VMware ESXi - Low temp directory space

Back


Id	2ee727f7-b7c2-4034-b6c9-d245d5a29343
Rulename	VMware ESXi - Low temp directory space
Description	This rule is triggered when temp directory space is detected.
Severity	Medium
Tactics	Impact
Techniques	T1529
Required data connectors	SyslogAma
Kind	Scheduled
Query frequency	1h
Query period	1h
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/VMWareESXi/Analytic Rules/ESXiLowTempDirSpace.yaml
Version	1.0.2
Arm template	2ee727f7-b7c2-4034-b6c9-d245d5a29343.json

KQL

let threshold = 10;
VMwareESXi
| where SyslogMessage has_all ('Temp directory', 'free space')
| extend sp = toreal(extract(@'free space is:\s(\d+)', 1, SyslogMessage)) / 1000000000
| where sp < threshold
| extend h = 'Hypervisor'
| extend HostCustomEntity = h

YAML

relevantTechniques:
- T1529
entityMappings:
- fieldMappings:
  - columnName: HostCustomEntity
    identifier: FullName
  entityType: Host
triggerThreshold: 0
description: |
    'This rule is triggered when temp directory space is detected.'
requiredDataConnectors:
- connectorId: SyslogAma
  datatypes:
  - Syslog
triggerOperator: gt
version: 1.0.2
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/VMWareESXi/Analytic Rules/ESXiLowTempDirSpace.yaml
id: 2ee727f7-b7c2-4034-b6c9-d245d5a29343
queryFrequency: 1h
query: |
  let threshold = 10;
  VMwareESXi
  | where SyslogMessage has_all ('Temp directory', 'free space')
  | extend sp = toreal(extract(@'free space is:\s(\d+)', 1, SyslogMessage)) / 1000000000
  | where sp < threshold
  | extend h = 'Hypervisor'
  | extend HostCustomEntity = h  
severity: Medium
status: Available
queryPeriod: 1h
name: VMware ESXi - Low temp directory space
tactics:
- Impact
kind: Scheduled

ARM