Microsoft Sentinel high experimental kql

Cisco SDWAN - Maleware Events

'This analytic rule will monitor Malware Events in Syslog and Netflow Data'

View Source

Detection Logic

CiscoSyslogUTD
| where isnotempty(Malware) and Malware != "None"
| distinct Malware, SourceIP
| join kind=inner (CiscoSDWANNetflow
| where isnotempty(NetflowUsername)
| summarize arg_max(TimeStamp, NetflowUsername) by NetflowFwSrcAddrIpv4
| distinct 
    ["Username"] = NetflowUsername,
    ["SourceIP"] = NetflowFwSrcAddrIpv4) on SourceIP
| project Malware, SourceIP, Username

Field Validations

Loading…

Comments (0)

Loading comments...