Updated EQ to correctly match IP
This commit is contained in:
Родитель
85fc757659
Коммит
d6273f9fad
|
@ -18,8 +18,9 @@ Tactics:
|
|||
- Collection
|
||||
query: |
|
||||
let GetSysLogEventsWithIP = (v_IP_Address:string){
|
||||
_Im_NetworkSession(srcipaddr_has_any_prefix=dynamic([v_IP_Address]))
|
||||
| where NetworkDirection == "Outbound"
|
||||
_Im_NetworkSession
|
||||
| where has_ipv4(SrcIpAddr, v_IP_Address) or ipv6_is_match(SrcIpAddr, v_IP_Address)
|
||||
| where NetworkDirection =~ "Outbound"
|
||||
| extend info = pack('HostIP', SrcIpAddr, 'SrcPort', SrcPortNumber, 'DstIP', DstIpAddr,'DstPort', DstPortNumber, 'DstFQDN', DstFQDN, 'User', SrcUsername, 'Process', Process)
|
||||
| extend Dvc = tolower(Dvc)
|
||||
| summarize min(TimeGenerated), max(TimeGenerated), count(), Host_Aux_info = make_set(info, maxSize=100) by Dvc
|
||||
|
|
Загрузка…
Ссылка в новой задаче