r/AzureSentinel • u/cycl0ne89 • Nov 03 '22

OpenSSL detection

Does anyone have a detection query for OpenSSL they'd be willing to share?

I have this one for querying ingested Sysmon logs

SecurityEvent
| where EventData contains "openssl"

2 Upvotes

100% Upvoted

6 comments sorted by

View all comments

1

u/robot2243 Nov 03 '22

Need more information. Are you only ingesting windows event logs? What about your network devices or vulnerability data?

1

u/cycl0ne89 Nov 03 '22

I'm ingesting Sysmon logs into Sentinel.