of rejects by policy

Back


Id	593e3e2a-43ce-11ec-81d3-0242ac130003
Rulename	Zscaler - Unexpected event count of rejects by policy
Description	Detects unexpected event count of rejects by policy.
Severity	High
Tactics	InitialAccess
Techniques	T1078 T1133
Required data connectors	CustomLogsAma
Kind	Scheduled
Query frequency	1h
Query period	1h
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Zscaler Private Access (ZPA)/Analytic Rules/ZscalerUnexpectedCountEventResult.yaml
Version	1.0.2
Arm template	593e3e2a-43ce-11ec-81d3-0242ac130003.json

KQL

let threshold = 1000;
ZPAEvent
| where EventResult has "REJECTED_BY_POLICY"
| summarize rejected = count() by EventResult, DstUserName
| where rejected > threshold
| extend AccountCustomEntity = DstUserName

YAML

queryPeriod: 1h
query: |
  let threshold = 1000;
  ZPAEvent
  | where EventResult has "REJECTED_BY_POLICY"
  | summarize rejected = count() by EventResult, DstUserName
  | where rejected > threshold
  | extend AccountCustomEntity = DstUserName  
name: Zscaler - Unexpected event count of rejects by policy
entityMappings:
- fieldMappings:
  - columnName: AccountCustomEntity
    identifier: Name
  entityType: Account
queryFrequency: 1h
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Zscaler Private Access (ZPA)/Analytic Rules/ZscalerUnexpectedCountEventResult.yaml
requiredDataConnectors:
- connectorId: CustomLogsAma
  datatypes:
  - ZPA_CL
description: |
    'Detects unexpected event count of rejects by policy.'
kind: Scheduled
version: 1.0.2
status: Available
severity: High
relevantTechniques:
- T1078
- T1133
triggerOperator: gt
triggerThreshold: 0
tactics:
- InitialAccess
id: 593e3e2a-43ce-11ec-81d3-0242ac130003

ARM