Threats detected by ESET

Back


Id	64badfab-1dd8-4491-927b-3ca206fa9a17
Rulename	Threats detected by ESET
Description	Escalates threats detected by ESET.
Severity	Low
Tactics	Execution
Techniques	T1204
Required data connectors	ESETPROTECT SyslogAma
Kind	Scheduled
Query frequency	5m
Query period	5m
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/ESETPROTECT/Analytic Rules/ESETThreatDetected.yaml
Version	1.0.3
Arm template	64badfab-1dd8-4491-927b-3ca206fa9a17.json

KQL

ESETPROTECT
| where EventType == "Threat_Event"
| extend DvcHostname, SrcUserName, DvcIpAddr, FileHashSha1, FileHashAlgo = "SHA1"

YAML

kind: Scheduled
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/ESETPROTECT/Analytic Rules/ESETThreatDetected.yaml
query: |
  ESETPROTECT
  | where EventType == "Threat_Event"
  | extend DvcHostname, SrcUserName, DvcIpAddr, FileHashSha1, FileHashAlgo = "SHA1"  
requiredDataConnectors:
- dataTypes:
  - ESETPROTECT
  connectorId: ESETPROTECT
- datatypes:
  - Syslog
  connectorId: SyslogAma
tactics:
- Execution
name: Threats detected by ESET
relevantTechniques:
- T1204
severity: Low
entityMappings:
- fieldMappings:
  - identifier: FullName
    columnName: SrcUserName
  entityType: Account
- fieldMappings:
  - identifier: FullName
    columnName: DvcHostname
  entityType: Host
- fieldMappings:
  - identifier: Address
    columnName: DvcIpAddr
  entityType: IP
- fieldMappings:
  - identifier: Algorithm
    columnName: FileHashAlgo
  - identifier: Value
    columnName: FileHashSha1
  entityType: FileHash
queryFrequency: 5m
description: |
    'Escalates threats detected by ESET.'
triggerThreshold: 0
triggerOperator: gt
version: 1.0.3
queryPeriod: 5m
id: 64badfab-1dd8-4491-927b-3ca206fa9a17

ARM