Elastic medium stable kql

Exploit - Prevented - Elastic Endgame

Elastic Endgame prevented an Exploit. Click the Elastic Endgame icon in the event.module column or the link in the rule.reference column for additional information.

View Source

Detection Logic

event.kind:alert and event.module:endgame and endgame.metadata.type:prevention and (event.action:exploit_event or endgame.event_subtype_full:exploit_event)

Field Validations

Loading…

Comments (0)

Loading comments...