// sigma convert -t kusto -p microsoft_xdr (pySigma via sigma-cli 3.1.0 (online pypi.org: 4.0.0)), generated 2026-11-09. Not run on a live tenant.
// ===== freeswitch_api_proto_rejected.yml
// CONVERSION FAILED: Unable to determine table name from rule

// ===== freeswitch_sip_message_api_proto.yml
// CONVERSION FAILED: Unable to determine table name from rule

// ===== lnx_freeswitch_child_process.yml
DeviceProcessEvents
| where InitiatingProcessFolderPath endswith "/freeswitch" and (FolderPath endswith "/sh" or FolderPath endswith "/bash" or FolderPath endswith "/dash" or FolderPath endswith "/busybox" or FolderPath endswith "/curl" or FolderPath endswith "/wget" or FolderPath endswith "/nc" or FolderPath endswith "/ncat" or FolderPath endswith "/socat" or FolderPath endswith "/python" or FolderPath endswith "/python3" or FolderPath endswith "/perl")

// ===== lnx_freeswitch_config_change.yml
DeviceFileEvents
| where FolderPath contains "/freeswitch/" and (FolderPath contains "/dialplan/" or FolderPath contains "/directory/" or FolderPath contains "/autoload_configs/" or FolderPath contains "/sip_profiles/")

// ===== lnx_freeswitch_outbound_non_sip.yml
DeviceNetworkEvents
| where InitiatingProcessFolderPath endswith "/freeswitch" and (not((RemotePort in~ ("5060", "5061", "5080", "5081", "8021"))))

