CiscoISE - Log collector was suspended

Back


Id	ce171782-1643-4f21-bbb7-fa954b1e6897
Rulename	CiscoISE - Log collector was suspended
Description	Detects when log collector was suspended.
Severity	Medium
Tactics	DefenseEvasion
Techniques	T1562.002
Required data connectors	SyslogAma
Kind	Scheduled
Query frequency	10m
Query period	10m
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Cisco ISE/Analytic Rules/CiscoISELogCollectorSuspended.yaml
Version	1.0.3
Arm template	ce171782-1643-4f21-bbb7-fa954b1e6897.json

KQL

let lbtime = 10m;
CiscoISEEvent
| where TimeGenerated > ago(lbtime)
| where EventId == '59207'
| project TimeGenerated, SrcIpAddr, DstIpAddr
| extend IPCustomEntity = DstIpAddr

YAML

status: Available
queryFrequency: 10m
id: ce171782-1643-4f21-bbb7-fa954b1e6897
tactics:
- DefenseEvasion
entityMappings:
- fieldMappings:
  - columnName: IPCustomEntity
    identifier: Address
  entityType: IP
requiredDataConnectors:
- connectorId: SyslogAma
  datatypes:
  - Syslog
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Cisco ISE/Analytic Rules/CiscoISELogCollectorSuspended.yaml
version: 1.0.3
query: |
  let lbtime = 10m;
  CiscoISEEvent
  | where TimeGenerated > ago(lbtime)
  | where EventId == '59207'
  | project TimeGenerated, SrcIpAddr, DstIpAddr
  | extend IPCustomEntity = DstIpAddr  
description: |
    'Detects when log collector was suspended.'
relevantTechniques:
- T1562.002
triggerThreshold: 0
queryPeriod: 10m
triggerOperator: gt
name: CiscoISE - Log collector was suspended
severity: Medium
kind: Scheduled

ARM