Elastic high stable eql
Elastic Defend Alert Followed by Telemetry Loss
Detects when an Elastic Defend endpoint alert is generated on a host and is not followed by any subsequent endpoint telemetry (process, network, registry, library, or DNS events) within a short time window. This behavior may indicate endpoint security evasion, agent tampering, sensor disablement, service termination, system crash, or malicious interference with telemetry collection following detection.
Detection Logic
sequence by host.id with maxspan=10m
[any where data_stream.dataset == "endpoint.alerts"]
![any where event.category in ("process", "library", "registry", "network", "dns", "file")]False Positives
- ⚠ Misconfiguration, system reboot, network issues or expected uninstall of the Elastic Defend agent.
Field Validations
Loading…
Comments (0)
Loading comments...