Forcepoint Security Service Edge alert event

This rule is part of a beta feature. To learn more, contact Support.
forcepoint-security-service-edge

Classification:

attack

이 페이지는 아직 영어로 제공되지 않습니다. 번역 작업 중입니다.
현재 번역 프로젝트에 대한 질문이나 피드백이 있으신 경우 언제든지 연락주시기 바랍니다.

Goal

Detects Forcepoint SSE logs with an Alert action.

Strategy

This rule monitors all the Forcepoint SSE logs for which the Alert action is enforced by Forcepoint ONE SSE according to the set policy.

Triage and Response

  1. Review the specific alert action enforced by Forcepoint ONE SSE from IP Address - {{@network.client.ip}} to analyze the corresponding log entry to understand the context of the alert.
  2. Determine the affected system, user, or resource related to the alert and assess the potential risk or impact based on the policy violation or enforced action. Analyze activity performed by which user and the application detail as below:
    Activity- {{@activity}} | Performed By- {{@usr.name}} | Application- {{@application}}
  3. If necessary, update or refine the policy in Forcepoint ONE SSE to prevent false positives or improve enforcement.
  4. If the alert indicates a critical security threat or unusual activity, escalate it to the security operations team for further investigation.