AR Microsoft Sentinel Analytic Rules ONLINE

Analytic rule catalog

Netskope - Data Movement Tracking UploadDownload Monitoring

Back
Idcf103180-cb81-4796-921d-3cc7eef4e817
RulenameNetskope - Data Movement Tracking (Upload/Download Monitoring)
DescriptionTracks file uploads and downloads, monitoring data movement direction, size, and destination. Provides visibility into data flow patterns.
SeverityInformational
TacticsExfiltration
Collection
TechniquesT1567
T1074
Required data connectorsNetskopeWebTxConnector
KindScheduled
Query frequency1h
Query period1h
Trigger threshold0
Trigger operatorgt
Source Urihttps://github.com/Azure/Azure-Sentinel/blob/master/Solutions/NetskopeWebTx/Analytic%20Rules/NetskopeWebtx_Rule2.yaml
Version1.0.0
Arm templatecf103180-cb81-4796-921d-3cc7eef4e817.json
Deploy To Azure
let significantSizeMB = 50;
NetskopeWebTransactions_CL
| where TimeGenerated > ago(1h)
| where isnotempty(CsUsername)
| where CsBytes > 0 or ScBytes > 0 or XRsFileSize > 0
| extend 
    Direction = case(
        CsBytes > ScBytes, 'Upload',
        ScBytes > CsBytes, 'Download',
        'Unknown'),
    TransferSize = max_of(CsBytes, ScBytes, XRsFileSize)
| summarize 
    TotalUploadBytes = sumif(CsBytes, Direction == 'Upload'),
    TotalDownloadBytes = sumif(ScBytes, Direction == 'Download'),
    UploadCount = countif(Direction == 'Upload'),
    DownloadCount = countif(Direction == 'Download'),
    UniqueFiles = dcount(XCsAppObjectName),
    Files = make_set(XCsAppObjectName, 20),
    FileTypes = make_set(XRsFileType),
    Apps = make_set(XCsApp),
    Destinations = make_set(CsHost, 20)
    by CsUsername, XCDevice, XCCountry, bin(TimeGenerated, 1h)
| extend 
    TotalUploadMB = round(TotalUploadBytes / 1048576.0, 2),
    TotalDownloadMB = round(TotalDownloadBytes / 1048576.0, 2),
    TotalTransferMB = round((TotalUploadBytes + TotalDownloadBytes) / 1048576.0, 2)
| where TotalTransferMB > significantSizeMB
| extend DataFlowSummary = strcat('Upload: ', TotalUploadMB, ' MB (', UploadCount, ' ops), Download: ', TotalDownloadMB, ' MB (', DownloadCount, ' ops)')
| project 
    TimeGenerated,
    User = CsUsername,
    Device = XCDevice,
    Country = XCCountry,
    TotalUploadMB,
    TotalDownloadMB,
    TotalTransferMB,
    UploadOperations = UploadCount,
    DownloadOperations = DownloadCount,
    UniqueFiles,
    FilesSample = Files,
    FileTypes,
    Applications = Apps,
    Destinations,
    DataFlowSummary

queryFrequency: 1h
entityMappings:
- fieldMappings:
  - columnName: User
    identifier: Name
  entityType: Account
triggerThreshold: 0
triggerOperator: gt
severity: Informational
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/NetskopeWebTx/Analytic%20Rules/NetskopeWebtx_Rule2.yaml
query: |
  let significantSizeMB = 50;
  NetskopeWebTransactions_CL
  | where TimeGenerated > ago(1h)
  | where isnotempty(CsUsername)
  | where CsBytes > 0 or ScBytes > 0 or XRsFileSize > 0
  | extend 
      Direction = case(
          CsBytes > ScBytes, 'Upload',
          ScBytes > CsBytes, 'Download',
          'Unknown'),
      TransferSize = max_of(CsBytes, ScBytes, XRsFileSize)
  | summarize 
      TotalUploadBytes = sumif(CsBytes, Direction == 'Upload'),
      TotalDownloadBytes = sumif(ScBytes, Direction == 'Download'),
      UploadCount = countif(Direction == 'Upload'),
      DownloadCount = countif(Direction == 'Download'),
      UniqueFiles = dcount(XCsAppObjectName),
      Files = make_set(XCsAppObjectName, 20),
      FileTypes = make_set(XRsFileType),
      Apps = make_set(XCsApp),
      Destinations = make_set(CsHost, 20)
      by CsUsername, XCDevice, XCCountry, bin(TimeGenerated, 1h)
  | extend 
      TotalUploadMB = round(TotalUploadBytes / 1048576.0, 2),
      TotalDownloadMB = round(TotalDownloadBytes / 1048576.0, 2),
      TotalTransferMB = round((TotalUploadBytes + TotalDownloadBytes) / 1048576.0, 2)
  | where TotalTransferMB > significantSizeMB
  | extend DataFlowSummary = strcat('Upload: ', TotalUploadMB, ' MB (', UploadCount, ' ops), Download: ', TotalDownloadMB, ' MB (', DownloadCount, ' ops)')
  | project 
      TimeGenerated,
      User = CsUsername,
      Device = XCDevice,
      Country = XCCountry,
      TotalUploadMB,
      TotalDownloadMB,
      TotalTransferMB,
      UploadOperations = UploadCount,
      DownloadOperations = DownloadCount,
      UniqueFiles,
      FilesSample = Files,
      FileTypes,
      Applications = Apps,
      Destinations,
      DataFlowSummary
tactics:
- Exfiltration
- Collection
queryPeriod: 1h
relevantTechniques:
- T1567
- T1074
requiredDataConnectors:
- connectorId: NetskopeWebTxConnector
  dataTypes:
  - NetskopeWebTransactions_CL
id: cf103180-cb81-4796-921d-3cc7eef4e817
kind: Scheduled
version: 1.0.0
description: |
  Tracks file uploads and downloads, monitoring data movement direction, size, and destination. Provides visibility into data flow patterns.
status: Available
name: Netskope - Data Movement Tracking (Upload/Download Monitoring)

{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "workspace": {
      "type": "String"
    }
  },
  "resources": [
    {
      "apiVersion": "2024-01-01-preview",
      "id": "[concat(resourceId('Microsoft.OperationalInsights/workspaces/providers', parameters('workspace'), 'Microsoft.SecurityInsights'),'/alertRules/cf103180-cb81-4796-921d-3cc7eef4e817')]",
      "kind": "Scheduled",
      "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/cf103180-cb81-4796-921d-3cc7eef4e817')]",
      "properties": {
        "alertRuleTemplateName": "cf103180-cb81-4796-921d-3cc7eef4e817",
        "customDetails": null,
        "description": "Tracks file uploads and downloads, monitoring data movement direction, size, and destination. Provides visibility into data flow patterns.\n",
        "displayName": "Netskope - Data Movement Tracking (Upload/Download Monitoring)",
        "enabled": true,
        "entityMappings": [
          {
            "entityType": "Account",
            "fieldMappings": [
              {
                "columnName": "User",
                "identifier": "Name"
              }
            ]
          }
        ],
        "OriginalUri": "https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/NetskopeWebTx/Analytic%20Rules/NetskopeWebtx_Rule2.yaml",
        "query": "let significantSizeMB = 50;\nNetskopeWebTransactions_CL\n| where TimeGenerated > ago(1h)\n| where isnotempty(CsUsername)\n| where CsBytes > 0 or ScBytes > 0 or XRsFileSize > 0\n| extend \n    Direction = case(\n        CsBytes > ScBytes, 'Upload',\n        ScBytes > CsBytes, 'Download',\n        'Unknown'),\n    TransferSize = max_of(CsBytes, ScBytes, XRsFileSize)\n| summarize \n    TotalUploadBytes = sumif(CsBytes, Direction == 'Upload'),\n    TotalDownloadBytes = sumif(ScBytes, Direction == 'Download'),\n    UploadCount = countif(Direction == 'Upload'),\n    DownloadCount = countif(Direction == 'Download'),\n    UniqueFiles = dcount(XCsAppObjectName),\n    Files = make_set(XCsAppObjectName, 20),\n    FileTypes = make_set(XRsFileType),\n    Apps = make_set(XCsApp),\n    Destinations = make_set(CsHost, 20)\n    by CsUsername, XCDevice, XCCountry, bin(TimeGenerated, 1h)\n| extend \n    TotalUploadMB = round(TotalUploadBytes / 1048576.0, 2),\n    TotalDownloadMB = round(TotalDownloadBytes / 1048576.0, 2),\n    TotalTransferMB = round((TotalUploadBytes + TotalDownloadBytes) / 1048576.0, 2)\n| where TotalTransferMB > significantSizeMB\n| extend DataFlowSummary = strcat('Upload: ', TotalUploadMB, ' MB (', UploadCount, ' ops), Download: ', TotalDownloadMB, ' MB (', DownloadCount, ' ops)')\n| project \n    TimeGenerated,\n    User = CsUsername,\n    Device = XCDevice,\n    Country = XCCountry,\n    TotalUploadMB,\n    TotalDownloadMB,\n    TotalTransferMB,\n    UploadOperations = UploadCount,\n    DownloadOperations = DownloadCount,\n    UniqueFiles,\n    FilesSample = Files,\n    FileTypes,\n    Applications = Apps,\n    Destinations,\n    DataFlowSummary\n",
        "queryFrequency": "PT1H",
        "queryPeriod": "PT1H",
        "severity": "Informational",
        "status": "Available",
        "subTechniques": [],
        "suppressionDuration": "PT1H",
        "suppressionEnabled": false,
        "tactics": [
          "Collection",
          "Exfiltration"
        ],
        "techniques": [
          "T1074",
          "T1567"
        ],
        "templateVersion": "1.0.0",
        "triggerOperator": "GreaterThan",
        "triggerThreshold": 0
      },
      "type": "Microsoft.OperationalInsights/workspaces/providers/alertRules"
    }
  ]
}