Removed time range
Responding to PR comments to let user define time range when running. Have added comment to description to prompt user on this.
This commit is contained in:
Родитель
0378cd544b
Коммит
baeed297a6
|
@ -18,10 +18,10 @@
|
|||
// Usage Instruction :
|
||||
// Either run this parser as a stand alone query within Azure Sentinel or save it as a KQL function for later use. Further details on
|
||||
// functions can be found here: https://techcommunity.microsoft.com/t5/Azure-Sentinel/Using-KQL-functions-to-speed-up-analysis-in-Azure-Sentinel/ba-p/712381
|
||||
// If running as a stand alone qeury consider adding customised time range to the query at run time.
|
||||
//
|
||||
//
|
||||
OfficeActivity
|
||||
| where TimeGenerated >= ago(30d)
|
||||
| where Operation == 'New-InboxRule'
|
||||
| extend details = parse_json(Parameters)
|
||||
| where details contains 'ForwardTo' or details contains 'RedirectTo'
|
||||
|
|
Загрузка…
Ссылка в новой задаче