List FileZilla SFTP Activity Not Blocked By Symantec Endpoint Protection
Description
This KQL query lists all FileZilla SFTP events that Symantec Endpoint Protection detected but did not block and a summary count of unique alerts for a given time frame.
Risk
Explain what risk this detection tries to cover.
References
Query
Microsoft Sentinel
Kusto
SymantecEndpointProtection
| where LogType == "Agent Security Logs" or LogType == "Agent Risk Logs"
| where EventDescription contains "Audit: FileZilla SFTP Activity"
| where EventDescription contains "attack detected but not blocked"
| summarize Count=count() by UserName, LocalHostIpAddr, RemoteHostName, RemoteHostIpAddr, TrafficDirection, IntrusionUrl, EventDescription