+ SECURE \ Kusto Query Language \ Symantec Endpoint Protection

Detecting untrusted SSH file transfer protocol connection events can help cybersecurity teams identify potential security gaps within Symantec Endpoint Protection.

This Kusto Query Language (KQL) script identifies peer-to-peer (P2P) torrent traffic events that Symantec Endpoint Protection has detected but failed

This article focuses on how to detect suspicious directory traversal activities that Symantec Endpoint Protection logs but fails to block,

Description Using the power of KQL and Microsoft Sentinel, this detection script identifies events where a suspicious process attempted to

This KQL query helps detect FileZilla SFTP activities flagged by Symantec Endpoint Protection where attacks were detected but not blocked.

This KQL query extracts adware-related security events from Symantec Endpoint Protection (SEP) logs, focusing on instances where adware was detected

This article covers how to use a KQL (Kusto Query Language) script to list Ngrok activity detected by Symantec Endpoint

This KQL query identifies malicious scan attempts detected but not blocked by Symantec Endpoint Protection (SEP) by filtering relevant security

This KQL query is designed to identify all connections made to potential or malicious websites that Symantec Endpoint Protection (SEP)