High CPU usage for a long time
Last updated on:
In this page
About the rule
Rule Type
Standard
Rule Description
High CPU usage for a prolonged time period by the same software - Typical of cryptocurrency activity.
Severity
Critical
Rule Requirement
Criteria
Action1:
actionname = "CPU usage threshold violation"
| timewindow 30m
| groupby ALARM_SOURCE
| groupby PROCESS_NAME having COUNT >= 3
select Action1.timewindow.ALARM_ID,Action1.timewindow.ALARM_MESSAGE,Action1.timewindow.ALARM_SOURCE,Action1.timewindow.ALARM_CATEGORY,Action1.timewindow.ALARM_SEVERITY,Action1.timewindow.ALARM_TRIGGER_TIME,Action1.timewindow.ALARM_EVENT_TYPE,Action1.timewindow.PROCESS_NAME
Detection
Execution Mode
realtime
Log Sources
ME Applications
