Website blocked by ESET

Back


Id	7b84fc5b-9ffb-4e9b-945b-5d480e330b3f
Rulename	Website blocked by ESET
Description	Create alert on websites blocked by ESET.
Severity	Low
Tactics	Exfiltration CommandAndControl InitialAccess
Techniques	T1041 T1071 T1189 T1566
Required data connectors	ESETPROTECT SyslogAma
Kind	Scheduled
Query frequency	5m
Query period	5m
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/ESETPROTECT/Analytic Rules/ESETWebsiteBlocked.yaml
Version	1.0.2
Arm template	7b84fc5b-9ffb-4e9b-945b-5d480e330b3f.json

KQL

ESETPROTECT
| where EventType == 'FilteredWebsites_Event'
| extend SrcUserName, FilePath, DvcHostname, DvcIpAddr

YAML

OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/ESETPROTECT/Analytic Rules/ESETWebsiteBlocked.yaml
queryFrequency: 5m
name: Website blocked by ESET
severity: Low
triggerThreshold: 0
query: |
  ESETPROTECT
  | where EventType == 'FilteredWebsites_Event'
  | extend SrcUserName, FilePath, DvcHostname, DvcIpAddr  
requiredDataConnectors:
- dataTypes:
  - ESETPROTECT
  connectorId: ESETPROTECT
- datatypes:
  - Syslog
  connectorId: SyslogAma
relevantTechniques:
- T1041
- T1071
- T1189
- T1566
triggerOperator: gt
queryPeriod: 5m
description: |
    'Create alert on websites blocked by ESET.'
id: 7b84fc5b-9ffb-4e9b-945b-5d480e330b3f
version: 1.0.2
entityMappings:
- fieldMappings:
  - columnName: SrcUserName
    identifier: FullName
  entityType: Account
- fieldMappings:
  - columnName: DvcHostname
    identifier: FullName
  entityType: Host
- fieldMappings:
  - columnName: DvcIpAddr
    identifier: Address
  entityType: IP
- fieldMappings:
  - columnName: FilePath
    identifier: Url
  entityType: URL
kind: Scheduled
tactics:
- Exfiltration
- CommandAndControl
- InitialAccess

ARM