Updated EQ to correctly match IP

This commit is contained in:
Pete Bryan 2023-03-06 17:29:05 -08:00
Родитель 85fc757659
Коммит d6273f9fad
1 изменённых файлов: 3 добавлений и 2 удалений

Просмотреть файл

@ -18,8 +18,9 @@ Tactics:
- Collection
query: |
let GetSysLogEventsWithIP = (v_IP_Address:string){
_Im_NetworkSession(srcipaddr_has_any_prefix=dynamic([v_IP_Address]))
| where NetworkDirection == "Outbound"
_Im_NetworkSession
| where has_ipv4(SrcIpAddr, v_IP_Address) or ipv6_is_match(SrcIpAddr, v_IP_Address)
| where NetworkDirection =~ "Outbound"
| extend info = pack('HostIP', SrcIpAddr, 'SrcPort', SrcPortNumber, 'DstIP', DstIpAddr,'DstPort', DstPortNumber, 'DstFQDN', DstFQDN, 'User', SrcUsername, 'Process', Process)
| extend Dvc = tolower(Dvc)
| summarize min(TimeGenerated), max(TimeGenerated), count(), Host_Aux_info = make_set(info, maxSize=100) by Dvc