McAfee ePO - Update failed

Back


Id	4f0c91c3-1690-48f0-b538-4282dd5417a4
Rulename	McAfee ePO - Update failed
Description	Detects when update failed event occurs on agent.
Severity	Medium
Tactics	DefenseEvasion
Techniques	T1562 T1070
Required data connectors	SyslogAma
Kind	Scheduled
Query frequency	1h
Query period	1h
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/McAfee ePolicy Orchestrator/Analytic Rules/McAfeeEPOUpdateFailed.yaml
Version	1.0.2
Arm template	4f0c91c3-1690-48f0-b538-4282dd5417a4.json

KQL

McAfeeEPOEvent
| where EventId in ('2402', '1119', '1123')
| extend IPCustomEntity = DvcIpAddr, HostCustomEntity = DvcHostname

YAML

name: McAfee ePO - Update failed
id: 4f0c91c3-1690-48f0-b538-4282dd5417a4
description: |
    'Detects when update failed event occurs on agent.'
triggerThreshold: 0
entityMappings:
- fieldMappings:
  - columnName: IPCustomEntity
    identifier: Address
  entityType: IP
- fieldMappings:
  - columnName: HostCustomEntity
    identifier: FullName
  entityType: Host
version: 1.0.2
triggerOperator: gt
query: |
  McAfeeEPOEvent
  | where EventId in ('2402', '1119', '1123')
  | extend IPCustomEntity = DvcIpAddr, HostCustomEntity = DvcHostname  
tactics:
- DefenseEvasion
kind: Scheduled
queryFrequency: 1h
severity: Medium
queryPeriod: 1h
requiredDataConnectors:
- datatypes:
  - Syslog
  connectorId: SyslogAma
status: Available
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/McAfee ePolicy Orchestrator/Analytic Rules/McAfeeEPOUpdateFailed.yaml
relevantTechniques:
- T1562
- T1070

ARM