Zscaler ZDX - Unexpected Network Path / ASN Change (Possible Route Hijack)
This rule detects when a user's network connection originates from an Autonomous System Number (ASN) that differs from their previously established baseline using Zscaler Digital Experience (ZDX) telemetry. This can indicate anomalous network behavior, such as a user connecting from an unexpected location or a potentially compromised VPN/proxy session.
Microsoft Sentinel (KQL)
