This commit is contained in:
Pete Bryan 2023-03-07 12:04:33 -08:00
Родитель d6273f9fad
Коммит 5a40beb13d
3 изменённых файлов: 4 добавлений и 2 удалений

Просмотреть файл

@ -60,7 +60,8 @@ query: |
| where EventResult =~ "Success"
| extend FullLocation = strcat(SrcGeoCountry,'|', SrcGeoRegion, '|', SrcGeoCity)
| extend TargetUserScope = column_ifexists("TargetUserScope", iif(User has "@", split(User, "@")[1], "Unknown"))
| extend columnifexists("IpAddr", SrcIpAddr)
| extend SrcIpAddr = column_ifexists("SrcIpAddr", "")
| extend IpAddr = column_ifexists("IpAddr", SrcIpAddr)
| summarize ConnectionCount = count() by FullLocation, User, IpAddr, TargetUsername,TargetUserScope, TargetUserId
| summarize make_list(IpAddr), make_list(FullLocation), make_list(ConnectionCount), dcount(FullLocation), totalActivity = sum(ConnectionCount) by User, TargetUsername, TargetUserScope, TargetUserId
| mvexpand Location = list_FullLocation, ConnectionCount = list_ConnectionCount, IPAddress = list_IpAddr

Просмотреть файл

@ -1,4 +1,4 @@
id: d7cfd771-3082-4199-8fbb-9c12a3db88a8
Id: d7cfd771-3082-4199-8fbb-9c12a3db88a8
DisplayName: Most Prevalent Inbound Network Connections by Host
Description: Top 10 (most prevalent) inbound network connection events by a given host in the range of +-30m
InputEntityType: Host

Просмотреть файл

@ -21,6 +21,7 @@ query: |
_Im_NetworkSession
| where has_ipv4(SrcIpAddr, v_IP_Address) or ipv6_is_match(SrcIpAddr, v_IP_Address)
| where NetworkDirection =~ "Outbound"
| extend Process = columnifexists("Process", "")
| extend info = pack('HostIP', SrcIpAddr, 'SrcPort', SrcPortNumber, 'DstIP', DstIpAddr,'DstPort', DstPortNumber, 'DstFQDN', DstFQDN, 'User', SrcUsername, 'Process', Process)
| extend Dvc = tolower(Dvc)
| summarize min(TimeGenerated), max(TimeGenerated), count(), Host_Aux_info = make_set(info, maxSize=100) by Dvc