Netskope - New Risky App Access vs 7-Day Baseline | Microsoft Sentinel Analytic Rules

Back


Id	ba66b81c-2cf7-4c53-9db0-e8b6f537704a
Rulename	Netskope - New Risky App Access vs 7-Day Baseline
Description	Compares today’s accessed applications against a 7-day baseline and triggers alerts when users access new risky applications not seen before.
Severity	Medium
Tactics	InitialAccess Discovery
Techniques	T1199 T1526
Required data connectors	NetskopeWebTxConnector
Kind	Scheduled
Query frequency	1d
Query period	8d
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/NetskopeWebTx/Analytic%20Rules/NetskopeWebtx_Rule7.yaml
Version	1.0.0
Arm template	ba66b81c-2cf7-4c53-9db0-e8b6f537704a.json

KQL

let lookbackPeriod = 7d;
let currentPeriod = 1d;
let baseline = NetskopeWebTransactions_CL
    | where TimeGenerated between (ago(lookbackPeriod) .. ago(currentPeriod))
    | where isnotempty(CsUsername) and isnotempty(XCsApp)
    | summarize BaselineApps = make_set(XCsApp) by CsUsername;
let current = NetskopeWebTransactions_CL
    | where TimeGenerated > ago(currentPeriod)
    | where isnotempty(CsUsername) and isnotempty(XCsApp)
    | where XCsAppCcl =~ 'poor' or XCsAppCcl =~ 'low' or XCsAppCcl =~ 'medium' or XCsAppCci < 70
    | summarize 
        CurrentApps = make_set(XCsApp),
        arg_max(TimeGenerated, XCsAppCcl, XCsAppCci, XCsAppCategory)
        by CsUsername, XCsApp;
current
| join kind=leftouter baseline on CsUsername
| extend BaselineApps = coalesce(BaselineApps, dynamic([]))
| where not(set_has_element(BaselineApps, XCsApp))
| where isnotempty(XCsApp)
| where XCsAppCci < 70 or XCsAppCcl =~ 'poor' or XCsAppCcl =~ 'low'
| project 
    TimeGenerated,
    User = CsUsername,
    NewRiskyApp = XCsApp,
    AppCCL = XCsAppCcl,
    AppCCI = XCsAppCci,
    AppCategory = XCsAppCategory,
    BaselineAppCount = array_length(BaselineApps)

YAML

entityMappings:
- entityType: Account
  fieldMappings:
  - identifier: Name
    columnName: User
- entityType: CloudApplication
  fieldMappings:
  - identifier: Name
    columnName: NewRiskyApp
name: Netskope - New Risky App Access vs 7-Day Baseline
kind: Scheduled
triggerOperator: gt
status: Available
queryPeriod: 8d
requiredDataConnectors:
- connectorId: NetskopeWebTxConnector
  dataTypes:
  - NetskopeWebTransactions_CL
tactics:
- InitialAccess
- Discovery
query: |
  let lookbackPeriod = 7d;
  let currentPeriod = 1d;
  let baseline = NetskopeWebTransactions_CL
      | where TimeGenerated between (ago(lookbackPeriod) .. ago(currentPeriod))
      | where isnotempty(CsUsername) and isnotempty(XCsApp)
      | summarize BaselineApps = make_set(XCsApp) by CsUsername;
  let current = NetskopeWebTransactions_CL
      | where TimeGenerated > ago(currentPeriod)
      | where isnotempty(CsUsername) and isnotempty(XCsApp)
      | where XCsAppCcl =~ 'poor' or XCsAppCcl =~ 'low' or XCsAppCcl =~ 'medium' or XCsAppCci < 70
      | summarize 
          CurrentApps = make_set(XCsApp),
          arg_max(TimeGenerated, XCsAppCcl, XCsAppCci, XCsAppCategory)
          by CsUsername, XCsApp;
  current
  | join kind=leftouter baseline on CsUsername
  | extend BaselineApps = coalesce(BaselineApps, dynamic([]))
  | where not(set_has_element(BaselineApps, XCsApp))
  | where isnotempty(XCsApp)
  | where XCsAppCci < 70 or XCsAppCcl =~ 'poor' or XCsAppCcl =~ 'low'
  | project 
      TimeGenerated,
      User = CsUsername,
      NewRiskyApp = XCsApp,
      AppCCL = XCsAppCcl,
      AppCCI = XCsAppCci,
      AppCategory = XCsAppCategory,
      BaselineAppCount = array_length(BaselineApps)
description: |
  Compares today's accessed applications against a 7-day baseline and triggers alerts when users access new risky applications not seen before.
severity: Medium
id: ba66b81c-2cf7-4c53-9db0-e8b6f537704a
triggerThreshold: 0
queryFrequency: 1d
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/NetskopeWebTx/Analytic%20Rules/NetskopeWebtx_Rule7.yaml
version: 1.0.0
relevantTechniques:
- T1199
- T1526

ARM

{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "workspace": {
      "type": "String"
    }
  },
  "resources": [
    {
      "apiVersion": "2024-01-01-preview",
      "id": "[concat(resourceId('Microsoft.OperationalInsights/workspaces/providers', parameters('workspace'), 'Microsoft.SecurityInsights'),'/alertRules/ba66b81c-2cf7-4c53-9db0-e8b6f537704a')]",
      "kind": "Scheduled",
      "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/ba66b81c-2cf7-4c53-9db0-e8b6f537704a')]",
      "properties": {
        "alertRuleTemplateName": "ba66b81c-2cf7-4c53-9db0-e8b6f537704a",
        "customDetails": null,
        "description": "Compares today's accessed applications against a 7-day baseline and triggers alerts when users access new risky applications not seen before.\n",
        "displayName": "Netskope - New Risky App Access vs 7-Day Baseline",
        "enabled": true,
        "entityMappings": [
          {
            "entityType": "Account",
            "fieldMappings": [
              {
                "columnName": "User",
                "identifier": "Name"
              }
            ]
          },
          {
            "entityType": "CloudApplication",
            "fieldMappings": [
              {
                "columnName": "NewRiskyApp",
                "identifier": "Name"
              }
            ]
          }
        ],
        "OriginalUri": "https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/NetskopeWebTx/Analytic%20Rules/NetskopeWebtx_Rule7.yaml",
        "query": "let lookbackPeriod = 7d;\nlet currentPeriod = 1d;\nlet baseline = NetskopeWebTransactions_CL\n    | where TimeGenerated between (ago(lookbackPeriod) .. ago(currentPeriod))\n    | where isnotempty(CsUsername) and isnotempty(XCsApp)\n    | summarize BaselineApps = make_set(XCsApp) by CsUsername;\nlet current = NetskopeWebTransactions_CL\n    | where TimeGenerated > ago(currentPeriod)\n    | where isnotempty(CsUsername) and isnotempty(XCsApp)\n    | where XCsAppCcl =~ 'poor' or XCsAppCcl =~ 'low' or XCsAppCcl =~ 'medium' or XCsAppCci < 70\n    | summarize \n        CurrentApps = make_set(XCsApp),\n        arg_max(TimeGenerated, XCsAppCcl, XCsAppCci, XCsAppCategory)\n        by CsUsername, XCsApp;\ncurrent\n| join kind=leftouter baseline on CsUsername\n| extend BaselineApps = coalesce(BaselineApps, dynamic([]))\n| where not(set_has_element(BaselineApps, XCsApp))\n| where isnotempty(XCsApp)\n| where XCsAppCci < 70 or XCsAppCcl =~ 'poor' or XCsAppCcl =~ 'low'\n| project \n    TimeGenerated,\n    User = CsUsername,\n    NewRiskyApp = XCsApp,\n    AppCCL = XCsAppCcl,\n    AppCCI = XCsAppCci,\n    AppCategory = XCsAppCategory,\n    BaselineAppCount = array_length(BaselineApps)\n",
        "queryFrequency": "P1D",
        "queryPeriod": "P8D",
        "severity": "Medium",
        "status": "Available",
        "subTechniques": [],
        "suppressionDuration": "PT1H",
        "suppressionEnabled": false,
        "tactics": [
          "Discovery",
          "InitialAccess"
        ],
        "techniques": [
          "T1199",
          "T1526"
        ],
        "templateVersion": "1.0.0",
        "triggerOperator": "GreaterThan",
        "triggerThreshold": 0
      },
      "type": "Microsoft.OperationalInsights/workspaces/providers/alertRules"
    }
  ]
}