27 строки
1011 B
Plaintext
27 строки
1011 B
Plaintext
// Name: Alerts On Host
|
|
// Description: Any Alerts that fired on a given host during the range of +6h and -3d
|
|
//
|
|
// Entity: Host
|
|
// Input: Compromised Host, (HostName)
|
|
// Output: Alerts
|
|
//
|
|
// QueryPeriod: +6h and -3d default, change as needed
|
|
//
|
|
// Data Source: SecurityAlert
|
|
//
|
|
// Tactics: #Persistence, #Discovery, #Lateral Movement, #Collection
|
|
//
|
|
let GetAllAlertsOnHost = (suspiciousEventTime:datetime, v_Host:string){
|
|
//-3d and +6h as some alerts fire after accumulation of events
|
|
let v_StartTime = suspiciousEventTime-3d;
|
|
let v_EndTime = suspiciousEventTime+6h;
|
|
SecurityAlert
|
|
| where TimeGenerated between (v_StartTime .. v_EndTime)
|
|
// expand JSON properties
|
|
| extend Extprop = parse_json(ExtendedProperties)
|
|
| extend Computer = toupper(tostring(Extprop["Compromised Host"]))
|
|
| where Computer contains v_Host
|
|
| project TimeGenerated, AlertName, Computer, ExtendedProperties
|
|
};
|
|
// change datetime value and hostname value below
|
|
GetAllAlertsOnHost(datetime('2019-01-20T10:02:51.000'), toupper("<hostname>")) |