diff --git a/Hunting Queries/SecurityAlert/AlertsWithFile.txt b/Hunting Queries/SecurityAlert/AlertsWithFile.txt index c9643307a1..a91bfc8d5d 100644 --- a/Hunting Queries/SecurityAlert/AlertsWithFile.txt +++ b/Hunting Queries/SecurityAlert/AlertsWithFile.txt @@ -1,18 +1,12 @@ // Name: Alerts related to File // Description: Any Alerts that fired related to a given File during the range of +6h and -3d // -// Id: 82d58507-c4e6-4fae-9aa4-db58be3ef9a6 -// -// Entity: #File -// Input: Filename -// Output: Host, Account -// -// QueryPeriod: +6h and -3d default, change as needed -// // Data Source: SecurityAlert // // Tactics: #Persistence, #Discovery, #LateralMovement, #Collection // +// Id: 11d808a1-32fe-4618-946a-cfd43523347a +// let GetAllAlertsWithFile = (suspiciousEventTime:datetime, v_File:string){ let v_StartTime = suspiciousEventTime-1d; let v_EndTime = suspiciousEventTime+1d;