Link Search Menu Expand Document

Ingress_Interruption_EventSender_Hourly

ID: 100278

Description:

Event from one import source (@sender) stopped for 4 hour(s)

Repository: Fluency Group: System Type: event

Default Status:

Enabled

Tags:
Services
 

Selector:

Query:

Filters:

Field MUST hit
@sender entity: [ Interruption_Monitoring_EventSender_Hourly ]
Field MUST NOT hit
   

Behavior Rule:

Key Type Behavior Category
@type asset application activity

Risks:

Risks Base Score Dimension
     

Attributes:

Alias Key
EventSource @source
EventSender @sender

Correlation Rules:

Aggregation:

Name Window Field AggType Match
Interruption 4 hours   count lt 1
  Risks: ALERT_NORMAL    

History:

User Date
ho*d@fluencysecurity.com 2021 Jul 22 23:06:46 EDT
ho*d@fluencysecurity.com 2021 Jul 24 00:26:36 EDT

This page was automatically created/formatted on Wed, 2022 May 4 21:43:53 EDT, from rule_dump.json (4d88bffdfb1cea26b3985f2193033606)