Sagan low stable other

Azure Eventhub Active Directory detected

Azure Eventhub Active Directory detected

View Source

Detection Logic

alert any $HOME_NET any -> $HOME_NET any (msg:"Azure Eventhub Active Directory detected"; program:azureEventHub; event_id:4768,8004; metadata: fingerprint_source logs, fingerprint_os azure_ad, fingerprint_expire 86400; threshold: type suppress, track by_src, seconds 43200, count 1; classtype:fingerprint; sid:5100164; rev:1;)

Field Validations

Loading…

Comments (0)

Loading comments...