// sigma convert -t kusto -p sentinel_asim. NOT run against a live tenant.
// ===== checkpoint_dynamiccli_unwrapped_command.yml (-p sentinel_asim)
// NOT CONVERTED: this pipeline has no table mapping for the rule's logsource. Use the matching KQL hunt instead.

// ===== esxi_destroy_v6_wiper_artefacts.yml (-p sentinel_asim)
// NOT CONVERTED: this pipeline has no table mapping for the rule's logsource. Use the matching KQL hunt instead.

// ===== esxi_vpxuser_ssh_login.yml (-p sentinel_asim)
// NOT CONVERTED: this pipeline has no table mapping for the rule's logsource. Use the matching KQL hunt instead.

// ===== file_event_lnx_checkpoint_campaign_files.yml (-p sentinel_asim)
imFileEvent
| where (TargetFileName endswith "/challenge_render.tpl" or TargetFileName endswith "/tmp/.up.tpl" or TargetFileName endswith "/tmp/CPconfigdaemon" or TargetFileName endswith "/slot_CPconfigdaemon" or TargetFileName endswith "/tmp/.bd.log" or TargetFileName endswith "/lib/libcpfwcommon.so" or TargetFileName endswith "/tmp/.p_sock" or TargetFileName endswith "/DREAM_ANNEXATION.txt") or (TargetFileName contains "/zz" and TargetFileName endswith ".tpl")

// ===== net_firewall_checkpoint_php2shell_attacker_ips.yml (-p sentinel_asim)
// NOT CONVERTED: this pipeline has no table mapping for the rule's logsource. Use the matching KQL hunt instead.

// ===== net_firewall_checkpoint_tsga_port_11072.yml (-p sentinel_asim)
// NOT CONVERTED: this pipeline has no table mapping for the rule's logsource. Use the matching KQL hunt instead.

// ===== proc_creation_lnx_checkpoint_tsga_paths.yml (-p sentinel_asim)
imProcessCreate
| where (TargetProcessName endswith "/tmp/CPconfigdaemon" or TargetProcessName endswith "/slot_CPconfigdaemon" or TargetProcessName endswith "/tmp/des" or TargetProcessName endswith "/destroy_v6") or (TargetProcessCommandLine contains "/tmp/CPconfigdaemon" or TargetProcessCommandLine contains "slot_CPconfigdaemon" or TargetProcessCommandLine contains "/tmp/.bd.log" or TargetProcessCommandLine contains "/lib/libcpfwcommon.so" or TargetProcessCommandLine contains "/tmp/.p_sock" or TargetProcessCommandLine contains "destroy_v6")

