McAfee ePO - Error sending alert

Back


Id	1e3bcd0f-10b2-4fbd-854f-1c6f33acc36a
Rulename	McAfee ePO - Error sending alert
Description	Detects when error sending alert occurs.
Severity	Medium
Tactics	DefenseEvasion
Techniques	T1562 T1070
Required data connectors	SyslogAma
Kind	Scheduled
Query frequency	1h
Query period	1h
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/McAfee ePolicy Orchestrator/Analytic Rules/McAfeeEPOAlertError.yaml
Version	1.0.2
Arm template	1e3bcd0f-10b2-4fbd-854f-1c6f33acc36a.json

KQL

McAfeeEPOEvent
| where EventId == '1062'
| extend IPCustomEntity = DvcIpAddr

YAML

id: 1e3bcd0f-10b2-4fbd-854f-1c6f33acc36a
triggerOperator: gt
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/McAfee ePolicy Orchestrator/Analytic Rules/McAfeeEPOAlertError.yaml
entityMappings:
- fieldMappings:
  - identifier: Address
    columnName: IPCustomEntity
  entityType: IP
requiredDataConnectors:
- datatypes:
  - Syslog
  connectorId: SyslogAma
queryFrequency: 1h
queryPeriod: 1h
status: Available
query: |
  McAfeeEPOEvent
  | where EventId == '1062'
  | extend IPCustomEntity = DvcIpAddr  
name: McAfee ePO - Error sending alert
kind: Scheduled
tactics:
- DefenseEvasion
severity: Medium
relevantTechniques:
- T1562
- T1070
triggerThreshold: 0
version: 1.0.2
description: |
    'Detects when error sending alert occurs.'

ARM