|
Services Started |
Displays a table of services started on Windows platform and
limits results to the first 200 entries.
Hide Query Show Query #event_simpleName=ServiceStarted AND event_platform=Win
| test(?aid != "*")
| aid=?aid AND #cid = ?cid
| table([@timestamp, UserName, ServiceDisplayName, CommandLine], limit=200)
| Table |
|
Network Connection Destinations |
Displays a world map of network connection destinations by IP
address.
Hide Query Show Query #event_simpleName=NetworkConnectIP4
| test(?aid != "*")
| aid=?aid AND #cid = ?cid
| worldMap(ip=RemoteAddressIP4)
| World Map |
|
Parent to Child Process |
Displays a flow chart of the parent file to child file process.
Hide Query Show Query #event_simpleName=ProcessRollup2
| test(?aid != "*")
| aid=?aid AND #cid = ?cid
| sankey(source=ParentBaseFileName, target=ImageFileName)
| Sankey |
|
Listening Ports |
Displays a table of ports that are listening and associated data,
then limits results to the first 200 entries.
Hide Query Show Query #event_simpleName=ProcessRollup2 OR #event_simpleName=NetworkListenIP4
| aid=?aid
| test(?aid != "*")
| #event_simpleName match {
ProcessRollup2 => pid := TargetProcessId;
NetworkListenIP4 => pid := ContextProcessId;
}
// Group by the agent ID and for each group, group by the 'pid' field.
| groupBy("aid", function=[
{ groupBy("pid", function=[
{ #event_simpleName="ProcessRollup2" | selectLast([ImageFileName]) },
{ #event_simpleName="NetworkListenIP4" | table([LocalAddressIP4, LocalPort]) }
], limit=max)
}
], limit=max)
| match(field=aid, file="fdr_aidmaster.csv", column=aid, include=ComputerName, strict=true)
| LocalAddressIP4=* AND LocalPort=* AND ImageFileName=*
| table([aid, ComputerName, ImageFileName, LocalAddressIP4, LocalPort], limit=200)
| Table |
|
Top DNS Requests |
Displays a list of top DNS requests by domain name.
Hide Query Show Query #event_simpleName=DnsRequest
| test(?aid != "*")
| aid=?aid AND #cid = ?cid
| top(DomainName)
| rename(_count, as="#requests")
| Table |
|
Detections: Map Tactic Technique |
Displays a flow chart of detections by tactic and technique.
Hide Query Show Query EventType=Event_ExternalApiEvent
| test(?aid != "*")
| AgentIdString = ?aid #cid = ?cid
| sankey(target=Tactic, source=Technique)
| Sankey |
|
User Logons |
Displays a table of user logons by type with additional data, then
limits results to the first 200 entries.
Hide Query Show Query #event_simpleName=UserLogon
| test(?aid != "*")
| aid=?aid AND #cid = ?cid
| case { LogonType="2" | Logon_Type:="Interactive"; LogonType="3" | Logon_Type:="Network";
LogonType="4" | Logon_Type:="Batch"; LogonType="5" | Logon_Type:="Service";
LogonType="6" | Logon_Type:="Proxy"; LogonType="7" | Logon_Type:="Unlock";
LogonType="8" | Logon_Type:="Network clear text"; LogonType="9" | Logon_Type:="New Credentials";
LogonType="10" | Logon_Type:="RDP"; LogonType="11" | Logon_Type:="Cached Credentials";
LogonType="12" | Logon_Type:="Auditing"; LogonType="13" | Logon_Type:="Unlock Workstation";*}
| table([@timestamp, UserName, LogonDomain, Logon_Type, UserIsAdmin], limit=200)
| Table |
|
Schedule Tasks |
Displays a table of scheduled tasks with associated data
(username, task name, command data, and arguments).
Hide Query Show Query #event_simpleName=ScheduledTaskRegistered
| test(?aid != "*")
| aid=?aid AND #cid = ?cid
| table([UserName, TaskName, TaskExecCommand, TaskExecArguments])
| Table |
|
Network Connections Count |
Displays a list of IP4 network connections.
Hide Query Show Query #event_simpleName=NetworkConnectIP4
| test(?aid != "*")
| aid=?aid AND #cid = ?cid
| !regex("^(10|172\.16|192\.168)\.", field=RemoteAddressIP4)
| ipLocation(field=RemoteAddressIP4, as=RemoteAddressIP4)
| top([RemoteAddressIP4, RemoteAddressIP4.country])
| rename(_count, as="#connections")
| Table |
|
Detections |
Displays a list of API event detections.
Hide Query Show Query ExternalApiType=Event_DetectionSummaryEvent
| test(?aid != "*")
| AgentIdString = ?aid AND CustomerIdString = ?cid
| groupby([UserName, FileName, DetectName, DetectDescription, SeverityName], function=[count(as=DetectionCount)], limit=max)
| Table |
|
Packed Executable Written |
Displays a list of packed executables that have been written.
Hide Query Show Query #event_simpleName=PackedExecutableWritten
| test(?aid != "*")
| #cid = ?cid AND aid=?aid
| count()
| Single Value |
|
Unique Executables Written |
Displays a list of unique executables written using SHA256 hash
data.
Hide Query Show Query #event_simpleName=PeFileWritten
| test(?aid != "*")
| aid=?aid AND #cid = ?cid
| count(SHA256HashData, distinct=true)
| Single Value |
|
Processes |
Displays a table of processes by file name and limits results to
the first 200 entries.
Hide Query Show Query #event_simpleName=ProcessRollup2
| test(?aid != "*")
| aid=?aid AND #cid = ?cid
| regex(field=ImageFileName, regex="(?<FileName>[^/\\\]+$)")
| table([@timestamp, FileName, CommandLine, ParentBaseFileName], limit=200)
| Table |
|
Host Information |
Displays a table of host information, including computer name,
agent version, etc.)
Hide Query Show Query #event_simpleName=AgentOnline
| test(?aid != "*")
| aid=?aid AND #cid = ?cid
| ipLocation(field=aip, as=aip)
| groupby([ComputerName, AgentVersion, aip, aip.country, aip.city, BiosManufacturer, BiosVersion, ChassisManufacturer, SystemManufacturer, SystemProductName, aid], limit=max)
| drop(_count)
| Table |
|
Workflow Note |
#Workflow Add a non-wildcard value to the aid parameter for the
widgets to display results.
| Note |
