Netskope - Repeated or Critical Policy Violations | Microsoft Sentinel Analytic Rules

Back


Id	dacab67e-fcf3-41c6-a191-579c7be1814d
Rulename	Netskope - Repeated or Critical Policy Violations
Description	Detects users with repeated policy violations or critical policy blocks. Monitors policy enforcement effectiveness and compliance.
Severity	High
Tactics	DefenseEvasion Exfiltration
Techniques	T1562 T1048
Required data connectors	NetskopeWebTxConnector
Kind	Scheduled
Query frequency	1h
Query period	1h
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/NetskopeWebTx/Analytic%20Rules/NetskopeWebtx_Rule8.yaml
Version	1.0.0
Arm template	dacab67e-fcf3-41c6-a191-579c7be1814d.json

KQL

let violationThreshold = 5;
NetskopeWebTransactions_CL
| where TimeGenerated > ago(1h)
| where isnotempty(CsUsername)
| where isnotempty(XPolicyAction) and isnotempty(XPolicyName)
| where XPolicyAction =~ 'block' or XPolicyAction =~ 'alert'
| summarize 
    ViolationCount = count(),
    Policies = make_set(XPolicyName),
    PolicyActions = make_set(XPolicyAction),
    Apps = make_set(XCsApp),
    Hosts = make_set(CsHost),
    Activities = make_set(XCsAppActivity),
    BlockCount = countif(XPolicyAction =~ 'block'),
    AlertCount = countif(XPolicyAction =~ 'alert'),
    FirstViolation = min(TimeGenerated),
    LastViolation = max(TimeGenerated)
    by CsUsername, XCCountry, XCDevice
| where ViolationCount >= violationThreshold or BlockCount > 0
| extend ViolationSeverity = case(
    BlockCount > 10, 'Critical',
    BlockCount > 5, 'High',
    ViolationCount > 20, 'High',
    ViolationCount > 10, 'Medium',
    'Low')
| project 
    TimeGenerated = LastViolation,
    User = CsUsername,
    TotalViolations = ViolationCount,
    BlockedAttempts = BlockCount,
    AlertedActions = AlertCount,
    ViolatedPolicies = Policies,
    PolicyActions,
    ApplicationsInvolved = Apps,
    TargetHosts = Hosts,
    Activities,
    Country = XCCountry,
    Device = XCDevice,
    ViolationSeverity,
    FirstOccurrence = FirstViolation,
    LastOccurrence = LastViolation

YAML

version: 1.0.0
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/NetskopeWebTx/Analytic%20Rules/NetskopeWebtx_Rule8.yaml
triggerThreshold: 0
requiredDataConnectors:
- dataTypes:
  - NetskopeWebTransactions_CL
  connectorId: NetskopeWebTxConnector
tactics:
- DefenseEvasion
- Exfiltration
relevantTechniques:
- T1562
- T1048
kind: Scheduled
entityMappings:
- fieldMappings:
  - identifier: Name
    columnName: User
  entityType: Account
description: |
  Detects users with repeated policy violations or critical policy blocks. Monitors policy enforcement effectiveness and compliance.
triggerOperator: gt
status: Available
queryFrequency: 1h
id: dacab67e-fcf3-41c6-a191-579c7be1814d
name: Netskope - Repeated or Critical Policy Violations
severity: High
query: |
  let violationThreshold = 5;
  NetskopeWebTransactions_CL
  | where TimeGenerated > ago(1h)
  | where isnotempty(CsUsername)
  | where isnotempty(XPolicyAction) and isnotempty(XPolicyName)
  | where XPolicyAction =~ 'block' or XPolicyAction =~ 'alert'
  | summarize 
      ViolationCount = count(),
      Policies = make_set(XPolicyName),
      PolicyActions = make_set(XPolicyAction),
      Apps = make_set(XCsApp),
      Hosts = make_set(CsHost),
      Activities = make_set(XCsAppActivity),
      BlockCount = countif(XPolicyAction =~ 'block'),
      AlertCount = countif(XPolicyAction =~ 'alert'),
      FirstViolation = min(TimeGenerated),
      LastViolation = max(TimeGenerated)
      by CsUsername, XCCountry, XCDevice
  | where ViolationCount >= violationThreshold or BlockCount > 0
  | extend ViolationSeverity = case(
      BlockCount > 10, 'Critical',
      BlockCount > 5, 'High',
      ViolationCount > 20, 'High',
      ViolationCount > 10, 'Medium',
      'Low')
  | project 
      TimeGenerated = LastViolation,
      User = CsUsername,
      TotalViolations = ViolationCount,
      BlockedAttempts = BlockCount,
      AlertedActions = AlertCount,
      ViolatedPolicies = Policies,
      PolicyActions,
      ApplicationsInvolved = Apps,
      TargetHosts = Hosts,
      Activities,
      Country = XCCountry,
      Device = XCDevice,
      ViolationSeverity,
      FirstOccurrence = FirstViolation,
      LastOccurrence = LastViolation
queryPeriod: 1h

ARM

{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "workspace": {
      "type": "String"
    }
  },
  "resources": [
    {
      "apiVersion": "2024-01-01-preview",
      "id": "[concat(resourceId('Microsoft.OperationalInsights/workspaces/providers', parameters('workspace'), 'Microsoft.SecurityInsights'),'/alertRules/dacab67e-fcf3-41c6-a191-579c7be1814d')]",
      "kind": "Scheduled",
      "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/dacab67e-fcf3-41c6-a191-579c7be1814d')]",
      "properties": {
        "alertRuleTemplateName": "dacab67e-fcf3-41c6-a191-579c7be1814d",
        "customDetails": null,
        "description": "Detects users with repeated policy violations or critical policy blocks. Monitors policy enforcement effectiveness and compliance.\n",
        "displayName": "Netskope - Repeated or Critical Policy Violations",
        "enabled": true,
        "entityMappings": [
          {
            "entityType": "Account",
            "fieldMappings": [
              {
                "columnName": "User",
                "identifier": "Name"
              }
            ]
          }
        ],
        "OriginalUri": "https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/NetskopeWebTx/Analytic%20Rules/NetskopeWebtx_Rule8.yaml",
        "query": "let violationThreshold = 5;\nNetskopeWebTransactions_CL\n| where TimeGenerated > ago(1h)\n| where isnotempty(CsUsername)\n| where isnotempty(XPolicyAction) and isnotempty(XPolicyName)\n| where XPolicyAction =~ 'block' or XPolicyAction =~ 'alert'\n| summarize \n    ViolationCount = count(),\n    Policies = make_set(XPolicyName),\n    PolicyActions = make_set(XPolicyAction),\n    Apps = make_set(XCsApp),\n    Hosts = make_set(CsHost),\n    Activities = make_set(XCsAppActivity),\n    BlockCount = countif(XPolicyAction =~ 'block'),\n    AlertCount = countif(XPolicyAction =~ 'alert'),\n    FirstViolation = min(TimeGenerated),\n    LastViolation = max(TimeGenerated)\n    by CsUsername, XCCountry, XCDevice\n| where ViolationCount >= violationThreshold or BlockCount > 0\n| extend ViolationSeverity = case(\n    BlockCount > 10, 'Critical',\n    BlockCount > 5, 'High',\n    ViolationCount > 20, 'High',\n    ViolationCount > 10, 'Medium',\n    'Low')\n| project \n    TimeGenerated = LastViolation,\n    User = CsUsername,\n    TotalViolations = ViolationCount,\n    BlockedAttempts = BlockCount,\n    AlertedActions = AlertCount,\n    ViolatedPolicies = Policies,\n    PolicyActions,\n    ApplicationsInvolved = Apps,\n    TargetHosts = Hosts,\n    Activities,\n    Country = XCCountry,\n    Device = XCDevice,\n    ViolationSeverity,\n    FirstOccurrence = FirstViolation,\n    LastOccurrence = LastViolation\n",
        "queryFrequency": "PT1H",
        "queryPeriod": "PT1H",
        "severity": "High",
        "status": "Available",
        "subTechniques": [],
        "suppressionDuration": "PT1H",
        "suppressionEnabled": false,
        "tactics": [
          "DefenseEvasion",
          "Exfiltration"
        ],
        "techniques": [
          "T1048",
          "T1562"
        ],
        "templateVersion": "1.0.0",
        "triggerOperator": "GreaterThan",
        "triggerThreshold": 0
      },
      "type": "Microsoft.OperationalInsights/workspaces/providers/alertRules"
    }
  ]
}