Website blocked by ESET

Back


Id	7b84fc5b-9ffb-4e9b-945b-5d480e330b3f
Rulename	Website blocked by ESET
Description	Create alert on websites blocked by ESET.
Severity	Low
Tactics	Exfiltration CommandAndControl InitialAccess
Techniques	T1041 T1071 T1189 T1566
Required data connectors	ESETPROTECT SyslogAma
Kind	Scheduled
Query frequency	5m
Query period	5m
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/ESETPROTECT/Analytic Rules/ESETWebsiteBlocked.yaml
Version	1.0.2
Arm template	7b84fc5b-9ffb-4e9b-945b-5d480e330b3f.json

KQL

ESETPROTECT
| where EventType == 'FilteredWebsites_Event'
| extend SrcUserName, FilePath, DvcHostname, DvcIpAddr

YAML

kind: Scheduled
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/ESETPROTECT/Analytic Rules/ESETWebsiteBlocked.yaml
query: |
  ESETPROTECT
  | where EventType == 'FilteredWebsites_Event'
  | extend SrcUserName, FilePath, DvcHostname, DvcIpAddr  
requiredDataConnectors:
- dataTypes:
  - ESETPROTECT
  connectorId: ESETPROTECT
- datatypes:
  - Syslog
  connectorId: SyslogAma
tactics:
- Exfiltration
- CommandAndControl
- InitialAccess
name: Website blocked by ESET
relevantTechniques:
- T1041
- T1071
- T1189
- T1566
severity: Low
entityMappings:
- fieldMappings:
  - identifier: FullName
    columnName: SrcUserName
  entityType: Account
- fieldMappings:
  - identifier: FullName
    columnName: DvcHostname
  entityType: Host
- fieldMappings:
  - identifier: Address
    columnName: DvcIpAddr
  entityType: IP
- fieldMappings:
  - identifier: Url
    columnName: FilePath
  entityType: URL
queryFrequency: 5m
description: |
    'Create alert on websites blocked by ESET.'
triggerThreshold: 0
triggerOperator: gt
version: 1.0.2
queryPeriod: 5m
id: 7b84fc5b-9ffb-4e9b-945b-5d480e330b3f

ARM