59 lines
1.3 KiB
JSON
59 lines
1.3 KiB
JSON
{
|
|
"version": 1,
|
|
"defaults": {
|
|
"enabled": true,
|
|
"cooldownSeconds": 300,
|
|
"action": "log",
|
|
"severity": "low"
|
|
},
|
|
"rules": [
|
|
{
|
|
"id": "personal-web-during-workhours",
|
|
"enabled": true,
|
|
"cooldownSeconds": 600,
|
|
"action": "alert",
|
|
"severity": "medium",
|
|
"message": "Личные ресурсы в рабочее время",
|
|
"when": {
|
|
"categoryGroups": ["personal"],
|
|
"hourFrom": 9,
|
|
"hourTo": 19
|
|
}
|
|
},
|
|
{
|
|
"id": "high-risk-cloud-storage",
|
|
"enabled": true,
|
|
"cooldownSeconds": 900,
|
|
"action": "alert",
|
|
"severity": "high",
|
|
"message": "Подозрительный доступ к облачному хранилищу",
|
|
"when": {
|
|
"domains": [
|
|
"dropbox.com",
|
|
"drive.google.com",
|
|
"mega.nz",
|
|
"onedrive.live.com",
|
|
"disk.yandex.ru"
|
|
]
|
|
}
|
|
},
|
|
{
|
|
"id": "anonymizer-and-vpn-web",
|
|
"enabled": true,
|
|
"cooldownSeconds": 900,
|
|
"action": "alert",
|
|
"severity": "high",
|
|
"message": "Использование веб-анонимайзеров / VPN-сервисов",
|
|
"when": {
|
|
"domains": [
|
|
"hidemy.name",
|
|
"2ip.ru",
|
|
"whoer.net",
|
|
"protonvpn.com",
|
|
"nordvpn.com"
|
|
]
|
|
}
|
|
}
|
|
]
|
|
}
|