KQL Search

This query is designed to monitor and detect potentially risky behavior involving large data downloads from cloud storage services using Zscaler ZIA. Here's a simple breakdown of what it does:

1. Purpose: The query identifies users who download more than 500 MB or make more than 200 requests to cloud storage services (like Dropbox, OneDrive, Google Drive, etc.) within a 24-hour period. Such activity could indicate data staging for exfiltration, which might be performed by a malicious insider or a compromised account.

2. Data Source: It uses data from the "CommonSecurityLog" where the vendor is "Zscaler" and excludes blocked or denied actions.

3. Key Metrics:

   • Counts the number of download requests (DownloadCount).
   • Calculates the total amount of data downloaded in megabytes (MBDownloaded).
   • Calculates the total amount of data uploaded in megabytes (MBUploaded).
   • Identifies the number of unique cloud services accessed (UniqueServices).
   • Collects samples of URLs accessed (URLSamples).

4. Risk Assessment:

   • Assigns a risk score based on the volume of data downloaded:
     • "Critical" for downloads over 5000 MB.
     • "High" for downloads over 2000 MB or more than 1000 requests.
     • "Medium" for other cases that meet the initial criteria.

5. Alerting:

   • Generates alerts with details like the username, amount of data downloaded, and risk score.
   • Alerts are grouped by user account to manage incidents efficiently.

6. Incident Management:

   • Automatically creates incidents for detected activities.
   • Groups related alerts into a single incident to avoid duplication.

Overall, this query helps in identifying and managing potential data exfiltration risks by monitoring large-scale data downloads from cloud storage services.