KQL to Detect Suspicious Process Website Access Not Blocked by Symantec
Description Using the power of KQL and Microsoft Sentinel, this detection script identifies events where a suspicious process attempted to
Read MoreWhere Every Failure Becomes A Manual
Description Using the power of KQL and Microsoft Sentinel, this detection script identifies events where a suspicious process attempted to
Read MoreThis KQL query detects banned files written to computers by VMware Carbon Black App Control. It targets security events logged
Read MoreThis KQL query detects suspicious files flagged by VMware Carbon Black App Control, enabling security analysts to pinpoint potential risky
Read MoreUsing KQL (Kusto Query Language), you can efficiently identify malicious files detected by VMware Carbon Black App Control. This query
Read MoreThis KQL query helps detect FileZilla SFTP activities flagged by Symantec Endpoint Protection where attacks were detected but not blocked.
Read MoreThis KQL query extracts adware-related security events from Symantec Endpoint Protection (SEP) logs, focusing on instances where adware was detected
Read MoreThis article covers how to use a KQL (Kusto Query Language) script to list Ngrok activity detected by Symantec Endpoint
Read MoreThis KQL query identifies malicious scan attempts detected but not blocked by Symantec Endpoint Protection (SEP) by filtering relevant security
Read MoreThis KQL query is designed to identify all connections made to potential or malicious websites that Symantec Endpoint Protection (SEP)
Read More