ESA Rules & Event Sources

[AntonioTeixeira]

Hi! Is there any type of document that explains the type of event source necessary for each ESA Rule? Example: for the "Web DoS Alert" rule the necessary or recommended event source would be a Firewall or a Router

[MohammedMustafa · Accepted solution]

Hi Antonio,

Basically it depends on the type & purpose of the Alert that you are planning to create.

For example, if I want to detect 'Lateral movement of infection' - First thing I will check if any Antivirus event source is sending logs to NW,

   >   then I will check what type of events Antivirus machine is sending,

   >   then I will check if those collected logs have the (infection/virus) & affected host information that I need,

   >   then I will check in which meta is that infection & affected host machine information is showing up.

   >   then my alert will consist of ((device.class = 'antivirus' OR device.class = 'symanecav') AND virusname exists AND host.src exists. Just an example.

Hope it helps.