Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · Logic Apps · 📊
Fires when the UniqkeyEvents_CL table has received no events for six consecutive hours. A silent feed can mean the data connector is failing, the API token has expired or been revoked, or the audit feed has been disabled on the Uniqkey side, and an attacker disabling logging looks identical to an operational outage, so the gap itself is treated as a security signal. Extend the query period if your organization is regularly quiet for longer stretches, for example over weekends.
| Attribute | Value |
|---|---|
| Type | Analytic Rule |
| Solution | Uniqkey |
| ID | 97857198-99f2-48dd-b036-461d85a29570 |
| Severity | Medium |
| Kind | Scheduled |
| Tactics | DefenseEvasion |
| Techniques | T1562 |
| Required Connectors | UniqkeyEventsConnector |
| Source | View on GitHub |
This content item queries data from the following tables:
| Table | Transformations | Ingestion API | Lake-Only |
|---|---|---|---|
UniqkeyEvents_CL |
? | ✓ | ? |
Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · Logic Apps · 📊