Added missing TargetUserName and TargetDomainName

Added missing TargetUserName and TargetDomainName as the rule was failing after the last update
This commit is contained in:
Tiago Duarte 2023-12-22 13:19:44 +00:00 коммит произвёл GitHub
Родитель c3f6243c39
Коммит ac62bd58bb
Не найден ключ, соответствующий данной подписи
Идентификатор ключа GPG: 4AEE18F83AFDEB23
1 изменённых файлов: 3 добавлений и 3 удалений

Просмотреть файл

@ -94,7 +94,7 @@ query: |
| where DisableTime - EnableTime < spanoftime
| extend TimeDelta = DisableTime - EnableTime
| where tolong(TimeDelta) >= threshold
| project TimeDelta, EnableTime, EnableEventID, EnableActivity, Computer, TargetAccount, TargetSid, UserPrincipalName,
| project TimeDelta, EnableTime, EnableEventID, EnableActivity, Computer, TargetAccount, TargetSid, TargetUserName, TargetDomainName, UserPrincipalName,
AccountUsedToEnable, SIDofAccountUsedToEnable, DisableTime, DisableEventID, DisableActivity, AccountUsedToDisable, SIDofAccountUsedToDisable,
EnabledBySubjectUserName, EnabledBySubjectDomainName, DisabledBySubjectUserName, DisabledBySubjectDomainName
| extend HostName = tostring(split(Computer, ".")[0]), DomainIndex = toint(indexof(Computer, '.'))
@ -137,7 +137,7 @@ entityMappings:
columnName: HostName
- identifier: NTDomain
columnName: HostNameDomain
version: 1.2.1
version: 1.2.2
kind: Scheduled
metadata:
source:
@ -147,4 +147,4 @@ metadata:
support:
tier: Community
categories:
domains: [ "Security - Others", "Identity" ]
domains: [ "Security - Others", "Identity" ]