Microsoft Sentinel Analytic Rules
cloudbrothers.infoAzure Sentinel RepoToggle Dark/Light/Auto modeToggle Dark/Light/Auto modeToggle Dark/Light/Auto modeBack to homepage

VMware ESXi - Low patch disk space

Back
Id48d992ba-d404-4159-a8c6-46f51d1325c7
RulenameVMware ESXi - Low patch disk space
DescriptionThis rule is triggered when low patch disk store space is detected.
SeverityMedium
TacticsImpact
TechniquesT1529
Required data connectorsSyslogAma
KindScheduled
Query frequency1h
Query period1h
Trigger threshold0
Trigger operatorgt
Source Urihttps://github.com/Azure/Azure-Sentinel/blob/master/Solutions/VMWareESXi/Analytic Rules/ESXiLowPatchDiskSpace.yaml
Version1.0.2
Arm template48d992ba-d404-4159-a8c6-46f51d1325c7.json
Deploy To Azure
let threshold = 100;
VMwareESXi
| where SyslogMessage has ('Patch store disk')
| extend sp = toreal(extract(@'free space is:\s(\d+)', 1, SyslogMessage)) / 1000000000
| where sp < threshold
| extend h = 'Hypervisor'
| extend HostCustomEntity = h
queryPeriod: 1h
entityMappings:
- fieldMappings:
  - identifier: FullName
    columnName: HostCustomEntity
  entityType: Host
relevantTechniques:
- T1529
severity: Medium
requiredDataConnectors:
- connectorId: SyslogAma
  datatypes:
  - Syslog
id: 48d992ba-d404-4159-a8c6-46f51d1325c7
triggerOperator: gt
kind: Scheduled
query: |
  let threshold = 100;
  VMwareESXi
  | where SyslogMessage has ('Patch store disk')
  | extend sp = toreal(extract(@'free space is:\s(\d+)', 1, SyslogMessage)) / 1000000000
  | where sp < threshold
  | extend h = 'Hypervisor'
  | extend HostCustomEntity = h  
tactics:
- Impact
triggerThreshold: 0
queryFrequency: 1h
status: Available
description: |
    'This rule is triggered when low patch disk store space is detected.'
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/VMWareESXi/Analytic Rules/ESXiLowPatchDiskSpace.yaml
name: VMware ESXi - Low patch disk space
version: 1.0.2
{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "workspace": {
      "type": "String"
    }
  },
  "resources": [
    {
      "apiVersion": "2024-01-01-preview",
      "id": "[concat(resourceId('Microsoft.OperationalInsights/workspaces/providers', parameters('workspace'), 'Microsoft.SecurityInsights'),'/alertRules/48d992ba-d404-4159-a8c6-46f51d1325c7')]",
      "kind": "Scheduled",
      "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/48d992ba-d404-4159-a8c6-46f51d1325c7')]",
      "properties": {
        "alertRuleTemplateName": "48d992ba-d404-4159-a8c6-46f51d1325c7",
        "customDetails": null,
        "description": "'This rule is triggered when low patch disk store space is detected.'\n",
        "displayName": "VMware ESXi - Low patch disk space",
        "enabled": true,
        "entityMappings": [
          {
            "entityType": "Host",
            "fieldMappings": [
              {
                "columnName": "HostCustomEntity",
                "identifier": "FullName"
              }
            ]
          }
        ],
        "OriginalUri": "https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/VMWareESXi/Analytic Rules/ESXiLowPatchDiskSpace.yaml",
        "query": "let threshold = 100;\nVMwareESXi\n| where SyslogMessage has ('Patch store disk')\n| extend sp = toreal(extract(@'free space is:\\s(\\d+)', 1, SyslogMessage)) / 1000000000\n| where sp < threshold\n| extend h = 'Hypervisor'\n| extend HostCustomEntity = h\n",
        "queryFrequency": "PT1H",
        "queryPeriod": "PT1H",
        "severity": "Medium",
        "status": "Available",
        "subTechniques": [],
        "suppressionDuration": "PT1H",
        "suppressionEnabled": false,
        "tactics": [
          "Impact"
        ],
        "techniques": [
          "T1529"
        ],
        "templateVersion": "1.0.2",
        "triggerOperator": "GreaterThan",
        "triggerThreshold": 0
      },
      "type": "Microsoft.OperationalInsights/workspaces/providers/alertRules"
    }
  ]
}