Netskope - High Severity Alert | Microsoft Sentinel Analytic Rules

Back


Id	a1f6c2d4-8b35-4e19-9c7a-2d4e6f8a1b30
Rulename	Netskope - High Severity Alert
Description	Detects Netskope alerts raised with a high or critical severity. High severity alerts typically indicate DLP violations, malware detections, compromised credentials, or significant policy breaches that warrant immediate investigation.
Severity	High
Tactics	InitialAccess Exfiltration
Techniques	T1078 T1567
Required data connectors	NetskopeAlertEventsConnector
Kind	Scheduled
Query frequency	1h
Query period	1h
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/NetskopeAlertEvents/Analytic%20Rules/NetskopeAlertEvents_Rule1.yaml
Version	1.0.0
Arm template	a1f6c2d4-8b35-4e19-9c7a-2d4e6f8a1b30.json

KQL

NetskopeAlertEvents_CL
| where TimeGenerated > ago(1h)
| where Alert =~ "yes"
| where Severity in~ ("high", "critical")
| extend NormalizedSeverity = tolower(Severity)
| summarize
    AlertCount = count(),
    Activities = make_set(Activity, 20),
    Applications = make_set(App, 20),
    Policies = make_set(Policy, 20),
    Actions = make_set(Action, 10),
    FirstSeen = min(TimeGenerated),
    LastSeen = max(TimeGenerated)
    by AlertName, AlertType, NormalizedSeverity, User, Userip, Hostname, SrcCountry
| order by AlertCount desc
| project
    LastSeen,
    AlertName,
    AlertType,
    Severity = NormalizedSeverity,
    User,
    Userip,
    Hostname,
    SrcCountry,
    AlertCount,
    Applications,
    Activities,
    Policies,
    Actions,
    FirstSeen

YAML

entityMappings:
- entityType: Account
  fieldMappings:
  - identifier: Name
    columnName: User
- entityType: IP
  fieldMappings:
  - identifier: Address
    columnName: Userip
- entityType: Host
  fieldMappings:
  - identifier: HostName
    columnName: Hostname
name: Netskope - High Severity Alert
kind: Scheduled
triggerOperator: gt
status: Available
queryPeriod: 1h
requiredDataConnectors:
- connectorId: NetskopeAlertEventsConnector
  dataTypes:
  - NetskopeAlertEvents_CL
tactics:
- InitialAccess
- Exfiltration
query: |
  NetskopeAlertEvents_CL
  | where TimeGenerated > ago(1h)
  | where Alert =~ "yes"
  | where Severity in~ ("high", "critical")
  | extend NormalizedSeverity = tolower(Severity)
  | summarize
      AlertCount = count(),
      Activities = make_set(Activity, 20),
      Applications = make_set(App, 20),
      Policies = make_set(Policy, 20),
      Actions = make_set(Action, 10),
      FirstSeen = min(TimeGenerated),
      LastSeen = max(TimeGenerated)
      by AlertName, AlertType, NormalizedSeverity, User, Userip, Hostname, SrcCountry
  | order by AlertCount desc
  | project
      LastSeen,
      AlertName,
      AlertType,
      Severity = NormalizedSeverity,
      User,
      Userip,
      Hostname,
      SrcCountry,
      AlertCount,
      Applications,
      Activities,
      Policies,
      Actions,
      FirstSeen
description: |
  Detects Netskope alerts raised with a high or critical severity. High severity alerts
  typically indicate DLP violations, malware detections, compromised credentials, or
  significant policy breaches that warrant immediate investigation.
severity: High
id: a1f6c2d4-8b35-4e19-9c7a-2d4e6f8a1b30
triggerThreshold: 0
queryFrequency: 1h
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/NetskopeAlertEvents/Analytic%20Rules/NetskopeAlertEvents_Rule1.yaml
version: 1.0.0
relevantTechniques:
- T1078
- T1567

ARM

{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "workspace": {
      "type": "String"
    }
  },
  "resources": [
    {
      "apiVersion": "2024-01-01-preview",
      "id": "[concat(resourceId('Microsoft.OperationalInsights/workspaces/providers', parameters('workspace'), 'Microsoft.SecurityInsights'),'/alertRules/a1f6c2d4-8b35-4e19-9c7a-2d4e6f8a1b30')]",
      "kind": "Scheduled",
      "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/a1f6c2d4-8b35-4e19-9c7a-2d4e6f8a1b30')]",
      "properties": {
        "alertRuleTemplateName": "a1f6c2d4-8b35-4e19-9c7a-2d4e6f8a1b30",
        "customDetails": null,
        "description": "Detects Netskope alerts raised with a high or critical severity. High severity alerts\ntypically indicate DLP violations, malware detections, compromised credentials, or\nsignificant policy breaches that warrant immediate investigation.\n",
        "displayName": "Netskope - High Severity Alert",
        "enabled": true,
        "entityMappings": [
          {
            "entityType": "Account",
            "fieldMappings": [
              {
                "columnName": "User",
                "identifier": "Name"
              }
            ]
          },
          {
            "entityType": "IP",
            "fieldMappings": [
              {
                "columnName": "Userip",
                "identifier": "Address"
              }
            ]
          },
          {
            "entityType": "Host",
            "fieldMappings": [
              {
                "columnName": "Hostname",
                "identifier": "HostName"
              }
            ]
          }
        ],
        "OriginalUri": "https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/NetskopeAlertEvents/Analytic%20Rules/NetskopeAlertEvents_Rule1.yaml",
        "query": "NetskopeAlertEvents_CL\n| where TimeGenerated > ago(1h)\n| where Alert =~ \"yes\"\n| where Severity in~ (\"high\", \"critical\")\n| extend NormalizedSeverity = tolower(Severity)\n| summarize\n    AlertCount = count(),\n    Activities = make_set(Activity, 20),\n    Applications = make_set(App, 20),\n    Policies = make_set(Policy, 20),\n    Actions = make_set(Action, 10),\n    FirstSeen = min(TimeGenerated),\n    LastSeen = max(TimeGenerated)\n    by AlertName, AlertType, NormalizedSeverity, User, Userip, Hostname, SrcCountry\n| order by AlertCount desc\n| project\n    LastSeen,\n    AlertName,\n    AlertType,\n    Severity = NormalizedSeverity,\n    User,\n    Userip,\n    Hostname,\n    SrcCountry,\n    AlertCount,\n    Applications,\n    Activities,\n    Policies,\n    Actions,\n    FirstSeen\n",
        "queryFrequency": "PT1H",
        "queryPeriod": "PT1H",
        "severity": "High",
        "status": "Available",
        "subTechniques": [],
        "suppressionDuration": "PT1H",
        "suppressionEnabled": false,
        "tactics": [
          "Exfiltration",
          "InitialAccess"
        ],
        "techniques": [
          "T1078",
          "T1567"
        ],
        "templateVersion": "1.0.0",
        "triggerOperator": "GreaterThan",
        "triggerThreshold": 0
      },
      "type": "Microsoft.OperationalInsights/workspaces/providers/alertRules"
    }
  ]
}