Update WindowsFirewall.kql
Windows Firewall parser did not align with the normalized schema, DvcDvcHostname should be DvcHostname
This commit is contained in:
Родитель
6d302a73a4
Коммит
9583114a87
|
@ -5,7 +5,7 @@
|
|||
// Reference: Sentinel normalization documentation: https://aka.ms/sentinelnormalizationdocs
|
||||
//
|
||||
// Note: This parser only populates and shows relevant fields within the networking schema. Please use the meta parser to see all relevant fields, or union this parser with the empty network schema.
|
||||
// Parser Version: 1.0.0
|
||||
// Parser Version: 1.0.1
|
||||
// Schema version: 1.0.0
|
||||
// Alias name: WindowsFW-Network-NormalizedParser (please change hypens(-) to underscores(_) when using the alias)
|
||||
let NetworkParserWindowsFirewall=(){ WindowsFirewall
|
||||
|
@ -19,7 +19,7 @@ let NetworkParserWindowsFirewall=(){ WindowsFirewall
|
|||
, EventSeverity=tostring(Severity)
|
||||
| project-rename
|
||||
DvcAction=FirewallAction,
|
||||
DvcDvcHostname = Computer,
|
||||
DvcHostname = Computer,
|
||||
EventResourceId = _ResourceId,
|
||||
NetworkProtocol = Protocol,
|
||||
EventOriginalUid = _ItemId,
|
||||
|
@ -30,4 +30,4 @@ let NetworkParserWindowsFirewall=(){ WindowsFirewall
|
|||
SrcPortNumber=SourcePort,
|
||||
EventReportUrl = ReportReferenceLink
|
||||
};
|
||||
NetworkParserWindowsFirewall
|
||||
NetworkParserWindowsFirewall
|
||||
|
|
Загрузка…
Ссылка в новой задаче