Sagan medium stable other

[NETSKOPE] Enabled Netskope Support SSO Event Detected

[NETSKOPE] Enabled Netskope Support SSO Event Detected

View Source

Detection Logic

alert any $HOME_NET any -> $HOME_NET any (msg:"[NETSKOPE] Enabled Netskope Support SSO Event Detected"; program:netskope-api_data; json_content:".record_type","audit"; json_nocase; json_content:".audit_log_event","Enabled Netskope Support SSO"; json_nocase; json_map:"src_ip",".srcip"; json_map:"dest_ip",".dstip"; classtype:suspicious-activity; reference:url,https://docs.netskope.com/en/audit-log-1/; sid:5015256; rev:1;)

Field Validations

Loading…

Comments (0)

Loading comments...