Samsung Knox - Security Log Full Events

Back


Id	bf9be360-7f08-48b2-8e9d-ca240c48b404
Rulename	Samsung Knox - Security Log Full Events
Description	When the Knox Security Log is full on a device.
Severity	High
Required data connectors	SamsungDCDefinition
Kind	NRT
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Samsung Knox Asset Intelligence/Analytic Rules/SamsungKnoxSecurityLogFull.yaml
Version	1.0.2
Arm template	bf9be360-7f08-48b2-8e9d-ca240c48b404.json

KQL

Samsung_Knox_Audit_CL
| where Name == "LOG_IS_FULL" 
and MitreTtp has "KNOX.1"

YAML

id: bf9be360-7f08-48b2-8e9d-ca240c48b404
tactics: []
kind: NRT
name: Samsung Knox - Security Log Full Events
query: |
  Samsung_Knox_Audit_CL
  | where Name == "LOG_IS_FULL" 
  and MitreTtp has "KNOX.1"  
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Samsung Knox Asset Intelligence/Analytic Rules/SamsungKnoxSecurityLogFull.yaml
description: When the Knox Security Log is full on a device.
version: 1.0.2
severity: High
relevantTechniques: []
suppressionDuration: PT5H
status: Available
suppressionEnabled: false
incidentConfiguration:
  createIncident: true
  groupingConfiguration:
    matchingMethod: AllEntities
    lookbackDuration: PT5H
    enabled: false
    reopenClosedIncident: false
eventGroupingSettings:
  aggregationKind: SingleAlert
requiredDataConnectors:
- connectorId: SamsungDCDefinition
  dataTypes:
  - Samsung_Knox_Audit_CL

ARM