Adversary Behavior - Detected - Elastic Endgame

calendarApr 3, 2023  ·
Share on: linkedincopy

Elastic Endgame detected an Adversary Behavior. Click the Elastic Endgame icon in the event.module column or the link in the rule.reference column for additional information.

Elastic rule (View on GitHub)

 1[metadata]
 2creation_date = "2020/02/18"
 3maturity = "production"
 4min_stack_comments = "New fields added: required_fields, related_integrations, setup"
 5min_stack_version = "8.3.0"
 6updated_date = "2023/03/31"
 7promotion = true
 8
 9[rule]
10author = ["Elastic"]
11description = """
12Elastic Endgame detected an Adversary Behavior. Click the Elastic Endgame icon in the event.module column or the
13link in the rule.reference column for additional information.
14"""
15from = "now-15m"
16index = ["endgame-*"]
17interval = "10m"
18language = "kuery"
19license = "Elastic License v2"
20max_signals = 10000
21name = "Adversary Behavior - Detected - Elastic Endgame"
22risk_score = 47
23rule_id = "77a3c3df-8ec4-4da4-b758-878f551dee69"
24severity = "medium"
25tags = ["Elastic", "Elastic Endgame"]
26type = "query"
27
28query = '''
29event.kind:alert and event.module:endgame and (event.action:behavior_protection_event or endgame.event_subtype_full:behavior_protection_event)
30'''

to-top