Bitglass - The SmartEdge endpoint agent was uninstalled

Back


Id	40f69a27-8c68-4c8c-bb7c-7eb0f0a8a1fa
Rulename	Bitglass - The SmartEdge endpoint agent was uninstalled
Description	Detects when SmartEdge endpoint agent was uninstalled.
Severity	Medium
Tactics	DefenseEvasion
Techniques	T1070
Required data connectors	Bitglass
Kind	Scheduled
Query frequency	1h
Query period	1h
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Bitglass/Analytic Rules/BitglassSmartEdgeAgentUninstall.yaml
Version	1.0.0
Arm template	40f69a27-8c68-4c8c-bb7c-7eb0f0a8a1fa.json

KQL

Bitglass
| where EventType =~ 'access'
| where EventResultDetails startswith 'The SmartEdge endpoint agent was uninstalled'
| extend IPCustomEntity = SrcIpAddr

YAML

relevantTechniques:
- T1070
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Bitglass/Analytic Rules/BitglassSmartEdgeAgentUninstall.yaml
query: |
  Bitglass
  | where EventType =~ 'access'
  | where EventResultDetails startswith 'The SmartEdge endpoint agent was uninstalled'
  | extend IPCustomEntity = SrcIpAddr  
description: |
    'Detects when SmartEdge endpoint agent was uninstalled.'
requiredDataConnectors:
- connectorId: Bitglass
  dataTypes:
  - Bitglass
triggerOperator: gt
entityMappings:
- entityType: IP
  fieldMappings:
  - columnName: IPCustomEntity
    identifier: Address
name: Bitglass - The SmartEdge endpoint agent was uninstalled
queryPeriod: 1h
triggerThreshold: 0
id: 40f69a27-8c68-4c8c-bb7c-7eb0f0a8a1fa
status: Available
kind: Scheduled
severity: Medium
queryFrequency: 1h
tactics:
- DefenseEvasion
version: 1.0.0

ARM