Microsoft COVID-19 file hash indicator matches

Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · 📊

Back to Content Index


Identifies a match in CommonSecurityLog Event data from any FileHash published in the Microsoft COVID-19 Threat Intel Feed - as described at https://www.microsoft.com/security/blog/2020/05/14/open-sourcing-covid-threat-intelligence/

Attribute Value
Type Analytic Rule
Solution PaloAlto-PAN-OS
ID 2be4ef67-a93f-4d8a-981a-88158cb73abd
Severity Medium
Status Available
Kind Scheduled
Tactics Execution
Techniques T1204.002
Required Connectors CefAma
Source View on GitHub

Tables Used

This content item queries data from the following tables:

Table Transformations Ingestion API Lake-Only
CommonSecurityLog ?

Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · 📊

Back to Analytic Rules · Back to PaloAlto-PAN-OS