Elastic medium stable kql

Adversary Behavior - Detected - Elastic Endgame

Elastic Endgame detected an Adversary Behavior. Click the Elastic Endgame icon in the event.module column or the link in the rule.reference column for additional information.

View Source

Detection Logic

event.kind:alert and event.module:endgame and (event.action:behavior_protection_event or endgame.event_subtype_full:behavior_protection_event)

Field Validations

Loading…

Comments (0)

Loading comments...