Forcepoint Secure Web Gateway threat indicator detected

This rule is part of a beta feature. To learn more, contact Support.

Classification:

attack

Tactic:

Technique:

このページは日本語には対応しておりません。随時翻訳に取り組んでいます。
翻訳に関してご質問やご意見ございましたら、お気軽にご連絡ください。

Goal

Identify that a threat indicator was detected within Forcepoint Secure Web Gateway.

This rule analyzes Forcepoint SWG logs to identify a detected threat indicator.

Analyze the Forcepoint SWG logs and identify the user {{@usr.name}} associated with the occurrences of flagged threat indicator.
Review activities, accessed URLs, and files associated with the flagged threat indicators to understand the nature of the threat indicator.
Assess web categories and reputation scores of accessed URLs.
Examine patterns like DLP pattern or keyword to identify sensitive or regulated data involved in the flagged actions.
Quarantine flagged files or data uploads if they contain sensitive information.
Block further access to flagged URLs or applications if not already restricted.
Suspend or reset the user’s account credentials if compromise is suspected.