Citrix Analytics for Security™

数据外泄

从 SaaS 应用打印

当文件从不允许打印的 SaaS 应用程序中打印时,会发生此情况。它通过监控 SaaS 应用程序中的打印操作来检测潜在的数据外泄。

详细信息

数据源:应用程序和桌面 (Citrix Enterprise Browser™)

CAS 查询

Event-Type = "App.SaaS.File.Print" AND SaaS-App-Name = "<App-Name>"
<!--NeedCopy-->

Sigma 签名

author: Citrix®
date: 2023/01/31
description: 从 SaaS 应用打印
detection:
  condition: selection and not filter_null and filter_saas_app_name
  filter_saas_app_name:
  -  saas_app_name: '<App-Name>'
  filter_null:
  -  saas_app_name: null
  selection:
  -  occurrence_event_type: App.SaaS.File.Print
logsource:
  product: citrixanalytics
  service: security
title: 从 SaaS 应用打印
<!--NeedCopy-->

SaaS 应用中的剪贴板使用情况

当从任何 SaaS 应用程序执行剪切、复制或粘贴活动时,会发生此情况。它通过监控剪贴板操作来检测组织中 SaaS 应用程序的潜在数据外泄。

详细信息

数据源:应用程序和桌面 (Citrix Enterprise Browser)

CAS 查询

Event-Type = "App.SaaS.Clipboard" AND Clipboard-Result = "success" AND Clipboard-Operation IN ( "copy" , "cut" )
<!--NeedCopy-->

Sigma 签名

author: Citrix
date: 2023/01/31
description: SaaS 应用中的剪贴板使用情况
detection:
  condition: selection and not filter_null and filter_clipboard_details_result and filter_clipboard_operation
  filter_clipboard_details_result:
  -  clipboard_details_result: 'success'
  filter_clipboard_operation:
  -  clipboard_operation: ['cut', 'copy', '<Other Operation>']
  filter_null:
  -  clipboard_operation: null
  -  clipboard_details_result: null
  selection:
  -  occurrence_event_type: App.SaaS.Clipboard
logsource:
  product: citrixanalytics
  service: security
title: SaaS 应用中的剪贴板使用情况
<!--NeedCopy-->
数据外泄