Netskope high-risk admin config changes (policy/DLP/protection deletion, admin/API token creation)
Detects high-risk administrative actions within Netskope, including the deletion of security policies, modification of Data Loss Prevention (DLP) rules, disabling of threat protection features, or the creation of new API tokens and administrative accounts. The rule flags these activities as 'critical' or 'high' severity, particularly if they occur outside standard business hours.
Splunk (SPL)
