More validation fixes
This commit is contained in:
Родитель
d6273f9fad
Коммит
5a40beb13d
|
@ -60,7 +60,8 @@ query: |
|
|||
| where EventResult =~ "Success"
|
||||
| extend FullLocation = strcat(SrcGeoCountry,'|', SrcGeoRegion, '|', SrcGeoCity)
|
||||
| extend TargetUserScope = column_ifexists("TargetUserScope", iif(User has "@", split(User, "@")[1], "Unknown"))
|
||||
| extend columnifexists("IpAddr", SrcIpAddr)
|
||||
| extend SrcIpAddr = column_ifexists("SrcIpAddr", "")
|
||||
| extend IpAddr = column_ifexists("IpAddr", SrcIpAddr)
|
||||
| summarize ConnectionCount = count() by FullLocation, User, IpAddr, TargetUsername,TargetUserScope, TargetUserId
|
||||
| summarize make_list(IpAddr), make_list(FullLocation), make_list(ConnectionCount), dcount(FullLocation), totalActivity = sum(ConnectionCount) by User, TargetUsername, TargetUserScope, TargetUserId
|
||||
| mvexpand Location = list_FullLocation, ConnectionCount = list_ConnectionCount, IPAddress = list_IpAddr
|
||||
|
|
|
@ -1,4 +1,4 @@
|
|||
id: d7cfd771-3082-4199-8fbb-9c12a3db88a8
|
||||
Id: d7cfd771-3082-4199-8fbb-9c12a3db88a8
|
||||
DisplayName: Most Prevalent Inbound Network Connections by Host
|
||||
Description: Top 10 (most prevalent) inbound network connection events by a given host in the range of +-30m
|
||||
InputEntityType: Host
|
||||
|
|
|
@ -21,6 +21,7 @@ query: |
|
|||
_Im_NetworkSession
|
||||
| where has_ipv4(SrcIpAddr, v_IP_Address) or ipv6_is_match(SrcIpAddr, v_IP_Address)
|
||||
| where NetworkDirection =~ "Outbound"
|
||||
| extend Process = columnifexists("Process", "")
|
||||
| extend info = pack('HostIP', SrcIpAddr, 'SrcPort', SrcPortNumber, 'DstIP', DstIpAddr,'DstPort', DstPortNumber, 'DstFQDN', DstFQDN, 'User', SrcUsername, 'Process', Process)
|
||||
| extend Dvc = tolower(Dvc)
|
||||
| summarize min(TimeGenerated), max(TimeGenerated), count(), Host_Aux_info = make_set(info, maxSize=100) by Dvc
|
||||
|
|
Загрузка…
Ссылка в новой задаче