Update AlertsForUser.txt
This commit is contained in:
Родитель
b35d9edf45
Коммит
13ba1cdf02
|
@ -1,16 +1,12 @@
|
|||
// Name: Alerts related to account
|
||||
// Description: Any Alerts that fired related to a given account during the range of +6h and -3d
|
||||
//
|
||||
// Entity: User
|
||||
// Input: Account, UserName
|
||||
// Output: Alerts
|
||||
//
|
||||
// QueryPeriod: +6h and -3d default, change as needed
|
||||
//
|
||||
// Data Source: SecurityAlert
|
||||
//
|
||||
// Tactics: #Persistence, #Discovery, #LateralMovement, #Collection
|
||||
//
|
||||
// Id: 3a72ba65-00fa-4bbc-b246-be1ff3f73ce1
|
||||
//
|
||||
let GetAllAlertsForUser = (suspiciousEventTime:datetime, v_User:string){
|
||||
//-3d and +6h as some alerts fire after accumulation of events
|
||||
let v_StartTime = suspiciousEventTime-3d;
|
||||
|
|
Загрузка…
Ссылка в новой задаче