McAfee ePO - Scanning engine disabled

Back


Id	5223c1b8-75ef-4019-9076-a19b1ef3e5d1
Rulename	McAfee ePO - Scanning engine disabled
Description	Detects when OAS scanning engine was disabled.
Severity	Low
Tactics	DefenseEvasion
Techniques	T1562 T1070
Required data connectors	SyslogAma
Kind	Scheduled
Query frequency	1h
Query period	1h
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/McAfee ePolicy Orchestrator/Analytic Rules/McAfeeEPOScanningEngineDisabled.yaml
Version	1.0.2
Arm template	5223c1b8-75ef-4019-9076-a19b1ef3e5d1.json

KQL

McAfeeEPOEvent
| where EventId == '1127'
| extend IPCustomEntity = DvcIpAddr, HostCustomEntity = DvcHostname

YAML

triggerThreshold: 0
entityMappings:
- entityType: IP
  fieldMappings:
  - identifier: Address
    columnName: IPCustomEntity
- entityType: Host
  fieldMappings:
  - identifier: FullName
    columnName: HostCustomEntity
requiredDataConnectors:
- datatypes:
  - Syslog
  connectorId: SyslogAma
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/McAfee ePolicy Orchestrator/Analytic Rules/McAfeeEPOScanningEngineDisabled.yaml
name: McAfee ePO - Scanning engine disabled
relevantTechniques:
- T1562
- T1070
status: Available
version: 1.0.2
queryPeriod: 1h
kind: Scheduled
id: 5223c1b8-75ef-4019-9076-a19b1ef3e5d1
query: |
  McAfeeEPOEvent
  | where EventId == '1127'
  | extend IPCustomEntity = DvcIpAddr, HostCustomEntity = DvcHostname  
description: |
    'Detects when OAS scanning engine was disabled.'
queryFrequency: 1h
severity: Low
triggerOperator: gt
tactics:
- DefenseEvasion

ARM