↳ GitHub sourceAnalytics ruleHigh
Antivirus Detected an Infected File
Description
Monitors CTERA platform to detect files infected with viruses identified by the antivirus engine on Edge Filers.
- Rule type
- NRT
- Version
- 1.0.0
- Declared status
- Available
Declared MITRE coverage
Declared sources
Metadata from the source file. No dependencies inferred from KQL.
Connectors
Data types
KQL query
Original query, unchanged.
Syslog
| where SyslogMessage contains "found an infected file"
| extend
EdgeFiler = extract("Edge filer (\\w+)", 1, SyslogMessage),
DetectionTime = extract("found an infected file at ([^ ]+)", 1, SyslogMessage),
Portal = extract("from portal: (\\w+)", 1, SyslogMessage),
FilePath = extract("The file path is: ([^\\.]+)", 1, SyslogMessage),
Virus = extract("The virus is: ([^\\.]+)", 1, SyslogMessage)
| project TimeGenerated, EdgeFiler, DetectionTime, Portal, FilePath, Virus
Declared entities
Related content
Links established from declared identifiers and solution manifests.
Source provenance
GitHubDisplayed values come from files in Azure/Azure-Sentinel. They describe the published template, not your workspace configuration.
- Commit
9800e51↗- Source identifier
4f767afa-d666-4ed4-b453-a4f5ad35181b
GSTEP / CATALOG TRACKING
Added to catalog : 16 Sept 2026 · 05:49 UTC
Last change observed : 16 Sept 2026 · 05:49 UTC