Azure
/
Azure-Sentinel
зеркало из
1
0
Форкнуть 0
Код Задачи Пакеты Проекты Релизы Вики Активность

adding fields that were recently added to ASimDnsActivityLogs table schema

This commit is contained in:
vakohl 2023-03-01 20:32:31 +05:30
Родитель 25c15c6a55
Коммит 0159db7821
1 изменённых файлов: 34 добавлений и 1 удалений
Показать статистику Скачать Patch файл Скачать Diff файл Показать все файлы Свернуть все файлы

35
.script/tests/KqlvalidationsTests/CustomTables/ASimDnsActivityLogs.json
Просмотреть файл

@ -106,6 +106,39 @@
{ "Name": "_ResourceId", "Type": "string" },
{ "Name": "_SubscriptionId", "Type": "string" },
{ "Name": "_ItemId", "Type": "string" },
{ "Name": "DvcScopeId", "Type": "string" }
{ "Name": "DvcScopeId", "Type": "string" },
{ "Name": "DnsResponseIpCity", "Type": "string" },
{ "Name": "DnsResponseIpRegion", "Type": "string" },
{ "Name": "DstDescription", "Type": "string" },
{ "Name": "DstDvcScope", "Type": "string" },
{ "Name": "DstDvcScopeId", "Type": "string" },
{ "Name": "DstOriginalRiskLevel", "Type": "string" },
{ "Name": "DstRiskLevel", "Type": "int" },
{ "Name": "DvcDescription", "Type": "string" },
{ "Name": "DvcInterface", "Type": "string" },
{ "Name": "DvcOriginalAction", "Type": "string" },
{ "Name": "DvcScope", "Type": "string" },
{ "Name": "EventEndTime", "Type": "datetime" },
{ "Name": "EventOriginalSeverity", "Type": "string" },
{ "Name": "EventOwner", "Type": "string" },
{ "Name": "EventProductVersion", "Type": "string" },
{ "Name": "EventSchemaVersion", "Type": "string" },
{ "Name": "EventSeverity", "Type": "string" },
{ "Name": "EventStartTime", "Type": "datetime" },
{ "Name": "NetworkProtocolVersion", "Type": "string" },
{ "Name": "RuleName", "Type": "string" },
{ "Name": "RuleNumber", "Type": "int" },
{ "Name": "SrcDescription", "Type": "string" },
{ "Name": "SrcDvcScope", "Type": "string" },
{ "Name": "SrcDvcScopeId", "Type": "string" },
{ "Name": "SrcOriginalRiskLevel", "Type": "string" },
{ "Name": "SrcRiskLevel", "Type": "int" },
{ "Name": "SrcUserScope", "Type": "string" },
{ "Name": "SrcUserScopeId", "Type": "string" },
{ "Name": "SrcUserSessionId", "Type": "string" },
{ "Name": "ThreatFirstReportedTime_d", "Type": "datetime" },
{ "Name": "ThreatId", "Type": "string" },
{ "Name": "ThreatLastReportedTime_d", "Type": "datetime" },
{ "Name": "ThreatOriginalRiskLevel_s", "Type": "string" }
]
}