// sigma convert -t kusto -p sentinel_asim (pySigma via sigma-cli 3.1.0 (online pypi.org: 4.0.0)), generated 2026-11-09. Not run on a live tenant.
// ===== freeswitch_api_proto_rejected.yml
// CONVERSION FAILED: Unable to determine table name from rule

// ===== freeswitch_sip_message_api_proto.yml
// CONVERSION FAILED: Unable to determine table name from rule

// ===== lnx_freeswitch_child_process.yml
imProcessCreate
| where (ParentProcessName endswith "/freeswitch" or ActingProcessName endswith "/freeswitch") and (TargetProcessName endswith "/sh" or TargetProcessName endswith "/bash" or TargetProcessName endswith "/dash" or TargetProcessName endswith "/busybox" or TargetProcessName endswith "/curl" or TargetProcessName endswith "/wget" or TargetProcessName endswith "/nc" or TargetProcessName endswith "/ncat" or TargetProcessName endswith "/socat" or TargetProcessName endswith "/python" or TargetProcessName endswith "/python3" or TargetProcessName endswith "/perl")

// ===== lnx_freeswitch_config_change.yml
imFileEvent
| where TargetFileName contains "/freeswitch/" and (TargetFileName contains "/dialplan/" or TargetFileName contains "/directory/" or TargetFileName contains "/autoload_configs/" or TargetFileName contains "/sip_profiles/")

// ===== lnx_freeswitch_outbound_non_sip.yml
imNetworkSession
| where ((SrcProcessName endswith "/freeswitch" or DstProcessName endswith "/freeswitch") and NetworkDirection =~ "true") and (not((DstPortNumber in~ ("5060", "5061", "5080", "5081", "8021"))))

