Exploit Prevention Queries and Alerts on Specific Rules

[Jmac24]

I've been driving myself crazy for a while trying to build a query or automated response when a specific EP rule is violated and action is taken. There are 2 in particular and I have no been able to find a way to filter them down for them. 

Lets say I only want to query on or have a response if rule ID 6109 - Powershell - Suspocious wmi script execution is violated. I don't see a way to filter for Analyzer Rule ID or Analyzer rule name. Is there a way to do this?

Thanks

[AdithyanT]

Hi @Jmac24,

Firstly, Good Post and Question. I am afraid my answer will not make you happy

The maximum you can get in terms of granularity is that you can pick Threat Name ExP:Illegal API Use for the powershell based Exploit Prevention Events. However, This will club all illegal API use events! This is restricted in Automatic Responses.

As you can see the Exploit Prevention Signature rules do not have a separate Event ID by themselves! Hence The Signatures Rule IDs are registered by the endpoint and sent to ePO in the form of Analyzer Rule ID.

I am afraid this would mean that you may have to raise a PER - product Enhancement Request with us.

[AdithyanT]

Hi @Jmac24 

Having said the above, If you are okay with a daily report of these events instead of automatic responses, You may work around this using Reports/Queries. You can pull a Threat Report and Use Filters to filter out the "Analyzer Rule IDs" you require. Then, You can schedule the report on a daily manner or a higher frequency to your email address with only these events being reported.