Skip to content

Commit 2f53632

Browse files
arielkr256arielkr256
authored
Netskope detections and pack (#1017)
1 parent 02ce284 commit 2f53632

6 files changed

+393
-0
lines changed

‎packs/netskope.yml

+11
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
AnalysisType: pack
2+
PackID: PantherManaged.Netskope
3+
Description: Group of all Netskope detections
4+
PackDefinition:
5+
IDs:
6+
- Netskope.AdminLoggedOutLoginFailures
7+
- Netskope.AdminUserChange
8+
- Netskope.ManyDeletes
9+
- Netskope.NetskopePersonnelActivity
10+
- Netskope.UnauthorizedAPICalls
11+
DisplayName: "Panther Netskope Pack"

‎rules/netskope_rules/netskope_admin_logged_out.yml

+73
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,73 @@
1+
AnalysisType: rule
2+
RuleID: "Netskope.AdminLoggedOutLoginFailures"
3+
DisplayName: "Admin logged out because of successive login failures"
4+
AlertTitle: "Admin [{user}] was logged out because of successive login failures"
5+
Detection:
6+
- All:
7+
- KeyPath: audit_log_event
8+
Condition: Equals
9+
Value: "Admin logged out because of successive login failures"
10+
Enabled: true
11+
LogTypes:
12+
- Netskope.Audit
13+
Tags:
14+
- Netskope
15+
- Brute Force
16+
Reports:
17+
MITRE ATT&CK:
18+
- TA0006:T1110
19+
Severity: Medium
20+
Description: An admin was logged out because of successive login failures.
21+
DedupPeriodMinutes: 60
22+
Threshold: 1
23+
Runbook: An admin was logged out because of successive login failures. This could indicate brute force activity against this account.
24+
Tests:
25+
- Name: True positive
26+
ExpectedResult: true
27+
Log:
28+
{
29+
"_id": "e5ca619b059fccdd0cfd9398",
30+
"_insertion_epoch_timestamp": 1702308331,
31+
"audit_log_event": "Admin logged out because of successive login failures",
32+
"count": 1,
33+
"is_netskope_personnel": true,
34+
"organization_unit": "",
35+
"severity_level": 2,
36+
"supporting_data": {
37+
"data_type": "user",
38+
"data_values": [
39+
"11.22.33.44",
40+
"[email protected]"
41+
]
42+
},
43+
"timestamp": "2023-12-11 15:25:31.000000000",
44+
"type": "admin_audit_logs",
45+
"ur_normalized": "[email protected]",
46+
"user": "[email protected]"
47+
}
48+
- Name: True negative
49+
ExpectedResult: false
50+
Log:
51+
{
52+
"_id": "1e589befa3da30132362f32a",
53+
"_insertion_epoch_timestamp": 1702318213,
54+
"audit_log_event": "Rest API V2 Call",
55+
"count": 1,
56+
"is_netskope_personnel": false,
57+
"organization_unit": "",
58+
"severity_level": 2,
59+
"supporting_data": {
60+
"data_type": "incidents",
61+
"data_values": [
62+
200,
63+
"POST",
64+
"/api/v2/incidents/uba/getuci",
65+
"trid=ccb898fgrhvdd0v0lebg"
66+
]
67+
},
68+
"timestamp": "2023-12-11 18:10:13.000000000",
69+
"type": "admin_audit_logs",
70+
"ur_normalized": "service-account",
71+
"user": "service-account"
72+
}
73+

‎rules/netskope_rules/netskope_admin_user_change.yml

+93
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,93 @@
1+
AnalysisType: rule
2+
RuleID: "Netskope.AdminUserChange"
3+
DisplayName: "An administrator account was created, deleted, or modified."
4+
AlertTitle: "User [{user}] performed [{audit_log_event}]"
5+
Detection:
6+
- All:
7+
- KeyPath: audit_log_event
8+
Condition: IsIn
9+
Values:
10+
- Created new admin
11+
- Added SSO Admin
12+
- Edited SSO Admin Record
13+
- Created new support admin
14+
- Edit admin record
15+
- Deleted admin
16+
- Enabled admin
17+
- Disabled admin
18+
- Unlocked admin
19+
- Updated admin settings
20+
- Deleted Netskope SSO admin
21+
Enabled: true
22+
LogTypes:
23+
- Netskope.Audit
24+
Tags:
25+
- Netskope
26+
- Account Manipulation
27+
Reports:
28+
MITRE ATT&CK:
29+
- TA0004:T1098
30+
Severity: High
31+
DynamicSeverities:
32+
- ChangeTo: Critical
33+
Conditions:
34+
- KeyPath: audit_log_event
35+
Condition: Contains
36+
Values:
37+
- Create
38+
- Add
39+
- Delete
40+
Description: An administrator account was created, deleted, or modified.
41+
DedupPeriodMinutes: 60
42+
Threshold: 1
43+
Runbook: An administrator account was created, deleted, or modified. Validate that this activity is expected and authorized.
44+
Tests:
45+
- Name: True positive
46+
ExpectedResult: true
47+
Log:
48+
{
49+
"_id": "e5ca619b059fccdd0cfd9398",
50+
"_insertion_epoch_timestamp": 1702308331,
51+
"audit_log_event": "Created new admin",
52+
"count": 1,
53+
"is_netskope_personnel": true,
54+
"organization_unit": "",
55+
"severity_level": 2,
56+
"supporting_data": {
57+
"data_type": "user",
58+
"data_values": [
59+
"11.22.33.44",
60+
"[email protected]"
61+
]
62+
},
63+
"timestamp": "2023-12-11 15:25:31.000000000",
64+
"type": "admin_audit_logs",
65+
"ur_normalized": "[email protected]",
66+
"user": "[email protected]"
67+
}
68+
- Name: True negative
69+
ExpectedResult: false
70+
Log:
71+
{
72+
"_id": "1e589befa3da30132362f32a",
73+
"_insertion_epoch_timestamp": 1702318213,
74+
"audit_log_event": "Rest API V2 Call",
75+
"count": 1,
76+
"is_netskope_personnel": false,
77+
"organization_unit": "",
78+
"severity_level": 2,
79+
"supporting_data": {
80+
"data_type": "incidents",
81+
"data_values": [
82+
200,
83+
"POST",
84+
"/api/v2/incidents/uba/getuci",
85+
"trid=ccb898fgrhvdd0v0lebg"
86+
]
87+
},
88+
"timestamp": "2023-12-11 18:10:13.000000000",
89+
"type": "admin_audit_logs",
90+
"ur_normalized": "service-account",
91+
"user": "service-account"
92+
}
93+

‎rules/netskope_rules/netskope_many_deletes.yml

+67
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,67 @@
1+
AnalysisType: rule
2+
RuleID: "Netskope.ManyDeletes"
3+
DisplayName: "Netskope Many Objects Deleted"
4+
AlertTitle: "[{user}] deleted many objects in a short time"
5+
Detection:
6+
- All:
7+
- KeyPath: audit_log_event
8+
Condition: Contains
9+
Value: Delete
10+
Enabled: true
11+
LogTypes:
12+
- Netskope.Audit
13+
Tags:
14+
- Netskope
15+
- Configuration Required
16+
- Data Destruction
17+
Reports:
18+
MITRE ATT&CK:
19+
- TA0040:T1485
20+
Severity: High
21+
Description: A user deleted a large number of objects in a short period of time.
22+
DedupPeriodMinutes: 60
23+
Threshold: 10
24+
Runbook: A user deleted a large number of objects in a short period of time. Validate that this activity is expected and authorized.
25+
Tests:
26+
- Name: True positive
27+
ExpectedResult: true
28+
Log:
29+
{
30+
"_id": "1e589befa3da30132362f32a",
31+
"_insertion_epoch_timestamp": 1702318213,
32+
"audit_log_event": "Deleted rbi template",
33+
"count": 1,
34+
"is_netskope_personnel": false,
35+
"organization_unit": "",
36+
"severity_level": 2,
37+
"timestamp": "2023-12-11 18:10:13.000000000",
38+
"type": "admin_audit_logs",
39+
"ur_normalized": "service-account",
40+
"user": "service-account"
41+
}
42+
- Name: True negative
43+
ExpectedResult: false
44+
Log:
45+
{
46+
"_id": "1e589befa3da30132362f32a",
47+
"_insertion_epoch_timestamp": 1702318213,
48+
"audit_log_event": "Rest API V2 Call",
49+
"count": 1,
50+
"is_netskope_personnel": false,
51+
"organization_unit": "",
52+
"severity_level": 2,
53+
"supporting_data": {
54+
"data_type": "incidents",
55+
"data_values": [
56+
200,
57+
"POST",
58+
"/api/v2/incidents/uba/getuci",
59+
"trid=ccb898fgrhvdd0v0lebg"
60+
]
61+
},
62+
"timestamp": "2023-12-11 18:10:13.000000000",
63+
"type": "admin_audit_logs",
64+
"ur_normalized": "service-account",
65+
"user": "service-account"
66+
}
67+

‎rules/netskope_rules/netskope_personnel_action.yml

+73
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,73 @@
1+
AnalysisType: rule
2+
RuleID: "Netskope.NetskopePersonnelActivity"
3+
DisplayName: "Action Performed by Netskope Personnel"
4+
AlertTitle: "Action [{audit_log_event}] performed by Netskope personnel [{user}]"
5+
Detection:
6+
- All:
7+
- KeyPath: is_netskope_personnel
8+
Condition: Equals
9+
Value: true
10+
Enabled: true
11+
LogTypes:
12+
- Netskope.Audit
13+
Tags:
14+
- Netskope
15+
- Supply Chain Compromise
16+
Reports:
17+
MITRE ATT&CK:
18+
- TA0001:T1195
19+
Severity: Medium
20+
Description: An action was performed by Netskope personnel.
21+
DedupPeriodMinutes: 60
22+
Threshold: 1
23+
Runbook: Action taken by Netskope Personnel. Validate that this action was authorized.
24+
Tests:
25+
- Name: True positive
26+
ExpectedResult: true
27+
Log:
28+
{
29+
"_id": "e5ca619b059fccdd0cfd9398",
30+
"_insertion_epoch_timestamp": 1702308331,
31+
"audit_log_event": "Login Successful",
32+
"count": 1,
33+
"is_netskope_personnel": true,
34+
"organization_unit": "",
35+
"severity_level": 2,
36+
"supporting_data": {
37+
"data_type": "user",
38+
"data_values": [
39+
"11.22.33.44",
40+
"[email protected]"
41+
]
42+
},
43+
"timestamp": "2023-12-11 15:25:31.000000000",
44+
"type": "admin_audit_logs",
45+
"ur_normalized": "[email protected]",
46+
"user": "[email protected]"
47+
}
48+
- Name: True negative
49+
ExpectedResult: false
50+
Log:
51+
{
52+
"_id": "1e589befa3da30132362f32a",
53+
"_insertion_epoch_timestamp": 1702318213,
54+
"audit_log_event": "Rest API V2 Call",
55+
"count": 1,
56+
"is_netskope_personnel": false,
57+
"organization_unit": "",
58+
"severity_level": 2,
59+
"supporting_data": {
60+
"data_type": "incidents",
61+
"data_values": [
62+
200,
63+
"POST",
64+
"/api/v2/incidents/uba/getuci",
65+
"trid=ccb898fgrhvdd0v0lebg"
66+
]
67+
},
68+
"timestamp": "2023-12-11 18:10:13.000000000",
69+
"type": "admin_audit_logs",
70+
"ur_normalized": "service-account",
71+
"user": "service-account"
72+
}
73+

‎rules/netskope_rules/netskope_unauthorized_api_calls.yml

+76
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,76 @@
1+
AnalysisType: rule
2+
RuleID: "Netskope.UnauthorizedAPICalls"
3+
DisplayName: "Netskope Many Unauthorized API Calls"
4+
AlertTitle: "Many unauthorized API calls from user [{user}]"
5+
Detection:
6+
- All:
7+
- KeyPath: supporting_data.data_values[0]
8+
Condition: Equals
9+
Value: 403
10+
Enabled: true
11+
LogTypes:
12+
- Netskope.Audit
13+
Tags:
14+
- Netskope
15+
- Configuration Required
16+
- Brute Force
17+
Reports:
18+
MITRE ATT&CK:
19+
- TA0006:T1110
20+
Severity: High
21+
Description: Many unauthorized API calls were observed for a user in a short period of time.
22+
DedupPeriodMinutes: 60
23+
Threshold: 10
24+
Runbook: An account is making many unauthorized API calls. This could indicate brute force activity, or expired service account credentials.
25+
Tests:
26+
- Name: True positive
27+
ExpectedResult: true
28+
Log:
29+
{
30+
"_id": "1e589befa3da30132362f32a",
31+
"_insertion_epoch_timestamp": 1702318213,
32+
"audit_log_event": "Rest API V2 Call",
33+
"count": 1,
34+
"is_netskope_personnel": false,
35+
"organization_unit": "",
36+
"severity_level": 2,
37+
"supporting_data": {
38+
"data_type": "incidents",
39+
"data_values": [
40+
403,
41+
"POST",
42+
"/api/v2/incidents/uba/getuci",
43+
"trid=ccb898fgrhvdd0v0lebg"
44+
]
45+
},
46+
"timestamp": "2023-12-11 18:10:13.000000000",
47+
"type": "admin_audit_logs",
48+
"ur_normalized": "service-account",
49+
"user": "service-account"
50+
}
51+
- Name: True negative
52+
ExpectedResult: false
53+
Log:
54+
{
55+
"_id": "1e589befa3da30132362f32a",
56+
"_insertion_epoch_timestamp": 1702318213,
57+
"audit_log_event": "Rest API V2 Call",
58+
"count": 1,
59+
"is_netskope_personnel": false,
60+
"organization_unit": "",
61+
"severity_level": 2,
62+
"supporting_data": {
63+
"data_type": "incidents",
64+
"data_values": [
65+
200,
66+
"POST",
67+
"/api/v2/incidents/uba/getuci",
68+
"trid=ccb898fgrhvdd0v0lebg"
69+
]
70+
},
71+
"timestamp": "2023-12-11 18:10:13.000000000",
72+
"type": "admin_audit_logs",
73+
"ur_normalized": "service-account",
74+
"user": "service-account"
75+
}
76+

0 commit comments

Comments
 (0)