↳ GitHub sourceAnalytics ruleMedium

CiscoISE - Log files deleted

View on GitHub ↗Original file ↗

Description

'Detects log file deleting activity.'

Rule type: Scheduled
Version: 1.0.3
Declared status: Available
Query frequency: 5m
Query period: 5m
Trigger: gt 0

Declared MITRE coverage

DefenseEvasion T1070.004

Declared sources

Metadata from the source file. No dependencies inferred from KQL.

Connectors

SyslogAma

KQL query

Original query, unchanged.

let lbtime = 5m;
CiscoISEEvent
| where TimeGenerated > ago(lbtime)
| where EventId in ('58015', '59101', '59102')
| project TimeGenerated, DvcHostname, DvcIpAddr, DstUserName
| extend HostCustomEntity = DvcHostname
| extend IPCustomEntity = DvcIpAddr
| extend AccountCustomEntity = DstUserName

Declared entities

AccountIPHost

Source provenance

GitHub

Displayed values come from files in Azure/Azure-Sentinel. They describe the published template, not your workspace configuration.

File: Solutions/Cisco ISE/Analytic Rules/CiscoISELogsDeleted.yaml ↗
Commit: 9800e51 ↗
Source identifier: 21d3be4c-6088-4e76-b6eb-d25479019cb9

Additional source files 2

Solutions/Cisco ISE/Analytic Rules/CiscoISELogsDeleted.yamlsource ↗Solutions/Cisco ISE/Data/Solution_CiscoISE.jsonsolution-membership ↗

GSTEP / CATALOG TRACKING

Added to catalog : 16 Sept 2026 · 05:49 UTC
Last change observed : 16 Sept 2026 · 05:49 UTC

GSTEP sync dates, separate from the source content’s publication dates.