Responding to PR comments to let user define time range when running. Have added comment to description to prompt user on this.
This commit is contained in:
petebryan 2019-06-24 10:27:53 -07:00 коммит произвёл GitHub
Родитель 0378cd544b
Коммит baeed297a6
Не найден ключ, соответствующий данной подписи
Идентификатор ключа GPG: 4AEE18F83AFDEB23
1 изменённых файлов: 1 добавлений и 1 удалений

Просмотреть файл

@ -18,10 +18,10 @@
// Usage Instruction :
// Either run this parser as a stand alone query within Azure Sentinel or save it as a KQL function for later use. Further details on
// functions can be found here: https://techcommunity.microsoft.com/t5/Azure-Sentinel/Using-KQL-functions-to-speed-up-analysis-in-Azure-Sentinel/ba-p/712381
// If running as a stand alone qeury consider adding customised time range to the query at run time.
//
//
OfficeActivity
| where TimeGenerated >= ago(30d)
| where Operation == 'New-InboxRule'
| extend details = parse_json(Parameters)
| where details contains 'ForwardTo' or details contains 'RedirectTo'