Updating to proper column name and removing validation exception

This commit is contained in:
Shain Wray (MSTIC) 2021-07-06 22:44:02 -07:00
Родитель ca92600995
Коммит 3f4fbc604b
2 изменённых файлов: 1 добавлений и 6 удалений

Просмотреть файл

@ -9,11 +9,6 @@
"templateName": "TI map IP entity to GitHub_CL",
"validationFailReason": "The name 'OperationType' does not refer to any known column, table, variable or function."
},
{
"id": "f2dd4a3a-ebac-4994-9499-1a859938c947",
"templateName": "Time series anomaly for data size transferred to public internet",
"validationFailReason": "The name 'DestinationIP' does not refer to any known column, table, variable or function."
},
{
"id": "e70fa6e0-796a-4e85-9420-98b17b0bb749",
"templateName": "Solorigate Defender Detections",

Просмотреть файл

@ -38,7 +38,7 @@ query: |
(
VMConnection
| where TimeGenerated between (startofday(ago(starttime))..startofday(ago(endtime)))
| where isnotempty(DestinationIP) and isnotempty(SourceIP)
| where isnotempty(DestinationIp) and isnotempty(SourceIp)
| extend DestinationIpType = iff(DestinationIp matches regex PrivateIPregex,"private" ,"public" )
| where DestinationIpType == "public" | extend DeviceVendor = "VMConnection"
| project TimeGenerated, BytesSent, DeviceVendor