Zscaler - Forbidden countries

Back


Id	b3d112b4-3e1e-11ec-9bbc-0242ac130002
Rulename	Zscaler - Forbidden countries
Description	Detects suspicious ZPA connections from forbidden countries.
Severity	High
Tactics	InitialAccess
Techniques	T1190 T1133
Required data connectors	CustomLogsAma
Kind	Scheduled
Query frequency	1h
Query period	1h
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Zscaler Private Access (ZPA)/Analytic Rules/ZscalerUnexpectedCountries.yaml
Version	1.0.2
Arm template	b3d112b4-3e1e-11ec-9bbc-0242ac130002.json

KQL

let bl_countries = dynamic(['CH', 'RU']);       //List of countries from which you do not expect connections
ZPAEvent 
| where DvcAction == 'open'
| where SrcGeoCountry in~ (bl_countries)
| extend IPCustomEntity = SrcIpAddr, AccountCustomEntity = DstUserName

YAML

queryPeriod: 1h
query: |
  let bl_countries = dynamic(['CH', 'RU']);       //List of countries from which you do not expect connections
  ZPAEvent 
  | where DvcAction == 'open'
  | where SrcGeoCountry in~ (bl_countries)
  | extend IPCustomEntity = SrcIpAddr, AccountCustomEntity = DstUserName  
name: Zscaler - Forbidden countries
entityMappings:
- fieldMappings:
  - columnName: AccountCustomEntity
    identifier: Name
  entityType: Account
- fieldMappings:
  - columnName: IPCustomEntity
    identifier: Address
  entityType: IP
queryFrequency: 1h
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Zscaler Private Access (ZPA)/Analytic Rules/ZscalerUnexpectedCountries.yaml
requiredDataConnectors:
- connectorId: CustomLogsAma
  datatypes:
  - ZPA_CL
description: |
    'Detects suspicious ZPA connections from forbidden countries.'
kind: Scheduled
version: 1.0.2
status: Available
severity: High
relevantTechniques:
- T1190
- T1133
triggerOperator: gt
triggerThreshold: 0
tactics:
- InitialAccess
id: b3d112b4-3e1e-11ec-9bbc-0242ac130002

ARM