Classification:

attack

Tactic:

TA0011-command-and-control

Technique:

T1102-web-service

VIEW RULE IN DATADOG VIEW SIGNALS

Set up the forcepoint-secure-web-gateway integration.

Goal

Identify users who are attempting to access an unusually anomalous number of blocked URLs.

Strategy

This rule analyzes Forcepoint SWG logs to detect an anomalous number of blocked URL access attempts by users.

Triage and Response

1. Review the Forcepoint SWG logs for user {{@usr.name}} associated with this abnormal number of blocked URL access attempts.
2. Engage with the user to understand the intent behind the blocked access attempts.
3. Reset the user’s credentials immediately if a compromise is suspected.
4. Educate the user about acceptable browsing behavior and your organization’s internet usage policy.