// sigma convert -t kusto -p azure_monitor, generated 11 Nov 2026. NOT run against a live tenant.
// ===== lnx_file_checkmk_agent_plugin_spool.yml (-p azure_monitor)
SecurityEvent
| where ObjectName startswith "/usr/lib/check_mk_agent/plugins/" or ObjectName startswith "/usr/lib/check_mk_agent/local/" or ObjectName startswith "/var/lib/check_mk_agent/spool/"

// ===== lnx_file_checkmk_discovered_host_labels_non_mk.yml (-p azure_monitor)
SecurityEvent
| where (ObjectName startswith "/omd/sites/" and ObjectName contains "/var/check_mk/discovered_host_labels/") and (not(ObjectName endswith ".mk"))

// ===== lnx_file_checkmk_html_outside_robotmk_logs.yml (-p azure_monitor)
SecurityEvent
| where (ObjectName startswith "/omd/sites/" and (ObjectName endswith ".html" or ObjectName endswith ".htm")) and (not(ObjectName contains "/var/robotmk/html_logs/"))

// ===== lnx_proc_checkmk_kube_agent_profile.yml (-p azure_monitor)
SecurityEvent
| where CommandLine contains "agent_kube" and (CommandLine contains " --profile" or CommandLine contains "--cluster-aggregation-exclude-node-role=-")

// ===== lnx_proc_checkmk_site_user_shell.yml (-p azure_monitor)
SecurityEvent
| where (ParentProcessName startswith "/omd/sites/" or ParentProcessName startswith "/omd/versions/") and (NewProcessName endswith "/sh" or NewProcessName endswith "/bash" or NewProcessName endswith "/dash" or NewProcessName endswith "/zsh" or NewProcessName endswith "/curl" or NewProcessName endswith "/wget" or NewProcessName endswith "/nc" or NewProcessName endswith "/ncat" or NewProcessName endswith "/socat")

// ===== win_file_checkmk_agent_plugin_spool.yml (-p azure_monitor)
SecurityEvent
| where ObjectName endswith "\\ProgramData\\checkmk\\agent\\plugins*" or ObjectName endswith "\\ProgramData\\checkmk\\agent\\local*" or ObjectName endswith "\\ProgramData\\checkmk\\agent\\spool*"

