Panther medium experimental python

Carbon Black Log Entry Flagged

Detects when Carbon Black has flagged a log as important, such as failed login attempts and locked accounts.

View Source

Detection Logic

def rule(event):
    return event.get("flagged", False)


def title(event):
    user = event.get("loginName", "<NO_USERNAME_FOUND>")
    ip_addr = event.get("clientIp", "<NO_IP_FOUND>")
    desc = event.get("description", "<NO_DESCRIPTION_FOUND>")
    return f"{user} [{ip_addr}] {desc}"


def severity(event):
    if event.get("description").startswith("Requested sensor update"):
        return "INFO"
    return "DEFAULT"

Field Validations

Loading…

Comments (0)

Loading comments...