List Untrusted SSH File Transfer Protocol Connection Not Blocked By Symantec Endpoint Protection
Description
This KQL query lists all untrusted SSH file transfer protocol connection events that Symantec Endpoint Protection detected but did not block and a summary count of unique alerts for a given time frame.
Query
Microsoft Sentinel
Kusto
SymantecEndpointProtection
| where LogType == "Agent Security Logs" or LogType == "Agent Risk Logs"
| where EventDescription contains "Audit: Untrusted SSH File Transfer Protocol Connection"
| where EventDescription contains "attack detected but not blocked"
| summarize Count=count() by UserName, LocalHostIpAddr, RemoteHostName, RemoteHostIpAddr, TrafficDirection, IntrusionUrl, EventDescription