Hi! Is there any type of document that explains the type of event source necessary for each ESA Rule? Example: for the "Web DoS Alert" rule the necessary or recommended event source would be a Firewall or a Router
Basically it depends on the type & purpose of the Alert that you are planning to create.
For example, if I want to detect 'Lateral movement of infection' - First thing I will check if any Antivirus event source is sending logs to NW,
> then I will check what type of events Antivirus machine is sending,
> then I will check if those collected logs have the (infection/virus) & affected host information that I need,
> then I will check in which meta is that infection & affected host machine information is showing up.
> then my alert will consist of ((device.class = 'antivirus' OR device.class = 'symanecav') AND virusname exists AND host.src exists. Just an example.
Hope it helps.
Retrieving data ...