Detection rules › Kusto
Malware Detection Session Finished
Detects when malware detection session finishes.
Rule body
id: 88b9223c-29ff-48a9-a745-c553aa0dbae2
name: Malware Detection Session Finished
description: Detects when malware detection session finishes.
severity: Informational
status: Available
requiredDataConnectors:
- connectorId: Syslog
dataTypes:
- Syslog
- connectorId: SyslogAma
dataTypes:
- Syslog
queryFrequency: 3h
queryPeriod: 3h
triggerOperator: gt
triggerThreshold: 0
eventGroupingSettings:
aggregationKind: AlertPerResult
tactics: []
relevantTechniques: []
query: "let action_results_lookup = union isfuzzy=true (datatable(JobResult:string,\
\ JobResultMessage:string)[]), (_GetWatchlist(\"action_results_lookup\")); \nVeeam_GetSecurityEvents\n\
| where instanceId == 42210\n| extend Result = extract(\"Result=\\\"([^\\\"]*)\\\
\"\", 1, SyslogMessage)\n| extend SessionID = extract(\"SessionID=\\\"([^\\\"]*)\\\
\"\", 1, SyslogMessage)\n| lookup kind=leftouter (action_results_lookup)\n on\
\ $left.Result == $right.JobResult\n| project\n Date = format_datetime(TimeGenerated,\
\ 'dd.MM.yyyy HH:mm'),\n DataSource = original_host,\n EventId = instanceId,\n\
\ [\"Session ID\"] = SessionID,\n [\"StateMessage\"] = JobResultMessage,\n\
\ MessageDetails = Description,\n Severity = SeverityDescription\n"
version: 1.0.1
kind: Scheduled
customDetails:
Date: Date
VbrHostName: DataSource
EventId: EventId
MessageDetails: MessageDetails
Severity: Severity
Stages and Predicates
Stage 0: let
let action_results_lookup = union isfuzzy=true (datatable(JobResult:string, JobResultMessage:string)[]), (_GetWatchlist("action_results_lookup"));
Stage 1: source
Veeam_GetSecurityEvents
Stage 2: where
| where instanceId == 42210
Stage 3: extend
| extend Result = extract("Result=\"([^\"]*)\"", 1, SyslogMessage)
Stage 4: extend
| extend SessionID = extract("SessionID=\"([^\"]*)\"", 1, SyslogMessage)
Stage 5: kusto:lookup
lookup kind=leftouter (action_results_lookup) on Result, JobResult
Stage 6: project
project DataSource, Date, EventId, MessageDetails, Session ID, Severity, StateMessage
Indicators
These rows show field, operator, and value matches.
| Field | Kind | Values | Search |
|---|---|---|---|
instanceId | eq |
| field:"instanceId" kind:eq value:"42210" |
Output fields
These fields are emitted when the rule matches.
| Field | Source |
|---|---|
DataSource | project |
Date | project |
EventId | project |
MessageDetails | project |
Session ID | project |
Severity | project |
StateMessage | project |