The SIEM app is now a part of the Elastic Security solution.
Click
here to view SIEM documentation for previous releases.
Permission Theft - Prevented - Elastic Endpoint Security
editPermission Theft - Prevented - Elastic Endpoint Security
editElastic Endpoint Security prevented Permission Theft. Click the Elastic Endpoint Security icon in the event.module column or the link in the rule.reference column for additional information.
Rule type: query
Rule indices:
- endgame-*
Severity: medium
Risk score: 47
Runs every: 10 minutes
Searches indices from: now-15m (Date Math format, see also Additional look-back time
)
Maximum alerts per execution: 100
Tags:
- Elastic
- Endpoint
Version: 3 (version history)
Added (Elastic Stack release): 7.6.0
Last modified (Elastic Stack release): 7.9.0
Rule authors: Elastic
Rule license: Elastic License
Rule query
editevent.kind:alert and event.module:endgame and endgame.metadata.type:prevention and (event.action:token_protection_event or endgame.event_subtype_full:token_protection_event)
Rule version history
edit- Version 3 (7.9.0 release)
-
- Rule name changed from: Permission Theft - Prevented - Elastic Endpoint
- Version 2 (7.7.0 release)
-
-
Updated query, changed from:
event.kind:alert and event.module:endgame and event.action:token_protection_event and endgame.metadata.type:prevention
-