McAfee ePO - Update failed

Back


Id	4f0c91c3-1690-48f0-b538-4282dd5417a4
Rulename	McAfee ePO - Update failed
Description	Detects when update failed event occurs on agent.
Severity	Medium
Tactics	DefenseEvasion
Techniques	T1562 T1070
Required data connectors	SyslogAma
Kind	Scheduled
Query frequency	1h
Query period	1h
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/McAfee ePolicy Orchestrator/Analytic Rules/McAfeeEPOUpdateFailed.yaml
Version	1.0.2
Arm template	4f0c91c3-1690-48f0-b538-4282dd5417a4.json

KQL

McAfeeEPOEvent
| where EventId in ('2402', '1119', '1123')
| extend IPCustomEntity = DvcIpAddr, HostCustomEntity = DvcHostname

YAML

version: 1.0.2
requiredDataConnectors:
- connectorId: SyslogAma
  datatypes:
  - Syslog
status: Available
entityMappings:
- fieldMappings:
  - identifier: Address
    columnName: IPCustomEntity
  entityType: IP
- fieldMappings:
  - identifier: FullName
    columnName: HostCustomEntity
  entityType: Host
tactics:
- DefenseEvasion
relevantTechniques:
- T1562
- T1070
queryFrequency: 1h
severity: Medium
name: McAfee ePO - Update failed
description: |
    'Detects when update failed event occurs on agent.'
triggerThreshold: 0
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/McAfee ePolicy Orchestrator/Analytic Rules/McAfeeEPOUpdateFailed.yaml
query: |
  McAfeeEPOEvent
  | where EventId in ('2402', '1119', '1123')
  | extend IPCustomEntity = DvcIpAddr, HostCustomEntity = DvcHostname  
kind: Scheduled
queryPeriod: 1h
triggerOperator: gt
id: 4f0c91c3-1690-48f0-b538-4282dd5417a4

ARM