// sigma convert -t kusto -p sentinel_asim, generated 11 Nov 2026. NOT run against a live tenant.
// ===== lnx_file_checkmk_agent_plugin_spool.yml (-p sentinel_asim)
imFileEvent
| where TargetFileName startswith "/usr/lib/check_mk_agent/plugins/" or TargetFileName startswith "/usr/lib/check_mk_agent/local/" or TargetFileName startswith "/var/lib/check_mk_agent/spool/"

// ===== lnx_file_checkmk_discovered_host_labels_non_mk.yml (-p sentinel_asim)
imFileEvent
| where (TargetFileName startswith "/omd/sites/" and TargetFileName contains "/var/check_mk/discovered_host_labels/") and (not(TargetFileName endswith ".mk"))

// ===== lnx_file_checkmk_html_outside_robotmk_logs.yml (-p sentinel_asim)
imFileEvent
| where (TargetFileName startswith "/omd/sites/" and (TargetFileName endswith ".html" or TargetFileName endswith ".htm")) and (not(TargetFileName contains "/var/robotmk/html_logs/"))

// ===== lnx_proc_checkmk_kube_agent_profile.yml (-p sentinel_asim)
imProcessCreate
| where TargetProcessCommandLine contains "agent_kube" and (TargetProcessCommandLine contains " --profile" or TargetProcessCommandLine contains "--cluster-aggregation-exclude-node-role=-")

// ===== lnx_proc_checkmk_site_user_shell.yml (-p sentinel_asim)
imProcessCreate
| where ((ParentProcessName startswith "/omd/sites/" or ActingProcessName startswith "/omd/sites/") or (ParentProcessName startswith "/omd/versions/" or ActingProcessName startswith "/omd/versions/")) and (TargetProcessName endswith "/sh" or TargetProcessName endswith "/bash" or TargetProcessName endswith "/dash" or TargetProcessName endswith "/zsh" or TargetProcessName endswith "/curl" or TargetProcessName endswith "/wget" or TargetProcessName endswith "/nc" or TargetProcessName endswith "/ncat" or TargetProcessName endswith "/socat")

// ===== win_file_checkmk_agent_plugin_spool.yml (-p sentinel_asim)
imFileEvent
| where TargetFileName contains "\\ProgramData\\checkmk\\agent\\plugins\\" or TargetFileName contains "\\ProgramData\\checkmk\\agent\\local\\" or TargetFileName contains "\\ProgramData\\checkmk\\agent\\spool\\"

