Website blocked by ESET

Back


Id	7b84fc5b-9ffb-4e9b-945b-5d480e330b3f
Rulename	Website blocked by ESET
Description	Create alert on websites blocked by ESET.
Severity	Low
Tactics	Exfiltration CommandAndControl InitialAccess
Techniques	T1041 T1071 T1189 T1566
Required data connectors	ESETPROTECT SyslogAma
Kind	Scheduled
Query frequency	5m
Query period	5m
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/ESETPROTECT/Analytic Rules/ESETWebsiteBlocked.yaml
Version	1.0.2
Arm template	7b84fc5b-9ffb-4e9b-945b-5d480e330b3f.json

KQL

ESETPROTECT
| where EventType == 'FilteredWebsites_Event'
| extend SrcUserName, FilePath, DvcHostname, DvcIpAddr

YAML

name: Website blocked by ESET
id: 7b84fc5b-9ffb-4e9b-945b-5d480e330b3f
description: |
    'Create alert on websites blocked by ESET.'
triggerThreshold: 0
entityMappings:
- fieldMappings:
  - columnName: SrcUserName
    identifier: FullName
  entityType: Account
- fieldMappings:
  - columnName: DvcHostname
    identifier: FullName
  entityType: Host
- fieldMappings:
  - columnName: DvcIpAddr
    identifier: Address
  entityType: IP
- fieldMappings:
  - columnName: FilePath
    identifier: Url
  entityType: URL
version: 1.0.2
triggerOperator: gt
query: |
  ESETPROTECT
  | where EventType == 'FilteredWebsites_Event'
  | extend SrcUserName, FilePath, DvcHostname, DvcIpAddr  
tactics:
- Exfiltration
- CommandAndControl
- InitialAccess
kind: Scheduled
queryFrequency: 5m
severity: Low
queryPeriod: 5m
requiredDataConnectors:
- dataTypes:
  - ESETPROTECT
  connectorId: ESETPROTECT
- datatypes:
  - Syslog
  connectorId: SyslogAma
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/ESETPROTECT/Analytic Rules/ESETWebsiteBlocked.yaml
relevantTechniques:
- T1041
- T1071
- T1189
- T1566

ARM