Web sites blocked by Eset

Back


Id	84ad2f8a-b64c-49bc-b669-bdb4fd3071e9
Rulename	Web sites blocked by Eset
Description	Create alert on web sites blocked by Eset.
Severity	Low
Tactics	Exfiltration CommandAndControl InitialAccess
Techniques	T1189 T1567 T1071.001
Required data connectors	EsetSMC
Kind	Scheduled
Query frequency	5m
Query period	5m
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Eset Security Management Center/Analytic Rules/eset-sites-blocked.yaml
Version	1.0.1
Arm template	84ad2f8a-b64c-49bc-b669-bdb4fd3071e9.json

KQL

eset_CL
| where event_type_s == 'FilteredWebsites_Event'
| extend AccountCustomEntity = username_s, URLCustomEntity = object_uri_s, HostCustomEntity = hostname_s, IPCustomEntity = ipv4_s

YAML

kind: Scheduled
entityMappings:
- entityType: Account
  fieldMappings:
  - columnName: AccountCustomEntity
    identifier: FullName
- entityType: Host
  fieldMappings:
  - columnName: HostCustomEntity
    identifier: FullName
- entityType: IP
  fieldMappings:
  - columnName: IPCustomEntity
    identifier: Address
- entityType: URL
  fieldMappings:
  - columnName: URLCustomEntity
    identifier: Url
description: |
    'Create alert on web sites blocked by Eset.'
severity: Low
queryFrequency: 5m
triggerThreshold: 0
relevantTechniques:
- T1189
- T1567
- T1071.001
status: Available
tactics:
- Exfiltration
- CommandAndControl
- InitialAccess
name: Web sites blocked by Eset
id: 84ad2f8a-b64c-49bc-b669-bdb4fd3071e9
query: |
  eset_CL
  | where event_type_s == 'FilteredWebsites_Event'
  | extend AccountCustomEntity = username_s, URLCustomEntity = object_uri_s, HostCustomEntity = hostname_s, IPCustomEntity = ipv4_s  
requiredDataConnectors:
- dataTypes:
  - eset_CL
  connectorId: EsetSMC
version: 1.0.1
triggerOperator: gt
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Eset Security Management Center/Analytic Rules/eset-sites-blocked.yaml
queryPeriod: 5m

ARM

{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "workspace": {
      "type": "String"
    }
  },
  "resources": [
    {
      "apiVersion": "2024-01-01-preview",
      "id": "[concat(resourceId('Microsoft.OperationalInsights/workspaces/providers', parameters('workspace'), 'Microsoft.SecurityInsights'),'/alertRules/84ad2f8a-b64c-49bc-b669-bdb4fd3071e9')]",
      "kind": "Scheduled",
      "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/84ad2f8a-b64c-49bc-b669-bdb4fd3071e9')]",
      "properties": {
        "alertRuleTemplateName": "84ad2f8a-b64c-49bc-b669-bdb4fd3071e9",
        "customDetails": null,
        "description": "'Create alert on web sites blocked by Eset.'\n",
        "displayName": "Web sites blocked by Eset",
        "enabled": true,
        "entityMappings": [
          {
            "entityType": "Account",
            "fieldMappings": [
              {
                "columnName": "AccountCustomEntity",
                "identifier": "FullName"
              }
            ]
          },
          {
            "entityType": "Host",
            "fieldMappings": [
              {
                "columnName": "HostCustomEntity",
                "identifier": "FullName"
              }
            ]
          },
          {
            "entityType": "IP",
            "fieldMappings": [
              {
                "columnName": "IPCustomEntity",
                "identifier": "Address"
              }
            ]
          },
          {
            "entityType": "URL",
            "fieldMappings": [
              {
                "columnName": "URLCustomEntity",
                "identifier": "Url"
              }
            ]
          }
        ],
        "OriginalUri": "https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Eset Security Management Center/Analytic Rules/eset-sites-blocked.yaml",
        "query": "eset_CL\n| where event_type_s == 'FilteredWebsites_Event'\n| extend AccountCustomEntity = username_s, URLCustomEntity = object_uri_s, HostCustomEntity = hostname_s, IPCustomEntity = ipv4_s\n",
        "queryFrequency": "PT5M",
        "queryPeriod": "PT5M",
        "severity": "Low",
        "status": "Available",
        "subTechniques": [
          "T1071.001"
        ],
        "suppressionDuration": "PT1H",
        "suppressionEnabled": false,
        "tactics": [
          "CommandAndControl",
          "Exfiltration",
          "InitialAccess"
        ],
        "techniques": [
          "T1071",
          "T1189",
          "T1567"
        ],
        "templateVersion": "1.0.1",
        "triggerOperator": "GreaterThan",
        "triggerThreshold": 0
      },
      "type": "Microsoft.OperationalInsights/workspaces/providers/alertRules"
    }
  ]
}