VMware ESXi - Low temp directory space

Back


Id	2ee727f7-b7c2-4034-b6c9-d245d5a29343
Rulename	VMware ESXi - Low temp directory space
Description	This rule is triggered when temp directory space is detected.
Severity	Medium
Tactics	Impact
Techniques	T1529
Required data connectors	SyslogAma
Kind	Scheduled
Query frequency	1h
Query period	1h
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/VMWareESXi/Analytic Rules/ESXiLowTempDirSpace.yaml
Version	1.0.2
Arm template	2ee727f7-b7c2-4034-b6c9-d245d5a29343.json

KQL

let threshold = 10;
VMwareESXi
| where SyslogMessage has_all ('Temp directory', 'free space')
| extend sp = toreal(extract(@'free space is:\s(\d+)', 1, SyslogMessage)) / 1000000000
| where sp < threshold
| extend h = 'Hypervisor'
| extend HostCustomEntity = h

YAML

tactics:
- Impact
triggerOperator: gt
requiredDataConnectors:
- connectorId: SyslogAma
  datatypes:
  - Syslog
relevantTechniques:
- T1529
entityMappings:
- fieldMappings:
  - identifier: FullName
    columnName: HostCustomEntity
  entityType: Host
id: 2ee727f7-b7c2-4034-b6c9-d245d5a29343
queryPeriod: 1h
name: VMware ESXi - Low temp directory space
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/VMWareESXi/Analytic Rules/ESXiLowTempDirSpace.yaml
queryFrequency: 1h
description: |
    'This rule is triggered when temp directory space is detected.'
version: 1.0.2
query: |
  let threshold = 10;
  VMwareESXi
  | where SyslogMessage has_all ('Temp directory', 'free space')
  | extend sp = toreal(extract(@'free space is:\s(\d+)', 1, SyslogMessage)) / 1000000000
  | where sp < threshold
  | extend h = 'Hypervisor'
  | extend HostCustomEntity = h  
triggerThreshold: 0
severity: Medium
status: Available
kind: Scheduled

ARM