Detection rules › Kusto
Cisco SE High Events Last Hour
'Find events from Cisco Secure Endpoint that are of High severity in the last hour.'
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Initial Access | T1190 Exploit Public-Facing Application |
| Execution | T1204.002 User Execution: Malicious File |
Rule body kusto
id: 4683ebce-07ad-4089-89e3-39d8fe83c011
name: Cisco SE High Events Last Hour
description: |
'Find events from Cisco Secure Endpoint that are of High severity in the last hour.'
severity: High
requiredDataConnectors:
- connectorId: CiscoSecureEndpoint
dataTypes:
- CiscoSecureEndpoint_CL
queryFrequency: 1h
queryPeriod: 1h
triggerOperator: gt
triggerThreshold: 0
status: Available
tactics:
- Execution
- InitialAccess
relevantTechniques:
- T1204.002
- T1190
query: |
let endtime = 1h;
CiscoSecureEndpoint_CL
| where TimeGenerated >= ago(endtime)
| where severity_s == "High"
| project NetworkAddresses = parse_json(computer_network_addresses_s), computer_hostname_s, date_t, event_type_s, computer_links_trajectory_s
| summarize CountInLastHour = count() by computer_hostname_s, date_t, event_type_s, tostring(NetworkAddresses.ip), computer_links_trajectory_s
entityMappings:
- entityType: IP
fieldMappings:
- identifier: Address
columnName: NetworkAddresses_ip
- entityType: Host
fieldMappings:
- identifier: HostName
columnName: computer_hostname_s
- entityType: URL
fieldMappings:
- identifier: Url
columnName: computer_links_trajectory_s
version: 1.0.1
kind: Scheduled
Stages and Predicates
Parameters
let endtime = 1h;
Stage 1: source
CiscoSecureEndpoint_CL
Stage 2: where
| where TimeGenerated >= ago(endtime)
Stage 3: where
| where severity_s == "High"
Stage 4: project
| project NetworkAddresses = parse_json(computer_network_addresses_s), computer_hostname_s, date_t, event_type_s, computer_links_trajectory_s
Stage 5: summarize
| summarize CountInLastHour = count() by computer_hostname_s, date_t, event_type_s, tostring(NetworkAddresses.ip), computer_links_trajectory_s
Indicators
Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.
| Field | Kind | Values |
|---|---|---|
severity_s | eq |
|
Output fields
Fields the rule emits when it matches. Chronicle authors list these in the outcome block; they appear on the detection and $risk_score drives alerting. Sentinel / Defender XDR rules build them up through project / summarize / extend stages. Sentinel maps these into alert fields via entityMappings and customDetails; Defender XDR custom detections surface them as alert fields directly.
| Field | Source |
|---|---|
CountInLastHour | summarize |
computer_hostname_s | summarize |
computer_links_trajectory_s | summarize |
date_t | summarize |
event_type_s | summarize |