查询规则和检测

支持的平台：

本文档面向安全运营中心 (SOC) 的经理和分析师，他们希望使用精选的信息中心（预定义的信息中心，旨在提高各种安全应用场景的可见性）来监控威胁形势和系统运行状况。本文档针对 SOAR 案例来源类型提供了一系列精选的信息中心及其底层查询。

您可以在查询编辑器中使用这些查询，也可以将其用作自定义 widget 的基准。 如需了解如何创建和管理信息中心，请参阅管理信息中心。

信息中心名称 说明 图表名称 查询
ISO 27001 - 技术控制 可让您了解技术控制措施和加密标准，从而支持合规性和数据驱动的补救措施。
注意：应用过滤条件可优化数据。		 按数据源划分的提醒趋势 
$Date = timestamp.get_date(detection.created_time.seconds)

match:
    $Date

outcome:
    $Count = count(detection.id)

order:
    $Date desc
ISO 27001 - 技术控制 可让您了解技术控制措施和加密标准，从而支持合规性和数据驱动的补救措施。
注意：应用过滤条件可优化数据。		 10 大高风险资产 
detection.detection.risk_score > 0
detection.collection_elements.references.event.principal.hostname != ""
detection.collection_elements.references.event.metadata.product_name != ""
detection.collection_elements.references.event.principal.ip != ""

$Hostname = detection.collection_elements.references.event.principal.hostname
$IP_Address = detection.collection_elements.references.event.principal.ip
$Product_Name = detection.collection_elements.references.event.metadata.product_name

match:
    $Hostname, $IP_Address, $Product_Name

outcome:
    $Risk_Score = max(detection.detection.risk_score)
    $First_Time_Seen = timestamp.get_timestamp(min(detection.collection_elements.references.event.metadata.event_timestamp.seconds))
    $Last_Time_Seen = timestamp.get_timestamp(max(detection.collection_elements.references.event.metadata.event_timestamp.seconds))

order:
    $Risk_Score desc

limit:
    10
Chrome 企业进阶版安全功能概览 实时深入分析与 Chrome 相关的安全事件，包括敏感数据传输、恶意软件尝试和密码安全问题。 来自 Chrome 风险精选检测规则包的检测结果 
detection.detection.ruleset_category_display_name = "Chrome Enterprise Premium Threats"

$Rule_Name = detection.detection.rule_name
$User = strings.coalesce(detection.detection.outcomes["victim_name"], detection.detection.outcomes["victim_netid"], detection.collection_elements.references.event.principal.user.userid, detection.collection_elements.references.event.principal.user.user_display_name, detection.collection_elements.references.event.principal.user.email_addresses, detection.collection_elements.references.event.target.user.userid, detection.collection_elements.references.event.target.user.user_display_name, detection.collection_elements.references.event.target.user.email_addresses)
$Hostname = strings.coalesce(detection.detection.outcomes["hostname"], detection.collection_elements.references.event.principal.hostname, detection.collection_elements.references.event.principal.asset.product_object_id)
$IP = strings.coalesce(detection.collection_elements.references.event.principal.ip, detection.collection_elements.references.event.about.ip)
$Severity = detection.detection.severity
$File = strings.coalesce(detection.collection_elements.references.event.target.file.full_path, detection.collection_elements.references.event.target.resource.name, detection.collection_elements.references.event.target.url, detection.detection.outcomes["url"])
$Risk_Score = detection.detection.outcomes["risk_score"]
$Threat_Name = detection.collection_elements.references.event.security_result.threat_name

match:
    $User, $Rule_Name, $Hostname, $IP, $File, $Risk_Score, $Severity, $Threat_Name

outcome:
    $Description = array_distinct(detection.detection.description)
    $Count = count(detection.id)

order:
    $Severity, $Count desc
Cloud Key Management 概览 集中显示 Cloud Key 管理（包括 Secret 和证书）的相关信息。利用这些数据洞见来跟踪生命周期变化并检测未经授权的活动。 一段时间内的提醒 
detection.detection.ruleset_category_display_name = "Cloud Threats"
detection.detection.alert_state = "ALERTING"
detection.detection.rule_name = /Secrets|Key|KMS/ nocase

$Date = timestamp.get_date(detection.collection_elements.references.event.metadata.event_timestamp.seconds)
$Rule_Name = detection.detection.rule_name

match:
  $Date, $Rule_Name

outcome:
  $Count = count(detection.id)

order:
  $Date desc
云安全状况概览 通过跟踪 Google Cloud、AWS 和 Azure 中的关键指标，提供云安全态势洞见。 检测趋势随时间的变化 
$log_type = detection.collection_elements.references.event.metadata.log_type
$log_type = /GCP|AWS|AZURE/
$date = timestamp.get_date(detection.created_time.seconds)
match:
$date
outcome:
$event_count = count(detection.id)
order:
$date asc
云安全状况概览 通过跟踪 Google Cloud、AWS 和 Azure 中的关键指标，提供云安全态势洞见。 检测结果（按类别） 
$log_type = detection.collection_elements.references.event.metadata.log_type
$log_type = /GCP|AWS|AZURE/
$category = detection.collection_elements.references.event.security_result.category
match:
$category
outcome:
$event_count = count(detection.id)
order:
$event_count desc
云安全状况概览 通过跟踪 Google Cloud、AWS 和 Azure 中的关键指标，提供云安全态势洞见。 检测结果（按严重程度划分） 
$log_type = detection.collection_elements.references.event.metadata.log_type
$log_type = /AWS|GCP|AZURE/
$severity = detection.collection_elements.references.event.security_result.severity
match:
$severity
outcome:
$event_count = count(detection.id)
order:
$event_count desc
云安全状况概览 通过跟踪 Google Cloud、AWS 和 Azure 中的关键指标，提供云安全态势洞见。 热门资产位置 
$log_type = detection.collection_elements.references.event.metadata.log_type
$log_type = /AWS|GCP|AZURE/
$resource = detection.collection_elements.references.event.target.resource.name
$location = detection.collection_elements.references.event.principal.ip_geo_artifact.location.country_or_region
match:
$location
outcome:
$event_count = count($resource)
$latitude = max(detection.collection_elements.references.event.principal.ip_geo_artifact.location.region_latitude)
$longitude = max(detection.collection_elements.references.event.principal.ip_geo_artifact.location.region_longitude)
order:
$event_count desc
云安全状况概览 通过跟踪 Google Cloud、AWS 和 Azure 中的关键指标，提供云安全态势洞见。 受影响程度最高的 10 项资源 
$log_type = detection.collection_elements.references.event.metadata.log_type
$log_type = /AWS|GCP|AZURE/
$targeted_resources = detection.collection_elements.references.event.target.resource.name
$targeted_resources != ""
match:
$targeted_resources
outcome:
$event_count = count($targeted_resources)
order:
$event_count desc
limit : 10
云安全状况概览 通过跟踪 Google Cloud、AWS 和 Azure 中的关键指标，提供云安全态势洞见。 10 大检测结果 
$log_type = detection.collection_elements.references.event.metadata.log_type
$log_type = /GCP|AWS|AZURE/
$rule_name = detection.detection.rule_name
$rule_name != ""
match:
$rule_name
outcome:
$event_count = count(detection.id)
order:
$event_count desc
limit:
10
云安全状况概览 通过跟踪 Google Cloud、AWS 和 Azure 中的关键指标，提供云安全态势洞见。 10 大触发者 
$log_type = detection.collection_elements.references.event.metadata.log_type
$log_type = /GCP|AWS|AZURE/
$user= detection.collection_elements.references.event.principal.user.userid
$user != ""
match:
$user
outcome:
$event_count = count(detection.collection_elements.references.event.metadata.id)
order:
$event_count desc
limit:
10
云安全状况概览 通过跟踪 Google Cloud、AWS 和 Azure 中的关键指标，提供云安全态势洞见。 按检测类别划分的严重程度分布 
$log_type = detection.collection_elements.references.event.metadata.log_type
$log_type = /GCP|AWS|AZURE/
$category = detection.collection_elements.references.event.security_result.category
$severity = detection.collection_elements.references.event.security_result.severity
match:
$severity,$category
outcome:
$event_count = count(detection.id)
order:
$event_count desc
Cloud Storage 服务概览 可让您了解云端存储活动和权限变更，帮助团队监控提醒并维护数据完整性。利用这些数据洞见跟踪顶级用户并识别异常访问模式。 一段时间内的提醒 
detection.detection.ruleset_category_display_name = "Cloud Threats"
(detection.tags = /T1530|T1567.002/
or detection.detection.rule_name = /storage|blob|bucket/ nocase)
detection.detection.alert_state = "ALERTING"

$Date = timestamp.get_date(detection.collection_elements.references.event.metadata.event_timestamp.seconds)
$Rule_Name = detection.detection.rule_name

match:
  $Date, $Rule_Name

outcome:
  $Count = count(detection.id)

order:
  $Date desc
数据注入和健康状况 可直观显示提取吞吐量和错误计数，帮助团队快速发现数据流问题。您可以使用这些指标来监控日志分布，确保运营稳定性。 规则 
$a = rules.name
match: $a
GDPR 数据治理 可让您了解欧盟各区域的数据访问情况，包括访问趋势、非欧盟访问尝试和热门地理位置。它有助于监控 GDPR 法规的合规情况、检测未经授权的数据访问权限，并确保欧盟数据的安全处理。注意：应用过滤条件可显示相关结果。 按用户列出的异常数据传输 
strings.coalesce(detection.collection_elements.references.event.principal.location.country_or_region, detection.collection_elements.references.event.principal.ip_geo_artifact.location.country_or_region, detection.collection_elements.references.event.principal.location.name)
  = /Austria|Belgium|Bulgaria|Croatia|Cyprus|Czechia|Denmark|Estonia|Finland|France|Germany|Greece|Hungary|Ireland|Italy|Latvia|Lithuania|Luxembourg|Malta|Netherlands|Poland|Portugal|Romania|Slovakia|Slovenia|Spain|Sweden|eu-(west-1|west-3|central-1|north-1|south-1|south-2)|europe-(west1|west3|west4|west8|west9|west10|west12|central2|north1|north2|southwest1)|austriaeast|denmarkeast|francecentral|germanywestcentral|greececentral|italynorth|northeurope|spaincentral|swedencentral|westeurope|polandcentral/ nocase

$Rule_Set = detection.detection.rule_set
$Rule_Set = "Anomalous Total Bytes by User"
$Employee_Name = strings.coalesce(detection.collection_elements.references.event.principal.user.userid,detection.collection_elements.references.event.principal.user.user_display_name,
detection.collection_elements.references.event.principal.user.email_addresses)
$Employee_ID = detection.collection_elements.references.event.principal.user.employee_id
$Empolyee_Namespace = detection.collection_elements.references.event.principal.namespace

match:
   $Employee_Name ,$Employee_ID, $Empolyee_Namespace,  $Rule_Set

outcome:
    $Count = count_distinct(detection.id)

order:
    $Count Desc
IAM 安全运维 用于日常监控的简要概览。它侧重于实时异常、主动威胁和高风险事件，以便快速检测和响应突发事件。根据需要使用可用的过滤条件缩小结果范围。 IAM 随时间变化的提醒 
detection.detection.rule_set_display_name = "Admin Action"
or detection.detection.rule_set_display_name = "Potential Workspace Account Compromise"
or detection.detection.rule_set_display_name = "Suspicious Workspace Administrative Actions"
or detection.detection.rule_set_display_name = "AWS - Identity"
or detection.detection.rule_set_display_name = "AWS - Organization"
or detection.detection.rule_set_display_name = "Azure - Identity"
or detection.detection.rule_set_display_name = "Azure - Organization"
or detection.detection.rule_set_display_name = "IAM Abuse"
or detection.detection.rule_set_display_name = "New Login by User to Device"
or detection.detection.rule_set_display_name = "Anomalous Authentication Events by User"
or detection.detection.rule_set_display_name = "Failed Authentications by Device"
or detection.detection.rule_set_display_name = "Failed Authentications by User"
or detection.detection.rule_set_display_name = "Anomalous Inbound Bytes by User"
or detection.detection.rule_set_display_name = "Anomalous Total Bytes by User"
or detection.detection.rule_set_display_name = "Brute Force then Successful Login by User"
or detection.detection.rule_set_display_name = "Anomalous or Excessive Logins for a Newly Created User"
or detection.detection.rule_set_display_name = "Anomalous or Excessive Suspicious Actions for a Newly Created User"
or detection.detection.rule_set_display_name = "Excessive Alerts by User"
detection.detection.alert_state = "ALERTING"

$Date = timestamp.get_date(detection.collection_elements.references.event.metadata.event_timestamp.seconds)
$Rule_Name = detection.detection.rule_name

match:
    $Date, $Rule_Name

outcome:
    $Count = count(detection.id)

order:
    $Date desc
ISO 27001 - 组织控制措施 根据 ISO 27001 标准，提供组织安全控制和合规性表现方面的可见性。它有助于跟踪审核结果并找出有待改进的方面。
注意：应用过滤条件可优化结果。		 近期的 Cloud Threat Detection 
detection.detection.ruleset_category_display_name = "Cloud Threats"

$Date = timestamp.get_timestamp(detection.collection_elements.references.event.metadata.event_timestamp.seconds)
$Rule_Name = detection.detection.rule_name
$User = strings.coalesce(detection.collection_elements.references.event.principal.user.userid, detection.collection_elements.references.event.principal.user.email_addresses)
$Source_IP = strings.coalesce(detection.collection_elements.references.event.principal.asset.ip, detection.collection_elements.references.event.principal.ip)
$Host = strings.coalesce(detection.collection_elements.references.event.principal.asset.hostname, detection.collection_elements.references.event.principal.hostname)

match:
    $Date, $Rule_Name, $User, $Source_IP, $Host

order:
    $Date desc
ISO 27001 - 组织控制措施 根据 ISO 27001 标准，提供组织安全控制和合规性表现方面的可见性。它有助于跟踪审核结果并找出有待改进的方面。
注意：应用过滤条件可优化结果。		 提醒随时间的变化（按严重程度划分） 
$Date = timestamp.get_date(detection.created_time.seconds)
$Severity = detection.collection_elements.references.event.security_result.severity
$Severity != "UNKNOWN_SEVERITY"

match:
    $Date, $Severity

outcome:
    $Count = count(detection.id)

order:
    $Date desc
离地攻击活动 深入分析了 Rundll32 和 Regsvr32 等可信系统工具的潜在滥用情况。它会跟踪并直观呈现高级威胁为逃避检测和利用系统实用程序而经常使用的活动。 离地攻击检测随时间的变化 
detection.detection.rule_set = "89adf0db-5d29-0a04-c926-f8c2a58f5d1b"

$Rule_Name = detection.detection.rule_name
$Severity = detection.detection.severity
$Risk_Score = detection.detection.risk_score
$Date = timestamp.get_date(detection.collection_elements.references.event.metadata.event_timestamp.seconds)

match:
    $Rule_Name, $Severity, $Risk_Score, $Date
outcome:
    $Count = count(detection.detection.threat_id)
order:
    $Count desc
离地攻击活动 深入分析了 Rundll32 和 Regsvr32 等可信系统工具的潜在滥用情况。它会跟踪并直观呈现高级威胁为逃避检测和利用系统实用程序而经常使用的活动。 离地攻击检测结果（按严重程度划分） 
$event.detection.detection.rule_set = "89adf0db-5d29-0a04-c926-f8c2a58f5d1b"

$Rule_Name = $event.detection.detection.rule_name
$Severity = $event.detection.detection.severity
$Risk_Score = $event.detection.detection.risk_score

match:
    $Rule_Name, $Severity, $Risk_Score
limit:
    50
离地攻击活动 深入分析了 Rundll32 和 Regsvr32 等可信系统工具的潜在滥用情况。它会跟踪并直观呈现高级威胁为逃避检测和利用系统实用程序而经常使用的活动。 离地攻击检测 
$event.detection.detection.rule_set = "89adf0db-5d29-0a04-c926-f8c2a58f5d1b"

$Rule_Name = $event.detection.detection.rule_name

match:
    $Rule_Name
outcome:
    $Last_Detection = timestamp.get_timestamp(max($event.detection.collection_elements.references.event.metadata.event_timestamp.seconds))
order:
    $Last_Detection desc
主要 提供数据注入健康状况和检测到的 IoC 的摘要，并提供有关潜在威胁的全局视角。 检测 
detection.id != ""
outcome:
   $count = count(detection.id)
主要 提供数据注入健康状况和检测到的 IoC 的摘要，并提供有关潜在威胁的全局视角。 提醒 
detection.id != ""
outcome:
   $count = count_distinct(detection.id)
Mandiant Threat Defense 清晰展示 Mandiant 在您的环境中执行的主动威胁搜寻。其中详细介绍了正在进行和已完成的搜寻活动，同时突出了通过搜寻过程发现的趋势。 按检测次数排名的前 100 名用户 
$rule_pack_name = detection.detection.rule_set_display_name
$rule_name = detection.detection.rule_name
$username = group(detection.collection_elements.references.event.principal.user.userid, detection.collection_elements.references.event.src.user.userid, detection.collection_elements.references.event.target.user.userid)

$username != ""

re.regex($rule_pack_name, `^Mandiant.*`)

match:
    $username

outcome:
    $count = count_distinct(detection.id)
    $unique_rules = count_distinct($rule_name)

order:
    $count desc

limit:
    100
Mandiant Threat Defense 清晰展示 Mandiant 在您的环境中执行的主动威胁搜寻。其中详细介绍了正在进行和已完成的搜寻活动，同时突出了通过搜寻过程发现的趋势。 Mandiant Threat Defense 检测结果随时间的变化趋势 
$rule_pack_name = detection.detection.rule_set_display_name
$date = timestamp.get_date(detection.created_time.seconds)

re.regex($rule_pack_name, `^Mandiant.*`)

match:
    $date

outcome:
    $count = count_distinct(detection.id)

order:
    $date asc
Mandiant Threat Defense 清晰展示 Mandiant 在您的环境中执行的主动威胁搜寻。其中详细介绍了正在进行和已完成的搜寻活动，同时突出了通过搜寻过程发现的趋势。 按遥测来源划分的检测结果 
$rule_pack_name = detection.detection.rule_set_display_name
$rule_name = detection.detection.rule_name
$vendor_name = detection.collection_elements.references.event.metadata.vendor_name
$product_name = detection.collection_elements.references.event.metadata.product_name

$vendor_name != ""
$product_name != ""

re.regex($rule_pack_name, `^Mandiant.*`)

match:
    $vendor_name, $product_name

outcome:
    $count = count_distinct(detection.id)

order:
    $count desc

limit:
    10
Mandiant Threat Defense 清晰展示 Mandiant 在您的环境中执行的主动威胁搜寻。其中详细介绍了正在进行和已完成的搜寻活动，同时突出了通过搜寻过程发现的趋势。 检测 
$rule_pack_name = detection.detection.rule_set_display_name
re.regex($rule_pack_name, `^Mandiant.*`)

outcome:
    $count = count_distinct(detection.id)
Mandiant Threat Defense 清晰展示 Mandiant 在您的环境中执行的主动威胁搜寻。其中详细介绍了正在进行和已完成的搜寻活动，同时突出了通过搜寻过程发现的趋势。 按检测次数排名的前 100 个主机 
$rule_pack_name = detection.detection.rule_set_display_name
$rule_name = detection.detection.rule_name
$hostname = group(detection.collection_elements.references.event.principal.hostname, detection.collection_elements.references.event.src.hostname, detection.collection_elements.references.event.target.hostname)

$hostname != ""

re.regex($rule_pack_name, `^Mandiant.*`)

match:
    $hostname

outcome:
    $count = count_distinct(detection.id)
    $unique_rules = count_distinct($rule_name)

order:
    $count desc

limit:
    100
Mandiant Threat Defense 清晰展示 Mandiant 在您的环境中执行的主动威胁搜寻。其中详细介绍了正在进行和已完成的搜寻活动，同时突出了通过搜寻过程发现的趋势。 检测次数最多的前 100 项资产 
$rule_pack_name = detection.detection.rule_set_display_name
$rule_name = detection.detection.rule_name
$asset_id = group(detection.collection_elements.references.event.principal.asset_id, detection.collection_elements.references.event.src.asset_id, detection.collection_elements.references.event.target.asset_id)

$asset_id != ""

re.regex($rule_pack_name, `^Mandiant.*`)

match:
    $asset_id

outcome:
    $count = count_distinct(detection.id)
    $unique_rules = count_distinct($rule_name)

order:
    $count desc

limit:
    100
Mandiant Threat Defense 清晰展示 Mandiant 在您的环境中执行的主动威胁搜寻。其中详细介绍了正在进行和已完成的搜寻活动，同时突出了通过搜寻过程发现的趋势。 检测次数最多的前 100 条规则 
$rule_pack_name = detection.detection.rule_set_display_name
$rule_name = detection.detection.rule_name
$asset_id = group(detection.collection_elements.references.event.principal.asset_id, detection.collection_elements.references.event.src.asset_id, detection.collection_elements.references.event.target.asset_id)

re.regex($rule_pack_name, `^Mandiant.*`)

match:
    $rule_name

outcome:
    $count = count_distinct(detection.id)
    $asset_count = count_distinct($asset_id)

order:
    $count desc

limit:
    100
Mandiant Threat Defense 清晰展示 Mandiant 在您的环境中执行的主动威胁搜寻。其中详细介绍了正在进行和已完成的搜寻活动，同时突出了通过搜寻过程发现的趋势。 按平台划分的检测结果 
$rule_pack_name = detection.detection.rule_set_display_name
$rule_name = detection.detection.rule_name
$platform = detection.collection_elements.references.event.principal.asset.platform_software.platform

$platform != "UNKNOWN_PLATFORM"

re.regex($rule_pack_name, `^Mandiant.*`)

match:
    $platform

outcome:
    $count = count_distinct(detection.id)

order:
    $count desc

limit:
    10
Mandiant Threat Defense 清晰展示 Mandiant 在您的环境中执行的主动威胁搜寻。其中详细介绍了正在进行和已完成的搜寻活动，同时突出了通过搜寻过程发现的趋势。 按事件类型划分的检测结果 
$rule_pack_name = detection.detection.rule_set_display_name
$rule_name = detection.detection.rule_name
$event_type = detection.collection_elements.references.event.metadata.event_type

re.regex($rule_pack_name, `^Mandiant.*`)

match:
    $event_type

outcome:
    $count = count_distinct(detection.id)

order:
    $count desc

limit:
    10
Mandiant Threat Defense 清晰展示 Mandiant 在您的环境中执行的主动威胁搜寻。其中详细介绍了正在进行和已完成的搜寻活动，同时突出了通过搜寻过程发现的趋势。 按检测次数排名的前 100 个网域 
$rule_pack_name = detection.detection.rule_set_display_name
$rule_name = detection.detection.rule_name

$domain = group(detection.collection_elements.references.event.principal.administrative_domain, detection.collection_elements.references.event.target.administrative_domain, detection.collection_elements.references.event.about.administrative_domain, detection.collection_elements.references.event.principal.asset.network_domain, detection.collection_elements.references.event.target.asset.network_domain, detection.collection_elements.references.event.about.asset.network_domain)

$domain != ""

re.regex($rule_pack_name, `^Mandiant.*`)

match:
    $domain

outcome:
    $count = count_distinct(detection.id)
    $unique_rules = count_distinct($rule_name)

order:
    $count desc

limit:
    100
Mandiant Threat Defense 清晰展示 Mandiant 在您的环境中执行的主动威胁搜寻。其中详细介绍了正在进行和已完成的搜寻活动，同时突出了通过搜寻过程发现的趋势。 最常见的 10 项 MITRE ATT&CK® 技术（对数刻度） 
$rule_pack_name = detection.detection.rule_set_display_name
$rule_name = detection.detection.rule_name

re.regex($rule_pack_name, `^Mandiant.*`)

$mitre_technique = if(detection.detection.rule_labels["technique"] = "", "Unassigned", detection.detection.rule_labels["technique"])

match:
    $mitre_technique

outcome:
    $count = count_distinct(detection.id)

order:
    $count desc

limit:
    10
NIST 800-53 - 访问权限控制 让您可以了解 NIST 800-53 访问权限控制趋势和地理位置风险。确保为图表创建 NIST_Compliance_Assets 参考列表，以加载和确定数据范围。 异常登录位置检测 
detection.collection_elements.references.event.security_result.action = "ALLOW"
detection.detection.rule_name = "Login from Country Never Before Seen for a User Group"

$Country = strings.coalesce(detection.collection_elements.references.event.principal.location.country_or_region, detection.collection_elements.references.event.principal.ip_geo_artifact.location.country_or_region)
$Rulename = detection.detection.rule_name
$User = strings.coalesce(detection.collection_elements.references.event.principal.user.userid,detection.collection_elements.references.event.principal.user.user_display_name,
detection.collection_elements.references.event.principal.user.email_addresses,detection.collection_elements.references.event.target.user.userid,detection.collection_elements.references.event.target.user.user_display_name,detection.collection_elements.references.event.target.user.email_addresses)

match:
     $User, $Rulename, $Country

outcome:
    $Count = count(detection.id)

order:
    $Count desc
NIST 800-53 - 访问权限控制 让您可以了解 NIST 800-53 访问权限控制趋势和地理位置风险。确保为图表创建 NIST_Compliance_Assets 参考列表，以加载和确定数据范围。 可疑登录活动 
detection.detection.rule_name = "Brute Force then Successful Login by User"

$Country = strings.coalesce(detection.collection_elements.references.event.principal.location.country_or_region, detection.collection_elements.references.event.principal.ip_geo_artifact.location.country_or_region)
$Rulename = detection.detection.rule_name
$User = strings.coalesce(detection.collection_elements.references.event.principal.user.userid,detection.collection_elements.references.event.principal.user.user_display_name,
detection.collection_elements.references.event.principal.user.email_addresses,detection.collection_elements.references.event.target.user.userid,detection.collection_elements.references.event.target.user.user_display_name,detection.collection_elements.references.event.target.user.email_addresses)

match:
     $User, $Rulename, $Country

outcome:
    $Count = count(detection.id)

order:
    $Count desc
网络流量概览 按 IP、协议、供应商提醒和区域实时监控云端和本地网络流量，从而有效分析流量和潜在问题 使用精选检测功能的用户 
detection.collection_elements.references.event.security_result.action = "ALLOW"

$Country = strings.coalesce(detection.collection_elements.references.event.principal.location.country_or_region, detection.collection_elements.references.event.principal.ip_geo_artifact.location.country_or_region)
$Rulename = detection.detection.rule_name
$Rulename = "Azure Multiple Geolocation Login Success" or $Rulename = "Login from Country Never Before Seen for a User Group"
$User = strings.coalesce(detection.collection_elements.references.event.principal.user.userid,detection.collection_elements.references.event.principal.user.user_display_name,
detection.collection_elements.references.event.principal.user.email_addresses,detection.collection_elements.references.event.target.user.userid,detection.collection_elements.references.event.target.user.user_display_name,detection.collection_elements.references.event.target.user.email_addresses)


match:
    $Country, $Rulename, $User, detection.collection_elements.references.event.metadata.event_type

outcome:
    $Count = count($Country)

order:
    $Count desc

limit:
    10
PCI - 提醒概览 提供有关可能影响 PCI 标准的潜在安全违规行为的提醒和分析洞见，并以整合视图的形式呈现。
注意：需要 PCI_ASSETS 参考列表才能正确加载和确定数据范围。		 按操作划分的随时间变化的提醒 
(detection.collection_elements.references.event.principal.hostname in %PCI_Assets or detection.collection_elements.references.event.principal.asset.hostname in %PCI_Assets or detection.collection_elements.references.event.target.hostname in %PCI_Assets or detection.collection_elements.references.event.target.asset.hostname in %PCI_Assets)

$Date = timestamp.get_date(detection.created_time.seconds)
$Action = detection.collection_elements.references.event.security_result.action

match:
    $Date,$Action

outcome:
    $Count = count(detection.id)

order:
    $Date asc
PCI - 提醒概览 提供有关可能影响 PCI 标准的潜在安全违规行为的提醒和分析洞见，并以整合视图的形式呈现。
注意：需要 PCI_ASSETS 参考列表才能正确加载和确定数据范围。		 按说明划分的活动 
(detection.collection_elements.references.event.principal.hostname in %PCI_Assets or detection.collection_elements.references.event.principal.asset.hostname in %PCI_Assets or detection.collection_elements.references.event.target.hostname in %PCI_Assets or detection.collection_elements.references.event.target.asset.hostname in %PCI_Assets)

$Event_Name = detection.collection_elements.references.event.metadata.event_type
$Description = strings.coalesce(detection.collection_elements.references.event.security_result.summary,detection.collection_elements.references.event.security_result.description,detection.collection_elements.references.event.metadata.description)
$Log_Type = detection.collection_elements.references.event.metadata.log_type
$Source_IP = strings.coalesce(detection.collection_elements.references.event.principal.ip, detection.collection_elements.references.event.principal.asset.ip)
$Destination_IP = strings.coalesce(detection.collection_elements.references.event.target.ip, detection.collection_elements.references.event.target.asset.ip)
$Action = detection.collection_elements.references.event.security_result.action
$Destination_Hostname = strings.coalesce(detection.collection_elements.references.event.target.hostname, detection.collection_elements.references.event.target.asset.hostname)
$File = detection.collection_elements.references.event.target.process.file.full_path
$User = strings.coalesce(detection.collection_elements.references.event.principal.user.userid, detection.collection_elements.references.event.principal.user.user_display_name, detection.collection_elements.references.event.principal.user.email_addresses, detection.collection_elements.references.event.target.user.userid, detection.collection_elements.references.event.target.user.user_display_name, detection.collection_elements.references.event.target.user.email_addresses)

match:
    $Description, $Event_Name,$User, $Source_IP, $Destination_IP, $Action, $Destination_Hostname, $File, $Log_Type

outcome:
    $Count = count(detection.collection_elements.references.event.metadata.id)

order:
    $Count desc
PCI - 提醒概览 提供有关可能影响 PCI 标准的潜在安全违规行为的提醒和分析洞见，并以整合视图的形式呈现。
注意：需要 PCI_ASSETS 参考列表才能正确加载和确定数据范围。		 10 大提醒 
(detection.collection_elements.references.event.principal.hostname in %PCI_Assets or detection.collection_elements.references.event.principal.asset.hostname in %PCI_Assets or detection.collection_elements.references.event.target.hostname in %PCI_Assets or detection.collection_elements.references.event.target.asset.hostname in %PCI_Assets)

$Rule_Name = detection.detection.rule_name
$Severity = detection.detection.severity

match:
    $Rule_Name,$Severity

outcome:
    $Count = count(detection.id)

order:
    $Count desc

limit:
    10
PCI - 提醒概览 提供有关可能影响 PCI 标准的潜在安全违规行为的提醒和分析洞见，并以整合视图的形式呈现。
注意：需要 PCI_ASSETS 参考列表才能正确加载和确定数据范围。		 生成提醒的前 10 位用户 
(detection.collection_elements.references.event.principal.hostname in %PCI_Assets or detection.collection_elements.references.event.principal.asset.hostname in %PCI_Assets or detection.collection_elements.references.event.target.hostname in %PCI_Assets or detection.collection_elements.references.event.target.asset.hostname in %PCI_Assets)

$User = strings.coalesce(detection.collection_elements.references.event.principal.user.userid,detection.collection_elements.references.event.principal.user.user_display_name,detection.collection_elements.references.event.principal.user.email_addresses,detection.collection_elements.references.event.target.user.userid, detection.collection_elements.references.event.target.user.user_display_name,detection.collection_elements.references.event.target.user.email_addresses)

match:
    $User

outcome:
    $Count = count(detection.id)

order:
    $Count desc

limit:
    10
PCI - 提醒概览 提供有关可能影响 PCI 标准的潜在安全违规行为的提醒和分析洞见，并以整合视图的形式呈现。
注意：需要 PCI_ASSETS 参考列表才能正确加载和确定数据范围。		 提醒数量 
(detection.collection_elements.references.event.principal.hostname in %PCI_Assets or detection.collection_elements.references.event.principal.asset.hostname in %PCI_Assets or detection.collection_elements.references.event.target.hostname in %PCI_Assets or detection.collection_elements.references.event.target.asset.hostname in %PCI_Assets)

outcome:
    $Count = count(detection.id)
PCI - 提醒概览 提供有关可能影响 PCI 标准的潜在安全违规行为的提醒和分析洞见，并以整合视图的形式呈现。
注意：需要 PCI_ASSETS 参考列表才能正确加载和确定数据范围。		 端点数量（生成提醒） 
(detection.collection_elements.references.event.principal.hostname in %PCI_Assets or detection.collection_elements.references.event.principal.asset.hostname in %PCI_Assets or detection.collection_elements.references.event.target.hostname in %PCI_Assets or detection.collection_elements.references.event.target.asset.hostname in %PCI_Assets)

$Hostname = strings.coalesce(detection.collection_elements.references.event.principal.hostname,detection.collection_elements.references.event.principal.asset.hostname,detection.collection_elements.references.event.target.hostname,detection.collection_elements.references.event.target.asset.hostname)

outcome:
    $Count = count_distinct($Hostname)
PCI - 提醒概览 提供有关可能影响 PCI 标准的潜在安全违规行为的提醒和分析洞见，并以整合视图的形式呈现。
注意：需要 PCI_ASSETS 参考列表才能正确加载和确定数据范围。		 排名前 10 的端点（生成提醒） 
(detection.collection_elements.references.event.principal.hostname in %PCI_Assets or detection.collection_elements.references.event.principal.asset.hostname in %PCI_Assets or detection.collection_elements.references.event.target.hostname in %PCI_Assets or detection.collection_elements.references.event.target.asset.hostname in %PCI_Assets)

$Hostname = strings.coalesce(detection.collection_elements.references.event.principal.hostname,detection.collection_elements.references.event.principal.asset.hostname,detection.collection_elements.references.event.target.hostname,detection.collection_elements.references.event.target.asset.hostname)

match:
    $Hostname

outcome:
    $Count = count(detection.id)

order:
    $Count desc

limit:
    10
PCI - 补丁管理 提供补丁管理生命周期的全面视图，帮助您有效监控和管理系统更新。
注意：需要加载 Patch_UPDATES 和 PCI_ASSETS 参考列表才能正确确定数据范围。		 系统未在 48 小时内更新 
strings.coalesce($event.detection.collection_elements.references.event.principal.asset.hostname, $event.detection.collection_elements.references.event.principal.hostname) in %PCI_Assets
$Rule_Name = $event.detection.detection.rule_name
$Rule_Name = "systems_not_updating_within_48_hours"
$Hostname = strings.coalesce($event.detection.collection_elements.references.event.principal.asset.hostname, $event.detection.collection_elements.references.event.principal.hostname)


match:
    $Hostname
limit:
    50
“规则检测”概览 提供检测规则和威胁模式分析，以提高可见性。您可以利用这些数据分析来评估规则效果，并加强突发事件响应。
注意：应用过滤条件是为了优化结果。		 按名称显示的规则检测随时间的变化 
$rulename = detection.detection.rule_name
$date = timestamp.get_date(detection.detection_time.seconds)
match:
    $rulename, $date
outcome:
    $detection_count = count_distinct(detection.id)
order:
    $date
“规则检测”概览 提供检测规则和威胁模式分析，以提高可见性。您可以利用这些数据分析来评估规则效果，并加强突发事件响应。
注意：应用过滤条件是为了优化结果。		 前 10 条有效规则 
$Rulename = detection.detection.rule_name

match:
    $Rulename

outcome:
    $Count = count_distinct(detection.id)

order:
    $Count desc

limit:
        10
“规则检测”概览 提供检测规则和威胁模式分析，以提高可见性。您可以利用这些数据分析来评估规则效果，并加强突发事件响应。
注意：应用过滤条件是为了优化结果。		 触发检测的前 10 大供应商产品 
$Product_Name = detection.collection_elements.references.event.metadata.product_name

match:
    $Product_Name

outcome:
    $Count = count(detection.id)

order:
    $Count desc

limit:
    10
“规则检测”概览 提供检测规则和威胁模式分析，以提高可见性。您可以利用这些数据分析来评估规则效果，并加强突发事件响应。
注意：应用过滤条件是为了优化结果。		 检测结果随时间的变化（按严重程度划分） 
$Severity = detection.detection.severity
$Date = timestamp.get_date(detection.detection_time.seconds)

match:
    $Date, $Severity

outcome:
    $Count = count_distinct(detection.id)

order:
    $Date asc
“规则检测”概览 提供检测规则和威胁模式分析，以提高可见性。您可以利用这些数据分析来评估规则效果，并加强突发事件响应。
注意：应用过滤条件是为了优化结果。		 检测结果（按严重程度） 
$Rulename = detection.detection.rule_name
$Severity = detection.detection.severity

match:
    $Rulename,$Severity

outcome:
    $Count = count_distinct(detection.id)

order:
    $Severity desc
“规则检测”概览 提供检测规则和威胁模式分析，以提高可见性。您可以利用这些数据分析来评估规则效果，并加强突发事件响应。
注意：应用过滤条件是为了优化结果。		 按规则检测次数排序的前 10 个 IP 地址 
$ip = group(
    detection.collection_elements.references.event.principal.ip,
    detection.collection_elements.references.event.target.ip,
    detection.collection_elements.references.event.src.ip
    )
$ip != ""
match:
  $ip
outcome:
  $count = count(detection.id)
order:
  $count desc
limit: 10
“规则检测”概览 提供检测规则和威胁模式分析，以提高可见性。您可以利用这些数据分析来评估规则效果，并加强突发事件响应。
注意：应用过滤条件是为了优化结果。		 按检测次数排序的前 10 个设备 
$Hostname = strings.coalesce(detection.collection_elements.references.event.principal.hostname, detection.collection_elements.references.event.principal.asset.hostname, detection.collection_elements.references.event.target.hostname,detection.collection_elements.references.event.target.asset.hostname)
$Severity = detection.detection.severity

match:
    $Hostname, $Severity

outcome:
    $Count = count(detection.id)

order:
    $Count desc

limit:
    10
“规则检测”概览 提供检测规则和威胁模式分析，以提高可见性。您可以利用这些数据分析来评估规则效果，并加强突发事件响应。
注意：应用过滤条件是为了优化结果。		 平均风险得分 
$Rule_Set = detection.detection.rule_set_display_name

match:
    $Rule_Set

outcome:
    $Detection_Count = count(detection.id)
    $Average_Risk_Score = math.round(sum(detection.detection.risk_score)/count(detection.id),2)

order:
    $Average_Risk_Score desc
“规则检测”概览 提供检测规则和威胁模式分析，以提高可见性。您可以利用这些数据分析来评估规则效果，并加强突发事件响应。
注意：应用过滤条件是为了优化结果。		 有风险的用户 
detection.detection.risk_score > 0
detection.collection_elements.references.event.principal.user.userid != ""
detection.collection_elements.references.event.metadata.product_name != ""

$User = detection.collection_elements.references.event.principal.user.userid
$Product_Name = detection.collection_elements.references.event.metadata.product_name

match:
    $User, $Product_Name

outcome:
    $Risk_Score = max(detection.detection.risk_score)
    $Count = count(detection.id)
    $First_Time_Seen = timestamp.get_timestamp(min(detection.collection_elements.references.event.metadata.event_timestamp.seconds))
    $Last_Time_Seen = timestamp.get_timestamp(max(detection.collection_elements.references.event.metadata.event_timestamp.seconds))

order:
    $Risk_Score desc, $Count desc
“规则检测”概览 提供检测规则和威胁模式分析，以提高可见性。您可以利用这些数据分析来评估规则效果，并加强突发事件响应。
注意：应用过滤条件是为了优化结果。		 按操作次数排序的前 10 个目标 IP 
$Destination_IP = strings.coalesce(detection.collection_elements.references.event.target.ip,detection.collection_elements.references.event.target.asset.ip)
$Action = detection.collection_elements.references.event.security_result.action

match:
    $Destination_IP,$Action

 outcome:
    $Count = count(detection.id)

order:
    $Count desc

limit:
    10
“规则检测”概览 提供检测规则和威胁模式分析，以提高可见性。您可以利用这些数据分析来评估规则效果，并加强突发事件响应。
注意：应用过滤条件是为了优化结果。		 最不活跃的 10 条规则 
$Rule_Name = detection.detection.rule_name

match:
    $Rule_Name

outcome:
    $Count = count_distinct(detection.id)

order:
    $Count asc

limit:
    10
“规则检测”概览 提供检测规则和威胁模式分析，以提高可见性。您可以利用这些数据分析来评估规则效果，并加强突发事件响应。
注意：应用过滤条件是为了优化结果。		 按供应商产品列出的前 10 大威胁签名 
$Threat_Signature = strings.coalesce(detection.collection_elements.references.event.security_result.threat_name, detection.detection.detection_fields["threat_signature"])

$Product_Name = detection.collection_elements.references.event.metadata.product_name

match:
    $Threat_Signature, $Product_Name

outcome:
    $Count = count(detection.id)

order:
    $Count desc

limit:
    10
“规则检测”概览 提供检测规则和威胁模式分析，以提高可见性。您可以利用这些数据分析来评估规则效果，并加强突发事件响应。
注意：应用过滤条件是为了优化结果。		 常见的 MITRE ATT&CK 技术和策略 
$Tactic_ID = detection.collection_elements.references.event.security_result.attack_details.tactics.id
$Tactic_Name = detection.collection_elements.references.event.security_result.attack_details.tactics.name
$Tactic_Name != ""
$Technique_Name = detection.collection_elements.references.event.security_result.attack_details.techniques.name
$Tectinque_ID = detection.collection_elements.references.event.security_result.attack_details.techniques.id
$Sub_Technique = detection.collection_elements.references.event.security_result.attack_details.techniques.subtechnique_name

match:
    $Tactic_Name, $Tactic_ID, $Technique_Name, $Tectinque_ID, $Sub_Technique

outcome:

    $Ruleset_Count = count_distinct(detection.detection.rule_set_display_name)
    $Count = count_distinct(detection.id)


order:
    $Count desc
“规则检测”概览 提供检测规则和威胁模式分析，以提高可见性。您可以利用这些数据分析来评估规则效果，并加强突发事件响应。
注意：应用过滤条件是为了优化结果。		 按检测次数排名的前 10 位用户 
$User = strings.coalesce(detection.collection_elements.references.event.principal.user.userid,detection.collection_elements.references.event.principal.user.user_display_name,
detection.collection_elements.references.event.principal.user.email_addresses,detection.collection_elements.references.event.target.user.userid,detection.collection_elements.references.event.target.user.user_display_name,detection.collection_elements.references.event.target.user.email_addresses)
$Severity = detection.detection.severity

match:
    $User, $Severity

 outcome:
    $Count = count(detection.id)

order:
    $Count desc

limit:
    10
“规则检测”概览 提供检测规则和威胁模式分析，以提高可见性。您可以利用这些数据分析来评估规则效果，并加强突发事件响应。
注意：应用过滤条件是为了优化结果。		 按规则检测次数排序的热门用户 
$user = group(
  detection.collection_elements.references.event.src.user.userid,
  detection.collection_elements.references.event.principal.user.userid,
  detection.collection_elements.references.event.target.user.userid
  )
$user != ""
match:
  $user
outcome:
  $count = count(detection.id)
order:
  $count desc
limit: 10
“规则检测”概览 提供检测规则和威胁模式分析，以提高可见性。您可以利用这些数据分析来评估规则效果，并加强突发事件响应。
注意：应用过滤条件是为了优化结果。		 按检测次数排序的前 10 个规则名称 
$rulename = detection.detection.rule_name
match:
    $rulename
outcome:
    $detection_count = count_distinct(detection.id)
order:
    $detection_count desc
limit:
    10
“规则检测”概览 提供检测规则和威胁模式分析，以提高可见性。您可以利用这些数据分析来评估规则效果，并加强突发事件响应。
注意：应用过滤条件是为了优化结果。		 按置信度水平检测 
$Rule_Name = detection.detection.rule_name
$Confidence_Level = detection.detection.confidence
$Risk_Score = detection.detection.risk_score
$Threat_Name = detection.collection_elements.references.event.security_result.threat_name
$Severity = detection.detection.severity

match:
   $Rule_Name,$Severity,$Risk_Score, $Confidence_Level,$Threat_Name

outcome:
   $Count = count_distinct(detection.id)

order:
    $Risk_Score desc
“规则检测”概览 提供检测规则和威胁模式分析，以提高可见性。您可以利用这些数据分析来评估规则效果，并加强突发事件响应。
注意：应用过滤条件是为了优化结果。		 活跃度排名前 10 的规则集 
$Ruleset = detection.detection.rule_set_display_name

match:
    $Ruleset

outcome:
    $Count = count_distinct(detection.id)

order:
    $Count desc

limit:
    10
“规则检测”概览 提供检测规则和威胁模式分析，以提高可见性。您可以利用这些数据分析来评估规则效果，并加强突发事件响应。
注意：应用过滤条件是为了优化结果。		 按操作排序的前 10 个来源 IP 
$Action = detection.collection_elements.references.event.security_result.action
$Source_IP = strings.coalesce(detection.collection_elements.references.event.principal.ip,detection.collection_elements.references.event.principal.asset.ip)


match:
    $Action, $Source_IP

 outcome:
    $Count = count(detection.id)

order:
    $Count desc

limit:
    10
“规则检测”概览 提供检测规则和威胁模式分析，以提高可见性。您可以利用这些数据分析来评估规则效果，并加强突发事件响应。
注意：应用过滤条件是为了优化结果。		 前 10 大威胁类别 
$Category = detection.collection_elements.references.event.security_result.category
$Category_Details= detection.collection_elements.references.event.security_result.category_details
$Threat_Name = detection.collection_elements.references.event.security_result.threat_name

match:
   $Category, $Category_Details

outcome:
    $Threat_Type = array_distinct($Threat_Name)
    $Count = count_distinct(detection.id)

order:
    $Count desc

limit:
    10
“规则检测”概览 提供检测规则和威胁模式分析，以提高可见性。您可以利用这些数据分析来评估规则效果，并加强突发事件响应。
注意：应用过滤条件是为了优化结果。		 按规则检测次数排名的前 10 个主机 
$host = group(detection.collection_elements.references.event.src.hostname,detection.collection_elements.references.event.principal.hostname,detection.collection_elements.references.event.target.hostname)
$host != ""
match:
  $host
outcome:
  $count = count(detection.id)
order:
  $count desc
limit: 10
“规则检测”概览 提供检测规则和威胁模式分析，以提高可见性。您可以利用这些数据分析来评估规则效果，并加强突发事件响应。
注意：应用过滤条件是为了优化结果。		 规则检测结果（按严重程度划分，随时间变化） 
$severity = detection.detection.rule_labels["severity"]
$severity != ""
$detection_time = timestamp.get_date(detection.detection_time.seconds)
match:
   $severity, $detection_time
outcome:
   $count = count_distinct(detection.id)

order:
    $detection_time
“规则检测”概览 提供检测规则和威胁模式分析，以提高可见性。您可以利用这些数据分析来评估规则效果，并加强突发事件响应。
注意：应用过滤条件是为了优化结果。		 规则检测随时间的变化 
$date = timestamp.get_date(detection.detection_time.seconds)
match:
    $date
outcome:
    $total=count_distinct(detection.id)
order:
    $date
“规则检测”概览 提供检测规则和威胁模式分析，以提高可见性。您可以利用这些数据分析来评估规则效果，并加强突发事件响应。
注意：应用过滤条件是为了优化结果。		 至少 10 个有效规则集 
$Rule_Set = detection.detection.rule_set_display_name

match:
    $Rule_Set

outcome:
    $Count = count_distinct(detection.id)

order:
    $Count asc

limit:
    10
“规则检测”概览 提供检测规则和威胁模式分析，以提高可见性。您可以利用这些数据分析来评估规则效果，并加强突发事件响应。
注意：应用过滤条件是为了优化结果。		 按严重程度划分的规则检测 
$severity = detection.detection.rule_labels["severity"]
$severity != ""
match:
   $severity
outcome:
   $count = count_distinct(detection.id)
“规则检测”概览 提供检测规则和威胁模式分析，以提高可见性。您可以利用这些数据分析来评估规则效果，并加强突发事件响应。
注意：应用过滤条件是为了优化结果。		 存在风险的资产 
detection.detection.risk_score > 0
detection.collection_elements.references.event.principal.hostname != ""
detection.collection_elements.references.event.metadata.product_name != ""

$Hostname = detection.collection_elements.references.event.principal.hostname
$IP_Address = detection.collection_elements.references.event.principal.ip
$Product_Name = detection.collection_elements.references.event.metadata.product_name

match:
    $Hostname, $IP_Address, $Product_Name

outcome:
    $Risk_Score = max(detection.detection.risk_score)
    $Count = count(detection.id)
    $First_Time_Seen = timestamp.get_timestamp(min(detection.collection_elements.references.event.metadata.event_timestamp.seconds))
    $Last_Time_Seen = timestamp.get_timestamp(max(detection.collection_elements.references.event.metadata.event_timestamp.seconds))

order:
    $Risk_Score desc, $Count desc
规则可观测性 此信息中心展示了规则执行所发出的底层指标。 P50 注入延迟时间（分钟） 
detection.type = "RULE_DETECTION"
detection.latency_metrics.newest_ingestion_time.seconds - detection.latency_metrics.newest_event_time.seconds < 3600
$rule_id = detection.detection.rule_id
$rule_name = detection.detection.rule_name

//detection.detection.rule_type = "MULTI_EVENT"

$did = detection.id
$day = timestamp.get_date(detection.created_time.seconds)


detection.latency_metrics.newest_ingestion_time.seconds != 0
detection.latency_metrics.newest_event_time.seconds != 0


match:
    $day
outcome:
    $p50_ingest_to_detection_delay = math.round(window.percentile(detection.latency_metrics.newest_ingestion_time.seconds - detection.latency_metrics.newest_event_time.seconds, 50) /60, 2)

order:
    $p50_ingest_to_detection_delay desc
规则可观测性 此信息中心展示了规则执行所发出的底层指标。 每次检测的延迟时间数据 - 前 20 名 
$detect_id = detection.id
$rule_name = detection.detection.rule_name
$rule_id = detection.detection.rule_id
$detectionTime = detection.created_time.seconds

detection.type = "RULE_DETECTION"

detection.latency_metrics.newest_ingestion_time.seconds != 0
detection.latency_metrics.newest_event_time.seconds != 0

detection.collection_elements.references.event.metadata.log_type != ""
$logType = detection.collection_elements.references.event.metadata.log_type

match:
  $rule_name, $detect_id

outcome:
  $ingestion_deleay = math.round( (max(detection.latency_metrics.newest_ingestion_time.seconds) - max(detection.latency_metrics.newest_event_time.seconds)) / 60, 1)
  $ingestion_to_detection = math.round((max(detection.created_time.seconds) - max(detection.latency_metrics.newest_ingestion_time.seconds)) / 60, 1)
  $event_to_deteciton = math.round((max(detection.created_time.seconds) - max(detection.latency_metrics.newest_event_time.seconds)) / 60, 1)

order:
  $ingestion_to_detection desc

limit:
  20
规则可观测性 此信息中心展示了规则执行所发出的底层指标。 从提取到检测的 P50 延迟时间（分钟） 
detection.type = "RULE_DETECTION"
detection.latency_metrics.newest_ingestion_time.seconds - detection.latency_metrics.newest_event_time.seconds < 3600
$rule_id = detection.detection.rule_id
$rule_name = detection.detection.rule_name

//detection.detection.rule_type = "MULTI_EVENT"

$did = detection.id
$day = timestamp.get_date(detection.created_time.seconds)

detection.created_time.seconds != 0
detection.latency_metrics.newest_ingestion_time.seconds != 0
detection.latency_metrics.newest_event_time.seconds != 0


match:
    $day
outcome:
    $p50_ingest_to_detection_delay = math.round(window.percentile(detection.created_time.seconds - detection.latency_metrics.newest_ingestion_time.seconds, 50) /60, 1)

order:
    $p50_ingest_to_detection_delay desc
规则可观测性 此信息中心展示了规则执行所发出的底层指标。 检测延迟 
detection.type = "RULE_DETECTION"
//$rule_id = detection.detection.rule_id
$rule_type = detection.detection.rule_type
$rule_name = detection.detection.rule_name
$rule_freq = detection.rule_run_frequency

//detection.detection.rule_type = "MULTI_EVENT"

detection.latency_metrics.newest_ingestion_time.seconds != 0
detection.latency_metrics.newest_event_time.seconds != 0
detection.created_time.seconds != 0

$did = detection.id

match:
    $rule_name, $rule_freq, $rule_type
outcome:
    $detect_count = count_distinct($did)

    $avg_ingest_delay = math.round(window.percentile(detection.latency_metrics.newest_ingestion_time.seconds - detection.latency_metrics.newest_event_time.seconds, 50) / 60, 2)
    $p50_ingest_to_detection_delay = math.round(window.percentile(detection.created_time.seconds - detection.latency_metrics.newest_ingestion_time.seconds, 50) /60, 1)
    $p90_ingest_to_detection_delay = math.round(window.percentile(detection.created_time.seconds - detection.latency_metrics.newest_ingestion_time.seconds, 90) /60, 1)

    $p50_event_to_detection_delay = math.round(window.percentile(detection.created_time.seconds - detection.latency_metrics.newest_event_time.seconds, 50) / 60, 1)
    $p90_event_to_detection_delay = math.round(window.percentile(detection.created_time.seconds - detection.latency_metrics.newest_event_time.seconds, 90) /60, 1)

order:
    $p50_ingest_to_detection_delay desc
规则可观测性 此信息中心展示了规则执行所发出的底层指标。 P90 从提取到检测的延迟时间（分钟） 
detection.type = "RULE_DETECTION"
$rule_id = detection.detection.rule_id
$rule_name = detection.detection.rule_name


$did = detection.id
$day = timestamp.get_date(detection.created_time.seconds)

detection.latency_metrics.newest_ingestion_time.seconds != 0
detection.latency_metrics.newest_event_time.seconds != 0
detection.created_time.seconds != 0

match:
    $day
outcome:
    $p90_ingest_to_detection_delay = math.round(window.percentile(detection.created_time.seconds - detection.latency_metrics.newest_ingestion_time.seconds, 90) /60, 1)

order:
    $p90_ingest_to_detection_delay desc
规则可观测性 此信息中心展示了规则执行所发出的底层指标。 按时间（主要或重放）划分的检测次数详情 
$detection_timing_details = detection.detection_timing_details
$detection_id = detection.id
detection.created_time.seconds != 0
$day = timestamp.get_date(detection.created_time.seconds)
$detection_type = detection.type

match:
    $day, $detection_timing_details

outcome:
    $total_detections = count_distinct($detection_id)


order:
    $day desc
安全管理概览 提供有关支持请求活动和突发事件趋势的关键指标，帮助领导者监控安全进度。利用这些分析洞见来识别风险，并推动数据驱动的安全有效性改进。 观测到的威胁活动 - 过去 7 天 
detection.detection.rule_name = /ioc/ nocase

$Threat_Campaign = detection.collection_elements.references.entity.metadata.threat.campaigns
$Threat_Campaign != ""

match:
    $Threat_Campaign

outcome:
    $Count = count_distinct(detection.id)

order:
    $Count desc
安全管理概览 提供有关支持请求活动和突发事件趋势的关键指标，帮助领导者监控安全进度。利用这些分析洞见来识别风险，并推动数据驱动的安全有效性改进。 观察到的威胁行为者 - 过去 7 天 
detection.detection.rule_name = /ioc/ nocase

$Threat_Actor = detection.collection_elements.references.entity.metadata.threat.associations.name
$Threat_Actor != ""

match:
    $Threat_Actor

outcome:
    $Count = count_distinct(detection.id)

order:
    $Count desc
安全管理概览 提供有关支持请求活动和突发事件趋势的关键指标，帮助领导者监控安全进度。利用这些分析洞见来识别风险，并推动数据驱动的安全有效性改进。 
detection.detection.alert_state = "ALERTING"

outcome:
    $total = count_distinct(detection.id)
安全管理概览 提供有关支持请求活动和突发事件趋势的关键指标，帮助领导者监控安全进度。利用这些分析洞见来识别风险，并推动数据驱动的安全有效性改进。 
outcome:
    $Count = count_distinct(detection.id)
安全状况管理 提供威胁、突发事件和漏洞的实时概览，包括检测和资产监控。它可帮助安全团队评估风险状况，并实施有效的补救策略来简化突发事件响应。 针对组织的前 10 大威胁行为者 
detection.detection.rule_name = /ioc/ nocase

$Threat_Actor = detection.collection_elements.references.entity.metadata.threat.associations.name
$Threat_Actor != ""
match:
    $Threat_Actor

outcome:
    $Count = count(detection.id)

order:
    $Count desc

limit:
    10
安全状况管理 提供威胁、突发事件和漏洞的实时概览，包括检测和资产监控。它可帮助安全团队评估风险状况，并实施有效的补救策略来简化突发事件响应。 UEBA 提醒 
detection.detection.ruleset_category_display_name = "Risk Analytics for UEBA"
detection.detection.alert_state = "ALERTING"

$Rule_Name = detection.detection.rule_name
$Hostname = strings.coalesce(detection.collection_elements.references.event.principal.hostname, detection.collection_elements.references.event.principal.asset.hostname, detection.collection_elements.references.event.target.hostname, detection.collection_elements.references.event.target.asset.hostname)
$User = strings.coalesce(detection.collection_elements.references.event.principal.user.user_display_name, detection.collection_elements.references.event.principal.user.email_addresses, detection.collection_elements.references.event.principal.user.userid,detection.collection_elements.references.event.target.user.user_display_name, detection.collection_elements.references.event.target.user.email_addresses, detection.collection_elements.references.event.target.user.userid)

match:
  $Rule_Name, $Hostname, $User

outcome:
  $Count = count(detection.id)

order:
  $Count desc
安全状况管理 提供威胁、突发事件和漏洞的实时概览，包括检测和资产监控。它可帮助安全团队评估风险状况，并实施有效的补救策略来简化突发事件响应。 一段时间内的检测结果 
$Date = timestamp.get_date(detection.created_time.seconds)

match:
    $Date

outcome:
    $Detection_Count = count(detection.id)

order:
    $Date asc
安全状况管理 提供威胁、突发事件和漏洞的实时概览，包括检测和资产监控。它可帮助安全团队评估风险状况，并实施有效的补救策略来简化突发事件响应。 检测结果（按严重程度划分） 
$Rule_Name = detection.detection.rule_name
$Severity = detection.collection_elements.references.event.security_result.severity

match:
    $Severity, $Rule_Name

outcome:
    $Detection_Count = count(detection.id)

order:
    $Severity desc
安全状况管理 提供威胁、突发事件和漏洞的实时概览，包括检测和资产监控。它可帮助安全团队评估风险状况，并实施有效的补救策略来简化突发事件响应。 按名称排序的前 10 项检测结果 
$Rule_Name = detection.detection.rule_name

match:
    $Rule_Name

outcome:
    $Detection_Count = count(detection.id)

order:
    $Detection_Count desc

limit:
    10
安全状况管理 提供威胁、突发事件和漏洞的实时概览，包括检测和资产监控。它可帮助安全团队评估风险状况，并实施有效的补救策略来简化突发事件响应。 前 10 大云端提醒 
detection.detection.ruleset_category_display_name = "Cloud Threats"
detection.detection.alert_state = "ALERTING"

$Rule_Name = detection.detection.rule_name
$Targeted_Resources = strings.coalesce(detection.collection_elements.references.event.target.application, detection.collection_elements.references.event.target.resource.name)
$User = strings.coalesce(detection.collection_elements.references.event.principal.user.user_display_name, detection.collection_elements.references.event.principal.user.email_addresses, detection.collection_elements.references.event.principal.user.userid,detection.collection_elements.references.event.target.user.user_display_name, detection.collection_elements.references.event.target.user.email_addresses, detection.collection_elements.references.event.target.user.userid)

match:
  $Rule_Name, $Targeted_Resources, $User

outcome:
  $Count = count(detection.id)

order:
  $Count desc

limit:
      10
安全状况管理 提供威胁、突发事件和漏洞的实时概览，包括检测和资产监控。它可帮助安全团队评估风险状况，并实施有效的补救策略来简化突发事件响应。 以组织为定位对象的 10 个效果最好的广告系列 
detection.detection.rule_name = /ioc/ nocase

$Threat_Campaign = detection.collection_elements.references.entity.metadata.threat.campaigns
$Threat_Campaign != ""
match:
    $Threat_Campaign

outcome:
    $Count = count(detection.id)

order:
    $Count desc

limit:
    10
安全状况管理 提供威胁、突发事件和漏洞的实时概览，包括检测和资产监控。它可帮助安全团队评估风险状况，并实施有效的补救策略来简化突发事件响应。 按检测次数排序的前 10 个主机 
$Rule_Name = detection.detection.rule_name
$Hostname = strings.coalesce(detection.collection_elements.references.event.principal.hostname, detection.collection_elements.references.event.principal.asset.hostname, detection.collection_elements.references.event.target.hostname, detection.collection_elements.references.event.target.asset.hostname)
$Hostname != ""
match:
    $Hostname

outcome:
    $Detection_Count = count_distinct(detection.id)

order:
    $Detection_Count desc

limit:
    10
威胁情报概览 提供有关 IOC 和风险得分的实时数据洞见，以便更快地检测新兴的基础设施威胁。 按检测次数细分的威胁活动 
detection.detection.rule_name = /ioc/ nocase
detection.collection_elements.references.entity.metadata.threat.campaigns !=""

$Rule_Name = detection.detection.rule_name
$Campaigns = detection.collection_elements.references.entity.metadata.threat.campaigns
$Campaigns != ""
match:
    $Campaigns, $Rule_Name

outcome:
    $Count = count(detection.id)

order:
    $Count desc
威胁情报概览 提供有关 IOC 和风险得分的实时数据洞见，以便更快地检测新兴的基础设施威胁。 按威胁行为者划分的检测结果随时间的变化趋势 
detection.detection.rule_name = /ioc/
detection.collection_elements.references.entity.metadata.threat.associations.type = "THREAT_ACTOR"

$Date = timestamp.get_date(detection.collection_elements.references.entity.metadata.event_metadata.event_timestamp.seconds)
$Threat_Actor = detection.collection_elements.references.entity.metadata.threat.associations.name
$Threat_Actor != ""
match:
    $Date, $Threat_Actor

outcome:
    $Count = count(detection.id)

order:
    $Count asc
威胁情报概览 提供有关 IOC 和风险得分的实时数据洞见，以便更快地检测新兴的基础设施威胁。 检测随时间的变化（按 IOC 类型） 
detection.detection.rule_name = /ioc/ nocase

$Date = timestamp.get_date(detection.collection_elements.references.entity.metadata.event_metadata.event_timestamp.seconds)
$IOC_Type = detection.collection_elements.references.entity.metadata.entity_type

match:
    $Date , $IOC_Type

outcome:
    $Count = count(detection.id)

order:
    $Count desc
威胁情报概览 提供有关 IOC 和风险得分的实时数据洞见，以便更快地检测新兴的基础设施威胁。 按检测次数列出的威胁行为者 
detection.detection.rule_name = /ioc/ nocase
detection.collection_elements.references.entity.metadata.threat.associations.type = "THREAT_ACTOR"

$Rule_Name = detection.detection.rule_name
$Threat_Actor = detection.collection_elements.references.entity.metadata.threat.associations.name
$Threat_Actor != ""
match:
    $Threat_Actor, $Rule_Name

outcome:
    $Count = count(detection.id)

order:
    $Count desc
用户生命周期审核 提供用户账号管理活动的详细视图。这有助于确保在整个用户生命周期内遵循配置和取消配置政策。
注意：应用过滤条件可优化结果。		 近期休眠的账号 
detection.collection_elements.references.event.metadata.event_type = "USER_LOGIN"

$User = strings.coalesce(detection.collection_elements.references.event.target.user.email_addresses, detection.collection_elements.references.event.target.user.userid, detection.collection_elements.references.event.target.user.windows_sid)
$User != ""

match:
    $User

outcome:
    $Last_Login_Time = max(detection.collection_elements.references.event.metadata.event_timestamp.seconds)
    $Last_Login_Timestamp = timestamp.get_timestamp($Last_Login_Time, "%F %T ")
    $Days_Since_Login = math.round((timestamp.current_seconds() - $Last_Login_Time )/ 86400)
    $Status = if($Last_Login_Time != 0 AND ($Days_Since_Login >= 180), "Dormant Account (≥180 Days)", if($Last_Login_Time != 0 AND ($Days_Since_Login >= 90), "Dormant Account (≥90 Days)", "Recently Dormant Account"))

order:
    $Days_Since_Login desc

unselect:
    $Last_Login_Time

需要更多帮助？获得社区成员和 Google SecOps 专业人士的解答。