// sigma convert -t kusto -p microsoft_365_defender, generated 11 Nov 2026. NOT run against a live tenant.
// ===== lnx_file_checkmk_agent_plugin_spool.yml (-p microsoft_365_defender)
DeviceFileEvents
| where FolderPath startswith "/usr/lib/check_mk_agent/plugins/" or FolderPath startswith "/usr/lib/check_mk_agent/local/" or FolderPath startswith "/var/lib/check_mk_agent/spool/"

// ===== lnx_file_checkmk_discovered_host_labels_non_mk.yml (-p microsoft_365_defender)
DeviceFileEvents
| where (FolderPath startswith "/omd/sites/" and FolderPath contains "/var/check_mk/discovered_host_labels/") and (not(FolderPath endswith ".mk"))

// ===== lnx_file_checkmk_html_outside_robotmk_logs.yml (-p microsoft_365_defender)
DeviceFileEvents
| where (FolderPath startswith "/omd/sites/" and (FolderPath endswith ".html" or FolderPath endswith ".htm")) and (not(FolderPath contains "/var/robotmk/html_logs/"))

// ===== lnx_proc_checkmk_kube_agent_profile.yml (-p microsoft_365_defender)
DeviceProcessEvents
| where ProcessCommandLine contains "agent_kube" and (ProcessCommandLine contains " --profile" or ProcessCommandLine contains "--cluster-aggregation-exclude-node-role=-")

// ===== lnx_proc_checkmk_site_user_shell.yml (-p microsoft_365_defender)
DeviceProcessEvents
| where (InitiatingProcessFolderPath startswith "/omd/sites/" or InitiatingProcessFolderPath startswith "/omd/versions/") and (FolderPath endswith "/sh" or FolderPath endswith "/bash" or FolderPath endswith "/dash" or FolderPath endswith "/zsh" or FolderPath endswith "/curl" or FolderPath endswith "/wget" or FolderPath endswith "/nc" or FolderPath endswith "/ncat" or FolderPath endswith "/socat")

// ===== win_file_checkmk_agent_plugin_spool.yml (-p microsoft_365_defender)
DeviceFileEvents
| where FolderPath contains "\\ProgramData\\checkmk\\agent\\plugins\\" or FolderPath contains "\\ProgramData\\checkmk\\agent\\local\\" or FolderPath contains "\\ProgramData\\checkmk\\agent\\spool\\"

