Skip to main content

Create Malwarebytes Alert Rules in Azure Sentinel

Create custom rules in Azure Sentinel that generate incidents based on incoming Malwarebytes Nebula event data. The incidents trigger based on criteria that you customize in the following procedure. This article shows how to create Malwarebytes alert rules and provides two sample rule queries.

Create Malwarebytes Alert Rules

  1. In Azure Sentinel, click Analytics.
  2. Click Create.
  3. In the drop down, click Scheduled query rule.
  4. In the General tab, set a Name 
  5. Select the Severity for Nebula events to trigger incidents.
  6. Click Next: Set rule logic.
  7. In the Set rule logic tab, define the logic for your new analytic rule. Below are two example rule queries:
    Malware or any potential threats by type and severity 
    Syslog
    | where SyslogMessage contains "Malwarebytes" 
    | project SyslogMessage
    | extend Category = extract("cat=([a-zA-Z]+)",1, 
    SyslogMessage) | where Category == "Malware"
    Suspicious activity 
    Syslog
    | where SyslogMessage contains "Malwarebytes"
    | project SyslogMessage
    | extend  EventAction = extract
    ("[|][a-zA-Z]+[|][A-Za-z ]+[|][a-zA-Z0-9. ]+[|][a-zA-Z]+[|]([a-zA-Z ]+)[|]", 
    1, SyslogMessage)
    | where EventAction contains "Suspicious Activity"
  8. Set values for the required fields under Query scheduling.
  9. Set a value for the required field under Alert threshold.
  10. Click Next: Incident Settings (Preview).
  11. In the Incident Settings (Preview) tab, enable or disable Alert grouping rules.
  12. Click Next: Automated response.
  13. Click Next: Review and create. 
  14. Click Create to finalize your alert rule.

For more information, see Microsoft's support article Tutorial: Create custom analytic rules to detect suspicious threats.

 

Return to the table of contents.

Related articles