↳ GitHub sourceAnalytics ruleMedium
Netskope - Unsanctioned/Risky Cloud App Access (Shadow IT)
Description
Alerts when users access unsanctioned or risky cloud applications based on Cloud Confidence Level (CCL) and app tags. Detects Shadow IT usage.
- Rule type
- Scheduled
- Version
- 1.0.0
- Declared status
- Available
- Query frequency
- 1h
- Query period
- 1h
- Trigger
- gt 0
Declared MITRE coverage
Declared sources
Metadata from the source file. No dependencies inferred from KQL.
Connectors
Data types
KQL query
Original query, unchanged.
NetskopeWebTransactions_CL
| where TimeGenerated > ago(1h)
| where isnotempty(CsUsername) and isnotempty(XCsApp)
| where XCsAppTags contains 'Unsanctioned'
or XCsAppCcl =~ 'poor'
or XCsAppCcl =~ 'low'
or XCsAppCci < 50
| summarize
EventCount = count(),
TotalBytesMB = round(sum(Bytes) / 1048576.0, 2),
Activities = make_set(XCsAppActivity),
FirstSeen = min(TimeGenerated),
LastSeen = max(TimeGenerated)
by
CsUsername,
XCsApp,
XCsAppCategory,
XCsAppCcl,
XCsAppCci,
XCsAppTags,
XCCountry,
XCDevice
| extend RiskLevel = case(
XCsAppCci < 30, 'Critical',
XCsAppCci < 50, 'High',
XCsAppCci < 70, 'Medium',
'Low')
| project
TimeGenerated = LastSeen,
User = CsUsername,
RiskyApplication = XCsApp,
AppCategory = XCsAppCategory,
CloudConfidenceLevel = XCsAppCcl,
CloudConfidenceIndex = XCsAppCci,
AppTags = XCsAppTags,
RiskLevel,
Country = XCCountry,
Device = XCDevice,
Activities,
EventCount,
DataTransferMB = TotalBytesMB
Declared entities
Related content
Links established from declared identifiers and solution manifests.
Source provenance
GitHubDisplayed values come from files in Azure/Azure-Sentinel. They describe the published template, not your workspace configuration.
- Commit
9800e51↗- Source identifier
cdc01279-d6ea-41b1-a32d-49d726be95b8
GSTEP / CATALOG TRACKING
Added to catalog : 16 Sept 2026 · 05:49 UTC
Last change observed : 16 Sept 2026 · 05:49 UTC