Netskope - Excessive Downloads Detection Spike vs Baseline

Back


Id	dd0ebd84-ffbe-45df-848b-0615ac446b04
Rulename	Netskope - Excessive Downloads Detection (Spike vs Baseline)
Description	Detects users with excessive download activity compared to their 7-day baseline. Triggers when current download volume exceeds 3x the average.
Severity	Medium
Tactics	Exfiltration Collection
Techniques	T1530 T1074
Required data connectors	NetskopeWebTxConnector
Kind	Scheduled
Query frequency	1h
Query period	7d
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/NetskopeWebTx/Analytic%20Rules/NetskopeWebtx_Rule3.yaml
Version	1.0.0
Arm template	dd0ebd84-ffbe-45df-848b-0615ac446b04.json

KQL

let lookbackPeriod = 7d;
let currentPeriod = 1h;
let threshold = 3;
let baseline = NetskopeWebTransactions_CL
    | where TimeGenerated between (ago(lookbackPeriod) .. ago(currentPeriod))
    | where isnotempty(CsUsername)
    | where XCsAppActivity =~ 'Download' or ScBytes > 0
    | summarize 
        BaselineAvgBytes = avg(ScBytes),
        BaselineTotalBytes = sum(ScBytes),
        BaselineCount = count()
        by CsUsername
    | extend BaselineDailyAvg = BaselineTotalBytes / 7;
let current = NetskopeWebTransactions_CL
    | where TimeGenerated > ago(currentPeriod)
    | where isnotempty(CsUsername)
    | where XCsAppActivity =~ 'Download' or ScBytes > 0
    | summarize 
        CurrentTotalBytes = sum(ScBytes),
        CurrentCount = count(),
        Apps = make_set(XCsApp),
        Files = make_set(XCsAppObjectName)
        by CsUsername;
current
| join kind=inner baseline on CsUsername
| where CurrentTotalBytes > (BaselineDailyAvg * threshold)
| extend 
    SpikeMultiplier = round(CurrentTotalBytes / BaselineDailyAvg, 2),
    CurrentTotalMB = round(CurrentTotalBytes / 1048576.0, 2),
    BaselineDailyMB = round(BaselineDailyAvg / 1048576.0, 2)
| project 
    TimeGenerated = now(),
    User = CsUsername,
    CurrentDownloadMB = CurrentTotalMB,
    BaselineDailyAvgMB = BaselineDailyMB,
    SpikeMultiplier,
    DownloadCount = CurrentCount,
    ApplicationsUsed = Apps,
    FilesDownloaded = Files

YAML

name: Netskope - Excessive Downloads Detection (Spike vs Baseline)
triggerOperator: gt
query: |
  let lookbackPeriod = 7d;
  let currentPeriod = 1h;
  let threshold = 3;
  let baseline = NetskopeWebTransactions_CL
      | where TimeGenerated between (ago(lookbackPeriod) .. ago(currentPeriod))
      | where isnotempty(CsUsername)
      | where XCsAppActivity =~ 'Download' or ScBytes > 0
      | summarize 
          BaselineAvgBytes = avg(ScBytes),
          BaselineTotalBytes = sum(ScBytes),
          BaselineCount = count()
          by CsUsername
      | extend BaselineDailyAvg = BaselineTotalBytes / 7;
  let current = NetskopeWebTransactions_CL
      | where TimeGenerated > ago(currentPeriod)
      | where isnotempty(CsUsername)
      | where XCsAppActivity =~ 'Download' or ScBytes > 0
      | summarize 
          CurrentTotalBytes = sum(ScBytes),
          CurrentCount = count(),
          Apps = make_set(XCsApp),
          Files = make_set(XCsAppObjectName)
          by CsUsername;
  current
  | join kind=inner baseline on CsUsername
  | where CurrentTotalBytes > (BaselineDailyAvg * threshold)
  | extend 
      SpikeMultiplier = round(CurrentTotalBytes / BaselineDailyAvg, 2),
      CurrentTotalMB = round(CurrentTotalBytes / 1048576.0, 2),
      BaselineDailyMB = round(BaselineDailyAvg / 1048576.0, 2)
  | project 
      TimeGenerated = now(),
      User = CsUsername,
      CurrentDownloadMB = CurrentTotalMB,
      BaselineDailyAvgMB = BaselineDailyMB,
      SpikeMultiplier,
      DownloadCount = CurrentCount,
      ApplicationsUsed = Apps,
      FilesDownloaded = Files
queryFrequency: 1h
description: |
  Detects users with excessive download activity compared to their 7-day baseline. Triggers when current download volume exceeds 3x the average.
id: dd0ebd84-ffbe-45df-848b-0615ac446b04
triggerThreshold: 0
queryPeriod: 7d
version: 1.0.0
kind: Scheduled
status: Available
severity: Medium
requiredDataConnectors:
- connectorId: NetskopeWebTxConnector
  dataTypes:
  - NetskopeWebTransactions_CL
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/NetskopeWebTx/Analytic%20Rules/NetskopeWebtx_Rule3.yaml
relevantTechniques:
- T1530
- T1074
tactics:
- Exfiltration
- Collection
entityMappings:
- fieldMappings:
  - identifier: Name
    columnName: User
  entityType: Account

ARM

{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "workspace": {
      "type": "String"
    }
  },
  "resources": [
    {
      "apiVersion": "2024-01-01-preview",
      "id": "[concat(resourceId('Microsoft.OperationalInsights/workspaces/providers', parameters('workspace'), 'Microsoft.SecurityInsights'),'/alertRules/dd0ebd84-ffbe-45df-848b-0615ac446b04')]",
      "kind": "Scheduled",
      "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/dd0ebd84-ffbe-45df-848b-0615ac446b04')]",
      "properties": {
        "alertRuleTemplateName": "dd0ebd84-ffbe-45df-848b-0615ac446b04",
        "customDetails": null,
        "description": "Detects users with excessive download activity compared to their 7-day baseline. Triggers when current download volume exceeds 3x the average.\n",
        "displayName": "Netskope - Excessive Downloads Detection (Spike vs Baseline)",
        "enabled": true,
        "entityMappings": [
          {
            "entityType": "Account",
            "fieldMappings": [
              {
                "columnName": "User",
                "identifier": "Name"
              }
            ]
          }
        ],
        "OriginalUri": "https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/NetskopeWebTx/Analytic%20Rules/NetskopeWebtx_Rule3.yaml",
        "query": "let lookbackPeriod = 7d;\nlet currentPeriod = 1h;\nlet threshold = 3;\nlet baseline = NetskopeWebTransactions_CL\n    | where TimeGenerated between (ago(lookbackPeriod) .. ago(currentPeriod))\n    | where isnotempty(CsUsername)\n    | where XCsAppActivity =~ 'Download' or ScBytes > 0\n    | summarize \n        BaselineAvgBytes = avg(ScBytes),\n        BaselineTotalBytes = sum(ScBytes),\n        BaselineCount = count()\n        by CsUsername\n    | extend BaselineDailyAvg = BaselineTotalBytes / 7;\nlet current = NetskopeWebTransactions_CL\n    | where TimeGenerated > ago(currentPeriod)\n    | where isnotempty(CsUsername)\n    | where XCsAppActivity =~ 'Download' or ScBytes > 0\n    | summarize \n        CurrentTotalBytes = sum(ScBytes),\n        CurrentCount = count(),\n        Apps = make_set(XCsApp),\n        Files = make_set(XCsAppObjectName)\n        by CsUsername;\ncurrent\n| join kind=inner baseline on CsUsername\n| where CurrentTotalBytes > (BaselineDailyAvg * threshold)\n| extend \n    SpikeMultiplier = round(CurrentTotalBytes / BaselineDailyAvg, 2),\n    CurrentTotalMB = round(CurrentTotalBytes / 1048576.0, 2),\n    BaselineDailyMB = round(BaselineDailyAvg / 1048576.0, 2)\n| project \n    TimeGenerated = now(),\n    User = CsUsername,\n    CurrentDownloadMB = CurrentTotalMB,\n    BaselineDailyAvgMB = BaselineDailyMB,\n    SpikeMultiplier,\n    DownloadCount = CurrentCount,\n    ApplicationsUsed = Apps,\n    FilesDownloaded = Files\n",
        "queryFrequency": "PT1H",
        "queryPeriod": "P7D",
        "severity": "Medium",
        "status": "Available",
        "subTechniques": [],
        "suppressionDuration": "PT1H",
        "suppressionEnabled": false,
        "tactics": [
          "Collection",
          "Exfiltration"
        ],
        "techniques": [
          "T1074",
          "T1530"
        ],
        "templateVersion": "1.0.0",
        "triggerOperator": "GreaterThan",
        "triggerThreshold": 0
      },
      "type": "Microsoft.OperationalInsights/workspaces/providers/alertRules"
    }
  ]
}