mapping OMS agent id to reduce chances of creating weak Host entity

This commit is contained in:
Yaron Fruchtmann 2020-10-21 10:57:38 +03:00
Родитель 319a796d5f
Коммит 1f813d9e90
3 изменённых файлов: 3 добавлений и 3 удалений

Просмотреть файл

@ -27,7 +27,7 @@ query: |
| where tolower(Account) contains tolower(v_Account_Name)
| extend info = pack('EventID', EventID, 'Account', Account, 'LogonTypeName', LogonTypeName, 'SubStatus', SubStatus, 'AccountType', AccountType, 'WorkstationName', WorkstationName, 'IpAddress', IpAddress)
| summarize min(TimeGenerated), max(TimeGenerated), Host_Aux_info = makeset(info) by Computer
| project Host_Aux_StartTime=min_TimeGenerated, Host_Aux_EndTime = max_TimeGenerated, Host_UnstructuredName=Computer, Host_Aux_info
| project Host_Aux_StartTime=min_TimeGenerated, Host_Aux_EndTime = max_TimeGenerated, Host_UnstructuredName=Computer, Host_Aux_info, Host_OMSAgentID=SourceComputerId
| top 10 by Host_Aux_StartTime asc nulls last
};
// change <Name> value below

Просмотреть файл

@ -25,7 +25,7 @@ query: |
| summarize min(EventTime), max(EventTime), count(), Host_Aux_info = makeset(info) by Computer
| top 10 by count_ desc nulls last
| project Host_Aux_StartTime = min_EventTime, Host_Aux_EndTime = max_EventTime, Computer, Host_Aux_info
| project-rename Host_UnstructuredName=Computer
| project-rename Host_UnstructuredName=Computer, Host_OMSAgentId=SourceComputerId
};
// change <Address> value below
GetSysLogEventsWithIP('<Address>')

Просмотреть файл

@ -30,7 +30,7 @@ query: |
| extend Host_Aux_info = IP_Aux_info
| top 10 by count_ asc
| project min_SessionStartTime, Computer, LocalIP, IP_Aux_info, Host_Aux_info
| project-rename IP_Address=LocalIP, Host_UnstructuredName=Computer, Host_Aux_min_SessionStartTime=min_SessionStartTime
| project-rename IP_Address=LocalIP, Host_UnstructuredName=Computer, Host_Aux_min_SessionStartTime=min_SessionStartTime, Host_OMSAgentId=SourceComputerId
};
// change <CommandLine> value below
GetWireDataInboundWithProcess('<CommandLine>')