Netskope - Repeated or Critical Policy Violations | Microsoft Sentinel Analytic Rules

Back


Id	dacab67e-fcf3-41c6-a191-579c7be1814d
Rulename	Netskope - Repeated or Critical Policy Violations
Description	Detects users with repeated policy violations or critical policy blocks. Monitors policy enforcement effectiveness and compliance.
Severity	High
Tactics	DefenseEvasion Exfiltration
Techniques	T1562 T1048
Required data connectors	NetskopeWebTxConnector
Kind	Scheduled
Query frequency	1h
Query period	1h
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/NetskopeWebTx/Analytic%20Rules/NetskopeWebtx_Rule8.yaml
Version	1.0.0
Arm template	dacab67e-fcf3-41c6-a191-579c7be1814d.json

KQL

let violationThreshold = 5;
NetskopeWebTransactions_CL
| where TimeGenerated > ago(1h)
| where isnotempty(CsUsername)
| where isnotempty(XPolicyAction) and isnotempty(XPolicyName)
| where XPolicyAction =~ 'block' or XPolicyAction =~ 'alert'
| summarize 
    ViolationCount = count(),
    Policies = make_set(XPolicyName),
    PolicyActions = make_set(XPolicyAction),
    Apps = make_set(XCsApp),
    Hosts = make_set(CsHost),
    Activities = make_set(XCsAppActivity),
    BlockCount = countif(XPolicyAction =~ 'block'),
    AlertCount = countif(XPolicyAction =~ 'alert'),
    FirstViolation = min(TimeGenerated),
    LastViolation = max(TimeGenerated)
    by CsUsername, XCCountry, XCDevice
| where ViolationCount >= violationThreshold or BlockCount > 0
| extend ViolationSeverity = case(
    BlockCount > 10, 'Critical',
    BlockCount > 5, 'High',
    ViolationCount > 20, 'High',
    ViolationCount > 10, 'Medium',
    'Low')
| project 
    TimeGenerated = LastViolation,
    User = CsUsername,
    TotalViolations = ViolationCount,
    BlockedAttempts = BlockCount,
    AlertedActions = AlertCount,
    ViolatedPolicies = Policies,
    PolicyActions,
    ApplicationsInvolved = Apps,
    TargetHosts = Hosts,
    Activities,
    Country = XCCountry,
    Device = XCDevice,
    ViolationSeverity,
    FirstOccurrence = FirstViolation,
    LastOccurrence = LastViolation

YAML

queryFrequency: 1h
entityMappings:
- fieldMappings:
  - columnName: User
    identifier: Name
  entityType: Account
triggerThreshold: 0
triggerOperator: gt
severity: High
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/NetskopeWebTx/Analytic%20Rules/NetskopeWebtx_Rule8.yaml
query: |
  let violationThreshold = 5;
  NetskopeWebTransactions_CL
  | where TimeGenerated > ago(1h)
  | where isnotempty(CsUsername)
  | where isnotempty(XPolicyAction) and isnotempty(XPolicyName)
  | where XPolicyAction =~ 'block' or XPolicyAction =~ 'alert'
  | summarize 
      ViolationCount = count(),
      Policies = make_set(XPolicyName),
      PolicyActions = make_set(XPolicyAction),
      Apps = make_set(XCsApp),
      Hosts = make_set(CsHost),
      Activities = make_set(XCsAppActivity),
      BlockCount = countif(XPolicyAction =~ 'block'),
      AlertCount = countif(XPolicyAction =~ 'alert'),
      FirstViolation = min(TimeGenerated),
      LastViolation = max(TimeGenerated)
      by CsUsername, XCCountry, XCDevice
  | where ViolationCount >= violationThreshold or BlockCount > 0
  | extend ViolationSeverity = case(
      BlockCount > 10, 'Critical',
      BlockCount > 5, 'High',
      ViolationCount > 20, 'High',
      ViolationCount > 10, 'Medium',
      'Low')
  | project 
      TimeGenerated = LastViolation,
      User = CsUsername,
      TotalViolations = ViolationCount,
      BlockedAttempts = BlockCount,
      AlertedActions = AlertCount,
      ViolatedPolicies = Policies,
      PolicyActions,
      ApplicationsInvolved = Apps,
      TargetHosts = Hosts,
      Activities,
      Country = XCCountry,
      Device = XCDevice,
      ViolationSeverity,
      FirstOccurrence = FirstViolation,
      LastOccurrence = LastViolation
tactics:
- DefenseEvasion
- Exfiltration
queryPeriod: 1h
relevantTechniques:
- T1562
- T1048
requiredDataConnectors:
- connectorId: NetskopeWebTxConnector
  dataTypes:
  - NetskopeWebTransactions_CL
id: dacab67e-fcf3-41c6-a191-579c7be1814d
kind: Scheduled
version: 1.0.0
description: |
  Detects users with repeated policy violations or critical policy blocks. Monitors policy enforcement effectiveness and compliance.
status: Available
name: Netskope - Repeated or Critical Policy Violations

ARM

{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "workspace": {
      "type": "String"
    }
  },
  "resources": [
    {
      "apiVersion": "2024-01-01-preview",
      "id": "[concat(resourceId('Microsoft.OperationalInsights/workspaces/providers', parameters('workspace'), 'Microsoft.SecurityInsights'),'/alertRules/dacab67e-fcf3-41c6-a191-579c7be1814d')]",
      "kind": "Scheduled",
      "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/dacab67e-fcf3-41c6-a191-579c7be1814d')]",
      "properties": {
        "alertRuleTemplateName": "dacab67e-fcf3-41c6-a191-579c7be1814d",
        "customDetails": null,
        "description": "Detects users with repeated policy violations or critical policy blocks. Monitors policy enforcement effectiveness and compliance.\n",
        "displayName": "Netskope - Repeated or Critical Policy Violations",
        "enabled": true,
        "entityMappings": [
          {
            "entityType": "Account",
            "fieldMappings": [
              {
                "columnName": "User",
                "identifier": "Name"
              }
            ]
          }
        ],
        "OriginalUri": "https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/NetskopeWebTx/Analytic%20Rules/NetskopeWebtx_Rule8.yaml",
        "query": "let violationThreshold = 5;\nNetskopeWebTransactions_CL\n| where TimeGenerated > ago(1h)\n| where isnotempty(CsUsername)\n| where isnotempty(XPolicyAction) and isnotempty(XPolicyName)\n| where XPolicyAction =~ 'block' or XPolicyAction =~ 'alert'\n| summarize \n    ViolationCount = count(),\n    Policies = make_set(XPolicyName),\n    PolicyActions = make_set(XPolicyAction),\n    Apps = make_set(XCsApp),\n    Hosts = make_set(CsHost),\n    Activities = make_set(XCsAppActivity),\n    BlockCount = countif(XPolicyAction =~ 'block'),\n    AlertCount = countif(XPolicyAction =~ 'alert'),\n    FirstViolation = min(TimeGenerated),\n    LastViolation = max(TimeGenerated)\n    by CsUsername, XCCountry, XCDevice\n| where ViolationCount >= violationThreshold or BlockCount > 0\n| extend ViolationSeverity = case(\n    BlockCount > 10, 'Critical',\n    BlockCount > 5, 'High',\n    ViolationCount > 20, 'High',\n    ViolationCount > 10, 'Medium',\n    'Low')\n| project \n    TimeGenerated = LastViolation,\n    User = CsUsername,\n    TotalViolations = ViolationCount,\n    BlockedAttempts = BlockCount,\n    AlertedActions = AlertCount,\n    ViolatedPolicies = Policies,\n    PolicyActions,\n    ApplicationsInvolved = Apps,\n    TargetHosts = Hosts,\n    Activities,\n    Country = XCCountry,\n    Device = XCDevice,\n    ViolationSeverity,\n    FirstOccurrence = FirstViolation,\n    LastOccurrence = LastViolation\n",
        "queryFrequency": "PT1H",
        "queryPeriod": "PT1H",
        "severity": "High",
        "status": "Available",
        "subTechniques": [],
        "suppressionDuration": "PT1H",
        "suppressionEnabled": false,
        "tactics": [
          "DefenseEvasion",
          "Exfiltration"
        ],
        "techniques": [
          "T1048",
          "T1562"
        ],
        "templateVersion": "1.0.0",
        "triggerOperator": "GreaterThan",
        "triggerThreshold": 0
      },
      "type": "Microsoft.OperationalInsights/workspaces/providers/alertRules"
    }
  ]
}