VMware ESXi - Low patch disk space

Back


Id	48d992ba-d404-4159-a8c6-46f51d1325c7
Rulename	VMware ESXi - Low patch disk space
Description	This rule is triggered when low patch disk store space is detected.
Severity	Medium
Tactics	Impact
Techniques	T1529
Required data connectors	SyslogAma
Kind	Scheduled
Query frequency	1h
Query period	1h
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/VMWareESXi/Analytic Rules/ESXiLowPatchDiskSpace.yaml
Version	1.0.2
Arm template	48d992ba-d404-4159-a8c6-46f51d1325c7.json

KQL

let threshold = 100;
VMwareESXi
| where SyslogMessage has ('Patch store disk')
| extend sp = toreal(extract(@'free space is:\s(\d+)', 1, SyslogMessage)) / 1000000000
| where sp < threshold
| extend h = 'Hypervisor'
| extend HostCustomEntity = h

YAML

name: VMware ESXi - Low patch disk space
id: 48d992ba-d404-4159-a8c6-46f51d1325c7
description: |
    'This rule is triggered when low patch disk store space is detected.'
triggerThreshold: 0
entityMappings:
- fieldMappings:
  - columnName: HostCustomEntity
    identifier: FullName
  entityType: Host
version: 1.0.2
triggerOperator: gt
query: |
  let threshold = 100;
  VMwareESXi
  | where SyslogMessage has ('Patch store disk')
  | extend sp = toreal(extract(@'free space is:\s(\d+)', 1, SyslogMessage)) / 1000000000
  | where sp < threshold
  | extend h = 'Hypervisor'
  | extend HostCustomEntity = h  
tactics:
- Impact
kind: Scheduled
queryFrequency: 1h
severity: Medium
queryPeriod: 1h
requiredDataConnectors:
- datatypes:
  - Syslog
  connectorId: SyslogAma
status: Available
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/VMWareESXi/Analytic Rules/ESXiLowPatchDiskSpace.yaml
relevantTechniques:
- T1529

ARM