111 lines
2.8 KiB
JSON
111 lines
2.8 KiB
JSON
{
|
|
"version": 1,
|
|
"defaults": {
|
|
"enabled": true,
|
|
"cooldownSeconds": 300,
|
|
"action": "log",
|
|
"severity": "low"
|
|
},
|
|
"rules": [
|
|
{
|
|
"id": "personal-web-during-workhours",
|
|
"enabled": true,
|
|
"cooldownSeconds": 600,
|
|
"action": "alert",
|
|
"severity": "medium",
|
|
"message": "Личные ресурсы в рабочее время",
|
|
"when": {
|
|
"categoryGroups": ["personal"],
|
|
"hourFrom": 9,
|
|
"hourTo": 19
|
|
}
|
|
},
|
|
{
|
|
"id": "high-risk-cloud-storage",
|
|
"enabled": true,
|
|
"cooldownSeconds": 900,
|
|
"action": "alert",
|
|
"severity": "high",
|
|
"message": "Подозрительный доступ к облачному хранилищу",
|
|
"when": {
|
|
"domains": [
|
|
"dropbox.com",
|
|
"drive.google.com",
|
|
"mega.nz",
|
|
"onedrive.live.com",
|
|
"disk.yandex.ru"
|
|
]
|
|
}
|
|
},
|
|
{
|
|
"id": "anonymizer-and-vpn-web",
|
|
"enabled": true,
|
|
"cooldownSeconds": 900,
|
|
"action": "alert",
|
|
"severity": "high",
|
|
"message": "Использование веб-анонимайзеров / VPN-сервисов",
|
|
"when": {
|
|
"domains": [
|
|
"hidemy.name",
|
|
"2ip.ru",
|
|
"whoer.net",
|
|
"protonvpn.com",
|
|
"nordvpn.com"
|
|
]
|
|
}
|
|
}
|
|
],
|
|
"endpoint": {
|
|
"clipboard": [
|
|
{
|
|
"id": "clipboard-sensitive-keywords",
|
|
"enabled": true,
|
|
"cooldownSeconds": 300,
|
|
"action": "alert",
|
|
"severity": "high",
|
|
"message": "В буфере обнаружены чувствительные ключевые слова",
|
|
"minLength": 20,
|
|
"regexPatterns": [
|
|
"(?i)парол(ь|и)",
|
|
"(?i)password",
|
|
"(?i)secret",
|
|
"(?i)cvv",
|
|
"(?i)паспорт"
|
|
]
|
|
}
|
|
],
|
|
"usb": [
|
|
{
|
|
"id": "usb-media-connected",
|
|
"enabled": true,
|
|
"cooldownSeconds": 300,
|
|
"action": "alert",
|
|
"severity": "medium",
|
|
"message": "Подключен съемный носитель"
|
|
}
|
|
],
|
|
"print": [
|
|
{
|
|
"id": "print-sensitive-docs",
|
|
"enabled": true,
|
|
"cooldownSeconds": 300,
|
|
"action": "alert",
|
|
"severity": "high",
|
|
"message": "Печать документа с признаками чувствительных данных",
|
|
"documentRegex": "(?i)(salary|зарплат|passport|паспорт|договор|contract)"
|
|
}
|
|
]
|
|
},
|
|
"contentAnalysis": {
|
|
"dictionaryPack": "152-fz-pdn",
|
|
"regexPack": "secrets",
|
|
"ocrEnabled": true
|
|
},
|
|
"ioc": {
|
|
"enabled": true,
|
|
"source": "http://10.10.10.13:5610/dlp-ioc/ioc_blacklist.json",
|
|
"format": "hayabusa_sigma_v1",
|
|
"refreshMinutes": 360
|
|
}
|
|
}
|