Document toolboxDocument toolbox

Platform alert pack: Proxy

Purpose

This content pack is a bundle of out-of-the-box detections that offer quick coverage of alerts using Devo’s Security Operations application’s power but without the need to have the Security Operations application installed.

What is a proxy?

Similar to firewalls, proxies are one of the last bastions of defense for your company. They act as the gatekeeper protecting your users and computers from the outside world. If compromised, it can open your company to outside threats and risks that could incur a loss. In order to ensure a more comprehensive security outlook, Devo’s detections provide the extra assurance that any crack in the wall is made known to your SOC and your company. Download this alert pack to instantly provide the coverage your company is missing.

Included alerts

Security Operations application

SecOps users can obtain detailed information if they install these alerts using the Content Manager instead.

SecOpsRevilKaseyaWebShellsUploadConn

SecOpsProxyHttpSingleCharacterFileNameRequest

SecOpsPortIntoURL

SecOpsNonStandardHTTPMethod

SecOpsLog4ShellVulnerabilityOverProxyConnections

SecOpsSeveralAccessByProxy

SecOpsOutcomingUnauthenticatedArbitraryFileReadInVMwareVCenter

SecOpsProxyGithubRawURLResourceRequest

SecOpsDynamicDNSDetected

SecOpsMultipleHTTPMethodsUsed

SecOpsProxyLargeFileUpload

SecOpsIPInsteadADomainInURL

SecOpsUserBlockedbyProxy

SecOpsProxyHttpExternalPowershellRequest

 

Prerequisites

To use this alert pack, you must have the following data sources available on your domain:

  • proxy.all.access

Open alert pack

Once you have installed the desired alerts individually, you can use the Open button at the top right of the card in Exchange to access the Alert configuration, where you can apply filters to find them and later manage them as required. You can also access this area via the Navigation pane (Administration → Alert Configuration → Available alerts).

Platform alert packs (use alert pack).png

Use alert pack

The alerts installed are deactivated by default. Access the Alert configuration area to activate those you need and assign sending policies to receive them through the desired channels.