Microsoft Sentinel Analytic Rules
cloudbrothers.infoAzure Sentinel RepoToggle Dark/Light/Auto modeToggle Dark/Light/Auto modeToggle Dark/Light/Auto modeBack to homepage

Website blocked by ESET

Back
Id7b84fc5b-9ffb-4e9b-945b-5d480e330b3f
RulenameWebsite blocked by ESET
DescriptionCreate alert on websites blocked by ESET.
SeverityLow
TacticsExfiltration
CommandAndControl
InitialAccess
TechniquesT1041
T1071
T1189
T1566
Required data connectorsESETPROTECT
KindScheduled
Query frequency5m
Query period5m
Trigger threshold0
Trigger operatorgt
Source Urihttps://github.com/Azure/Azure-Sentinel/blob/master/Solutions/ESETPROTECT/Analytic Rules/ESETWebsiteBlocked.yaml
Version1.0.1
Arm template7b84fc5b-9ffb-4e9b-945b-5d480e330b3f.json
Deploy To Azure
ESETPROTECT
| where EventType == 'FilteredWebsites_Event'
| extend SrcUserName, FilePath, DvcHostname, DvcIpAddr
name: Website blocked by ESET
triggerOperator: gt
relevantTechniques:
- T1041
- T1071
- T1189
- T1566
query: |
  ESETPROTECT
  | where EventType == 'FilteredWebsites_Event'
  | extend SrcUserName, FilePath, DvcHostname, DvcIpAddr  
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/ESETPROTECT/Analytic Rules/ESETWebsiteBlocked.yaml
description: |
    'Create alert on websites blocked by ESET.'
triggerThreshold: 0
id: 7b84fc5b-9ffb-4e9b-945b-5d480e330b3f
kind: Scheduled
severity: Low
version: 1.0.1
entityMappings:
- fieldMappings:
  - identifier: FullName
    columnName: SrcUserName
  entityType: Account
- fieldMappings:
  - identifier: FullName
    columnName: DvcHostname
  entityType: Host
- fieldMappings:
  - identifier: Address
    columnName: DvcIpAddr
  entityType: IP
- fieldMappings:
  - identifier: Url
    columnName: FilePath
  entityType: URL
queryFrequency: 5m
queryPeriod: 5m
requiredDataConnectors:
- dataTypes:
  - ESETPROTECT
  connectorId: ESETPROTECT
tactics:
- Exfiltration
- CommandAndControl
- InitialAccess
{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "workspace": {
      "type": "String"
    }
  },
  "resources": [
    {
      "apiVersion": "2023-02-01-preview",
      "id": "[concat(resourceId('Microsoft.OperationalInsights/workspaces/providers', parameters('workspace'), 'Microsoft.SecurityInsights'),'/alertRules/7b84fc5b-9ffb-4e9b-945b-5d480e330b3f')]",
      "kind": "Scheduled",
      "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/7b84fc5b-9ffb-4e9b-945b-5d480e330b3f')]",
      "properties": {
        "alertRuleTemplateName": "7b84fc5b-9ffb-4e9b-945b-5d480e330b3f",
        "customDetails": null,
        "description": "'Create alert on websites blocked by ESET.'\n",
        "displayName": "Website blocked by ESET",
        "enabled": true,
        "entityMappings": [
          {
            "entityType": "Account",
            "fieldMappings": [
              {
                "columnName": "SrcUserName",
                "identifier": "FullName"
              }
            ]
          },
          {
            "entityType": "Host",
            "fieldMappings": [
              {
                "columnName": "DvcHostname",
                "identifier": "FullName"
              }
            ]
          },
          {
            "entityType": "IP",
            "fieldMappings": [
              {
                "columnName": "DvcIpAddr",
                "identifier": "Address"
              }
            ]
          },
          {
            "entityType": "URL",
            "fieldMappings": [
              {
                "columnName": "FilePath",
                "identifier": "Url"
              }
            ]
          }
        ],
        "OriginalUri": "https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/ESETPROTECT/Analytic Rules/ESETWebsiteBlocked.yaml",
        "query": "ESETPROTECT\n| where EventType == 'FilteredWebsites_Event'\n| extend SrcUserName, FilePath, DvcHostname, DvcIpAddr\n",
        "queryFrequency": "PT5M",
        "queryPeriod": "PT5M",
        "severity": "Low",
        "suppressionDuration": "PT1H",
        "suppressionEnabled": false,
        "tactics": [
          "CommandAndControl",
          "Exfiltration",
          "InitialAccess"
        ],
        "techniques": [
          "T1041",
          "T1071",
          "T1189",
          "T1566"
        ],
        "templateVersion": "1.0.1",
        "triggerOperator": "GreaterThan",
        "triggerThreshold": 0
      },
      "type": "Microsoft.OperationalInsights/workspaces/providers/alertRules"
    }
  ]
}