Elastic high stable kql

Exploit - Detected - Elastic Endgame

Elastic Endgame detected an Exploit. Click the Elastic Endgame icon in the event.module column or the link in the rule.reference column for additional information.

View Source

Detection Logic

event.kind:alert and event.module:endgame and endgame.metadata.type:detection and (event.action:exploit_event or endgame.event_subtype_full:exploit_event)

Field Validations

Loading…

Comments (0)

Loading comments...