Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
485 detections
Filters
Last updated
All Time
Detection languages
151
136
74
42
39
Contributors
103
95
90
56
41
Categories
88
80
76
66
65
Platforms
210
208
110
108
71
Products / Services
10,660
9,755
6,689
4,418
3,748
485
MITRE Techniques
102
93
89
64
54
CVEs
6
6
5
4
4
Detects a significant increase in Zscaler Risk360 risk scores or the emergence of new high-impact security insights. This rule monitors for category-specific risk spikes (External Attack Surface, Compromise, Lateral Propagation, or Data Loss) that exceed a defined delta threshold or are flagged as Critical/High severity, serving as a posture-based alert for security investigation.
Detects users who have triggered five or more blocks by Netskope security policies for high-risk web categories such as Anonymizers, Hacking, Gambling, or Adult Content. This behavior may indicate an attempt to circumvent security controls or persistent engagement with prohibited content.
Detects sensitive files in cloud storage environments that have been shared publicly or with external entities, as identified by Netskope CASB (DLP) policies. This rule monitors for events where storage objects are assigned broad access permissions (e.g., 'public', 'anyone with link') in conjunction with DLP incident triggers.
Detects instances where Zscaler web security logs identify malware, threats, or viruses, specifically flagging users and destination hosts involved in these blocked or allowed security events.
This rule detects large file uploads (greater than 100MB) from endpoints to unmanaged or personal cloud storage services such as Google Drive, OneDrive, and Dropbox. This behavior may indicate unauthorized data exfiltration or the improper use of unapproved cloud storage platforms to move sensitive data outside of corporate control.
Detects users who have triggered five or more blocks by Netskope security policies for high-risk web categories such as Anonymizers, Hacking, Gambling, or Adult Content. This behavior may indicate an attempt to circumvent security controls or persistent engagement with prohibited content.
Detects sensitive files in cloud storage environments that have been shared publicly or with external entities, as identified by Netskope CASB (DLP) policies. This rule monitors for events where storage objects are assigned broad access permissions (e.g., 'public', 'anyone with link') in conjunction with DLP incident triggers.
KQL Query
Detects administrative changes to Zscaler location templates that disable critical security enforcement settings, specifically Firewall Control, IPS Control, or Acceptable Use Policy (AUP) enforcement. Such modifications may indicate an attempt to weaken an organization's perimeter defense posture.
Detects a significant increase in Zscaler Risk360 risk scores or the emergence of new high-impact security insights. This rule monitors for category-specific risk spikes (External Attack Surface, Compromise, Lateral Propagation, or Data Loss) that exceed a defined delta threshold or are flagged as Critical/High severity, serving as a posture-based alert for security investigation.
Detects instances where Netskope Advanced Threat Protection (ATP) identifies a malicious file during a user-initiated upload or download operation.
This rule detects data synchronization activities between sanctioned enterprise applications and unsanctioned or personal cloud applications using Netskope logs. This pattern often indicates potential shadow IT usage or unauthorized data exfiltration from controlled environments to personal storage services.
Detects command-line activity indicative of attempts to disable, bypass, uninstall, or interfere with the Netskope security agent functionality on an endpoint.
Detects user activity involving unsanctioned or 'Shadow IT' applications that have a low or poor Cloud Confidence Index (CCI) rating, as reported by Netskope. This rule helps identify potential security risks associated with the use of unapproved or newly observed cloud services.
Detects when a user authorizes an OAuth application that requests high or critical permissions in a SaaS environment via Netskope logs. This pattern is commonly used in OAuth-based phishing campaigns or illicit application consent grants where adversaries attempt to gain persistent access to cloud resources.
Detects DLP events from Netskope where sensitive data (PII, PCI, Source Code, or Credentials) is being uploaded or shared, indicating potential data exfiltration.
Detects instances where Netskope Advanced Threat Protection (ATP) identifies a malicious file during a user-initiated upload or download operation.
This rule analyzes recent agent telemetry to identify and summarize the distribution of local agent vendors present in the environment over a 30-day lookback period. It extracts vendor information from agent metadata and provides a frequency count to assist in auditing deployed infrastructure agents.
This rule detects potentially malicious AI prompt injection attempts targeting web-based AI assistants like Microsoft Copilot or Atlassian Rovo. It monitors CommonSecurityLog data for specific URL parameters (rovoChatPrompt, q, prompt) containing suspicious keywords (e.g., 'ignore', 'system', 'exfiltrate') or unusually long parameter values, which are indicators of efforts to bypass AI safety guardrails or perform data exfiltration via prompt manipulation.
This rule detects repeated ZTNA/ZPA session restore failures for a single user within a short timeframe (15 minutes). A high number of session restore failures can indicate potential brute force attempts, token manipulation, or automated abuse of session management mechanisms.
This rule detects repeated ZTNA/ZPA session restore failures for a single user within a short timeframe (15 minutes). A high number of session restore failures can indicate potential brute force attempts, token manipulation, or automated abuse of session management mechanisms.
Page 11 of 24