Detection rules › Kusto
AppServices AV Scan Failure
'Identifies if an AV scan fails in Azure App Services.'
Rule body
id: c2da1106-bfe4-4a63-bf14-5ab73130ccd5
name: AppServices AV Scan Failure
description: |
'Identifies if an AV scan fails in Azure App Services.'
severity: Informational
requiredDataConnectors: []
queryFrequency: 1d
queryPeriod: 1d
triggerOperator: gt
triggerThreshold: 1
query: |
let timeframe = ago(1d);
AppServiceAntivirusScanAuditLogs
| where ScanStatus == "Failed"
| extend timestamp = TimeGenerated
entityMappings:
- entityType: Host
fieldMappings:
- identifier: AzureID
columnName: _ResourceId
version: 1.0.3
kind: Scheduled
metadata:
source:
kind: Community
author:
name: SecurityJedi
support:
tier: Community
categories:
domains: [ "Security - Others", "Platform" ]
Stages and Predicates
Parameters
let timeframe = ago(1d);
Stage 1: source
AppServiceAntivirusScanAuditLogs
Stage 2: where
| where ScanStatus == "Failed"
Stage 3: extend
| extend timestamp = TimeGenerated
Indicators
These rows show field, operator, and value matches.
| Field | Kind | Values | Search |
|---|---|---|---|
ScanStatus | eq |
| field:"ScanStatus" kind:eq value:"Failed" |
Output fields
These fields are emitted when the rule matches.
| Field | Source |
|---|---|
timestamp | extend |