McAfee ePO - Multiple threats on same host

Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · 📊

↑ Back to Content Index

---

Rule fires when multiple threat events were detected on the same host.

Attribute	Value
Type	Analytic Rule
Solution	McAfee ePolicy Orchestrator
ID	f53e5168-afdb-4fad-b29a-bb9cb71ec460
Severity	Medium
Status	Available
Kind	Scheduled
Tactics	InitialAccess, Persistence, DefenseEvasion, PrivilegeEscalation
Techniques	T1562, T1070, T1189, T1195, T1543, T1055
Required Connectors	SyslogAma
Source	View on GitHub

Tables Used

This content item queries data from the following tables:

Table	Selection Criteria	Transformations	Ingestion API	Lake-Only
Syslog	ProcessName contains "EPOEvents" SyslogMessage contains "<EPOevent>" SyslogMessage contains "<UpdateEvents>"	✓	✓	?

---

Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · 📊

↑ Back to Analytic Rules · Back to McAfee ePolicy Orchestrator