Update WAF_log4j_vulnerability.yaml

Adding Category field to the summarize statement.
This commit is contained in:
aprakash13 2021-12-13 08:52:20 -08:00 коммит произвёл GitHub
Родитель e83c1957e3
Коммит 7b7d73ea43
Не найден ключ, соответствующий данной подписи
Идентификатор ключа GPG: 4AEE18F83AFDEB23
1 изменённых файлов: 2 добавлений и 2 удалений

Просмотреть файл

@ -24,10 +24,10 @@ query: |
| extend CmdLine = iff(originalRequestUriWithArgs_s has 'Base64/', split(split(originalRequestUriWithArgs_s, "Base64/",1)[0], "}", 0)[0], split(split(userAgent_s, "Base64/",1)[0], "}", 0)[0])
| extend CmdLine = base64_decode_tostring(tostring(CmdLine))
| where CmdLine has_any ("wget","curl")
| summarize Total = count() by originalRequestUriWithArgs_s, userAgent_s, clientIP_s,clientPort_d, TimeGenerated, host_s, requestUri_s, httpStatus_d,listenerName_s, CmdLine, httpMethod_s
| summarize Total = count() by originalRequestUriWithArgs_s, userAgent_s, clientIP_s,clientPort_d, TimeGenerated, host_s, requestUri_s, httpStatus_d,listenerName_s, CmdLine, httpMethod_s, Category
| extend IPCustomEntity = clientIP_s, timestamp = TimeGenerated
entityMappings:
- entityType: IP
fieldMappings:
- identifier: Address
columnName: IPCustomEntity
columnName: IPCustomEntity