Website blocked by ESET

Back


Id	7b84fc5b-9ffb-4e9b-945b-5d480e330b3f
Rulename	Website blocked by ESET
Description	Create alert on websites blocked by ESET.
Severity	Low
Tactics	Exfiltration CommandAndControl InitialAccess
Techniques	T1041 T1071 T1189 T1566
Required data connectors	ESETPROTECT SyslogAma
Kind	Scheduled
Query frequency	5m
Query period	5m
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/ESETPROTECT/Analytic Rules/ESETWebsiteBlocked.yaml
Version	1.0.2
Arm template	7b84fc5b-9ffb-4e9b-945b-5d480e330b3f.json

KQL

ESETPROTECT
| where EventType == 'FilteredWebsites_Event'
| extend SrcUserName, FilePath, DvcHostname, DvcIpAddr

YAML

name: Website blocked by ESET
query: |
  ESETPROTECT
  | where EventType == 'FilteredWebsites_Event'
  | extend SrcUserName, FilePath, DvcHostname, DvcIpAddr  
queryFrequency: 5m
triggerOperator: gt
requiredDataConnectors:
- dataTypes:
  - ESETPROTECT
  connectorId: ESETPROTECT
- datatypes:
  - Syslog
  connectorId: SyslogAma
entityMappings:
- entityType: Account
  fieldMappings:
  - identifier: FullName
    columnName: SrcUserName
- entityType: Host
  fieldMappings:
  - identifier: FullName
    columnName: DvcHostname
- entityType: IP
  fieldMappings:
  - identifier: Address
    columnName: DvcIpAddr
- entityType: URL
  fieldMappings:
  - identifier: Url
    columnName: FilePath
triggerThreshold: 0
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/ESETPROTECT/Analytic Rules/ESETWebsiteBlocked.yaml
description: |
    'Create alert on websites blocked by ESET.'
version: 1.0.2
id: 7b84fc5b-9ffb-4e9b-945b-5d480e330b3f
kind: Scheduled
relevantTechniques:
- T1041
- T1071
- T1189
- T1566
severity: Low
tactics:
- Exfiltration
- CommandAndControl
- InitialAccess
queryPeriod: 5m

ARM