Microsoft Sentinel Analytic Rules
cloudbrothers.infoAzure Sentinel RepoToggle Dark/Light/Auto modeToggle Dark/Light/Auto modeToggle Dark/Light/Auto modeBack to homepage

Website blocked by ESET

Back
Id7b84fc5b-9ffb-4e9b-945b-5d480e330b3f
RulenameWebsite blocked by ESET
DescriptionCreate alert on websites blocked by ESET.
SeverityLow
TacticsExfiltration
CommandAndControl
InitialAccess
TechniquesT1041
T1071
T1189
T1566
Required data connectorsESETPROTECT
SyslogAma
KindScheduled
Query frequency5m
Query period5m
Trigger threshold0
Trigger operatorgt
Source Urihttps://github.com/Azure/Azure-Sentinel/blob/master/Solutions/ESETPROTECT/Analytic Rules/ESETWebsiteBlocked.yaml
Version1.0.2
Arm template7b84fc5b-9ffb-4e9b-945b-5d480e330b3f.json
Deploy To Azure
ESETPROTECT
| where EventType == 'FilteredWebsites_Event'
| extend SrcUserName, FilePath, DvcHostname, DvcIpAddr
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/ESETPROTECT/Analytic Rules/ESETWebsiteBlocked.yaml
query: |
  ESETPROTECT
  | where EventType == 'FilteredWebsites_Event'
  | extend SrcUserName, FilePath, DvcHostname, DvcIpAddr  
description: |
    'Create alert on websites blocked by ESET.'
severity: Low
requiredDataConnectors:
- dataTypes:
  - ESETPROTECT
  connectorId: ESETPROTECT
- datatypes:
  - Syslog
  connectorId: SyslogAma
name: Website blocked by ESET
triggerThreshold: 0
tactics:
- Exfiltration
- CommandAndControl
- InitialAccess
version: 1.0.2
relevantTechniques:
- T1041
- T1071
- T1189
- T1566
triggerOperator: gt
entityMappings:
- entityType: Account
  fieldMappings:
  - columnName: SrcUserName
    identifier: FullName
- entityType: Host
  fieldMappings:
  - columnName: DvcHostname
    identifier: FullName
- entityType: IP
  fieldMappings:
  - columnName: DvcIpAddr
    identifier: Address
- entityType: URL
  fieldMappings:
  - columnName: FilePath
    identifier: Url
id: 7b84fc5b-9ffb-4e9b-945b-5d480e330b3f
kind: Scheduled
queryFrequency: 5m
queryPeriod: 5m
{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "workspace": {
      "type": "String"
    }
  },
  "resources": [
    {
      "apiVersion": "2024-01-01-preview",
      "id": "[concat(resourceId('Microsoft.OperationalInsights/workspaces/providers', parameters('workspace'), 'Microsoft.SecurityInsights'),'/alertRules/7b84fc5b-9ffb-4e9b-945b-5d480e330b3f')]",
      "kind": "Scheduled",
      "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/7b84fc5b-9ffb-4e9b-945b-5d480e330b3f')]",
      "properties": {
        "alertRuleTemplateName": "7b84fc5b-9ffb-4e9b-945b-5d480e330b3f",
        "customDetails": null,
        "description": "'Create alert on websites blocked by ESET.'\n",
        "displayName": "Website blocked by ESET",
        "enabled": true,
        "entityMappings": [
          {
            "entityType": "Account",
            "fieldMappings": [
              {
                "columnName": "SrcUserName",
                "identifier": "FullName"
              }
            ]
          },
          {
            "entityType": "Host",
            "fieldMappings": [
              {
                "columnName": "DvcHostname",
                "identifier": "FullName"
              }
            ]
          },
          {
            "entityType": "IP",
            "fieldMappings": [
              {
                "columnName": "DvcIpAddr",
                "identifier": "Address"
              }
            ]
          },
          {
            "entityType": "URL",
            "fieldMappings": [
              {
                "columnName": "FilePath",
                "identifier": "Url"
              }
            ]
          }
        ],
        "OriginalUri": "https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/ESETPROTECT/Analytic Rules/ESETWebsiteBlocked.yaml",
        "query": "ESETPROTECT\n| where EventType == 'FilteredWebsites_Event'\n| extend SrcUserName, FilePath, DvcHostname, DvcIpAddr\n",
        "queryFrequency": "PT5M",
        "queryPeriod": "PT5M",
        "severity": "Low",
        "subTechniques": [],
        "suppressionDuration": "PT1H",
        "suppressionEnabled": false,
        "tactics": [
          "CommandAndControl",
          "Exfiltration",
          "InitialAccess"
        ],
        "techniques": [
          "T1041",
          "T1071",
          "T1189",
          "T1566"
        ],
        "templateVersion": "1.0.2",
        "triggerOperator": "GreaterThan",
        "triggerThreshold": 0
      },
      "type": "Microsoft.OperationalInsights/workspaces/providers/alertRules"
    }
  ]
}