Zero Networks unusual spike in blocked network activity

This rule is part of a beta feature. To learn more, contact Support.
zero-networks

Classification:

attack

Tactic:

TA0007-discovery

Technique:

T1046-network-service-discovery

Goal

Detects unusual spike in blocked network activity.

Strategy

Monitor network activity logs and notify when unusual spike in blocked network activity.

Triage and Response

  1. Determine if the spike in blocked activity is widespread or isolated to a specific part of the network.
  2. Identify which systems or devices are involved, and check if any of them are outliers or have known vulnerabilities.
  3. Investigate if the spike corresponds with any recent changes, such as new devices, updates, or policy changes.
  4. Look for any related security alerts or system anomalies that might explain the spike in blocked activity.