List Tamper Protection Alert Triggered By VMware Carbon Black App Control
Description
This KQL query looks for where Tamper Protection is detected by VMware Carbon Black App Control.
Query
Microsoft Sentinel
Kusto
CommonSecurityLog
| where DeviceVendor == "VMware Carbon Black"
| where DeviceProduct == "App Control"
| where Activity == "Tamper Protection"
| project TimeGenerated, DestinationHostName, DestinationIP, DestinationUserName, FilePath, FileName