Website blocked by ESET

id: 7b84fc5b-9ffb-4e9b-945b-5d480e330b3f
name: Website blocked by ESET
description: |
  'Create alert on websites blocked by ESET.'
severity: Low
requiredDataConnectors:
  - connectorId: ESETPROTECT
    dataTypes:
      - ESETPROTECT
  - connectorId: SyslogAma
    datatypes:
      - Syslog
queryFrequency: 5m
queryPeriod: 5m
triggerOperator: gt
triggerThreshold: 0
tactics:
  - Exfiltration
  - CommandAndControl
  - InitialAccess
relevantTechniques:
  - T1041
  - T1071
  - T1189
  - T1566
query: |
  ESETPROTECT
  | where EventType == 'FilteredWebsites_Event'
  | extend SrcUserName, FilePath, DvcHostname, DvcIpAddr
entityMappings:
  - entityType: Account
    fieldMappings:
      - identifier: FullName
        columnName: SrcUserName
  - entityType: Host
    fieldMappings:
      - identifier: FullName
        columnName: DvcHostname
  - entityType: IP
    fieldMappings:
      - identifier: Address
        columnName: DvcIpAddr
  - entityType: URL
    fieldMappings:
      - identifier: Url
        columnName: FilePath
version: 1.0.2
kind: Scheduled