Sagan medium stable other

[MSAPI-SHAREPOINT] Data loss prevention rule match.

[MSAPI-SHAREPOINT] Data loss prevention rule match.

View Source

Detection Logic

alert any $HOME_NET any -> $EXTERNAL_NET any (msg: "[MSAPI-SHAREPOINT] Data loss prevention rule match."; json_content: ".Workload","SharePoint"; json_content: ".Operation", "DlpRuleMatch"; json_map: "src_ip", ".ClientIP"; json_map: "dest_ip", ".ClientIP"; json_map: "username", ".UserId"; json_map: "program",".Workload"; classtype: suspicious-traffic; sid:5005158; rev: 2;)

Field Validations

Loading…

Comments (0)

Loading comments...