McAfee ePO - Error sending alert

Back


Id	1e3bcd0f-10b2-4fbd-854f-1c6f33acc36a
Rulename	McAfee ePO - Error sending alert
Description	Detects when error sending alert occurs.
Severity	Medium
Tactics	DefenseEvasion
Techniques	T1562 T1070
Required data connectors	SyslogAma
Kind	Scheduled
Query frequency	1h
Query period	1h
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/McAfee ePolicy Orchestrator/Analytic Rules/McAfeeEPOAlertError.yaml
Version	1.0.2
Arm template	1e3bcd0f-10b2-4fbd-854f-1c6f33acc36a.json

KQL

McAfeeEPOEvent
| where EventId == '1062'
| extend IPCustomEntity = DvcIpAddr

YAML

triggerThreshold: 0
entityMappings:
- entityType: IP
  fieldMappings:
  - identifier: Address
    columnName: IPCustomEntity
requiredDataConnectors:
- datatypes:
  - Syslog
  connectorId: SyslogAma
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/McAfee ePolicy Orchestrator/Analytic Rules/McAfeeEPOAlertError.yaml
name: McAfee ePO - Error sending alert
relevantTechniques:
- T1562
- T1070
status: Available
version: 1.0.2
queryPeriod: 1h
kind: Scheduled
id: 1e3bcd0f-10b2-4fbd-854f-1c6f33acc36a
query: |
  McAfeeEPOEvent
  | where EventId == '1062'
  | extend IPCustomEntity = DvcIpAddr  
description: |
    'Detects when error sending alert occurs.'
queryFrequency: 1h
severity: Medium
triggerOperator: gt
tactics:
- DefenseEvasion

ARM