McAfee ePO - Error sending alert

Back


Id	1e3bcd0f-10b2-4fbd-854f-1c6f33acc36a
Rulename	McAfee ePO - Error sending alert
Description	Detects when error sending alert occurs.
Severity	Medium
Tactics	DefenseEvasion
Techniques	T1562 T1070
Required data connectors	SyslogAma
Kind	Scheduled
Query frequency	1h
Query period	1h
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/McAfee ePolicy Orchestrator/Analytic Rules/McAfeeEPOAlertError.yaml
Version	1.0.2
Arm template	1e3bcd0f-10b2-4fbd-854f-1c6f33acc36a.json

KQL

McAfeeEPOEvent
| where EventId == '1062'
| extend IPCustomEntity = DvcIpAddr

YAML

query: |
  McAfeeEPOEvent
  | where EventId == '1062'
  | extend IPCustomEntity = DvcIpAddr  
entityMappings:
- entityType: IP
  fieldMappings:
  - columnName: IPCustomEntity
    identifier: Address
triggerThreshold: 0
name: McAfee ePO - Error sending alert
severity: Medium
relevantTechniques:
- T1562
- T1070
queryPeriod: 1h
tactics:
- DefenseEvasion
requiredDataConnectors:
- connectorId: SyslogAma
  datatypes:
  - Syslog
queryFrequency: 1h
version: 1.0.2
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/McAfee ePolicy Orchestrator/Analytic Rules/McAfeeEPOAlertError.yaml
id: 1e3bcd0f-10b2-4fbd-854f-1c6f33acc36a
kind: Scheduled
description: |
    'Detects when error sending alert occurs.'
status: Available
triggerOperator: gt

ARM