Sagan medium stable other

[NETSKOPE] SSO Login Failed by Netskope Support Event Detected

[NETSKOPE] SSO Login Failed by Netskope Support Event Detected

View Source

Detection Logic

alert any $HOME_NET any -> $HOME_NET any (msg:"[NETSKOPE] SSO Login Failed by Netskope Support Event Detected"; program:netskope-api_data; json_content:".record_type","audit"; json_nocase; json_content:".audit_log_event","SSO Login Failed by Netskope Support"; json_nocase; json_map:"src_ip",".srcip"; json_map:"dest_ip",".dstip"; classtype:suspicious-activity; reference:url,https://docs.netskope.com/en/audit-log-1/; sid:5015260; rev:1;)

Field Validations

Loading…

Comments (0)

Loading comments...