Netskope - Large Outbound Data Transfer Sensitive Upload DLP

Back


Id	71e6586e-0d3f-4e33-b390-faa50b5e08fa
Rulename	Netskope - Large Outbound Data Transfer / Sensitive Upload (DLP)
Description	Detects large outbound data transfers and sensitive file uploads. Monitors for potential data exfiltration via cloud applications.
Severity	High
Tactics	Exfiltration
Techniques	T1567 T1048
Required data connectors	NetskopeWebTxConnector
Kind	Scheduled
Query frequency	1h
Query period	1h
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/NetskopeWebTx/Analytic%20Rules/NetskopeWebtx_Rule6.yaml
Version	1.0.0
Arm template	71e6586e-0d3f-4e33-b390-faa50b5e08fa.json

KQL

let uploadThresholdMB = 100;
NetskopeWebTransactions_CL
| where TimeGenerated > ago(1h)
| where isnotempty(CsUsername)
| where XCsAppActivity =~ 'Upload' or XCsAppActivity =~ 'Post' or XCsAppActivity =~ 'Share' 
    or CsMethod =~ 'POST' or CsMethod =~ 'PUT'
| where CsBytes > 0 or XRsFileSize > 0
| extend UploadBytes = coalesce(CsBytes, XRsFileSize, 0)
| summarize 
    TotalUploadBytes = sum(UploadBytes),
    FileCount = dcount(XCsAppObjectName),
    Files = make_set(XCsAppObjectName, 10),
    FileTypes = make_set(XRsFileType),
    Apps = make_set(XCsApp),
    Destinations = make_set(XCsAppInstanceName),
    Countries = make_set(XSCountry)
    by CsUsername, XCDevice, XCCountry, bin(TimeGenerated, 1h)
| extend TotalUploadMB = round(TotalUploadBytes / 1048576.0, 2)
| where TotalUploadMB > uploadThresholdMB
| extend AlertSeverity = case(
    TotalUploadMB > 1000, 'Critical',
    TotalUploadMB > 500, 'High',
    TotalUploadMB > 100, 'Medium',
    'Low')
| project 
    TimeGenerated,
    User = CsUsername,
    UploadVolumeMB = TotalUploadMB,
    FileCount,
    Files,
    FileTypes,
    Applications = Apps,
    DestinationInstances = Destinations,
    SourceCountry = XCCountry,
    DestinationCountries = Countries,
    Device = XCDevice,
    AlertSeverity

YAML

name: Netskope - Large Outbound Data Transfer / Sensitive Upload (DLP)
triggerOperator: gt
query: |
  let uploadThresholdMB = 100;
  NetskopeWebTransactions_CL
  | where TimeGenerated > ago(1h)
  | where isnotempty(CsUsername)
  | where XCsAppActivity =~ 'Upload' or XCsAppActivity =~ 'Post' or XCsAppActivity =~ 'Share' 
      or CsMethod =~ 'POST' or CsMethod =~ 'PUT'
  | where CsBytes > 0 or XRsFileSize > 0
  | extend UploadBytes = coalesce(CsBytes, XRsFileSize, 0)
  | summarize 
      TotalUploadBytes = sum(UploadBytes),
      FileCount = dcount(XCsAppObjectName),
      Files = make_set(XCsAppObjectName, 10),
      FileTypes = make_set(XRsFileType),
      Apps = make_set(XCsApp),
      Destinations = make_set(XCsAppInstanceName),
      Countries = make_set(XSCountry)
      by CsUsername, XCDevice, XCCountry, bin(TimeGenerated, 1h)
  | extend TotalUploadMB = round(TotalUploadBytes / 1048576.0, 2)
  | where TotalUploadMB > uploadThresholdMB
  | extend AlertSeverity = case(
      TotalUploadMB > 1000, 'Critical',
      TotalUploadMB > 500, 'High',
      TotalUploadMB > 100, 'Medium',
      'Low')
  | project 
      TimeGenerated,
      User = CsUsername,
      UploadVolumeMB = TotalUploadMB,
      FileCount,
      Files,
      FileTypes,
      Applications = Apps,
      DestinationInstances = Destinations,
      SourceCountry = XCCountry,
      DestinationCountries = Countries,
      Device = XCDevice,
      AlertSeverity
queryFrequency: 1h
description: |
  Detects large outbound data transfers and sensitive file uploads. Monitors for potential data exfiltration via cloud applications.
id: 71e6586e-0d3f-4e33-b390-faa50b5e08fa
triggerThreshold: 0
queryPeriod: 1h
version: 1.0.0
kind: Scheduled
status: Available
severity: High
requiredDataConnectors:
- connectorId: NetskopeWebTxConnector
  dataTypes:
  - NetskopeWebTransactions_CL
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/NetskopeWebTx/Analytic%20Rules/NetskopeWebtx_Rule6.yaml
relevantTechniques:
- T1567
- T1048
tactics:
- Exfiltration
entityMappings:
- fieldMappings:
  - identifier: Name
    columnName: User
  entityType: Account

ARM

{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "workspace": {
      "type": "String"
    }
  },
  "resources": [
    {
      "apiVersion": "2024-01-01-preview",
      "id": "[concat(resourceId('Microsoft.OperationalInsights/workspaces/providers', parameters('workspace'), 'Microsoft.SecurityInsights'),'/alertRules/71e6586e-0d3f-4e33-b390-faa50b5e08fa')]",
      "kind": "Scheduled",
      "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/71e6586e-0d3f-4e33-b390-faa50b5e08fa')]",
      "properties": {
        "alertRuleTemplateName": "71e6586e-0d3f-4e33-b390-faa50b5e08fa",
        "customDetails": null,
        "description": "Detects large outbound data transfers and sensitive file uploads. Monitors for potential data exfiltration via cloud applications.\n",
        "displayName": "Netskope - Large Outbound Data Transfer / Sensitive Upload (DLP)",
        "enabled": true,
        "entityMappings": [
          {
            "entityType": "Account",
            "fieldMappings": [
              {
                "columnName": "User",
                "identifier": "Name"
              }
            ]
          }
        ],
        "OriginalUri": "https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/NetskopeWebTx/Analytic%20Rules/NetskopeWebtx_Rule6.yaml",
        "query": "let uploadThresholdMB = 100;\nNetskopeWebTransactions_CL\n| where TimeGenerated > ago(1h)\n| where isnotempty(CsUsername)\n| where XCsAppActivity =~ 'Upload' or XCsAppActivity =~ 'Post' or XCsAppActivity =~ 'Share' \n    or CsMethod =~ 'POST' or CsMethod =~ 'PUT'\n| where CsBytes > 0 or XRsFileSize > 0\n| extend UploadBytes = coalesce(CsBytes, XRsFileSize, 0)\n| summarize \n    TotalUploadBytes = sum(UploadBytes),\n    FileCount = dcount(XCsAppObjectName),\n    Files = make_set(XCsAppObjectName, 10),\n    FileTypes = make_set(XRsFileType),\n    Apps = make_set(XCsApp),\n    Destinations = make_set(XCsAppInstanceName),\n    Countries = make_set(XSCountry)\n    by CsUsername, XCDevice, XCCountry, bin(TimeGenerated, 1h)\n| extend TotalUploadMB = round(TotalUploadBytes / 1048576.0, 2)\n| where TotalUploadMB > uploadThresholdMB\n| extend AlertSeverity = case(\n    TotalUploadMB > 1000, 'Critical',\n    TotalUploadMB > 500, 'High',\n    TotalUploadMB > 100, 'Medium',\n    'Low')\n| project \n    TimeGenerated,\n    User = CsUsername,\n    UploadVolumeMB = TotalUploadMB,\n    FileCount,\n    Files,\n    FileTypes,\n    Applications = Apps,\n    DestinationInstances = Destinations,\n    SourceCountry = XCCountry,\n    DestinationCountries = Countries,\n    Device = XCDevice,\n    AlertSeverity\n",
        "queryFrequency": "PT1H",
        "queryPeriod": "PT1H",
        "severity": "High",
        "status": "Available",
        "subTechniques": [],
        "suppressionDuration": "PT1H",
        "suppressionEnabled": false,
        "tactics": [
          "Exfiltration"
        ],
        "techniques": [
          "T1048",
          "T1567"
        ],
        "templateVersion": "1.0.0",
        "triggerOperator": "GreaterThan",
        "triggerThreshold": 0
      },
      "type": "Microsoft.OperationalInsights/workspaces/providers/alertRules"
    }
  ]
}