Microsoft Sentinel medium experimental kql

Bitglass - The SmartEdge endpoint agent was uninstalled

'Detects when SmartEdge endpoint agent was uninstalled.'

View Source

Detection Logic

Bitglass
| where EventType =~ 'access'
| where EventResultDetails startswith 'The SmartEdge endpoint agent was uninstalled'
| extend IPCustomEntity = SrcIpAddr

Field Validations

Loading…

Comments (0)

Loading comments...