McAfee ePO - Logging error occurred

Back


Id	0c9243d6-d2ec-48e1-8593-e713859c8f3c
Rulename	McAfee ePO - Logging error occurred
Description	Detects when logging errors on agent.
Severity	Medium
Tactics	DefenseEvasion
Techniques	T1562 T1070
Required data connectors	SyslogAma
Kind	Scheduled
Query frequency	1h
Query period	1h
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/McAfee ePolicy Orchestrator/Analytic Rules/McAfeeEPOLoggingError.yaml
Version	1.0.2
Arm template	0c9243d6-d2ec-48e1-8593-e713859c8f3c.json

KQL

McAfeeEPOEvent
| where EventId in ('1040', '1076', '3032', '3033', '3034', '3036', '3038')
| extend EventMessage = case(EventId == '1040', 'Activity Log error',
                              EventId == '1076', 'Error logging information',
                              EventId == '3032', 'Error while trying to open/create activity log file',
                              EventId == '3033', 'Activity log file maximum size reached',
                              EventId == '3034', 'Unable to write the activity log file',
                              EventId == '3036', 'Error during initialization of the activity log file',
                              'Error writing to log')
| project DvcIpAddr, EventId, EventMessage
| extend IPCustomEntity = DvcIpAddr

YAML

queryPeriod: 1h
query: |
  McAfeeEPOEvent
  | where EventId in ('1040', '1076', '3032', '3033', '3034', '3036', '3038')
  | extend EventMessage = case(EventId == '1040', 'Activity Log error',
                                EventId == '1076', 'Error logging information',
                                EventId == '3032', 'Error while trying to open/create activity log file',
                                EventId == '3033', 'Activity log file maximum size reached',
                                EventId == '3034', 'Unable to write the activity log file',
                                EventId == '3036', 'Error during initialization of the activity log file',
                                'Error writing to log')
  | project DvcIpAddr, EventId, EventMessage
  | extend IPCustomEntity = DvcIpAddr  
name: McAfee ePO - Logging error occurred
entityMappings:
- fieldMappings:
  - columnName: IPCustomEntity
    identifier: Address
  entityType: IP
queryFrequency: 1h
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/McAfee ePolicy Orchestrator/Analytic Rules/McAfeeEPOLoggingError.yaml
requiredDataConnectors:
- connectorId: SyslogAma
  datatypes:
  - Syslog
description: |
    'Detects when logging errors on agent.'
kind: Scheduled
version: 1.0.2
status: Available
severity: Medium
relevantTechniques:
- T1562
- T1070
triggerOperator: gt
triggerThreshold: 0
tactics:
- DefenseEvasion
id: 0c9243d6-d2ec-48e1-8593-e713859c8f3c

ARM