Sagan medium stable other

[NETSKOPE] Application Event Detected (poor)

[NETSKOPE] Application Event Detected (poor)

View Source

Detection Logic

alert any $HOME_NET any -> $HOME_NET any (msg:"[NETSKOPE] Application Event Detected (poor)"; program:netskope-api_data; json_content:".record_type","application"; json_nocase; json_content:".action","alert"; json_nocase; json_content:".ccl","poor"; json_nocase; json_map:"src_ip",".srcip"; json_map:"dest_ip",".dstip"; reference:url,https://docs.netskope.com/en/application-risk-exchange-custom-plugin-developers-guide/; classtype:suspicious-activity; sid:5015327; rev:1; metadata:created_at 2025_01_21, updated_at 2025_01_21;)

Field Validations

Loading…

Comments (0)

Loading comments...