Panther high experimental python

Netskope Many Objects Deleted

A user deleted a large number of objects in a short period of time.

View Source

Detection Logic

def rule(event):
    audit_log_event = event.get("audit_log_event")
    if audit_log_event and "Delete" in audit_log_event:
        return True
    return False


def title(event):
    user = event.get("user", "<USER_NOT_FOUND>")
    return f"[{user}] deleted many objects in a short time"

Field Validations

Loading…

Comments (0)

Loading comments...