Enhanced Security Measures in Place: To ensure a safer experience, we’ve implemented additional, temporary security measures for all users.
12-28-2022 02:03 AM
We received couple of alerts on rare iptable delete command.On checking the host activity, we could able to observe all commands including newly entered command in the host machine but not able to see the iptable delete/flush command in the activity log under Query builder.
12-29-2022 06:07 AM - edited 12-29-2022 06:07 AM
Hi Muthuvel,
I think the question is how can we see delete/flush command ?
But event its, still some of the important informations are missing like
What is the alert source?
did you try to investigate casualty chain?
did you check action_remote_process_image_command_line or actor_process_command_line fields for parameters?
is your time line correct when you use Query builder?
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!
The LIVEcommunity thanks you for your participation!
