List Suspicious Process Accessing A Website Not Blocked By Symantec Endpoint Protection
Description
This query lists all suspicious process accessing a website events that Symantec Endpoint Protection detected but did not block and a summary count of unique alerts for a given time frame.
Query
Microsoft Sentinel
Kusto
SymantecEndpointProtection
| where LogType == "Agent Security Logs" or LogType == "Agent Risk Logs"
| where EventDescription contains "Audit: Suspicious Process Accessing"
| where EventDescription contains "attack detected but not blocked"
| summarize Count=count() by UserName, LocalHostIpAddr, RemoteHostName, RemoteHostIpAddr, TrafficDirection, IntrusionUrl, EventDescription