McAfee ePO - Logging error occurred

Back


Id	0c9243d6-d2ec-48e1-8593-e713859c8f3c
Rulename	McAfee ePO - Logging error occurred
Description	Detects when logging errors on agent.
Severity	Medium
Tactics	DefenseEvasion
Techniques	T1562 T1070
Required data connectors	McAfeeePO SyslogAma
Kind	Scheduled
Query frequency	1h
Query period	1h
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/McAfee ePolicy Orchestrator/Analytic Rules/McAfeeEPOLoggingError.yaml
Version	1.0.1
Arm template	0c9243d6-d2ec-48e1-8593-e713859c8f3c.json

KQL

McAfeeEPOEvent
| where EventId in ('1040', '1076', '3032', '3033', '3034', '3036', '3038')
| extend EventMessage = case(EventId == '1040', 'Activity Log error',
                              EventId == '1076', 'Error logging information',
                              EventId == '3032', 'Error while trying to open/create activity log file',
                              EventId == '3033', 'Activity log file maximum size reached',
                              EventId == '3034', 'Unable to write the activity log file',
                              EventId == '3036', 'Error during initialization of the activity log file',
                              'Error writing to log')
| project DvcIpAddr, EventId, EventMessage
| extend IPCustomEntity = DvcIpAddr

YAML

relevantTechniques:
- T1562
- T1070
name: McAfee ePO - Logging error occurred
requiredDataConnectors:
- dataTypes:
  - Syslog
  connectorId: McAfeeePO
- datatypes:
  - Syslog
  connectorId: SyslogAma
entityMappings:
- fieldMappings:
  - identifier: Address
    columnName: IPCustomEntity
  entityType: IP
triggerThreshold: 0
id: 0c9243d6-d2ec-48e1-8593-e713859c8f3c
tactics:
- DefenseEvasion
version: 1.0.1
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/McAfee ePolicy Orchestrator/Analytic Rules/McAfeeEPOLoggingError.yaml
queryPeriod: 1h
kind: Scheduled
queryFrequency: 1h
severity: Medium
status: Available
description: |
    'Detects when logging errors on agent.'
query: |
  McAfeeEPOEvent
  | where EventId in ('1040', '1076', '3032', '3033', '3034', '3036', '3038')
  | extend EventMessage = case(EventId == '1040', 'Activity Log error',
                                EventId == '1076', 'Error logging information',
                                EventId == '3032', 'Error while trying to open/create activity log file',
                                EventId == '3033', 'Activity log file maximum size reached',
                                EventId == '3034', 'Unable to write the activity log file',
                                EventId == '3036', 'Error during initialization of the activity log file',
                                'Error writing to log')
  | project DvcIpAddr, EventId, EventMessage
  | extend IPCustomEntity = DvcIpAddr  
triggerOperator: gt

ARM

{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "workspace": {
      "type": "String"
    }
  },
  "resources": [
    {
      "apiVersion": "2024-01-01-preview",
      "id": "[concat(resourceId('Microsoft.OperationalInsights/workspaces/providers', parameters('workspace'), 'Microsoft.SecurityInsights'),'/alertRules/0c9243d6-d2ec-48e1-8593-e713859c8f3c')]",
      "kind": "Scheduled",
      "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/0c9243d6-d2ec-48e1-8593-e713859c8f3c')]",
      "properties": {
        "alertRuleTemplateName": "0c9243d6-d2ec-48e1-8593-e713859c8f3c",
        "customDetails": null,
        "description": "'Detects when logging errors on agent.'\n",
        "displayName": "McAfee ePO - Logging error occurred",
        "enabled": true,
        "entityMappings": [
          {
            "entityType": "IP",
            "fieldMappings": [
              {
                "columnName": "IPCustomEntity",
                "identifier": "Address"
              }
            ]
          }
        ],
        "OriginalUri": "https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/McAfee ePolicy Orchestrator/Analytic Rules/McAfeeEPOLoggingError.yaml",
        "query": "McAfeeEPOEvent\n| where EventId in ('1040', '1076', '3032', '3033', '3034', '3036', '3038')\n| extend EventMessage = case(EventId == '1040', 'Activity Log error',\n                              EventId == '1076', 'Error logging information',\n                              EventId == '3032', 'Error while trying to open/create activity log file',\n                              EventId == '3033', 'Activity log file maximum size reached',\n                              EventId == '3034', 'Unable to write the activity log file',\n                              EventId == '3036', 'Error during initialization of the activity log file',\n                              'Error writing to log')\n| project DvcIpAddr, EventId, EventMessage\n| extend IPCustomEntity = DvcIpAddr\n",
        "queryFrequency": "PT1H",
        "queryPeriod": "PT1H",
        "severity": "Medium",
        "status": "Available",
        "subTechniques": [],
        "suppressionDuration": "PT1H",
        "suppressionEnabled": false,
        "tactics": [
          "DefenseEvasion"
        ],
        "techniques": [
          "T1070",
          "T1562"
        ],
        "templateVersion": "1.0.1",
        "triggerOperator": "GreaterThan",
        "triggerThreshold": 0
      },
      "type": "Microsoft.OperationalInsights/workspaces/providers/alertRules"
    }
  ]
}