VMware ESXi - Low temp directory space

Back


Id	2ee727f7-b7c2-4034-b6c9-d245d5a29343
Rulename	VMware ESXi - Low temp directory space
Description	This rule is triggered when temp directory space is detected.
Severity	Medium
Tactics	Impact
Techniques	T1529
Required data connectors	SyslogAma
Kind	Scheduled
Query frequency	1h
Query period	1h
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/VMWareESXi/Analytic Rules/ESXiLowTempDirSpace.yaml
Version	1.0.2
Arm template	2ee727f7-b7c2-4034-b6c9-d245d5a29343.json

KQL

let threshold = 10;
VMwareESXi
| where SyslogMessage has_all ('Temp directory', 'free space')
| extend sp = toreal(extract(@'free space is:\s(\d+)', 1, SyslogMessage)) / 1000000000
| where sp < threshold
| extend h = 'Hypervisor'
| extend HostCustomEntity = h

YAML

relevantTechniques:
- T1529
entityMappings:
- entityType: Host
  fieldMappings:
  - columnName: HostCustomEntity
    identifier: FullName
version: 1.0.2
id: 2ee727f7-b7c2-4034-b6c9-d245d5a29343
severity: Medium
kind: Scheduled
queryFrequency: 1h
description: |
    'This rule is triggered when temp directory space is detected.'
requiredDataConnectors:
- connectorId: SyslogAma
  datatypes:
  - Syslog
triggerOperator: gt
name: VMware ESXi - Low temp directory space
tactics:
- Impact
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/VMWareESXi/Analytic Rules/ESXiLowTempDirSpace.yaml
triggerThreshold: 0
queryPeriod: 1h
query: |
  let threshold = 10;
  VMwareESXi
  | where SyslogMessage has_all ('Temp directory', 'free space')
  | extend sp = toreal(extract(@'free space is:\s(\d+)', 1, SyslogMessage)) / 1000000000
  | where sp < threshold
  | extend h = 'Hypervisor'
  | extend HostCustomEntity = h  
status: Available

ARM