Netskope - New Risky App Access vs 7-Day Baseline

Status: available
Severity: medium
Time window: 8d
Group by: CsUsername, XCsApp
Source: github.com/Azure/Azure-Sentinel

Compares today's accessed applications against a 7-day baseline and triggers alerts when users access new risky applications not seen before.

MITRE ATT&CK coverage

Tactic	Techniques
Initial Access	`T1199` Trusted Relationship
Discovery	`T1526` Cloud Service Discovery

Rule body

id: ba66b81c-2cf7-4c53-9db0-e8b6f537704a
name: Netskope - New Risky App Access vs 7-Day Baseline
description: |
  Compares today's accessed applications against a 7-day baseline and triggers alerts when users access new risky applications not seen before.
severity: Medium
status: Available
requiredDataConnectors:
  - connectorId: NetskopeWebTxConnector
    dataTypes:
      - NetskopeWebTransactions_CL
queryFrequency: 1d
queryPeriod: 8d
triggerOperator: gt
triggerThreshold: 0
tactics:
  - InitialAccess
  - Discovery
relevantTechniques:
  - T1199
  - T1526
query: |
  let lookbackPeriod = 7d;
  let currentPeriod = 1d;
  let baseline = NetskopeWebTransactions_CL
      | where TimeGenerated between (ago(lookbackPeriod) .. ago(currentPeriod))
      | where isnotempty(CsUsername) and isnotempty(XCsApp)
      | summarize BaselineApps = make_set(XCsApp) by CsUsername;
  let current = NetskopeWebTransactions_CL
      | where TimeGenerated > ago(currentPeriod)
      | where isnotempty(CsUsername) and isnotempty(XCsApp)
      | where XCsAppCcl =~ 'poor' or XCsAppCcl =~ 'low' or XCsAppCcl =~ 'medium' or XCsAppCci < 70
      | summarize 
          CurrentApps = make_set(XCsApp),
          arg_max(TimeGenerated, XCsAppCcl, XCsAppCci, XCsAppCategory)
          by CsUsername, XCsApp;
  current
  | join kind=leftouter baseline on CsUsername
  | extend BaselineApps = coalesce(BaselineApps, dynamic([]))
  | where not(set_has_element(BaselineApps, XCsApp))
  | where isnotempty(XCsApp)
  | where XCsAppCci < 70 or XCsAppCcl =~ 'poor' or XCsAppCcl =~ 'low'
  | project 
      TimeGenerated,
      User = CsUsername,
      NewRiskyApp = XCsApp,
      AppCCL = XCsAppCcl,
      AppCCI = XCsAppCci,
      AppCategory = XCsAppCategory,
      BaselineAppCount = array_length(BaselineApps)
entityMappings:
  - entityType: Account
    fieldMappings:
      - identifier: Name
        columnName: User
  - entityType: CloudApplication
    fieldMappings:
      - identifier: Name
        columnName: NewRiskyApp
version: 1.0.0
kind: Scheduled

Stages and Predicates

Parameters

let lookbackPeriod = 7d;
let currentPeriod = 1d;

let current is inlined into the numbered stages below.

Let binding: `baseline` used in Stage 6

let baseline = NetskopeWebTransactions_CL
    | where TimeGenerated between (ago(lookbackPeriod) .. ago(currentPeriod))
    | where isnotempty(CsUsername) and isnotempty(XCsApp)
    | summarize BaselineApps = make_set(XCsApp) by CsUsername;

Stages 1 to 5 define let current (the rule's main pipeline source); stages 6 to 11 run on it.

Stage 1: `source`

NetskopeWebTransactions_CL

Stage 2: `where`

| where TimeGenerated > ago(currentPeriod)

Stage 3: `where`

| where isnotempty(CsUsername) and isnotempty(XCsApp)

Stage 4: `where`

| where XCsAppCcl =~ 'poor' or XCsAppCcl =~ 'low' or XCsAppCcl =~ 'medium' or XCsAppCci < 70

Stage 5: `summarize`

| summarize 
        CurrentApps = make_set(XCsApp),
        arg_max(TimeGenerated, XCsAppCcl, XCsAppCci, XCsAppCategory)
        by CsUsername, XCsApp

Stage 6: `join`

current
| join kind=leftouter baseline on CsUsername

Stage 7: `extend`

| extend BaselineApps = coalesce(BaselineApps, dynamic([]))

Stage 8: `where`

| where not(set_has_element(BaselineApps, XCsApp))

Stage 9: `where`

| where isnotempty(XCsApp)

Stage 10: `where`

| where XCsAppCci < 70 or XCsAppCcl =~ 'poor' or XCsAppCcl =~ 'low'

Stage 11: `project`

| project 
    TimeGenerated,
    User = CsUsername,
    NewRiskyApp = XCsApp,
    AppCCL = XCsAppCcl,
    AppCCI = XCsAppCci,
    AppCategory = XCsAppCategory,
    BaselineAppCount = array_length(BaselineApps)

Exclusions

The rule actively suppresses these predicates.

Field	Kind	Excluded values	Search
`XCsApp`	eq	`BaselineApps`	`excludes:XCsApp` `field:"XCsApp" value:"BaselineApps"`

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`CsUsername`	is_not_null	(no value, null check)	`field:"CsUsername" kind:is_not_null`
`XCsApp`	is_not_null	(no value, null check)	`field:"XCsApp" kind:is_not_null`
`XCsAppCci`	lt	`70`	`field:"XCsAppCci" kind:lt value:"70"`
`XCsAppCcl`	eq	`low` `medium` `poor`	`field:"XCsAppCcl" kind:eq`

Output fields

These fields are emitted when the rule matches.

Field	Source
`AppCCI`	`project`
`AppCCL`	`project`
`AppCategory`	`project`
`BaselineAppCount`	`project`
`NewRiskyApp`	`project`
`TimeGenerated`	`project`
`User`	`project`

Netskope - New Risky App Access vs 7-Day Baseline

MITRE ATT&CK coverage

Rule body

Stages and Predicates

Parameters

Let binding: baseline used in Stage 6

Stage 1: source

Stage 2: where

Stage 3: where

Stage 4: where

Stage 5: summarize

Stage 6: join

Stage 7: extend

Stage 8: where

Stage 9: where

Stage 10: where

Stage 11: project