Fixing to match latest validatio tests:
- Agent Id as string
- removing brackets[notation] with dot.notation
This commit is contained in:
Yaron 2021-04-26 20:05:31 +03:00 коммит произвёл GitHub
Родитель a30836570e
Коммит b64ab56007
Не найден ключ, соответствующий данной подписи
Идентификатор ключа GPG: 4AEE18F83AFDEB23
5 изменённых файлов: 8 добавлений и 8 удалений

Просмотреть файл

@ -55,6 +55,6 @@ query: |
| parse Computer with Host_NTDomain '\\' *
| extend Host_HostName = tostring(split(Computer,'.')[0]),
Host_DnsDomain = strcat_array(array_slice(split(Computer,'.'),1,256),'.'), Host_OMSAgentID=toguid(SourceComputerId), Host_AzureID = _ResourceId
| project-away Computer, Account
| project-away Computer, Account, _ResourceId, SourceComputerId
};
MostFailedLogins('<Name>','<NTDomain>','<UPNSuffix>')

Просмотреть файл

@ -30,11 +30,11 @@ query: |
| where Entities has "account"
| where Entities has_any (PeerNames) or Entities has_any (PeerIds)
| mvexpand todynamic(Entities)
| where tostring(Entities ["Type"]) =="account"
| where tostring(Entities ["Name"]) has_any (PeerNames) or tostring(Entities ["AadUserId"]) has_any (PeerIds)
| where tostring(parsejson(Entities).Type) =="account"
| where tostring(parsejson(Entities).Name) has_any (PeerNames) or tostring(parsejson(Entities).AadUserId) has_any (PeerIds)
| summarize Account_Aux_AlertCount = count()
by Account_Name=tolower(tostring(Entities["Name"]))
, Account_UPNSuffix=tolower(tostring(Entities["UPNSuffix"]));
by Account_Name=tolower(tostring(parsejson(Entities).Name))
, Account_UPNSuffix=tolower(tostring(parsejson(Entities).UPNSuffix));
PeersWithSecAlert
| join kind=innerunique
Peers

Просмотреть файл

@ -27,7 +27,7 @@ query: |
| where tolower(Account) contains tolower(v_Account_Name)
| extend info = pack('EventID', EventID, 'Account', Account, 'LogonTypeName', LogonTypeName, 'SubStatus', SubStatus, 'AccountType', AccountType, 'WorkstationName', WorkstationName, 'IpAddress', IpAddress)
| summarize min(TimeGenerated), max(TimeGenerated), Host_Aux_info = makeset(info) by Computer, SourceComputerId, _ResourceId
| project min_TimeGenerated, max_TimeGenerated, Computer, Host_Aux_info, Host_OMSAgentID=toguid(SourceComputerId), Host_AzureID=_ResourceId
| project min_TimeGenerated, max_TimeGenerated, Computer, Host_Aux_info, Host_OMSAgentID=SourceComputerId, Host_AzureID=_ResourceId
| project-rename Host_UnstructuredName=Computer, Host_Aux_StartTime=min_TimeGenerated, Host_Aux_EndTime=max_TimeGenerated
| top 10 by Host_Aux_StartTime asc nulls last
};

Просмотреть файл

@ -20,7 +20,7 @@ query: |
let GetFilesHost = (v_File_Name:string){
SecurityEvent
| where CommandLine contains v_File_Name or ServiceFileName contains v_File_Name or ServiceName contains v_File_Name
| summarize min(TimeGenerated), max(TimeGenerated) by Computer, Host_OMSAgentID=toguid(SourceComputerId), Host_AzureID = _ResourceId
| summarize min(TimeGenerated), max(TimeGenerated) by Computer, Host_OMSAgentID=SourceComputerId, Host_AzureID = _ResourceId
| project min_TimeGenerated, max_TimeGenerated, Computer, Host_OMSAgentID, Host_AzureID
| project-rename Host_UnstructuredName=Computer, Host_Aux_min_TimeGenerated=min_TimeGenerated, Host_Aux_max_TimeGenerated=max_TimeGenerated
| top 10 by Host_Aux_min_TimeGenerated desc nulls last

Просмотреть файл

@ -27,7 +27,7 @@ query: |
| where NewProcessName has v_Process_ImageFile_FullPath
| extend info = pack('Account', Account, 'NewProcessName', NewProcessName, 'CommandLine', CommandLine)
| summarize min(TimeGenerated), max(TimeGenerated), Host_Aux_info = makeset(info) by Computer, SourceComputerId, _ResourceId
| project min_TimeGenerated, max_TimeGenerated, Computer, Host_Aux_info, Host_OMSAgentID=toguid(SourceComputerId)
| project min_TimeGenerated, max_TimeGenerated, Computer, Host_Aux_info, Host_OMSAgentID=SourceComputerId
| top 10 by min_TimeGenerated asc nulls last
| project-rename Host_UnstructuredName=Computer, Host_Aux_StartTime=min_TimeGenerated, Host_Aux_EndTime=max_TimeGenerated
};