Netskope : Anomaly Event

Base Rule

Suspicious

Suspicious User Activity

Device Vendor

N/A

N/A

Device Product

N/A 

N/A

Device Version

N/A

N/A

Device Event Class ID

<vmid>

Text/String

Name of the event

<vendorinfo>, <tag1>

Text/String

Severity of the event

<severity>

Text/String

act

<action>

Text/String

anomalyEventType

N/A

N/A

cci

N/A

N/A

ccl

N/A

N/A

dst

<dip>

IP Address

requestClientApplication

N/A

N/A

Action

N/A

N/A

sourceServiceName

<process>

Text/String

src

<sip>

IP Address

suser

<login>

Text/String

timestamp

N/A

N/A

url

<url>

Text/String