BugFix- additional field covereage containing IP
This commit is contained in:
Родитель
40bc08c197
Коммит
5177a432a7
|
@ -55,7 +55,8 @@ query: |
|
|||
| where isnotempty(SourceIP) or isnotempty(DestinationIP) or isnotempty(DNSName)
|
||||
| where SourceIP in (IPList) or DestinationIP in (IPList) or Message has_any (IPList) or DNSName in~ (DomainNames)
|
||||
| extend IPMatch = case( SourceIP in (IPList), "SourceIP", DestinationIP in (IPList), "DestinationIP", "Message")
|
||||
| extend timestamp = TimeGenerated , IPCustomEntity = case(IPMatch == "SourceIP", SourceIP, IPMatch == "DestinationIP", DestinationIP, "IP in Message Field"), Account = SourceUserID, Host = DeviceName),
|
||||
| extend timestamp = TimeGenerated , IPCustomEntity = case(IPMatch == "SourceIP", SourceIP, IPMatch == "DestinationIP", DestinationIP, "IP in Message Field"), Account = SourceUserID, Host = DeviceName
|
||||
),
|
||||
(DnsEvents
|
||||
| where TimeGenerated >= ago(timeframe)
|
||||
| extend DestinationIPAddress = IPAddresses, DNSName = Name, Host = Computer
|
||||
|
|
Загрузка…
Ссылка в новой задаче