VMware ESXi - Low temp directory space

Back


Id	2ee727f7-b7c2-4034-b6c9-d245d5a29343
Rulename	VMware ESXi - Low temp directory space
Description	This rule is triggered when temp directory space is detected.
Severity	Medium
Tactics	Impact
Techniques	T1529
Required data connectors	SyslogAma
Kind	Scheduled
Query frequency	1h
Query period	1h
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/VMWareESXi/Analytic Rules/ESXiLowTempDirSpace.yaml
Version	1.0.2
Arm template	2ee727f7-b7c2-4034-b6c9-d245d5a29343.json

KQL

let threshold = 10;
VMwareESXi
| where SyslogMessage has_all ('Temp directory', 'free space')
| extend sp = toreal(extract(@'free space is:\s(\d+)', 1, SyslogMessage)) / 1000000000
| where sp < threshold
| extend h = 'Hypervisor'
| extend HostCustomEntity = h

YAML

name: VMware ESXi - Low temp directory space
kind: Scheduled
tactics:
- Impact
triggerThreshold: 0
triggerOperator: gt
version: 1.0.2
status: Available
queryFrequency: 1h
id: 2ee727f7-b7c2-4034-b6c9-d245d5a29343
requiredDataConnectors:
- connectorId: SyslogAma
  datatypes:
  - Syslog
relevantTechniques:
- T1529
description: |
    'This rule is triggered when temp directory space is detected.'
entityMappings:
- entityType: Host
  fieldMappings:
  - columnName: HostCustomEntity
    identifier: FullName
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/VMWareESXi/Analytic Rules/ESXiLowTempDirSpace.yaml
queryPeriod: 1h
severity: Medium
query: |
  let threshold = 10;
  VMwareESXi
  | where SyslogMessage has_all ('Temp directory', 'free space')
  | extend sp = toreal(extract(@'free space is:\s(\d+)', 1, SyslogMessage)) / 1000000000
  | where sp < threshold
  | extend h = 'Hypervisor'
  | extend HostCustomEntity = h

ARM