Forcepoint Secure Web Gateway abnormal number of blocked urls accessed by user

This rule is part of a beta feature. To learn more, contact Support.
forcepoint-secure-web-gateway

Classification:

attack

Tactic:

TA0011-command-and-control

Technique:

T1102-web-service

Set up the forcepoint-secure-web-gateway integration.

이 페이지는 아직 영어로 제공되지 않습니다. 번역 작업 중입니다.
현재 번역 프로젝트에 대한 질문이나 피드백이 있으신 경우 언제든지 연락주시기 바랍니다.

Goal

Identify users who are attempting to access an unusually anomalous number of blocked URLs.

Strategy

This rule analyzes Forcepoint SWG logs to detect an anomalous number of blocked URL access attempts by users.

Triage and Response

  1. Review the Forcepoint SWG logs for user {{@usr.name}} associated with this abnormal number of blocked URL access attempts.
  2. Engage with the user to understand the intent behind the blocked access attempts.
  3. Reset the user’s credentials immediately if a compromise is suspected.
  4. Educate the user about acceptable browsing behavior and your organization’s internet usage policy.