Detection rules › Kusto
Zscaler - ZPA connections outside operational hours
'Detects ZAP connections outside operational hours.'
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Initial Access |
Rule body
id: 2859ad22-46c8-4cc7-ad7b-80ce0cba0af3
name: Zscaler - ZPA connections outside operational hours
description: |
'Detects ZAP connections outside operational hours.'
severity: Medium
status: Available
requiredDataConnectors:
- connectorId: CustomLogsAma
datatypes:
- ZPA_CL
queryFrequency: 1h
queryPeriod: 1h
triggerOperator: gt
triggerThreshold: 0
tactics:
- InitialAccess
relevantTechniques:
- T1190
- T1133
query: |
ZPAEvent
| where DvcAction == 'open'
| where datetime_part("Hour", todatetime(LogTimestamp)) between (datetime_part("Hour", todatetime('19:01:00.7654321')) .. datetime_part("Hour", todatetime('08:01:00.7654321')))
| summarize count() by DstUserName
| project DstUserName
| extend AccountCustomEntity = DstUserName
entityMappings:
- entityType: Account
fieldMappings:
- identifier: Name
columnName: AccountCustomEntity
version: 1.0.2
kind: Scheduled
Stages and Predicates
Stage 1: source
ZPAEvent
Stage 2: where
| where DvcAction == 'open'
Stage 3: where
| where datetime_part("Hour", todatetime(LogTimestamp)) between (datetime_part("Hour", todatetime('19:01:00.7654321')) .. datetime_part("Hour", todatetime('08:01:00.7654321')))
Stage 4: summarize
| summarize count() by DstUserName
Stage 5: project
| project DstUserName
Stage 6: extend
| extend AccountCustomEntity = DstUserName
Indicators
These rows show field, operator, and value matches.
| Field | Kind | Values | Search |
|---|---|---|---|
DvcAction | eq |
| field:"DvcAction" kind:eq value:"open" |
Output fields
These fields are emitted when the rule matches.
| Field | Source |
|---|---|
DstUserName | project |
AccountCustomEntity | extend |