Most recent detections |
Displays a list of recent external API events, arranges them in
order of severity (low, medium, high, and critical), then limits
results to the first 1000 entries.
Hide Query Show Query #event_simpleName!=* OR #streamingApiEvent=Event_IdpDetectionSummaryEvent OR #event_simpleName=Event_IdpDetectionSummaryEvent
| ExternalApiType="Event_IdpDetectionSummaryEvent"
| case {
Severity >= "0" and Severity <= "19" | Severity := "Info" ;
Severity >= "20" and Severity <= "39" | Severity := "๐ข Low" ;
Severity >= "40" and Severity <= "59" | Severity := "๐ก Medium" ;
Severity >= "60" and Severity <= "79" | Severity := "๐ High" ;
Severity >= "80" and Severity <= "100" | Severity := "๐ด Critical" ;
* }
| Severity != Info
// Set formatting for display
| format("[View detection](%s)", field=[FalconHostLink], as="Link")
| "Account Name":=rename(SourceAccountName)
| Source:=rename(SourceEndpointHostName)
// Display columns with all defined formatting
| table([Severity, DetectName, @timestamp, "Account Name", Source, "Link"], limit=1000)
| Table |
Source Users Most Involved in Detections |
Displays a table of source users most involved in detections.
Hide Query Show Query #event_simpleName!=* OR #streamingApiEvent=Event_IdpDetectionSummaryEvent OR #event_simpleName=Event_IdpDetectionSummaryEvent
| ExternalApiType="Event_IdpDetectionSummaryEvent"
| top(SourceAccountName)
// Rename variables for display purposes
| "Account Name" := rename(SourceAccountName)
| Detections:=rename(_count)
| Table |
Low |
Displays the number of events with a low severity rating (greater
than or equal to 20, or less than or equal to 39).
Hide Query Show Query #event_simpleName!=* OR #streamingApiEvent=Event_IdpDetectionSummaryEvent OR #event_simpleName=Event_IdpDetectionSummaryEvent
| ExternalApiType="Event_IdpDetectionSummaryEvent"
| Severity >= "20" and Severity <= "39"
| count(Severity)
// Severity mapping - numeric to label (from Event Data Dictionary)
// | case {
// Severity >= "0" and Severity <= "19" | Severity := "Info" ;
// Severity >= "20" and Severity <= "39" | Severity := "Low" ;
// Severity >= "40" and Severity <= "59" | Severity := "Medium" ;
// Severity >= "60" and Severity <= "79" | Severity := "High" ;
// Severity >= "80" and Severity <= "100" | Severity := "Critical" ;
// * }
// | Severity != Info
| Single Value |
Critical | Hide Query Show Query #event_simpleName!=* OR #streamingApiEvent=Event_IdpDetectionSummaryEvent OR #event_simpleName=Event_IdpDetectionSummaryEvent
| ExternalApiType="Event_IdpDetectionSummaryEvent"
| Severity >= "80" and Severity <= "100"
| count(Severity)
// Severity mapping - numeric to label (from Event Data Dictionary)
// | case {
// Severity >= "0" and Severity <= "19" | Severity := "Info" ;
// Severity >= "20" and Severity <= "39" | Severity := "Low" ;
// Severity >= "40" and Severity <= "59" | Severity := "Medium" ;
// Severity >= "60" and Severity <= "79" | Severity := "High" ;
// Severity >= "80" and Severity <= "100" | Severity := "Critical" ;
// * }
// | Severity != Info
| Single Value |
Medium |
Displays events considered medium severity, with a rating greater
than 40 but less than 59.
Hide Query Show Query #event_simpleName!=* OR #streamingApiEvent=Event_IdpDetectionSummaryEvent OR #event_simpleName=Event_IdpDetectionSummaryEvent
| ExternalApiType="Event_IdpDetectionSummaryEvent"
| Severity >= "40" and Severity <= "59"
| count(Severity)
// Severity mapping - numeric to label (from Event Data Dictionary)
// | case {
// Severity >= "0" and Severity <= "19" | Severity := "Info" ;
// Severity >= "20" and Severity <= "39" | Severity := "Low" ;
// Severity >= "40" and Severity <= "59" | Severity := "Medium" ;
// Severity >= "60" and Severity <= "79" | Severity := "High" ;
// Severity >= "80" and Severity <= "100" | Severity := "Critical" ;
// * }
// | Severity != Info
| Single Value |
Detections by severity |
Displays a chart of event detections by severity (information,
low, medium, high, and critical).
Hide Query Show Query #event_simpleName!=* OR #streamingApiEvent=Event_IdpDetectionSummaryEvent OR #event_simpleName=Event_IdpDetectionSummaryEvent
| ExternalApiType="Event_IdpDetectionSummaryEvent"
// Severity mapping - numeric to label (from Event Data Dictionary)
| case {
Severity >= "0" and Severity <= "19" | Severity := "Info" ;
Severity >= "20" and Severity <= "39" | Severity := "Low" ;
Severity >= "40" and Severity <= "59" | Severity := "Medium" ;
Severity >= "60" and Severity <= "79" | Severity := "High" ;
Severity >= "80" and Severity <= "100" | Severity := "Critical" ;
* }
| Severity != Info
| timeChart(Severity)
| Time Chart |
MITRE Tactics and Techniques Details |
Displays a table of MITRE ATT@CK tactics and techniques, and their
associated severity level (information, low, medium, high, and
critical).
Hide Query Show Query #event_simpleName!=* OR #streamingApiEvent=Event_IdpDetectionSummaryEvent OR #event_simpleName=Event_IdpDetectionSummaryEvent
| ExternalApiType="Event_IdpDetectionSummaryEvent"
| Tactic=*
| case {
Severity >= "0" and Severity <= "19" | Severity := "Info" ;
Severity >= "20" and Severity <= "39" | Severity := "๐ข Low" ;
Severity >= "40" and Severity <= "59" | Severity := "๐ก Medium" ;
Severity >= "60" and Severity <= "79" | Severity := "๐ High" ;
Severity >= "80" and Severity <= "100" | Severity := "๐ด Critical" ;
* }
| Severity != Info
// Set formatting for display
| format("[View detection](%s)", field=[FalconHostLink], as="Link")
// | "Account Name":=rename(SourceAccountName)
// | Source:=rename(SourceEndpointHostName)
// Display columns with all defined formatting
| table([Severity, Tactic, Technique, "Link"], limit=1000)
| Table |
Detections by name |
Displays a list of detections by name.
Hide Query Show Query #event_simpleName!=* OR #streamingApiEvent=Event_IdpDetectionSummaryEvent OR #event_simpleName=Event_IdpDetectionSummaryEvent
| ExternalApiType="Event_IdpDetectionSummaryEvent"
| top(DetectName)
// Rename variables for display purposes
| "Detections by name" := rename(DetectName)
| Total:=rename(_count)
| Table |
High |
Displays the number of events given a 'high' severity rating
(greater than or equal to 60, and less than or equal to 79).
Hide Query Show Query #event_simpleName!=* OR #streamingApiEvent=Event_IdpDetectionSummaryEvent OR #event_simpleName=Event_IdpDetectionSummaryEvent
| ExternalApiType="Event_IdpDetectionSummaryEvent"
| Severity >= "60" and Severity <= "79"
| count(Severity)
// Severity mapping - numeric to label (from Event Data Dictionary)
// | case {
// Severity >= "0" and Severity <= "19" | Severity := "Info" ;
// Severity >= "20" and Severity <= "39" | Severity := "Low" ;
// Severity >= "40" and Severity <= "59" | Severity := "Medium" ;
// Severity >= "60" and Severity <= "79" | Severity := "High" ;
// Severity >= "80" and Severity <= "100" | Severity := "Critical" ;
// * }
// | Severity != Info
| Single Value |
Source endpoints most involved in detections |
Displays a table of source endpoints most involved in system
detections.
Hide Query Show Query #event_simpleName!=* OR #streamingApiEvent=Event_IdpDetectionSummaryEvent OR #event_simpleName=Event_IdpDetectionSummaryEvent
| ExternalApiType="Event_IdpDetectionSummaryEvent"
| Endpoints:= rename(SourceEndpointHostName)
| top(Endpoints)
// Rename variables for display purposes
| Detections:=rename(_count)
| Table |
MITRE Tactics and Techniques Overview |
Displays an overview list of MITRE tactics and techniques.
Hide Query Show Query #event_simpleName!=* OR #streamingApiEvent=Event_IdpDetectionSummaryEvent OR #event_simpleName=Event_IdpDetectionSummaryEvent
| ExternalApiType="Event_IdpDetectionSummaryEvent"
//|
| groupBy([Tactic, Technique], function=stats([count(AgentIdString, as="detectCount")]))
| rename("detectCount", as="Detection Count")
| Heat Map |