McAfee ePO - Logging error occurred

Back


Id	0c9243d6-d2ec-48e1-8593-e713859c8f3c
Rulename	McAfee ePO - Logging error occurred
Description	Detects when logging errors on agent.
Severity	Medium
Tactics	DefenseEvasion
Techniques	T1562 T1070
Required data connectors	McAfeeePO
Kind	Scheduled
Query frequency	1h
Query period	1h
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/McAfee ePolicy Orchestrator/Analytic Rules/McAfeeEPOLoggingError.yaml
Version	1.0.0
Arm template	0c9243d6-d2ec-48e1-8593-e713859c8f3c.json

KQL

McAfeeEPOEvent
| where EventId in ('1040', '1076', '3032', '3033', '3034', '3036', '3038')
| extend EventMessage = case(EventId == '1040', 'Activity Log error',
                              EventId == '1076', 'Error logging information',
                              EventId == '3032', 'Error while trying to open/create activity log file',
                              EventId == '3033', 'Activity log file maximum size reached',
                              EventId == '3034', 'Unable to write the activity log file',
                              EventId == '3036', 'Error during initialization of the activity log file',
                              'Error writing to log')
| project DvcIpAddr, EventId, EventMessage
| extend IPCustomEntity = DvcIpAddr

YAML

relevantTechniques:
- T1562
- T1070
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/McAfee ePolicy Orchestrator/Analytic Rules/McAfeeEPOLoggingError.yaml
triggerOperator: gt
kind: Scheduled
entityMappings:
- fieldMappings:
  - columnName: IPCustomEntity
    identifier: Address
  entityType: IP
requiredDataConnectors:
- dataTypes:
  - Syslog
  connectorId: McAfeeePO
queryPeriod: 1h
query: |
  McAfeeEPOEvent
  | where EventId in ('1040', '1076', '3032', '3033', '3034', '3036', '3038')
  | extend EventMessage = case(EventId == '1040', 'Activity Log error',
                                EventId == '1076', 'Error logging information',
                                EventId == '3032', 'Error while trying to open/create activity log file',
                                EventId == '3033', 'Activity log file maximum size reached',
                                EventId == '3034', 'Unable to write the activity log file',
                                EventId == '3036', 'Error during initialization of the activity log file',
                                'Error writing to log')
  | project DvcIpAddr, EventId, EventMessage
  | extend IPCustomEntity = DvcIpAddr  
version: 1.0.0
name: McAfee ePO - Logging error occurred
description: |
    'Detects when logging errors on agent.'
tactics:
- DefenseEvasion
severity: Medium
triggerThreshold: 0
queryFrequency: 1h
status: Available
id: 0c9243d6-d2ec-48e1-8593-e713859c8f3c

ARM

{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "workspace": {
      "type": "String"
    }
  },
  "resources": [
    {
      "apiVersion": "2023-02-01-preview",
      "id": "[concat(resourceId('Microsoft.OperationalInsights/workspaces/providers', parameters('workspace'), 'Microsoft.SecurityInsights'),'/alertRules/0c9243d6-d2ec-48e1-8593-e713859c8f3c')]",
      "kind": "Scheduled",
      "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/0c9243d6-d2ec-48e1-8593-e713859c8f3c')]",
      "properties": {
        "alertRuleTemplateName": "0c9243d6-d2ec-48e1-8593-e713859c8f3c",
        "customDetails": null,
        "description": "'Detects when logging errors on agent.'\n",
        "displayName": "McAfee ePO - Logging error occurred",
        "enabled": true,
        "entityMappings": [
          {
            "entityType": "IP",
            "fieldMappings": [
              {
                "columnName": "IPCustomEntity",
                "identifier": "Address"
              }
            ]
          }
        ],
        "OriginalUri": "https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/McAfee ePolicy Orchestrator/Analytic Rules/McAfeeEPOLoggingError.yaml",
        "query": "McAfeeEPOEvent\n| where EventId in ('1040', '1076', '3032', '3033', '3034', '3036', '3038')\n| extend EventMessage = case(EventId == '1040', 'Activity Log error',\n                              EventId == '1076', 'Error logging information',\n                              EventId == '3032', 'Error while trying to open/create activity log file',\n                              EventId == '3033', 'Activity log file maximum size reached',\n                              EventId == '3034', 'Unable to write the activity log file',\n                              EventId == '3036', 'Error during initialization of the activity log file',\n                              'Error writing to log')\n| project DvcIpAddr, EventId, EventMessage\n| extend IPCustomEntity = DvcIpAddr\n",
        "queryFrequency": "PT1H",
        "queryPeriod": "PT1H",
        "severity": "Medium",
        "status": "Available",
        "suppressionDuration": "PT1H",
        "suppressionEnabled": false,
        "tactics": [
          "DefenseEvasion"
        ],
        "techniques": [
          "T1070",
          "T1562"
        ],
        "templateVersion": "1.0.0",
        "triggerOperator": "GreaterThan",
        "triggerThreshold": 0
      },
      "type": "Microsoft.OperationalInsights/workspaces/providers/alertRules"
    }
  ]
}