Update AlertsWithFile.txt
This commit is contained in:
Родитель
40fd8456da
Коммит
577b258a72
|
@ -1,18 +1,12 @@
|
|||
// Name: Alerts related to File
|
||||
// Description: Any Alerts that fired related to a given File during the range of +6h and -3d
|
||||
//
|
||||
// Id: 82d58507-c4e6-4fae-9aa4-db58be3ef9a6
|
||||
//
|
||||
// Entity: #File
|
||||
// Input: Filename
|
||||
// Output: Host, Account
|
||||
//
|
||||
// QueryPeriod: +6h and -3d default, change as needed
|
||||
//
|
||||
// Data Source: SecurityAlert
|
||||
//
|
||||
// Tactics: #Persistence, #Discovery, #LateralMovement, #Collection
|
||||
//
|
||||
// Id: 11d808a1-32fe-4618-946a-cfd43523347a
|
||||
//
|
||||
let GetAllAlertsWithFile = (suspiciousEventTime:datetime, v_File:string){
|
||||
let v_StartTime = suspiciousEventTime-1d;
|
||||
let v_EndTime = suspiciousEventTime+1d;
|
||||
|
|
Загрузка…
Ссылка в новой задаче