// sigma convert -t kusto -p azure_monitor (pySigma via sigma-cli 3.1.0 (online pypi.org: 4.0.0)), generated 2026-11-09. Not run on a live tenant.
// ===== freeswitch_api_proto_rejected.yml
// CONVERSION FAILED: Unable to determine table name from rule

// ===== freeswitch_sip_message_api_proto.yml
// CONVERSION FAILED: Unable to determine table name from rule

// ===== lnx_freeswitch_child_process.yml
SecurityEvent
| where ParentProcessName endswith "/freeswitch" and (NewProcessName endswith "/sh" or NewProcessName endswith "/bash" or NewProcessName endswith "/dash" or NewProcessName endswith "/busybox" or NewProcessName endswith "/curl" or NewProcessName endswith "/wget" or NewProcessName endswith "/nc" or NewProcessName endswith "/ncat" or NewProcessName endswith "/socat" or NewProcessName endswith "/python" or NewProcessName endswith "/python3" or NewProcessName endswith "/perl")

// ===== lnx_freeswitch_config_change.yml
SecurityEvent
| where ObjectName contains "/freeswitch/" and (ObjectName contains "/dialplan/" or ObjectName contains "/directory/" or ObjectName contains "/autoload_configs/" or ObjectName contains "/sip_profiles/")

// ===== lnx_freeswitch_outbound_non_sip.yml
SecurityEvent
| where NewProcessName endswith "/freeswitch" and (not((DestinationPort in~ ("5060", "5061", "5080", "5081", "8021"))))

