Sagan medium stable other

[NETSKOPE] Anomaly Alert Detected (Medium)

[NETSKOPE] Anomaly Alert Detected (Medium)

View Source

Detection Logic

alert any $HOME_NET any -> $HOME_NET any (msg:"[NETSKOPE] Anomaly Alert Detected (Medium)"; program:netskope-api_data; json_content:".record_type","alert"; json_nocase; json_content:".alert_type","anomaly"; json_nocase; json_content:".severity","Medium"; json_nocase; json_map:"src_ip",".srcip"; json_map:"dest_ip",".dstip"; reference:url,https://docs.netskope.com/en/get-alerts-data; classtype:suspicious-activity; sid:5015317; rev:1; metadata:created_at 2025_01_21, updated_at 2025_01_21;)

Field Validations

Loading…

Comments (0)

Loading comments...