Elastic low stable kql

Unusual Discovery Signal Alert with Unusual Process Executable

This rule leverages Discovery building block rule alert data to alert on signals with unusual unique host.id, user.id and process.executable entries.

View Source

Detection Logic

host.os.type:windows and event.kind:signal and kibana.alert.rule.rule_id:"1d72d014-e2ab-4707-b056-9b96abe7b511"

Field Validations

Loading…

Comments (0)

Loading comments...