Cisco SE - Generic IOC

Back


Id	bccdbc39-31d3-4e2b-9df2-e4c9eecba825
Rulename	Cisco SE - Generic IOC
Description	This rule is triggered when generic IOC is observed on host.
Severity	High
Tactics	Execution
Techniques	T1204.002
Required data connectors	CiscoSecureEndpoint
Kind	Scheduled
Query frequency	15m
Query period	15m
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Cisco Secure Endpoint/Analytic Rules/CiscoSEGenIoC.yaml
Version	1.0.0
Arm template	bccdbc39-31d3-4e2b-9df2-e4c9eecba825.json

KQL

CiscoSecureEndpoint
| where EventMessage has 'Generic IOC'
| extend HostCustomEntity = DstHostname, MalwareCustomEntity = ThreatName

YAML

entityMappings:
- entityType: Host
  fieldMappings:
  - identifier: HostName
    columnName: HostCustomEntity
- entityType: Malware
  fieldMappings:
  - identifier: Name
    columnName: MalwareCustomEntity
tactics:
- Execution
requiredDataConnectors:
- dataTypes:
  - CiscoSecureEndpoint
  connectorId: CiscoSecureEndpoint
id: bccdbc39-31d3-4e2b-9df2-e4c9eecba825
severity: High
status: Available
query: |
  CiscoSecureEndpoint
  | where EventMessage has 'Generic IOC'
  | extend HostCustomEntity = DstHostname, MalwareCustomEntity = ThreatName  
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Cisco Secure Endpoint/Analytic Rules/CiscoSEGenIoC.yaml
kind: Scheduled
queryPeriod: 15m
version: 1.0.0
name: Cisco SE - Generic IOC
queryFrequency: 15m
triggerThreshold: 0
relevantTechniques:
- T1204.002
description: |
    'This rule is triggered when generic IOC is observed on host.'
triggerOperator: gt

ARM