Netskope - Data Movement Tracking (Upload/Download Monitoring)

Status: available
Severity: informational
Time window: 1h
Group by: CsUsername, XCCountry, XCDevice
Source: github.com/Azure/Azure-Sentinel

Tracks file uploads and downloads, monitoring data movement direction, size, and destination. Provides visibility into data flow patterns.

MITRE ATT&CK coverage

Tactic	Techniques
Collection	`T1074` Data Staged
Exfiltration	`T1567` Exfiltration Over Web Service

Rule body

id: cf103180-cb81-4796-921d-3cc7eef4e817
name: Netskope - Data Movement Tracking (Upload/Download Monitoring)
description: |
  Tracks file uploads and downloads, monitoring data movement direction, size, and destination. Provides visibility into data flow patterns.
severity: Informational
status: Available
requiredDataConnectors:
  - connectorId: NetskopeWebTxConnector
    dataTypes:
      - NetskopeWebTransactions_CL
queryFrequency: 1h
queryPeriod: 1h
triggerOperator: gt
triggerThreshold: 0
tactics:
  - Exfiltration
  - Collection
relevantTechniques:
  - T1567
  - T1074
query: |
  let significantSizeMB = 50;
  NetskopeWebTransactions_CL
  | where TimeGenerated > ago(1h)
  | where isnotempty(CsUsername)
  | where CsBytes > 0 or ScBytes > 0 or XRsFileSize > 0
  | extend 
      Direction = case(
          CsBytes > ScBytes, 'Upload',
          ScBytes > CsBytes, 'Download',
          'Unknown'),
      TransferSize = max_of(CsBytes, ScBytes, XRsFileSize)
  | summarize 
      TotalUploadBytes = sumif(CsBytes, Direction == 'Upload'),
      TotalDownloadBytes = sumif(ScBytes, Direction == 'Download'),
      UploadCount = countif(Direction == 'Upload'),
      DownloadCount = countif(Direction == 'Download'),
      UniqueFiles = dcount(XCsAppObjectName),
      Files = make_set(XCsAppObjectName, 20),
      FileTypes = make_set(XRsFileType),
      Apps = make_set(XCsApp),
      Destinations = make_set(CsHost, 20)
      by CsUsername, XCDevice, XCCountry, bin(TimeGenerated, 1h)
  | extend 
      TotalUploadMB = round(TotalUploadBytes / 1048576.0, 2),
      TotalDownloadMB = round(TotalDownloadBytes / 1048576.0, 2),
      TotalTransferMB = round((TotalUploadBytes + TotalDownloadBytes) / 1048576.0, 2)
  | where TotalTransferMB > significantSizeMB
  | extend DataFlowSummary = strcat('Upload: ', TotalUploadMB, ' MB (', UploadCount, ' ops), Download: ', TotalDownloadMB, ' MB (', DownloadCount, ' ops)')
  | project 
      TimeGenerated,
      User = CsUsername,
      Device = XCDevice,
      Country = XCCountry,
      TotalUploadMB,
      TotalDownloadMB,
      TotalTransferMB,
      UploadOperations = UploadCount,
      DownloadOperations = DownloadCount,
      UniqueFiles,
      FilesSample = Files,
      FileTypes,
      Applications = Apps,
      Destinations,
      DataFlowSummary
entityMappings:
  - entityType: Account
    fieldMappings:
      - identifier: Name
        columnName: User
version: 1.0.0
kind: Scheduled

Stages and Predicates

Parameters

let significantSizeMB = 50;

Stage 1: `source`

NetskopeWebTransactions_CL

Stage 2: `where`

| where TimeGenerated > ago(1h)

Stage 3: `where`

| where isnotempty(CsUsername)

Stage 4: `where`

| where CsBytes > 0 or ScBytes > 0 or XRsFileSize > 0

Stage 5: `extend`

| extend 
    Direction = case(
        CsBytes > ScBytes, 'Upload',
        ScBytes > CsBytes, 'Download',
        'Unknown'),
    TransferSize = max_of(CsBytes, ScBytes, XRsFileSize)

Direction =

ifCsBytes > ScBytes'Upload'

elifScBytes > CsBytes'Download'

else'Unknown'

Stage 6: `summarize`

| summarize 
    TotalUploadBytes = sumif(CsBytes, Direction == 'Upload'),
    TotalDownloadBytes = sumif(ScBytes, Direction == 'Download'),
    UploadCount = countif(Direction == 'Upload'),
    DownloadCount = countif(Direction == 'Download'),
    UniqueFiles = dcount(XCsAppObjectName),
    Files = make_set(XCsAppObjectName, 20),
    FileTypes = make_set(XRsFileType),
    Apps = make_set(XCsApp),
    Destinations = make_set(CsHost, 20)
    by CsUsername, XCDevice, XCCountry, bin(TimeGenerated, 1h)

Stage 7: `extend`

| extend 
    TotalUploadMB = round(TotalUploadBytes / 1048576.0, 2),
    TotalDownloadMB = round(TotalDownloadBytes / 1048576.0, 2),
    TotalTransferMB = round((TotalUploadBytes + TotalDownloadBytes) / 1048576.0, 2)

Stage 8: `where`

| where TotalTransferMB > significantSizeMB

Stage 9: `extend`

| extend DataFlowSummary = strcat('Upload: ', TotalUploadMB, ' MB (', UploadCount, ' ops), Download: ', TotalDownloadMB, ' MB (', DownloadCount, ' ops)')

Stage 10: `project`

| project 
    TimeGenerated,
    User = CsUsername,
    Device = XCDevice,
    Country = XCCountry,
    TotalUploadMB,
    TotalDownloadMB,
    TotalTransferMB,
    UploadOperations = UploadCount,
    DownloadOperations = DownloadCount,
    UniqueFiles,
    FilesSample = Files,
    FileTypes,
    Applications = Apps,
    Destinations,
    DataFlowSummary

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`CsBytes`	gt	`0`	`field:"CsBytes" kind:gt value:"0"`
`CsUsername`	is_not_null	(no value, null check)	`field:"CsUsername" kind:is_not_null`
`ScBytes`	gt	`0`	`field:"ScBytes" kind:gt value:"0"`
`TotalTransferMB`	gt	`50`	`field:"TotalTransferMB" kind:gt value:"50"`
`XRsFileSize`	gt	`0`	`field:"XRsFileSize" kind:gt value:"0"`

Output fields

These fields are emitted when the rule matches.

Field	Source
`Applications`	`project`
`Country`	`project`
`DataFlowSummary`	`project`
`Destinations`	`project`
`Device`	`project`
`DownloadOperations`	`project`
`FileTypes`	`project`
`FilesSample`	`project`
`TimeGenerated`	`project`
`TotalDownloadMB`	`project`
`TotalTransferMB`	`project`
`TotalUploadMB`	`project`
`UniqueFiles`	`project`
`UploadOperations`	`project`
`User`	`project`

Netskope - Data Movement Tracking (Upload/Download Monitoring)

MITRE ATT&CK coverage

Rule body

Stages and Predicates

Parameters

Stage 1: source

Stage 2: where

Stage 3: where

Stage 4: where

Stage 5: extend

Stage 6: summarize

Stage 7: extend

Stage 8: where

Stage 9: extend

Stage 10: project