Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · Logic Apps · 📊
Identifies instances where Wazuh logged over 400 '403' Web Errors from one IP Address. To onboard Wazuh data into Sentinel please view: https://documentation.wazuh.com/current/cloud-security/azure/index.html
| Attribute | Value |
|---|---|
| Type | Analytic Rule |
| Solution | Standalone Content |
| ID | 2790795b-7dba-483e-853f-44aa0bc9c985 |
| Severity | Low |
| Kind | Scheduled |
| Tactics | CredentialAccess |
| Techniques | T1110 |
| Source | View on GitHub |
This content item queries data from the following tables:
| Table | Selection Criteria | Transformations | Ingestion API | Lake-Only |
|---|---|---|---|---|
CommonSecurityLog |
Activity has "Web server 400 error code."DeviceProduct == "Wazuh"Message has "403" |
✓ | ✓ | ✓ |
The following connectors provide data for this content item:
Solutions: Common Event Format, VirtualMetric DataStream
Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · Logic Apps · 📊