Netskope - High Severity Alert | Microsoft Sentinel Analytic Rules

Back


Id	a1f6c2d4-8b35-4e19-9c7a-2d4e6f8a1b30
Rulename	Netskope - High Severity Alert
Description	Detects Netskope alerts raised with a high or critical severity. High severity alerts typically indicate DLP violations, malware detections, compromised credentials, or significant policy breaches that warrant immediate investigation.
Severity	High
Tactics	InitialAccess Exfiltration
Techniques	T1078 T1567
Required data connectors	NetskopeAlertEventsConnector
Kind	Scheduled
Query frequency	1h
Query period	1h
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/NetskopeAlertEvents/Analytic%20Rules/NetskopeAlertEvents_Rule1.yaml
Version	1.0.0
Arm template	a1f6c2d4-8b35-4e19-9c7a-2d4e6f8a1b30.json

KQL

NetskopeAlertEvents_CL
| where TimeGenerated > ago(1h)
| where Alert =~ "yes"
| where Severity in~ ("high", "critical")
| extend NormalizedSeverity = tolower(Severity)
| summarize
    AlertCount = count(),
    Activities = make_set(Activity, 20),
    Applications = make_set(App, 20),
    Policies = make_set(Policy, 20),
    Actions = make_set(Action, 10),
    FirstSeen = min(TimeGenerated),
    LastSeen = max(TimeGenerated)
    by AlertName, AlertType, NormalizedSeverity, User, Userip, Hostname, SrcCountry
| order by AlertCount desc
| project
    LastSeen,
    AlertName,
    AlertType,
    Severity = NormalizedSeverity,
    User,
    Userip,
    Hostname,
    SrcCountry,
    AlertCount,
    Applications,
    Activities,
    Policies,
    Actions,
    FirstSeen

YAML

queryFrequency: 1h
entityMappings:
- fieldMappings:
  - columnName: User
    identifier: Name
  entityType: Account
- fieldMappings:
  - columnName: Userip
    identifier: Address
  entityType: IP
- fieldMappings:
  - columnName: Hostname
    identifier: HostName
  entityType: Host
triggerThreshold: 0
triggerOperator: gt
severity: High
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/NetskopeAlertEvents/Analytic%20Rules/NetskopeAlertEvents_Rule1.yaml
query: |
  NetskopeAlertEvents_CL
  | where TimeGenerated > ago(1h)
  | where Alert =~ "yes"
  | where Severity in~ ("high", "critical")
  | extend NormalizedSeverity = tolower(Severity)
  | summarize
      AlertCount = count(),
      Activities = make_set(Activity, 20),
      Applications = make_set(App, 20),
      Policies = make_set(Policy, 20),
      Actions = make_set(Action, 10),
      FirstSeen = min(TimeGenerated),
      LastSeen = max(TimeGenerated)
      by AlertName, AlertType, NormalizedSeverity, User, Userip, Hostname, SrcCountry
  | order by AlertCount desc
  | project
      LastSeen,
      AlertName,
      AlertType,
      Severity = NormalizedSeverity,
      User,
      Userip,
      Hostname,
      SrcCountry,
      AlertCount,
      Applications,
      Activities,
      Policies,
      Actions,
      FirstSeen
tactics:
- InitialAccess
- Exfiltration
queryPeriod: 1h
relevantTechniques:
- T1078
- T1567
requiredDataConnectors:
- connectorId: NetskopeAlertEventsConnector
  dataTypes:
  - NetskopeAlertEvents_CL
id: a1f6c2d4-8b35-4e19-9c7a-2d4e6f8a1b30
kind: Scheduled
version: 1.0.0
description: |
  Detects Netskope alerts raised with a high or critical severity. High severity alerts
  typically indicate DLP violations, malware detections, compromised credentials, or
  significant policy breaches that warrant immediate investigation.
status: Available
name: Netskope - High Severity Alert

ARM

{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "workspace": {
      "type": "String"
    }
  },
  "resources": [
    {
      "apiVersion": "2024-01-01-preview",
      "id": "[concat(resourceId('Microsoft.OperationalInsights/workspaces/providers', parameters('workspace'), 'Microsoft.SecurityInsights'),'/alertRules/a1f6c2d4-8b35-4e19-9c7a-2d4e6f8a1b30')]",
      "kind": "Scheduled",
      "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/a1f6c2d4-8b35-4e19-9c7a-2d4e6f8a1b30')]",
      "properties": {
        "alertRuleTemplateName": "a1f6c2d4-8b35-4e19-9c7a-2d4e6f8a1b30",
        "customDetails": null,
        "description": "Detects Netskope alerts raised with a high or critical severity. High severity alerts\ntypically indicate DLP violations, malware detections, compromised credentials, or\nsignificant policy breaches that warrant immediate investigation.\n",
        "displayName": "Netskope - High Severity Alert",
        "enabled": true,
        "entityMappings": [
          {
            "entityType": "Account",
            "fieldMappings": [
              {
                "columnName": "User",
                "identifier": "Name"
              }
            ]
          },
          {
            "entityType": "IP",
            "fieldMappings": [
              {
                "columnName": "Userip",
                "identifier": "Address"
              }
            ]
          },
          {
            "entityType": "Host",
            "fieldMappings": [
              {
                "columnName": "Hostname",
                "identifier": "HostName"
              }
            ]
          }
        ],
        "OriginalUri": "https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/NetskopeAlertEvents/Analytic%20Rules/NetskopeAlertEvents_Rule1.yaml",
        "query": "NetskopeAlertEvents_CL\n| where TimeGenerated > ago(1h)\n| where Alert =~ \"yes\"\n| where Severity in~ (\"high\", \"critical\")\n| extend NormalizedSeverity = tolower(Severity)\n| summarize\n    AlertCount = count(),\n    Activities = make_set(Activity, 20),\n    Applications = make_set(App, 20),\n    Policies = make_set(Policy, 20),\n    Actions = make_set(Action, 10),\n    FirstSeen = min(TimeGenerated),\n    LastSeen = max(TimeGenerated)\n    by AlertName, AlertType, NormalizedSeverity, User, Userip, Hostname, SrcCountry\n| order by AlertCount desc\n| project\n    LastSeen,\n    AlertName,\n    AlertType,\n    Severity = NormalizedSeverity,\n    User,\n    Userip,\n    Hostname,\n    SrcCountry,\n    AlertCount,\n    Applications,\n    Activities,\n    Policies,\n    Actions,\n    FirstSeen\n",
        "queryFrequency": "PT1H",
        "queryPeriod": "PT1H",
        "severity": "High",
        "status": "Available",
        "subTechniques": [],
        "suppressionDuration": "PT1H",
        "suppressionEnabled": false,
        "tactics": [
          "Exfiltration",
          "InitialAccess"
        ],
        "techniques": [
          "T1078",
          "T1567"
        ],
        "templateVersion": "1.0.0",
        "triggerOperator": "GreaterThan",
        "triggerThreshold": 0
      },
      "type": "Microsoft.OperationalInsights/workspaces/providers/alertRules"
    }
  ]
}