Netskope : Anomaly Event

Vendor Documentation

https://www.netskope.com/blog/the-eight-must-haves-for-successful-anomaly-detection

Classification

Rule Name	Rule Type	Classification	Common Event
Netskope : Anomaly Event	Base Rule	Suspicious	Suspicious User Activity

Mapping with LogRhythm Schema

Device Key in Log Message	LogRhythm Schema	Data Type
Device Vendor	N/A	N/A
Device Product	N/A	N/A
Device Version	N/A	N/A
Device Event Class ID	<vmid>	Text/String
Name of the event	<vendorinfo>, <tag1>	Text/String
Severity of the event	<severity>	Text/String
act	<action>	Text/String
anomalyEventType	N/A	N/A
cci	N/A	N/A
ccl	N/A	N/A
dst	<dip>	IP Address
requestClientApplication	N/A	N/A
Action	N/A	N/A
sourceServiceName	<process>	Text/String
src	<sip>	IP Address
suser	<login>	Text/String
timestamp	N/A	N/A
url	<url>	Text/String

Please note, these errors can depend on your browser setup.

If this problem persists, please contact our support.