This commit is contained in:
v-maudan 2021-07-23 16:44:31 +05:30
Родитель 32e739f995
Коммит 9e2b30408e
2 изменённых файлов: 2 добавлений и 1 удалений

Просмотреть файл

@ -92,6 +92,7 @@
"PulseConnectSecure",
"QualysKB",
"QualysVulnerabilityManagement",
"QualysVulnerabilityManagementV2",
"SalesforceServiceCloud",
"SecurityEvents",
"SemperisDSP",

Просмотреть файл

@ -19,7 +19,7 @@ query: |
let threshold = 10;
QualysHostDetection_CL
| where Severity_s == "5"
| where tostring(Severity_s) == "5"
| summarize StartTime = min(TimeGenerated), EndTime = max(TimeGenerated), count() by NetBios_s, IPAddress
| where count_ >= threshold
| extend timestamp = StartTime, HostCustomEntity = NetBios_s, IPCustomEntity = IPAddress