High CPU usage for a long time
Last updated on:
In this page
About the rule
Rule Type
Standard
Rule Description
High CPU usage for a prolonged time period by the same software - Typical of cryptocurrency activity.
Severity
Critical
Rule Requirement
Criteria
Action1: actionname = "cpu_usage_threshold_violation" | timewindow 30m | groupby ALARM_SOURCE | groupby PROCESS_NAME having COUNT > 3 select Action1.timewindow.ALARM_ID,Action1.timewindow.ALARM_MESSAGE,Action1.timewindow.ALARM_SOURCE,Action1.timewindow.ALARM_CATEGORY,Action1.timewindow.ALARM_SEVERITY,Action1.timewindow.ALARM_TRIGGER_TIME,Action1.timewindow.ALARM_EVENT_TYPE,Action1.timewindow.PROCESS_NAME
Detection
Execution Mode
realtime
Log Sources
ME Applications
