Netskope - Anomalous User Behavior (High Volume from Unmanaged Device)

Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · 📊

↑ Back to Content Index

---

Detects anomalous user behavior including high data volume transfers from unmanaged devices, unusual access patterns, and suspicious application usage.

Attribute	Value
Type	Analytic Rule
Solution	NetskopeWebTx
ID	fa4c4f1c-3c5f-4c3a-a13f-924c30db56e9
Severity	Medium
Status	Available
Kind	Scheduled
Tactics	Exfiltration, Collection
Techniques	T1567, T1074
Required Connectors	NetskopeWebTxConnector
Source	View on GitHub

Tables Used

This content item queries data from the following tables:

Table	Transformations	Ingestion API	Lake-Only
NetskopeWebTransactions_CL	?	✓	?

---

Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · 📊

↑ Back to Analytic Rules · Back to NetskopeWebTx