Microsoft Sentinel Analytic Rules
cloudbrothers.infoAzure Sentinel RepoToggle Dark/Light/Auto modeToggle Dark/Light/Auto modeToggle Dark/Light/Auto modeBack to homepage

Web sites blocked by Eset

Back
Id84ad2f8a-b64c-49bc-b669-bdb4fd3071e9
RulenameWeb sites blocked by Eset
DescriptionCreate alert on web sites blocked by Eset.
SeverityLow
TacticsExfiltration
CommandAndControl
InitialAccess
TechniquesT1189
T1567
T1071.001
Required data connectorsEsetSMC
KindScheduled
Query frequency5m
Query period5m
Trigger threshold0
Trigger operatorgt
Source Urihttps://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Eset Security Management Center/Analytic Rules/eset-sites-blocked.yaml
Version1.0.1
Arm template84ad2f8a-b64c-49bc-b669-bdb4fd3071e9.json
Deploy To Azure
eset_CL
| where event_type_s == 'FilteredWebsites_Event'
| extend AccountCustomEntity = username_s, URLCustomEntity = object_uri_s, HostCustomEntity = hostname_s, IPCustomEntity = ipv4_s
tactics:
- Exfiltration
- CommandAndControl
- InitialAccess
relevantTechniques:
- T1189
- T1567
- T1071.001
id: 84ad2f8a-b64c-49bc-b669-bdb4fd3071e9
severity: Low
status: Available
name: Web sites blocked by Eset
requiredDataConnectors:
- connectorId: EsetSMC
  dataTypes:
  - eset_CL
query: |
  eset_CL
  | where event_type_s == 'FilteredWebsites_Event'
  | extend AccountCustomEntity = username_s, URLCustomEntity = object_uri_s, HostCustomEntity = hostname_s, IPCustomEntity = ipv4_s  
queryPeriod: 5m
entityMappings:
- entityType: Account
  fieldMappings:
  - identifier: FullName
    columnName: AccountCustomEntity
- entityType: Host
  fieldMappings:
  - identifier: FullName
    columnName: HostCustomEntity
- entityType: IP
  fieldMappings:
  - identifier: Address
    columnName: IPCustomEntity
- entityType: URL
  fieldMappings:
  - identifier: Url
    columnName: URLCustomEntity
triggerOperator: gt
triggerThreshold: 0
description: |
    'Create alert on web sites blocked by Eset.'
version: 1.0.1
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Eset Security Management Center/Analytic Rules/eset-sites-blocked.yaml
queryFrequency: 5m
kind: Scheduled
{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "workspace": {
      "type": "String"
    }
  },
  "resources": [
    {
      "apiVersion": "2024-01-01-preview",
      "id": "[concat(resourceId('Microsoft.OperationalInsights/workspaces/providers', parameters('workspace'), 'Microsoft.SecurityInsights'),'/alertRules/84ad2f8a-b64c-49bc-b669-bdb4fd3071e9')]",
      "kind": "Scheduled",
      "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/84ad2f8a-b64c-49bc-b669-bdb4fd3071e9')]",
      "properties": {
        "alertRuleTemplateName": "84ad2f8a-b64c-49bc-b669-bdb4fd3071e9",
        "customDetails": null,
        "description": "'Create alert on web sites blocked by Eset.'\n",
        "displayName": "Web sites blocked by Eset",
        "enabled": true,
        "entityMappings": [
          {
            "entityType": "Account",
            "fieldMappings": [
              {
                "columnName": "AccountCustomEntity",
                "identifier": "FullName"
              }
            ]
          },
          {
            "entityType": "Host",
            "fieldMappings": [
              {
                "columnName": "HostCustomEntity",
                "identifier": "FullName"
              }
            ]
          },
          {
            "entityType": "IP",
            "fieldMappings": [
              {
                "columnName": "IPCustomEntity",
                "identifier": "Address"
              }
            ]
          },
          {
            "entityType": "URL",
            "fieldMappings": [
              {
                "columnName": "URLCustomEntity",
                "identifier": "Url"
              }
            ]
          }
        ],
        "OriginalUri": "https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Eset Security Management Center/Analytic Rules/eset-sites-blocked.yaml",
        "query": "eset_CL\n| where event_type_s == 'FilteredWebsites_Event'\n| extend AccountCustomEntity = username_s, URLCustomEntity = object_uri_s, HostCustomEntity = hostname_s, IPCustomEntity = ipv4_s\n",
        "queryFrequency": "PT5M",
        "queryPeriod": "PT5M",
        "severity": "Low",
        "status": "Available",
        "subTechniques": [
          "T1071.001"
        ],
        "suppressionDuration": "PT1H",
        "suppressionEnabled": false,
        "tactics": [
          "CommandAndControl",
          "Exfiltration",
          "InitialAccess"
        ],
        "techniques": [
          "T1071",
          "T1189",
          "T1567"
        ],
        "templateVersion": "1.0.1",
        "triggerOperator": "GreaterThan",
        "triggerThreshold": 0
      },
      "type": "Microsoft.OperationalInsights/workspaces/providers/alertRules"
    }
  ]
}