Sagan medium stable other

[NETSKOPE] Deleted Netskope SSO admin Event Detected

[NETSKOPE] Deleted Netskope SSO admin Event Detected

View Source

Detection Logic

alert any $HOME_NET any -> $HOME_NET any (msg:"[NETSKOPE] Deleted Netskope SSO admin Event Detected"; program:netskope-api_data; json_content:".record_type","audit"; json_nocase; json_content:".audit_log_event","Deleted Netskope SSO admin"; json_nocase; json_map:"src_ip",".srcip"; json_map:"dest_ip",".dstip"; classtype:suspicious-activity; reference:url,https://docs.netskope.com/en/audit-log-1/; sid:5015258; rev:1;)

Field Validations

Loading…

Comments (0)

Loading comments...