Threats detected by Eset

Back


Id	2d8a60aa-c15e-442e-9ce3-ee924889d2a6
Rulename	Threats detected by Eset
Description	Escalates threats detected by Eset.
Severity	Low
Tactics	Execution CredentialAccess PrivilegeEscalation
Techniques	T1204 T1212 T1548
Required data connectors	EsetSMC
Kind	Scheduled
Query frequency	5m
Query period	5m
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Eset Security Management Center/Analytic Rules/eset-threats.yaml
Version	1.0.1
Arm template	2d8a60aa-c15e-442e-9ce3-ee924889d2a6.json

KQL

eset_CL
| where event_type_s == "Threat_Event"
| extend HostCustomEntity = hostname_s, AccountCustomEntity = username_s, IPCustomEntity = ipv4_s

YAML

name: Threats detected by Eset
id: 2d8a60aa-c15e-442e-9ce3-ee924889d2a6
description: |
    'Escalates threats detected by Eset.'
triggerThreshold: 0
entityMappings:
- fieldMappings:
  - columnName: AccountCustomEntity
    identifier: FullName
  entityType: Account
- fieldMappings:
  - columnName: HostCustomEntity
    identifier: FullName
  entityType: Host
- fieldMappings:
  - columnName: IPCustomEntity
    identifier: Address
  entityType: IP
version: 1.0.1
triggerOperator: gt
query: |
  eset_CL
  | where event_type_s == "Threat_Event"
  | extend HostCustomEntity = hostname_s, AccountCustomEntity = username_s, IPCustomEntity = ipv4_s  
tactics:
- Execution
- CredentialAccess
- PrivilegeEscalation
kind: Scheduled
queryFrequency: 5m
severity: Low
queryPeriod: 5m
requiredDataConnectors:
- dataTypes:
  - eset_CL
  connectorId: EsetSMC
status: Available
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Eset Security Management Center/Analytic Rules/eset-threats.yaml
relevantTechniques:
- T1204
- T1212
- T1548

ARM