Sunturai
Back to results
MediumMicrosoft Sentinel analytics

Zero Networks Segment - Rare JIT Rule Creation

Identifies when a JIT Rule connection is new or rare by a given account today based on comparison with the previous 14 days. JIT Rule creations are indicated by the Activity Type Id 20

Detection logic

Detection requirements

Platform
ESXiIaaSLinuxmacOSWindows

The rule states no platform. This is derived from the ATT&CK technique it maps to.

Log source product
zeronetworkssegmentauditfunctionzeronetworkssegmentauditnativepoller
Log source service
znsegmentaudit_clznsegmentauditnativepoller_cl

Detections can measure how the public catalogue is used — which detections people look for, and which pages bring them here. It sets a cookie that recognises this browser for 180 days. It is never linked to an account and never follows you to other sites. Privacy notice