Possible External RDP Brute-Force

This trigger is responsible for handling External RDP Brute-Force alerts

Details

ID	`723030e7f5b76701564877846cd69eec`
Runs Playbook	Possible External RDP Brute-Force
Suggestion Reason	Recommended for External RDP Brute-Force alerts

Alert conditions (all must match)

Field	Operator	Value
`alert_name`	CONTAINS	Possible external RDP Brute-Force

Source

Trigger_-_Possible_External_RDP_Brute-Force.json

Download History Raw

{
  "trigger_id": "723030e7f5b76701564877846cd69eec",
  "playbook_id": "Possible External RDP Brute-Force",
  "suggestion_reason": "Recommended for External RDP Brute-Force alerts",
  "description": "This trigger is responsible for handling External RDP Brute-Force alerts",
  "trigger_name": "Possible External RDP Brute-Force",
  "alerts_filter": {
    "filter": {
      "AND": [
        {
          "SEARCH_FIELD": "alert_name",
          "SEARCH_TYPE": "CONTAINS",
          "SEARCH_VALUE": "Possible external RDP Brute-Force"
        }
      ]
    }
  },
  "supportedModules": [
    "xsiam",
    "agentix"
  ]
}