Website blocked by ESET

Back


Id	7b84fc5b-9ffb-4e9b-945b-5d480e330b3f
Rulename	Website blocked by ESET
Description	Create alert on websites blocked by ESET.
Severity	Low
Tactics	Exfiltration CommandAndControl InitialAccess
Techniques	T1041 T1071 T1189 T1566
Required data connectors	ESETPROTECT SyslogAma
Kind	Scheduled
Query frequency	5m
Query period	5m
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/ESETPROTECT/Analytic Rules/ESETWebsiteBlocked.yaml
Version	1.0.2
Arm template	7b84fc5b-9ffb-4e9b-945b-5d480e330b3f.json

KQL

ESETPROTECT
| where EventType == 'FilteredWebsites_Event'
| extend SrcUserName, FilePath, DvcHostname, DvcIpAddr

YAML

queryPeriod: 5m
query: |
  ESETPROTECT
  | where EventType == 'FilteredWebsites_Event'
  | extend SrcUserName, FilePath, DvcHostname, DvcIpAddr  
name: Website blocked by ESET
entityMappings:
- fieldMappings:
  - columnName: SrcUserName
    identifier: FullName
  entityType: Account
- fieldMappings:
  - columnName: DvcHostname
    identifier: FullName
  entityType: Host
- fieldMappings:
  - columnName: DvcIpAddr
    identifier: Address
  entityType: IP
- fieldMappings:
  - columnName: FilePath
    identifier: Url
  entityType: URL
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/ESETPROTECT/Analytic Rules/ESETWebsiteBlocked.yaml
requiredDataConnectors:
- connectorId: ESETPROTECT
  dataTypes:
  - ESETPROTECT
- connectorId: SyslogAma
  datatypes:
  - Syslog
description: |
    'Create alert on websites blocked by ESET.'
kind: Scheduled
version: 1.0.2
queryFrequency: 5m
severity: Low
relevantTechniques:
- T1041
- T1071
- T1189
- T1566
triggerOperator: gt
triggerThreshold: 0
tactics:
- Exfiltration
- CommandAndControl
- InitialAccess
id: 7b84fc5b-9ffb-4e9b-945b-5d480e330b3f

ARM