[Rule Tuning] Windows Event Logs Cleared - alerts about Qualys agent

[richlv]

Link to Rule

https://github.com/elastic/detection-rules/blob/main/rules/windows/defense_evasion_clearing_windows_security_logs.toml

Rule Tuning Type

False Positives - Reducing benign events mistakenly identified as threats.

Description

This rule occasionally alerts about Qualys log clearing, which seems to be initiated by the Qualys agent itself.

Possibly useful fields:
winlog.user_data.Channel Qualys
winlog.user.identifier S-1-5-18
winlog.user.name SYSTEM

Example Data

No response