Cisco SE High Events Last Hour

id: 4683ebce-07ad-4089-89e3-39d8fe83c011
name: Cisco SE High Events Last Hour
description: |
  'Find events from Cisco Secure Endpoint that are of High severity in the last hour.'
severity: High
requiredDataConnectors:
  - connectorId: CiscoSecureEndpoint
    dataTypes:
      - CiscoSecureEndpoint_CL
queryFrequency: 1h
queryPeriod: 1h
triggerOperator: gt
triggerThreshold: 0
status: Available
tactics:
  - Execution
  - InitialAccess
relevantTechniques:
  - T1204.002
  - T1190
query: |
  let endtime = 1h;
  CiscoSecureEndpoint_CL
  | where TimeGenerated >= ago(endtime)
  | where severity_s == "High"
  | project NetworkAddresses = parse_json(computer_network_addresses_s), computer_hostname_s, date_t, event_type_s, computer_links_trajectory_s
  | summarize CountInLastHour = count() by computer_hostname_s, date_t, event_type_s, tostring(NetworkAddresses.ip), computer_links_trajectory_s
entityMappings:
  - entityType: IP
    fieldMappings:
      - identifier: Address
        columnName: NetworkAddresses_ip
  - entityType: Host
    fieldMappings:
      - identifier: HostName
        columnName: computer_hostname_s
  - entityType: URL
    fieldMappings:
      - identifier: Url
        columnName: computer_links_trajectory_s
version: 1.0.1
kind: Scheduled