McAfee ePO - Error sending alert

Back


Id	1e3bcd0f-10b2-4fbd-854f-1c6f33acc36a
Rulename	McAfee ePO - Error sending alert
Description	Detects when error sending alert occurs.
Severity	Medium
Tactics	DefenseEvasion
Techniques	T1562 T1070
Required data connectors	SyslogAma
Kind	Scheduled
Query frequency	1h
Query period	1h
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/McAfee ePolicy Orchestrator/Analytic Rules/McAfeeEPOAlertError.yaml
Version	1.0.2
Arm template	1e3bcd0f-10b2-4fbd-854f-1c6f33acc36a.json

KQL

McAfeeEPOEvent
| where EventId == '1062'
| extend IPCustomEntity = DvcIpAddr

YAML

description: |
    'Detects when error sending alert occurs.'
kind: Scheduled
tactics:
- DefenseEvasion
requiredDataConnectors:
- connectorId: SyslogAma
  datatypes:
  - Syslog
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/McAfee ePolicy Orchestrator/Analytic Rules/McAfeeEPOAlertError.yaml
severity: Medium
name: McAfee ePO - Error sending alert
triggerThreshold: 0
queryPeriod: 1h
query: |
  McAfeeEPOEvent
  | where EventId == '1062'
  | extend IPCustomEntity = DvcIpAddr  
relevantTechniques:
- T1562
- T1070
id: 1e3bcd0f-10b2-4fbd-854f-1c6f33acc36a
queryFrequency: 1h
status: Available
triggerOperator: gt
version: 1.0.2
entityMappings:
- entityType: IP
  fieldMappings:
  - columnName: IPCustomEntity
    identifier: Address

ARM