Hello, I have a very simple ESA alert like this
:@RSAAlert(oneInSeconds=0) SELECT * FROM Event(
device_type='winevent_nic' AND user_dst.toLowerCase() IN
(admin,administrator) ) ;But when receiving ESA alert by mail,
event_time is displayed in epoch t...
Hello Community, I have the following ESA rule to detect portscan :
@RSAAlert(oneInSeconds=0)SELECT * FROM Event(device_type='snort'AND
ip_dstport=137).std:groupwin(ip_src).std:unique(ip_dst).win:time(60
sec)GROUP BY ip_src HAVING count(ip_dst) > 3; ...
Hello, Good question. I worked on the same case and I didn't found any
solution. Since log integration doesn't respect the original order,
alerts like this one can't work.
Hello, It looks like possible to use another way :
Get-SimpleAuditLogReport script powershell - Write a small script to
extract ms-exchange audit logs in csv format? - Stack Overflow
PowerShell Script to Generate a Report of Mailbox Audit Log Entries
Hello, You can use a syslog forwarder like EventReporter. It can monitor
dynamic evtx log files and forward them via syslog. Some time ago, I
used Windows Legacy collection protocol but I think that it works only
on evt and not evtx Maybe there is an...
