Netskope - High Severity Alert | Microsoft Sentinel Analytic Rules

Back


Id	a1f6c2d4-8b35-4e19-9c7a-2d4e6f8a1b30
Rulename	Netskope - High Severity Alert
Description	Detects Netskope alerts raised with a high or critical severity. High severity alerts typically indicate DLP violations, malware detections, compromised credentials, or significant policy breaches that warrant immediate investigation.
Severity	High
Tactics	InitialAccess Exfiltration
Techniques	T1078 T1567
Required data connectors	NetskopeAlertEventsConnector
Kind	Scheduled
Query frequency	1h
Query period	1h
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/NetskopeAlertEvents/Analytic%20Rules/NetskopeAlertEvents_Rule1.yaml
Version	1.0.0
Arm template	a1f6c2d4-8b35-4e19-9c7a-2d4e6f8a1b30.json

KQL

NetskopeAlertEvents_CL
| where TimeGenerated > ago(1h)
| where Alert =~ "yes"
| where Severity in~ ("high", "critical")
| extend NormalizedSeverity = tolower(Severity)
| summarize
    AlertCount = count(),
    Activities = make_set(Activity, 20),
    Applications = make_set(App, 20),
    Policies = make_set(Policy, 20),
    Actions = make_set(Action, 10),
    FirstSeen = min(TimeGenerated),
    LastSeen = max(TimeGenerated)
    by AlertName, AlertType, NormalizedSeverity, User, Userip, Hostname, SrcCountry
| order by AlertCount desc
| project
    LastSeen,
    AlertName,
    AlertType,
    Severity = NormalizedSeverity,
    User,
    Userip,
    Hostname,
    SrcCountry,
    AlertCount,
    Applications,
    Activities,
    Policies,
    Actions,
    FirstSeen

YAML

name: Netskope - High Severity Alert
triggerOperator: gt
query: |
  NetskopeAlertEvents_CL
  | where TimeGenerated > ago(1h)
  | where Alert =~ "yes"
  | where Severity in~ ("high", "critical")
  | extend NormalizedSeverity = tolower(Severity)
  | summarize
      AlertCount = count(),
      Activities = make_set(Activity, 20),
      Applications = make_set(App, 20),
      Policies = make_set(Policy, 20),
      Actions = make_set(Action, 10),
      FirstSeen = min(TimeGenerated),
      LastSeen = max(TimeGenerated)
      by AlertName, AlertType, NormalizedSeverity, User, Userip, Hostname, SrcCountry
  | order by AlertCount desc
  | project
      LastSeen,
      AlertName,
      AlertType,
      Severity = NormalizedSeverity,
      User,
      Userip,
      Hostname,
      SrcCountry,
      AlertCount,
      Applications,
      Activities,
      Policies,
      Actions,
      FirstSeen
queryFrequency: 1h
description: |
  Detects Netskope alerts raised with a high or critical severity. High severity alerts
  typically indicate DLP violations, malware detections, compromised credentials, or
  significant policy breaches that warrant immediate investigation.
id: a1f6c2d4-8b35-4e19-9c7a-2d4e6f8a1b30
triggerThreshold: 0
queryPeriod: 1h
version: 1.0.0
kind: Scheduled
status: Available
severity: High
requiredDataConnectors:
- connectorId: NetskopeAlertEventsConnector
  dataTypes:
  - NetskopeAlertEvents_CL
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/NetskopeAlertEvents/Analytic%20Rules/NetskopeAlertEvents_Rule1.yaml
relevantTechniques:
- T1078
- T1567
tactics:
- InitialAccess
- Exfiltration
entityMappings:
- fieldMappings:
  - identifier: Name
    columnName: User
  entityType: Account
- fieldMappings:
  - identifier: Address
    columnName: Userip
  entityType: IP
- fieldMappings:
  - identifier: HostName
    columnName: Hostname
  entityType: Host

ARM

{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "workspace": {
      "type": "String"
    }
  },
  "resources": [
    {
      "apiVersion": "2024-01-01-preview",
      "id": "[concat(resourceId('Microsoft.OperationalInsights/workspaces/providers', parameters('workspace'), 'Microsoft.SecurityInsights'),'/alertRules/a1f6c2d4-8b35-4e19-9c7a-2d4e6f8a1b30')]",
      "kind": "Scheduled",
      "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/a1f6c2d4-8b35-4e19-9c7a-2d4e6f8a1b30')]",
      "properties": {
        "alertRuleTemplateName": "a1f6c2d4-8b35-4e19-9c7a-2d4e6f8a1b30",
        "customDetails": null,
        "description": "Detects Netskope alerts raised with a high or critical severity. High severity alerts\ntypically indicate DLP violations, malware detections, compromised credentials, or\nsignificant policy breaches that warrant immediate investigation.\n",
        "displayName": "Netskope - High Severity Alert",
        "enabled": true,
        "entityMappings": [
          {
            "entityType": "Account",
            "fieldMappings": [
              {
                "columnName": "User",
                "identifier": "Name"
              }
            ]
          },
          {
            "entityType": "IP",
            "fieldMappings": [
              {
                "columnName": "Userip",
                "identifier": "Address"
              }
            ]
          },
          {
            "entityType": "Host",
            "fieldMappings": [
              {
                "columnName": "Hostname",
                "identifier": "HostName"
              }
            ]
          }
        ],
        "OriginalUri": "https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/NetskopeAlertEvents/Analytic%20Rules/NetskopeAlertEvents_Rule1.yaml",
        "query": "NetskopeAlertEvents_CL\n| where TimeGenerated > ago(1h)\n| where Alert =~ \"yes\"\n| where Severity in~ (\"high\", \"critical\")\n| extend NormalizedSeverity = tolower(Severity)\n| summarize\n    AlertCount = count(),\n    Activities = make_set(Activity, 20),\n    Applications = make_set(App, 20),\n    Policies = make_set(Policy, 20),\n    Actions = make_set(Action, 10),\n    FirstSeen = min(TimeGenerated),\n    LastSeen = max(TimeGenerated)\n    by AlertName, AlertType, NormalizedSeverity, User, Userip, Hostname, SrcCountry\n| order by AlertCount desc\n| project\n    LastSeen,\n    AlertName,\n    AlertType,\n    Severity = NormalizedSeverity,\n    User,\n    Userip,\n    Hostname,\n    SrcCountry,\n    AlertCount,\n    Applications,\n    Activities,\n    Policies,\n    Actions,\n    FirstSeen\n",
        "queryFrequency": "PT1H",
        "queryPeriod": "PT1H",
        "severity": "High",
        "status": "Available",
        "subTechniques": [],
        "suppressionDuration": "PT1H",
        "suppressionEnabled": false,
        "tactics": [
          "Exfiltration",
          "InitialAccess"
        ],
        "techniques": [
          "T1078",
          "T1567"
        ],
        "templateVersion": "1.0.0",
        "triggerOperator": "GreaterThan",
        "triggerThreshold": 0
      },
      "type": "Microsoft.OperationalInsights/workspaces/providers/alertRules"
    }
  ]
}