Netskope - New Risky App Access vs 7-Day Baseline | Microsoft Sentinel Analytic Rules

Back


Id	ba66b81c-2cf7-4c53-9db0-e8b6f537704a
Rulename	Netskope - New Risky App Access vs 7-Day Baseline
Description	Compares today’s accessed applications against a 7-day baseline and triggers alerts when users access new risky applications not seen before.
Severity	Medium
Tactics	InitialAccess Discovery
Techniques	T1199 T1526
Required data connectors	NetskopeWebTxConnector
Kind	Scheduled
Query frequency	1d
Query period	8d
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/NetskopeWebTx/Analytic%20Rules/NetskopeWebtx_Rule7.yaml
Version	1.0.0
Arm template	ba66b81c-2cf7-4c53-9db0-e8b6f537704a.json

KQL

let lookbackPeriod = 7d;
let currentPeriod = 1d;
let baseline = NetskopeWebTransactions_CL
    | where TimeGenerated between (ago(lookbackPeriod) .. ago(currentPeriod))
    | where isnotempty(CsUsername) and isnotempty(XCsApp)
    | summarize BaselineApps = make_set(XCsApp) by CsUsername;
let current = NetskopeWebTransactions_CL
    | where TimeGenerated > ago(currentPeriod)
    | where isnotempty(CsUsername) and isnotempty(XCsApp)
    | where XCsAppCcl =~ 'poor' or XCsAppCcl =~ 'low' or XCsAppCcl =~ 'medium' or XCsAppCci < 70
    | summarize 
        CurrentApps = make_set(XCsApp),
        arg_max(TimeGenerated, XCsAppCcl, XCsAppCci, XCsAppCategory)
        by CsUsername, XCsApp;
current
| join kind=leftouter baseline on CsUsername
| extend BaselineApps = coalesce(BaselineApps, dynamic([]))
| where not(set_has_element(BaselineApps, XCsApp))
| where isnotempty(XCsApp)
| where XCsAppCci < 70 or XCsAppCcl =~ 'poor' or XCsAppCcl =~ 'low'
| project 
    TimeGenerated,
    User = CsUsername,
    NewRiskyApp = XCsApp,
    AppCCL = XCsAppCcl,
    AppCCI = XCsAppCci,
    AppCategory = XCsAppCategory,
    BaselineAppCount = array_length(BaselineApps)

YAML

triggerThreshold: 0
kind: Scheduled
description: |
  Compares today's accessed applications against a 7-day baseline and triggers alerts when users access new risky applications not seen before.
queryFrequency: 1d
triggerOperator: gt
relevantTechniques:
- T1199
- T1526
entityMappings:
- fieldMappings:
  - identifier: Name
    columnName: User
  entityType: Account
- fieldMappings:
  - identifier: Name
    columnName: NewRiskyApp
  entityType: CloudApplication
id: ba66b81c-2cf7-4c53-9db0-e8b6f537704a
query: |
  let lookbackPeriod = 7d;
  let currentPeriod = 1d;
  let baseline = NetskopeWebTransactions_CL
      | where TimeGenerated between (ago(lookbackPeriod) .. ago(currentPeriod))
      | where isnotempty(CsUsername) and isnotempty(XCsApp)
      | summarize BaselineApps = make_set(XCsApp) by CsUsername;
  let current = NetskopeWebTransactions_CL
      | where TimeGenerated > ago(currentPeriod)
      | where isnotempty(CsUsername) and isnotempty(XCsApp)
      | where XCsAppCcl =~ 'poor' or XCsAppCcl =~ 'low' or XCsAppCcl =~ 'medium' or XCsAppCci < 70
      | summarize 
          CurrentApps = make_set(XCsApp),
          arg_max(TimeGenerated, XCsAppCcl, XCsAppCci, XCsAppCategory)
          by CsUsername, XCsApp;
  current
  | join kind=leftouter baseline on CsUsername
  | extend BaselineApps = coalesce(BaselineApps, dynamic([]))
  | where not(set_has_element(BaselineApps, XCsApp))
  | where isnotempty(XCsApp)
  | where XCsAppCci < 70 or XCsAppCcl =~ 'poor' or XCsAppCcl =~ 'low'
  | project 
      TimeGenerated,
      User = CsUsername,
      NewRiskyApp = XCsApp,
      AppCCL = XCsAppCcl,
      AppCCI = XCsAppCci,
      AppCategory = XCsAppCategory,
      BaselineAppCount = array_length(BaselineApps)
version: 1.0.0
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/NetskopeWebTx/Analytic%20Rules/NetskopeWebtx_Rule7.yaml
requiredDataConnectors:
- dataTypes:
  - NetskopeWebTransactions_CL
  connectorId: NetskopeWebTxConnector
tactics:
- InitialAccess
- Discovery
queryPeriod: 8d
severity: Medium
status: Available
name: Netskope - New Risky App Access vs 7-Day Baseline

ARM

{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "workspace": {
      "type": "String"
    }
  },
  "resources": [
    {
      "apiVersion": "2024-01-01-preview",
      "id": "[concat(resourceId('Microsoft.OperationalInsights/workspaces/providers', parameters('workspace'), 'Microsoft.SecurityInsights'),'/alertRules/ba66b81c-2cf7-4c53-9db0-e8b6f537704a')]",
      "kind": "Scheduled",
      "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/ba66b81c-2cf7-4c53-9db0-e8b6f537704a')]",
      "properties": {
        "alertRuleTemplateName": "ba66b81c-2cf7-4c53-9db0-e8b6f537704a",
        "customDetails": null,
        "description": "Compares today's accessed applications against a 7-day baseline and triggers alerts when users access new risky applications not seen before.\n",
        "displayName": "Netskope - New Risky App Access vs 7-Day Baseline",
        "enabled": true,
        "entityMappings": [
          {
            "entityType": "Account",
            "fieldMappings": [
              {
                "columnName": "User",
                "identifier": "Name"
              }
            ]
          },
          {
            "entityType": "CloudApplication",
            "fieldMappings": [
              {
                "columnName": "NewRiskyApp",
                "identifier": "Name"
              }
            ]
          }
        ],
        "OriginalUri": "https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/NetskopeWebTx/Analytic%20Rules/NetskopeWebtx_Rule7.yaml",
        "query": "let lookbackPeriod = 7d;\nlet currentPeriod = 1d;\nlet baseline = NetskopeWebTransactions_CL\n    | where TimeGenerated between (ago(lookbackPeriod) .. ago(currentPeriod))\n    | where isnotempty(CsUsername) and isnotempty(XCsApp)\n    | summarize BaselineApps = make_set(XCsApp) by CsUsername;\nlet current = NetskopeWebTransactions_CL\n    | where TimeGenerated > ago(currentPeriod)\n    | where isnotempty(CsUsername) and isnotempty(XCsApp)\n    | where XCsAppCcl =~ 'poor' or XCsAppCcl =~ 'low' or XCsAppCcl =~ 'medium' or XCsAppCci < 70\n    | summarize \n        CurrentApps = make_set(XCsApp),\n        arg_max(TimeGenerated, XCsAppCcl, XCsAppCci, XCsAppCategory)\n        by CsUsername, XCsApp;\ncurrent\n| join kind=leftouter baseline on CsUsername\n| extend BaselineApps = coalesce(BaselineApps, dynamic([]))\n| where not(set_has_element(BaselineApps, XCsApp))\n| where isnotempty(XCsApp)\n| where XCsAppCci < 70 or XCsAppCcl =~ 'poor' or XCsAppCcl =~ 'low'\n| project \n    TimeGenerated,\n    User = CsUsername,\n    NewRiskyApp = XCsApp,\n    AppCCL = XCsAppCcl,\n    AppCCI = XCsAppCci,\n    AppCategory = XCsAppCategory,\n    BaselineAppCount = array_length(BaselineApps)\n",
        "queryFrequency": "P1D",
        "queryPeriod": "P8D",
        "severity": "Medium",
        "status": "Available",
        "subTechniques": [],
        "suppressionDuration": "PT1H",
        "suppressionEnabled": false,
        "tactics": [
          "Discovery",
          "InitialAccess"
        ],
        "techniques": [
          "T1199",
          "T1526"
        ],
        "templateVersion": "1.0.0",
        "triggerOperator": "GreaterThan",
        "triggerThreshold": 0
      },
      "type": "Microsoft.OperationalInsights/workspaces/providers/alertRules"
    }
  ]
}