↳ GitHub sourceAnalytics ruleHigh

Cisco SE High Events Last Hour

View on GitHub ↗Original file ↗

Description

'Find events from Cisco Secure Endpoint that are of High severity in the last hour.'

Rule type: Scheduled
Version: 1.0.1
Declared status: Available
Query frequency: 1h
Query period: 1h
Trigger: gt 0

Declared MITRE coverage

Declared sources

Metadata from the source file. No dependencies inferred from KQL.

Connectors

CiscoSecureEndpoint

Data types

CiscoSecureEndpoint_CL

KQL query

Original query, unchanged.

let endtime = 1h;
CiscoSecureEndpoint_CL
| where TimeGenerated >= ago(endtime)
| where severity_s == "High"
| project NetworkAddresses = parse_json(computer_network_addresses_s), computer_hostname_s, date_t, event_type_s, computer_links_trajectory_s
| summarize CountInLastHour = count() by computer_hostname_s, date_t, event_type_s, tostring(NetworkAddresses.ip), computer_links_trajectory_s

Declared entities

IPHostURL

Source provenance

GitHub

Displayed values come from files in Azure/Azure-Sentinel. They describe the published template, not your workspace configuration.

File: Solutions/Cisco Secure Endpoint/Analytic Rules/CiscoEndpointHighAlert.yaml ↗
Commit: 9800e51 ↗
Source identifier: 4683ebce-07ad-4089-89e3-39d8fe83c011

Additional source files 2

Solutions/Cisco Secure Endpoint/Analytic Rules/CiscoEndpointHighAlert.yamlsource ↗Solutions/Cisco Secure Endpoint/Data/Solution_CiscoSecureEndpoint.jsonsolution-membership ↗

GSTEP / CATALOG TRACKING

Added to catalog : 16 Sept 2026 · 05:49 UTC
Last change observed : 16 Sept 2026 · 05:49 UTC

GSTEP sync dates, separate from the source content’s publication dates.