产品文档
Citrix Analytics for Security
查看 PDF

数据泄露

November 26, 2023
投稿者: 
C

从 SaaS 应用程序打印

当从不允许打印的 SaaS 应用程序打印文件时，就会发生这种情况。它通过在 SaaS 应用程序中进行打印操作来检测潜在的数据泄露。

详细信息

数据源：应用程序和桌面 (Citrix Enterprise Browser)

CAS 查询 

Event-Type = "App.SaaS.File.Print" AND SaaS-App-Name = "<App-Name>"
<!--NeedCopy-->

Sigma 签名 

author: Citrix
date: 2023/01/31
description: Printing from SaaS apps
detection:
  condition: selection and not filter_null and filter_saas_app_name
  filter_saas_app_name:
  - saas_app_name: '<App-Name>'
  filter_null:
  - saas_app_name: null
  selection:
  - occurrence_event_type: App.SaaS.File.Print
logsource:
  product: citrixanalytics
  service: security
title: Printing from SaaS apps
<!--NeedCopy-->

在 SaaS 应用程序上使用剪贴板

当使用任何 SaaS 应用程序完成剪切、复制或粘贴活动时，就会发生这种情况。它通过监视剪贴板操作来检测组织中 SaaS 应用程序的潜在数据泄露情况。

详细信息

数据源：应用程序和桌面 (Citrix Enterprise Browser)

CAS 查询 

Event-Type = "App.SaaS.Clipboard" AND Clipboard-Result = "success" AND Clipboard-Operation IN ( "copy" , "cut" )
<!--NeedCopy-->

Sigma 签名 

author: Citrix
date: 2023/01/31
description: Clipboard usage on SaaS apps
detection:
  condition: selection and not filter_null and filter_clipboard_details_result and filter_clipboard_operation
  filter_clipboard_details_result:
  - clipboard_details_result: 'success'
  filter_clipboard_operation:
  - clipboard_operation: ['cut', 'copy', '<Other Operation>']
  filter_null:
  - clipboard_operation: null
  - clipboard_details_result: null
  selection:
  - occurrence_event_type: App.SaaS.Clipboard
logsource:
  product: citrixanalytics
  service: security
title: Clipboard usage on SaaS apps
<!--NeedCopy-->
数据泄露
November 26, 2023
投稿者: 
C
November 26, 2023
投稿者: 
C

在本文中

站点反馈 | 隐私和法律条款 | Cookie 首选项 | 同意设置 | docs.cloud.com
© 1999- Cloud Software Group, Inc. All rights reserved.