Netskope app-to-app sync between sanctioned and personal/unsanctioned app instance
This rule detects data synchronization activities between sanctioned enterprise applications and unsanctioned or personal cloud applications using Netskope logs. This pattern often indicates potential shadow IT usage or unauthorized data exfiltration from controlled environments to personal storage services.
Microsoft Sentinel (KQL)
