Classification:

attack

VIEW RULE IN DATADOG VIEW SIGNALS

Set up the forcepoint-security-service-edge integration.

Goal

Detects Forcepoint SSE logs with an Alert action.

Strategy

This rule monitors all the Forcepoint SSE logs for which the Alert action is enforced by Forcepoint ONE SSE according to the set policy.

Triage and Response

1. Review the specific alert action enforced by Forcepoint ONE SSE from IP Address - {{@network.client.ip}} to analyze the corresponding log entry to understand the context of the alert.
2. Determine the affected system, user, or resource related to the alert and assess the potential risk or impact based on the policy violation or enforced action. Analyze activity performed by which user and the application detail as below:
   Activity- {{@activity}} | Performed By- {{@usr.name}} | Application- {{@application}}
3. If necessary, update or refine the policy in Forcepoint ONE SSE to prevent false positives or improve enforcement.
4. If the alert indicates a critical security threat or unusual activity, escalate it to the security operations team for further investigation.