Microsoft Sentinel medium experimental kql

CiscoISE - Log collector was suspended

'Detects when log collector was suspended.'

View Source

Detection Logic

let lbtime = 10m;
CiscoISEEvent
| where TimeGenerated > ago(lbtime)
| where EventId == '59207'
| project TimeGenerated, SrcIpAddr, DstIpAddr
| extend IPCustomEntity = DstIpAddr

Field Validations

Loading…

Comments (0)

Loading comments...