Netskope - WebTransaction Error Detection

Back


Id	66c4cd4c-d391-47e8-b4e6-93e55d86ca9f
Rulename	Netskope - WebTransaction Error Detection
Description	Rule helps to track error occurred in Netskope WebTransaction Data Connector.
Severity	Medium
Tactics	Execution
Techniques	T1204
Required data connectors	NetskopeDataConnector
Kind	Scheduled
Query frequency	5m
Query period	5m
Trigger threshold	0
Trigger operator	GreaterThan
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Netskopev2/Analytic Rules/NetskopeWebTxErrors.yaml
Version	1.0.0
Arm template	66c4cd4c-d391-47e8-b4e6-93e55d86ca9f.json

KQL

NetskopeWebtxErrors_CL
|where error_s has_any ("Invalid Netskope Hostname", "Webtx Authentication", "Webtx Token Empty", "Webtx Exponential Backoff", "Webtx Idle Time")

YAML

queryPeriod: 5m
query: |
  NetskopeWebtxErrors_CL
  |where error_s has_any ("Invalid Netskope Hostname", "Webtx Authentication", "Webtx Token Empty", "Webtx Exponential Backoff", "Webtx Idle Time")  
name: Netskope - WebTransaction Error Detection
eventGroupingSettings:
  aggregationKind: AlertPerResult
queryFrequency: 5m
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Netskopev2/Analytic Rules/NetskopeWebTxErrors.yaml
alertDetailsOverride:
  alertDisplayNameFormat: Netskope Error at {{TimeGenerated}}
  alertDescriptionFormat: 'Error Message: {{error_s}}'
requiredDataConnectors:
- connectorId: NetskopeDataConnector
  dataTypes:
  - NetskopeWebtxErrors_CL
description: |
    'Rule helps to track error occurred in Netskope WebTransaction Data Connector.'
kind: Scheduled
incidentConfiguration:
  groupingConfiguration:
    lookbackDuration: 5m
    reopenClosedIncident: false
    matchingMethod: AnyAlert
    enabled: true
  createIncident: true
version: 1.0.0
status: Available
severity: Medium
relevantTechniques:
- T1204
triggerOperator: GreaterThan
triggerThreshold: 0
customDetails:
  Time: TimeGenerated
  ErrorMessage: error_s
tactics:
- Execution
id: 66c4cd4c-d391-47e8-b4e6-93e55d86ca9f

ARM