Detection rules › Panther
Action Performed by Netskope Personnel
An action was performed by Netskope personnel.
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Initial Access | T1195 Supply Chain Compromise |
Rule body yaml
AnalysisType: rule
RuleID: "Netskope.NetskopePersonnelActivity"
DisplayName: "Action Performed by Netskope Personnel"
Enabled: true
Filename: netskope_personnel_action.py
LogTypes:
- Netskope.Audit
Tags:
- Netskope
- Supply Chain Compromise
Reports:
MITRE ATT&CK:
- TA0001:T1195
Severity: Medium
Description: An action was performed by Netskope personnel.
DedupPeriodMinutes: 60
Threshold: 1
Runbook: Action taken by Netskope Personnel. Validate that this action was authorized.
Reference: https://docs.netskope.com/en/netskope-help/admin-console/administration/audit-log/#filters-1
Tests:
- Name: True positive
ExpectedResult: true
Log:
{
"_id": "e5ca619b059fccdd0cfd9398",
"_insertion_epoch_timestamp": 1702308331,
"audit_log_event": "Login Successful",
"count": 1,
"is_netskope_personnel": true,
"organization_unit": "",
"severity_level": 2,
"supporting_data":
{
"data_type": "user",
"data_values": ["11.22.33.44", "adminsupport@netskope.com"],
},
"timestamp": "2023-12-11 15:25:31.000000000",
"type": "admin_audit_logs",
"ur_normalized": "adminsupport@netskope.com",
"user": "adminsupport@netskope.com",
}
- Name: True negative
ExpectedResult: false
Log:
{
"_id": "1e589befa3da30132362f32a",
"_insertion_epoch_timestamp": 1702318213,
"audit_log_event": "Rest API V2 Call",
"count": 1,
"is_netskope_personnel": false,
"organization_unit": "",
"severity_level": 2,
"supporting_data":
{
"data_type": "incidents",
"data_values":
[
200,
"POST",
"/api/v2/incidents/uba/getuci",
"trid=ccb898fgrhvdd0v0lebg",
],
},
"timestamp": "2023-12-11 18:10:13.000000000",
"type": "admin_audit_logs",
"ur_normalized": "service-account",
"user": "service-account",
}
Detection logic
Condition
is_netskope_personnel eq "True"
Indicators
Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.
| Field | Kind | Values |
|---|---|---|
is_netskope_personnel | eq |
|
Output fields
Fields the rule emits when it matches. Chronicle authors list these in the outcome block; they appear on the detection and $risk_score drives alerting. Sentinel / Defender XDR rules build them up through project / summarize / extend stages. Sentinel maps these into alert fields via entityMappings and customDetails; Defender XDR custom detections surface them as alert fields directly.
| Field |
|---|
audit_log_event |
user |