VMware ESXi - Low temp directory space

Back


Id	2ee727f7-b7c2-4034-b6c9-d245d5a29343
Rulename	VMware ESXi - Low temp directory space
Description	This rule is triggered when temp directory space is detected.
Severity	Medium
Tactics	Impact
Techniques	T1529
Required data connectors	SyslogAma
Kind	Scheduled
Query frequency	1h
Query period	1h
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/VMWareESXi/Analytic Rules/ESXiLowTempDirSpace.yaml
Version	1.0.2
Arm template	2ee727f7-b7c2-4034-b6c9-d245d5a29343.json

KQL

let threshold = 10;
VMwareESXi
| where SyslogMessage has_all ('Temp directory', 'free space')
| extend sp = toreal(extract(@'free space is:\s(\d+)', 1, SyslogMessage)) / 1000000000
| where sp < threshold
| extend h = 'Hypervisor'
| extend HostCustomEntity = h

YAML

entityMappings:
- fieldMappings:
  - identifier: FullName
    columnName: HostCustomEntity
  entityType: Host
kind: Scheduled
tactics:
- Impact
query: |
  let threshold = 10;
  VMwareESXi
  | where SyslogMessage has_all ('Temp directory', 'free space')
  | extend sp = toreal(extract(@'free space is:\s(\d+)', 1, SyslogMessage)) / 1000000000
  | where sp < threshold
  | extend h = 'Hypervisor'
  | extend HostCustomEntity = h  
name: VMware ESXi - Low temp directory space
queryFrequency: 1h
queryPeriod: 1h
triggerThreshold: 0
triggerOperator: gt
severity: Medium
relevantTechniques:
- T1529
requiredDataConnectors:
- connectorId: SyslogAma
  datatypes:
  - Syslog
version: 1.0.2
status: Available
description: |
    'This rule is triggered when temp directory space is detected.'
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/VMWareESXi/Analytic Rules/ESXiLowTempDirSpace.yaml
id: 2ee727f7-b7c2-4034-b6c9-d245d5a29343

ARM