Microsoft Sentinel Analytic Rules
cloudbrothers.infoAzure Sentinel RepoToggle Dark/Light/Auto modeToggle Dark/Light/Auto modeToggle Dark/Light/Auto modeBack to homepage

VMware ESXi - Low temp directory space

Back
Id2ee727f7-b7c2-4034-b6c9-d245d5a29343
RulenameVMware ESXi - Low temp directory space
DescriptionThis rule is triggered when temp directory space is detected.
SeverityMedium
TacticsImpact
TechniquesT1529
Required data connectorsSyslogAma
KindScheduled
Query frequency1h
Query period1h
Trigger threshold0
Trigger operatorgt
Source Urihttps://github.com/Azure/Azure-Sentinel/blob/master/Solutions/VMWareESXi/Analytic Rules/ESXiLowTempDirSpace.yaml
Version1.0.2
Arm template2ee727f7-b7c2-4034-b6c9-d245d5a29343.json
Deploy To Azure
let threshold = 10;
VMwareESXi
| where SyslogMessage has_all ('Temp directory', 'free space')
| extend sp = toreal(extract(@'free space is:\s(\d+)', 1, SyslogMessage)) / 1000000000
| where sp < threshold
| extend h = 'Hypervisor'
| extend HostCustomEntity = h
name: VMware ESXi - Low temp directory space
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/VMWareESXi/Analytic Rules/ESXiLowTempDirSpace.yaml
queryPeriod: 1h
version: 1.0.2
severity: Medium
id: 2ee727f7-b7c2-4034-b6c9-d245d5a29343
triggerOperator: gt
triggerThreshold: 0
kind: Scheduled
requiredDataConnectors:
- datatypes:
  - Syslog
  connectorId: SyslogAma
relevantTechniques:
- T1529
description: |
    'This rule is triggered when temp directory space is detected.'
query: |
  let threshold = 10;
  VMwareESXi
  | where SyslogMessage has_all ('Temp directory', 'free space')
  | extend sp = toreal(extract(@'free space is:\s(\d+)', 1, SyslogMessage)) / 1000000000
  | where sp < threshold
  | extend h = 'Hypervisor'
  | extend HostCustomEntity = h  
tactics:
- Impact
entityMappings:
- entityType: Host
  fieldMappings:
  - columnName: HostCustomEntity
    identifier: FullName
status: Available
queryFrequency: 1h
{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "workspace": {
      "type": "String"
    }
  },
  "resources": [
    {
      "apiVersion": "2024-01-01-preview",
      "id": "[concat(resourceId('Microsoft.OperationalInsights/workspaces/providers', parameters('workspace'), 'Microsoft.SecurityInsights'),'/alertRules/2ee727f7-b7c2-4034-b6c9-d245d5a29343')]",
      "kind": "Scheduled",
      "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/2ee727f7-b7c2-4034-b6c9-d245d5a29343')]",
      "properties": {
        "alertRuleTemplateName": "2ee727f7-b7c2-4034-b6c9-d245d5a29343",
        "customDetails": null,
        "description": "'This rule is triggered when temp directory space is detected.'\n",
        "displayName": "VMware ESXi - Low temp directory space",
        "enabled": true,
        "entityMappings": [
          {
            "entityType": "Host",
            "fieldMappings": [
              {
                "columnName": "HostCustomEntity",
                "identifier": "FullName"
              }
            ]
          }
        ],
        "OriginalUri": "https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/VMWareESXi/Analytic Rules/ESXiLowTempDirSpace.yaml",
        "query": "let threshold = 10;\nVMwareESXi\n| where SyslogMessage has_all ('Temp directory', 'free space')\n| extend sp = toreal(extract(@'free space is:\\s(\\d+)', 1, SyslogMessage)) / 1000000000\n| where sp < threshold\n| extend h = 'Hypervisor'\n| extend HostCustomEntity = h\n",
        "queryFrequency": "PT1H",
        "queryPeriod": "PT1H",
        "severity": "Medium",
        "status": "Available",
        "subTechniques": [],
        "suppressionDuration": "PT1H",
        "suppressionEnabled": false,
        "tactics": [
          "Impact"
        ],
        "techniques": [
          "T1529"
        ],
        "templateVersion": "1.0.2",
        "triggerOperator": "GreaterThan",
        "triggerThreshold": 0
      },
      "type": "Microsoft.OperationalInsights/workspaces/providers/alertRules"
    }
  ]
}