Azure
/
Azure-Sentinel
зеркало из
1
0
Форкнуть 0
Код Задачи Пакеты Проекты Релизы Вики Активность

JSON updated

This commit is contained in:
Ofer Shezaf 2022-05-12 16:02:07 +03:00
Родитель 449b56383e
Коммит db66516434
2 изменённых файлов: 3 добавлений и 3 удалений
Показать статистику Скачать Patch файл Скачать Diff файл Показать все файлы Свернуть все файлы

4
ASIM/Library/ARM/ASIM_LookupDnsQueryType/ASIM_LookupDnsQueryType.json
Просмотреть файл

@ -26,7 +26,7 @@
{
"type": "savedSearches",
"apiVersion": "2020-08-01",
"name": "ASIM_LookupQueryType",
"name": "ASIM_LookupDnsQueryType",
"dependsOn": [
"[concat('Microsoft.OperationalInsights/workspaces/', parameters('Workspace'))]"
],
@ -34,7 +34,7 @@
"etag": "*",
"displayName": "An ASIM Function to get the DNS query type name (resource record type) based on a numerical query type",
"category": "ASIM",
"FunctionAlias": "ASIM_LookupQueryType",
"FunctionAlias": "ASIM_LookupDnsQueryType",
"query": "let function = (QueryType:int) {\n let QueryTypeTable=dynamic\n ({\n \"0\":\"Reserved\",\n \"1\":\"A\",\n \"2\":\"NS\",\n \"3\":\"MD\",\n \"4\":\"MF\",\n \"5\":\"CNAME\",\n \"6\":\"SOA\",\n \"7\":\"MB\",\n \"8\":\"MG\",\n \"9\":\"MR\",\n \"10\":\"NULL\",\n \"11\":\"WKS\",\n \"12\":\"PTR\",\n \"13\":\"HINFO\",\n \"14\":\"MINFO\",\n \"15\":\"MX\",\n \"16\":\"TXT\",\n \"17\":\"RP\",\n \"18\":\"AFSDB\",\n \"19\":\"X25\",\n \"20\":\"ISDN\",\n \"21\":\"RT\",\n \"22\":\"NSAP\",\n \"23\":\"NSAP-PTR\",\n \"24\":\"SIG\",\n \"25\":\"KEY\",\n \"26\":\"PX\",\n \"27\":\"GPOS\",\n \"28\":\"AAAA\",\n \"29\":\"LOC\",\n \"30\":\"NXT\",\n \"31\":\"EID\",\n \"32\":\"NIMLOC\",\n \"33\":\"SRV\",\n \"34\":\"ATMA\",\n \"35\":\"NAPTR\",\n \"36\":\"KX\",\n \"37\":\"CERT\",\n \"38\":\"A6\",\n \"39\":\"DNAME\",\n \"40\":\"SINK\",\n \"41\":\"OPT\",\n \"42\":\"APL\",\n \"43\":\"DS\",\n \"44\":\"SSHFP\",\n \"45\":\"IPSECKEY\",\n \"46\":\"RRSIG\",\n \"47\":\"NSEC\",\n \"48\":\"DNSKEY\",\n \"49\":\"DHCID\",\n \"50\":\"NSEC3\",\n \"51\":\"NSEC3PARAM\",\n \"52\":\"TLSA\",\n \"53\":\"SMIMEA\",\n \"54\":\"Unassigned\",\n \"55\":\"HIP\",\n \"56\":\"NINFO\",\n \"57\":\"RKEY\",\n \"58\":\"TALINK\",\n \"59\":\"CDS\",\n \"60\":\"CDNSKEY\",\n \"61\":\"OPENPGPKEY\",\n \"62\":\"CSYNC\",\n \"99\":\"SPF\",\n \"100\":\"UINFO\",\n \"101\":\"UID\",\n \"102\":\"GID\",\n \"103\":\"UNSPEC\",\n \"104\":\"NID\",\n \"105\":\"L32\",\n \"106\":\"L64\",\n \"107\":\"LP\",\n \"108\":\"EUI48\",\n \"109\":\"EUI64\",\n \"249\":\"TKEY\",\n \"250\":\"TSIG\",\n \"251\":\"IXFR\",\n \"252\":\"AXFR\",\n \"253\":\"MAILB\",\n \"254\":\"MAILA\",\n \"255\":\"All\",\n \"256\":\"URI\",\n \"257\":\"CAA\",\n \"258\":\"AVC\",\n \"259\":\"DOA\",\n \"32768\":\"TA\",\n \"32769\":\"DLV\",\n \"65535\": \"Reserved\"\n });\n let QueryTypeLookup = QueryTypeTable[tostring(QueryType)];\n case (\n QueryTypeLookup != \"\", QueryTypeLookup,\n QueryType between (65280 .. 65534), 'Reserved for Private Use',\n 'Unassigned'\n )\n};\nfunction(QueryType)",
"version": 1,
"functionParameters": "QueryType:int"

2
ASIM/Library/ARM/ASIM_LookupDnsResponseCode/ASIM_LookupDnsResponseCode.json
Просмотреть файл

@ -35,7 +35,7 @@
"displayName": "An ASIM Function to get the DNS response code name based on a numerical response code",
"category": "ASIM",
"FunctionAlias": "ASIM_LookupDnsResponseCode",
"query": "let function = (ResponseCode:int) {\n let ResponseCodesTable=dynamic\n ({\n '0':'NOERROR',\n '1':'FORMERR',\n '2':'SERVFAIL',\n '3':'NXDOMAIN',\n '4':'NOTIMP',\n '5':'REFUSED',\n '6':'YXDOMAIN',\n '7':'YXRRSET',\n '8':'NXRRSET',\n '9':'NOTAUTH',\n '10':'NOTZONE',\n '11':'DSOTYPENI',\n '16':'BADVERS',\n //'16':'BADSIG',\n '17':'BADKEY',\n '18':'BADTIME',\n '19':'BADMODE',\n '20':'BADNAME',\n '21':'BADALG',\n '22':'BADTRUNC',\n '23':'BADCOOKIE'\n });\n let ResponseCodeNameLookup = ResponseCodesTable[tostring(field)];\n case (\n ResponseCodeNameLookup != \"\", ResponseCodeNameLookup,\n ResponseCode between (3841 .. 4095), 'Reserved for Private Use',\n 'Unassigned'\n )\n};\nfunction(ResponseCode)",
"query": "let function = (ResponseCode:int) {\n let ResponseCodesTable=dynamic\n ({\n '0':'NOERROR',\n '1':'FORMERR',\n '2':'SERVFAIL',\n '3':'NXDOMAIN',\n '4':'NOTIMP',\n '5':'REFUSED',\n '6':'YXDOMAIN',\n '7':'YXRRSET',\n '8':'NXRRSET',\n '9':'NOTAUTH',\n '10':'NOTZONE',\n '11':'DSOTYPENI',\n '16':'BADVERS',\n //'16':'BADSIG',\n '17':'BADKEY',\n '18':'BADTIME',\n '19':'BADMODE',\n '20':'BADNAME',\n '21':'BADALG',\n '22':'BADTRUNC',\n '23':'BADCOOKIE'\n });\n let ResponseCodeNameLookup = ResponseCodesTable[tostring(ResponseCode)];\n case (\n ResponseCodeNameLookup != \"\", ResponseCodeNameLookup,\n ResponseCode between (3841 .. 4095), 'Reserved for Private Use',\n 'Unassigned'\n )\n};\nfunction(ResponseCode)",
"version": 1,
"functionParameters": "ResponseCode:int"
}