Detection Logic
alert any $HOME_NET any -> $HOME_NET any (msg:"[SentinelOne] Quarantine failed"; content:"SentinelOne"; content:"activityType=2009"; classtype:system-error; priority:1; sid:5006644; rev:2;)Field Validations
Loading…
Comments (0)
Loading comments...