Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
485 detections
Filters
Last updated
All Time
Detection languages
151
136
74
42
39
Contributors
103
95
90
56
41
Categories
88
80
76
66
65
Platforms
210
208
110
108
71
Products / Services
10,660
9,755
6,689
4,418
3,748
485
MITRE Techniques
102
93
89
64
54
CVEs
6
6
5
4
4
Detects command-line activity indicative of attempts to disable, bypass, uninstall, or interfere with the Netskope security agent functionality on an endpoint.
This rule detects large file uploads (greater than 100MB) from endpoints to unmanaged or personal cloud storage services such as Google Drive, OneDrive, and Dropbox. This behavior may indicate unauthorized data exfiltration or the improper use of unapproved cloud storage platforms to move sensitive data outside of corporate control.
Detects instances where Zscaler web security logs identify malware, threats, or viruses, specifically flagging users and destination hosts involved in these blocked or allowed security events.
Detects Mirage2FA phishing stager artifacts by requiring multiple distinctive indicators together: XOR key 0xAD decode chain, LINX*/token placeholders, obfuscator.io _0x naming, api/xls C2 path, iframe injection, and SVG ECMAScript AiTM redirect
Detects user activity involving unsanctioned or 'Shadow IT' applications that have a low or poor Cloud Confidence Index (CCI) rating, as reported by Netskope. This rule helps identify potential security risks associated with the use of unapproved or newly observed cloud services.
Detects when a user authorizes an OAuth application that requests high or critical permissions in a SaaS environment via Netskope logs. This pattern is commonly used in OAuth-based phishing campaigns or illicit application consent grants where adversaries attempt to gain persistent access to cloud resources.
This rule identifies active, high or critical severity regulatory compliance violations (e.g., GDPR, HIPAA, PCI-DSS, NIST) reported by Zscaler Data Security Posture Management (DSPM). It further highlights assets with repeat violations across multiple regulatory frameworks, facilitating prioritization of remediation efforts for critical compliance gaps.
Detects instances where Netskope security solution has identified and blocked web-based traffic classified as malware or a security threat.
Detects high-risk administrative actions within Netskope, including the deletion of security policies, modification of Data Loss Prevention (DLP) rules, disabling of threat protection features, or the creation of new API tokens and administrative accounts. The rule flags these activities as 'critical' or 'high' severity, particularly if they occur outside standard business hours.
Detects anomalous activity where a user account experiences access denials across a high number of distinct applications (>= 5) within a 15-minute window via Zscaler Private Access. This pattern often indicates unauthorized exploration, directory probing, or automated credential testing against enterprise resources.
Detects DLP events from Netskope where sensitive data (PII, PCI, Source Code, or Credentials) is being uploaded or shared, indicating potential data exfiltration.
Detects DLP policy violations flagged by Netskope when users upload, share, post, or send files within Slack or Microsoft Teams. This rule monitors for DLP profile matches which may indicate unauthorized exfiltration or exposure of sensitive data via collaboration tools.
Detects anomalous activity where a user account experiences access denials across a high number of distinct applications (>= 5) within a 15-minute window via Zscaler Private Access. This pattern often indicates unauthorized exploration, directory probing, or automated credential testing against enterprise resources.
Detects a Cortex management audit event indicating that a Broker VM high-availability cluster has no available standby node, signaling reduced redundancy and potential risk to data collection services.
Detects instances where Netskope security solution has identified and blocked web-based traffic classified as malware or a security threat.
Detects anomalous access attempts to Netskope Private Access applications, specifically identifying connections from unmanaged devices, access occurring outside of typical business hours, or access from unusual/unexpected geographic locations.
Detects administrative changes to Zscaler location templates that disable critical security enforcement settings, specifically Firewall Control, IPS Control, or Acceptable Use Policy (AUP) enforcement. Such modifications may indicate an attempt to weaken an organization's perimeter defense posture.
Detects DLP policy violations flagged by Netskope when users upload, share, post, or send files within Slack or Microsoft Teams. This rule monitors for DLP profile matches which may indicate unauthorized exfiltration or exposure of sensitive data via collaboration tools.
Detects audit events in Imperva Cloud WAF where SSL/TLS configuration has been explicitly removed from a protected site. This change impacts the security posture of HTTPS delivery and requires validation to ensure it was an authorized administrative action.
This rule identifies active, high or critical severity regulatory compliance violations (e.g., GDPR, HIPAA, PCI-DSS, NIST) reported by Zscaler Data Security Posture Management (DSPM). It further highlights assets with repeat violations across multiple regulatory frameworks, facilitating prioritization of remediation efforts for critical compliance gaps.
KQL Query
Page 10 of 24