查詢規則和偵測項目

支援的國家/地區：

本文適用於安全營運中心 (SOC) 管理員和分析師，他們希望使用精選的儀表板監控威脅情勢和系統健康狀態。這些儀表板是預先定義的，可讓您掌握各種安全用途的資訊。這份文件提供精選的資訊主頁，以及 SOAR 案件來源類型的基礎查詢。

您可以在查詢編輯器中使用這些查詢，或將其做為自訂小工具的基準。 如要瞭解如何建立及管理資訊主頁，請參閱「管理資訊主頁」。

資訊主頁名稱 說明 圖表名稱 查詢
ISO 27001 - 技術控制 清楚掌握技術控管措施和加密標準，有助於遵循法規和根據資料進行補救。
注意：套用篩選器可縮小資料範圍。		 依資料來源顯示的快訊趨勢 
$Date = timestamp.get_date(detection.created_time.seconds)

match:
    $Date

outcome:
    $Count = count(detection.id)

order:
    $Date desc
ISO 27001 - 技術控制 清楚掌握技術控管措施和加密標準，有助於遵循法規和根據資料進行補救。
注意：套用篩選器可縮小資料範圍。		 前 10 項高風險資產 
detection.detection.risk_score > 0
detection.collection_elements.references.event.principal.hostname != ""
detection.collection_elements.references.event.metadata.product_name != ""
detection.collection_elements.references.event.principal.ip != ""

$Hostname = detection.collection_elements.references.event.principal.hostname
$IP_Address = detection.collection_elements.references.event.principal.ip
$Product_Name = detection.collection_elements.references.event.metadata.product_name

match:
    $Hostname, $IP_Address, $Product_Name

outcome:
    $Risk_Score = max(detection.detection.risk_score)
    $First_Time_Seen = timestamp.get_timestamp(min(detection.collection_elements.references.event.metadata.event_timestamp.seconds))
    $Last_Time_Seen = timestamp.get_timestamp(max(detection.collection_elements.references.event.metadata.event_timestamp.seconds))

order:
    $Risk_Score desc

limit:
    10
Chrome Enterprise 進階版安全性總覽 即時深入瞭解 Chrome 相關安全性事件，包括機密資料傳輸、惡意軟體嘗試和密碼安全性問題。 Chrome 風險精選偵測規則套件的偵測結果 
detection.detection.ruleset_category_display_name = "Chrome Enterprise Premium Threats"

$Rule_Name = detection.detection.rule_name
$User = strings.coalesce(detection.detection.outcomes["victim_name"], detection.detection.outcomes["victim_netid"], detection.collection_elements.references.event.principal.user.userid, detection.collection_elements.references.event.principal.user.user_display_name, detection.collection_elements.references.event.principal.user.email_addresses, detection.collection_elements.references.event.target.user.userid, detection.collection_elements.references.event.target.user.user_display_name, detection.collection_elements.references.event.target.user.email_addresses)
$Hostname = strings.coalesce(detection.detection.outcomes["hostname"], detection.collection_elements.references.event.principal.hostname, detection.collection_elements.references.event.principal.asset.product_object_id)
$IP = strings.coalesce(detection.collection_elements.references.event.principal.ip, detection.collection_elements.references.event.about.ip)
$Severity = detection.detection.severity
$File = strings.coalesce(detection.collection_elements.references.event.target.file.full_path, detection.collection_elements.references.event.target.resource.name, detection.collection_elements.references.event.target.url, detection.detection.outcomes["url"])
$Risk_Score = detection.detection.outcomes["risk_score"]
$Threat_Name = detection.collection_elements.references.event.security_result.threat_name

match:
    $User, $Rule_Name, $Hostname, $IP, $File, $Risk_Score, $Severity, $Threat_Name

outcome:
    $Description = array_distinct(detection.detection.description)
    $Count = count(detection.id)

order:
    $Severity, $Count desc
Cloud Key Management 總覽 集中控管雲端金鑰管理，包括密碼和憑證。您可以運用這些深入分析追蹤生命週期變化，並偵測未經授權的活動。 一段時間內的快訊 
detection.detection.ruleset_category_display_name = "Cloud Threats"
detection.detection.alert_state = "ALERTING"
detection.detection.rule_name = /Secrets|Key|KMS/ nocase

$Date = timestamp.get_date(detection.collection_elements.references.event.metadata.event_timestamp.seconds)
$Rule_Name = detection.detection.rule_name

match:
  $Date, $Rule_Name

outcome:
  $Count = count(detection.id)

order:
  $Date desc
雲端安全防護機制總覽 追蹤 Google Cloud、AWS 和 Azure 的重要指標，提供雲端安全狀態深入分析。 Google Cloud 隨時間推移的偵測趨勢 
$log_type = detection.collection_elements.references.event.metadata.log_type
$log_type = /GCP|AWS|AZURE/
$date = timestamp.get_date(detection.created_time.seconds)
match:
$date
outcome:
$event_count = count(detection.id)
order:
$date asc
雲端安全防護機制總覽 追蹤 Google Cloud、AWS 和 Azure 的重要指標，提供雲端安全狀態深入分析。 Google Cloud 依類別分類的偵測結果 
$log_type = detection.collection_elements.references.event.metadata.log_type
$log_type = /GCP|AWS|AZURE/
$category = detection.collection_elements.references.event.security_result.category
match:
$category
outcome:
$event_count = count(detection.id)
order:
$event_count desc
雲端安全防護機制總覽 追蹤 Google Cloud、AWS 和 Azure 的重要指標，提供雲端安全狀態深入分析。 Google Cloud 依嚴重程度分類的偵測項目 
$log_type = detection.collection_elements.references.event.metadata.log_type
$log_type = /AWS|GCP|AZURE/
$severity = detection.collection_elements.references.event.security_result.severity
match:
$severity
outcome:
$event_count = count(detection.id)
order:
$event_count desc
雲端安全防護機制總覽 追蹤 Google Cloud、AWS 和 Azure 的重要指標，提供雲端安全狀態深入分析。 Google Cloud 成效最佳的資產位置 
$log_type = detection.collection_elements.references.event.metadata.log_type
$log_type = /AWS|GCP|AZURE/
$resource = detection.collection_elements.references.event.target.resource.name
$location = detection.collection_elements.references.event.principal.ip_geo_artifact.location.country_or_region
match:
$location
outcome:
$event_count = count($resource)
$latitude = max(detection.collection_elements.references.event.principal.ip_geo_artifact.location.region_latitude)
$longitude = max(detection.collection_elements.references.event.principal.ip_geo_artifact.location.region_longitude)
order:
$event_count desc
雲端安全防護機制總覽 追蹤 Google Cloud、AWS 和 Azure 的重要指標，提供雲端安全狀態深入分析。 Google Cloud 前 10 項受影響的資源 
$log_type = detection.collection_elements.references.event.metadata.log_type
$log_type = /AWS|GCP|AZURE/
$targeted_resources = detection.collection_elements.references.event.target.resource.name
$targeted_resources != ""
match:
$targeted_resources
outcome:
$event_count = count($targeted_resources)
order:
$event_count desc
limit : 10
雲端安全防護機制總覽 追蹤 Google Cloud、AWS 和 Azure 的重要指標，提供雲端安全狀態深入分析。 Google Cloud 前 10 大偵測項目 
$log_type = detection.collection_elements.references.event.metadata.log_type
$log_type = /GCP|AWS|AZURE/
$rule_name = detection.detection.rule_name
$rule_name != ""
match:
$rule_name
outcome:
$event_count = count(detection.id)
order:
$event_count desc
limit:
10
雲端安全防護機制總覽 追蹤 Google Cloud、AWS 和 Azure 的重要指標，提供雲端安全狀態深入分析。 Google Cloud 前 10 名觸發者 
$log_type = detection.collection_elements.references.event.metadata.log_type
$log_type = /GCP|AWS|AZURE/
$user= detection.collection_elements.references.event.principal.user.userid
$user != ""
match:
$user
outcome:
$event_count = count(detection.collection_elements.references.event.metadata.id)
order:
$event_count desc
limit:
10
雲端安全防護機制總覽 追蹤 Google Cloud、AWS 和 Azure 的重要指標，提供雲端安全狀態深入分析。 Google Cloud 依偵測類別劃分的嚴重程度分布 
$log_type = detection.collection_elements.references.event.metadata.log_type
$log_type = /GCP|AWS|AZURE/
$category = detection.collection_elements.references.event.security_result.category
$severity = detection.collection_elements.references.event.security_result.severity
match:
$severity,$category
outcome:
$event_count = count(detection.id)
order:
$event_count desc
Cloud Storage 服務總覽 可掌握雲端儲存空間活動和權限變更，協助團隊監控警示並維持資料完整性。您可以運用這些深入分析追蹤頂尖使用者，並找出異常存取模式。 一段時間內的快訊 
detection.detection.ruleset_category_display_name = "Cloud Threats"
(detection.tags = /T1530|T1567.002/
or detection.detection.rule_name = /storage|blob|bucket/ nocase)
detection.detection.alert_state = "ALERTING"

$Date = timestamp.get_date(detection.collection_elements.references.event.metadata.event_timestamp.seconds)
$Rule_Name = detection.detection.rule_name

match:
  $Date, $Rule_Name

outcome:
  $Count = count(detection.id)

order:
  $Date desc
資料擷取與健康狀態 提供擷取輸送量和錯誤計數的相關資訊，協助團隊快速找出資料流問題。您可以使用這些指標監控記錄檔分配情形，確保作業穩定性。 規則 
$a = rules.name
match: $a
GDPR 資料治理 可掌握歐盟地區的資料存取情況，包括存取趨勢、非歐盟地區的存取嘗試，以及熱門地理位置。這項功能有助於監控 GDPR 法規的遵循情況、偵測未經授權的資料存取行為，並確保歐盟資料的處理方式安全無虞。注意：套用篩選器即可顯示相關結果。 使用者異常資料轉移 
strings.coalesce(detection.collection_elements.references.event.principal.location.country_or_region, detection.collection_elements.references.event.principal.ip_geo_artifact.location.country_or_region, detection.collection_elements.references.event.principal.location.name)
  = /Austria|Belgium|Bulgaria|Croatia|Cyprus|Czechia|Denmark|Estonia|Finland|France|Germany|Greece|Hungary|Ireland|Italy|Latvia|Lithuania|Luxembourg|Malta|Netherlands|Poland|Portugal|Romania|Slovakia|Slovenia|Spain|Sweden|eu-(west-1|west-3|central-1|north-1|south-1|south-2)|europe-(west1|west3|west4|west8|west9|west10|west12|central2|north1|north2|southwest1)|austriaeast|denmarkeast|francecentral|germanywestcentral|greececentral|italynorth|northeurope|spaincentral|swedencentral|westeurope|polandcentral/ nocase

$Rule_Set = detection.detection.rule_set
$Rule_Set = "Anomalous Total Bytes by User"
$Employee_Name = strings.coalesce(detection.collection_elements.references.event.principal.user.userid,detection.collection_elements.references.event.principal.user.user_display_name,
detection.collection_elements.references.event.principal.user.email_addresses)
$Employee_ID = detection.collection_elements.references.event.principal.user.employee_id
$Empolyee_Namespace = detection.collection_elements.references.event.principal.namespace

match:
   $Employee_Name ,$Employee_ID, $Empolyee_Namespace,  $Rule_Set

outcome:
    $Count = count_distinct(detection.id)

order:
    $Count Desc
身分與存取權管理安全作業 每日監控的概要總覽。這項服務著重於即時異常狀況、現有威脅和高風險事件，可快速偵測及回應事件。視需要使用篩選器縮小結果範圍。 一段時間內的 IAM 快訊 
detection.detection.rule_set_display_name = "Admin Action"
or detection.detection.rule_set_display_name = "Potential Workspace Account Compromise"
or detection.detection.rule_set_display_name = "Suspicious Workspace Administrative Actions"
or detection.detection.rule_set_display_name = "AWS - Identity"
or detection.detection.rule_set_display_name = "AWS - Organization"
or detection.detection.rule_set_display_name = "Azure - Identity"
or detection.detection.rule_set_display_name = "Azure - Organization"
or detection.detection.rule_set_display_name = "IAM Abuse"
or detection.detection.rule_set_display_name = "New Login by User to Device"
or detection.detection.rule_set_display_name = "Anomalous Authentication Events by User"
or detection.detection.rule_set_display_name = "Failed Authentications by Device"
or detection.detection.rule_set_display_name = "Failed Authentications by User"
or detection.detection.rule_set_display_name = "Anomalous Inbound Bytes by User"
or detection.detection.rule_set_display_name = "Anomalous Total Bytes by User"
or detection.detection.rule_set_display_name = "Brute Force then Successful Login by User"
or detection.detection.rule_set_display_name = "Anomalous or Excessive Logins for a Newly Created User"
or detection.detection.rule_set_display_name = "Anomalous or Excessive Suspicious Actions for a Newly Created User"
or detection.detection.rule_set_display_name = "Excessive Alerts by User"
detection.detection.alert_state = "ALERTING"

$Date = timestamp.get_date(detection.collection_elements.references.event.metadata.event_timestamp.seconds)
$Rule_Name = detection.detection.rule_name

match:
    $Date, $Rule_Name

outcome:
    $Count = count(detection.id)

order:
    $Date desc
ISO 27001 - 機構控制措施 根據 ISO 27001 標準，提供機構安全控管措施和法規遵循成效的相關資訊。有助於追蹤稽核結果，並找出需要改進的地方。
注意：套用篩選器可縮小結果範圍。		 近期偵測到的雲端威脅 
detection.detection.ruleset_category_display_name = "Cloud Threats"

$Date = timestamp.get_timestamp(detection.collection_elements.references.event.metadata.event_timestamp.seconds)
$Rule_Name = detection.detection.rule_name
$User = strings.coalesce(detection.collection_elements.references.event.principal.user.userid, detection.collection_elements.references.event.principal.user.email_addresses)
$Source_IP = strings.coalesce(detection.collection_elements.references.event.principal.asset.ip, detection.collection_elements.references.event.principal.ip)
$Host = strings.coalesce(detection.collection_elements.references.event.principal.asset.hostname, detection.collection_elements.references.event.principal.hostname)

match:
    $Date, $Rule_Name, $User, $Source_IP, $Host

order:
    $Date desc
ISO 27001 - 機構控制措施 根據 ISO 27001 標準，提供機構安全控管措施和法規遵循成效的相關資訊。有助於追蹤稽核結果，並找出需要改進的地方。
注意：套用篩選器可縮小結果範圍。		 一段時間內依嚴重性分組的快訊 
$Date = timestamp.get_date(detection.created_time.seconds)
$Severity = detection.collection_elements.references.event.security_result.severity
$Severity != "UNKNOWN_SEVERITY"

match:
    $Date, $Severity

outcome:
    $Count = count(detection.id)

order:
    $Date desc
寄生攻擊活動 深入瞭解 Rundll32 和 Regsvr32 等受信任的系統工具是否遭到濫用。這項功能會追蹤並顯示進階威脅常用於規避偵測和濫用系統公用程式的活動。 隨時間推移的寄生攻擊偵測 
detection.detection.rule_set = "89adf0db-5d29-0a04-c926-f8c2a58f5d1b"

$Rule_Name = detection.detection.rule_name
$Severity = detection.detection.severity
$Risk_Score = detection.detection.risk_score
$Date = timestamp.get_date(detection.collection_elements.references.event.metadata.event_timestamp.seconds)

match:
    $Rule_Name, $Severity, $Risk_Score, $Date
outcome:
    $Count = count(detection.detection.threat_id)
order:
    $Count desc
寄生攻擊活動 深入瞭解 Rundll32 和 Regsvr32 等受信任的系統工具是否遭到濫用。這項功能會追蹤並顯示進階威脅常用於規避偵測和濫用系統公用程式的活動。 依嚴重性分組的離地攻擊偵測 
$event.detection.detection.rule_set = "89adf0db-5d29-0a04-c926-f8c2a58f5d1b"

$Rule_Name = $event.detection.detection.rule_name
$Severity = $event.detection.detection.severity
$Risk_Score = $event.detection.detection.risk_score

match:
    $Rule_Name, $Severity, $Risk_Score
limit:
    50
寄生攻擊活動 深入瞭解 Rundll32 和 Regsvr32 等受信任的系統工具是否遭到濫用。這項功能會追蹤並顯示進階威脅常用於規避偵測和濫用系統公用程式的活動。 寄生攻擊偵測 
$event.detection.detection.rule_set = "89adf0db-5d29-0a04-c926-f8c2a58f5d1b"

$Rule_Name = $event.detection.detection.rule_name

match:
    $Rule_Name
outcome:
    $Last_Detection = timestamp.get_timestamp(max($event.detection.collection_elements.references.event.metadata.event_timestamp.seconds))
order:
    $Last_Detection desc
主要 提供資料擷取健康狀態和偵測到的 IoC 摘要，並從全球角度分析潛在威脅。 偵測項目 
detection.id != ""
outcome:
   $count = count(detection.id)
主要 提供資料擷取健康狀態和偵測到的 IoC 摘要，並從全球角度分析潛在威脅。 快訊 
detection.id != ""
outcome:
   $count = count_distinct(detection.id)
Mandiant Threat Defense 清楚顯示 Mandiant 在您環境中執行的主動威脅搜尋作業。這份報告會詳細列出進行中和已完成的搜尋活動，並醒目顯示搜尋程序發現的趨勢。 偵測次數前 100 名的使用者 
$rule_pack_name = detection.detection.rule_set_display_name
$rule_name = detection.detection.rule_name
$username = group(detection.collection_elements.references.event.principal.user.userid, detection.collection_elements.references.event.src.user.userid, detection.collection_elements.references.event.target.user.userid)

$username != ""

re.regex($rule_pack_name, `^Mandiant.*`)

match:
    $username

outcome:
    $count = count_distinct(detection.id)
    $unique_rules = count_distinct($rule_name)

order:
    $count desc

limit:
    100
Mandiant Threat Defense 清楚顯示 Mandiant 在您環境中執行的主動威脅搜尋作業。這份報告會詳細列出進行中和已完成的搜尋活動，並醒目顯示搜尋程序發現的趨勢。 過去一段時間的 Mandiant Threat Defense 偵測結果 
$rule_pack_name = detection.detection.rule_set_display_name
$date = timestamp.get_date(detection.created_time.seconds)

re.regex($rule_pack_name, `^Mandiant.*`)

match:
    $date

outcome:
    $count = count_distinct(detection.id)

order:
    $date asc
Mandiant Threat Defense 清楚顯示 Mandiant 在您環境中執行的主動威脅搜尋作業。這份報告會詳細列出進行中和已完成的搜尋活動，並醒目顯示搜尋程序發現的趨勢。 依遙測來源偵測 
$rule_pack_name = detection.detection.rule_set_display_name
$rule_name = detection.detection.rule_name
$vendor_name = detection.collection_elements.references.event.metadata.vendor_name
$product_name = detection.collection_elements.references.event.metadata.product_name

$vendor_name != ""
$product_name != ""

re.regex($rule_pack_name, `^Mandiant.*`)

match:
    $vendor_name, $product_name

outcome:
    $count = count_distinct(detection.id)

order:
    $count desc

limit:
    10
Mandiant Threat Defense 清楚顯示 Mandiant 在您環境中執行的主動威脅搜尋作業。這份報告會詳細列出進行中和已完成的搜尋活動，並醒目顯示搜尋程序發現的趨勢。 偵測項目 
$rule_pack_name = detection.detection.rule_set_display_name
re.regex($rule_pack_name, `^Mandiant.*`)

outcome:
    $count = count_distinct(detection.id)
Mandiant Threat Defense 清楚顯示 Mandiant 在您環境中執行的主動威脅搜尋作業。這份報告會詳細列出進行中和已完成的搜尋活動，並醒目顯示搜尋程序發現的趨勢。 偵測項目數量前 100 名的主機 
$rule_pack_name = detection.detection.rule_set_display_name
$rule_name = detection.detection.rule_name
$hostname = group(detection.collection_elements.references.event.principal.hostname, detection.collection_elements.references.event.src.hostname, detection.collection_elements.references.event.target.hostname)

$hostname != ""

re.regex($rule_pack_name, `^Mandiant.*`)

match:
    $hostname

outcome:
    $count = count_distinct(detection.id)
    $unique_rules = count_distinct($rule_name)

order:
    $count desc

limit:
    100
Mandiant Threat Defense 清楚顯示 Mandiant 在您環境中執行的主動威脅搜尋作業。這份報告會詳細列出進行中和已完成的搜尋活動，並醒目顯示搜尋程序發現的趨勢。 偵測項目數量前 100 名的資產 
$rule_pack_name = detection.detection.rule_set_display_name
$rule_name = detection.detection.rule_name
$asset_id = group(detection.collection_elements.references.event.principal.asset_id, detection.collection_elements.references.event.src.asset_id, detection.collection_elements.references.event.target.asset_id)

$asset_id != ""

re.regex($rule_pack_name, `^Mandiant.*`)

match:
    $asset_id

outcome:
    $count = count_distinct(detection.id)
    $unique_rules = count_distinct($rule_name)

order:
    $count desc

limit:
    100
Mandiant Threat Defense 清楚顯示 Mandiant 在您環境中執行的主動威脅搜尋作業。這份報告會詳細列出進行中和已完成的搜尋活動，並醒目顯示搜尋程序發現的趨勢。 偵測次數最多的前 100 項規則 
$rule_pack_name = detection.detection.rule_set_display_name
$rule_name = detection.detection.rule_name
$asset_id = group(detection.collection_elements.references.event.principal.asset_id, detection.collection_elements.references.event.src.asset_id, detection.collection_elements.references.event.target.asset_id)

re.regex($rule_pack_name, `^Mandiant.*`)

match:
    $rule_name

outcome:
    $count = count_distinct(detection.id)
    $asset_count = count_distinct($asset_id)

order:
    $count desc

limit:
    100
Mandiant Threat Defense 清楚顯示 Mandiant 在您環境中執行的主動威脅搜尋作業。這份報告會詳細列出進行中和已完成的搜尋活動，並醒目顯示搜尋程序發現的趨勢。 依平台劃分的偵測次數 
$rule_pack_name = detection.detection.rule_set_display_name
$rule_name = detection.detection.rule_name
$platform = detection.collection_elements.references.event.principal.asset.platform_software.platform

$platform != "UNKNOWN_PLATFORM"

re.regex($rule_pack_name, `^Mandiant.*`)

match:
    $platform

outcome:
    $count = count_distinct(detection.id)

order:
    $count desc

limit:
    10
Mandiant Threat Defense 清楚顯示 Mandiant 在您環境中執行的主動威脅搜尋作業。這份報告會詳細列出進行中和已完成的搜尋活動，並醒目顯示搜尋程序發現的趨勢。 依事件類型分組的偵測結果 
$rule_pack_name = detection.detection.rule_set_display_name
$rule_name = detection.detection.rule_name
$event_type = detection.collection_elements.references.event.metadata.event_type

re.regex($rule_pack_name, `^Mandiant.*`)

match:
    $event_type

outcome:
    $count = count_distinct(detection.id)

order:
    $count desc

limit:
    10
Mandiant Threat Defense 清楚顯示 Mandiant 在您環境中執行的主動威脅搜尋作業。這份報告會詳細列出進行中和已完成的搜尋活動，並醒目顯示搜尋程序發現的趨勢。 偵測次數最多的前 100 個網域 
$rule_pack_name = detection.detection.rule_set_display_name
$rule_name = detection.detection.rule_name

$domain = group(detection.collection_elements.references.event.principal.administrative_domain, detection.collection_elements.references.event.target.administrative_domain, detection.collection_elements.references.event.about.administrative_domain, detection.collection_elements.references.event.principal.asset.network_domain, detection.collection_elements.references.event.target.asset.network_domain, detection.collection_elements.references.event.about.asset.network_domain)

$domain != ""

re.regex($rule_pack_name, `^Mandiant.*`)

match:
    $domain

outcome:
    $count = count_distinct(detection.id)
    $unique_rules = count_distinct($rule_name)

order:
    $count desc

limit:
    100
Mandiant Threat Defense 清楚顯示 Mandiant 在您環境中執行的主動威脅搜尋作業。這份報告會詳細列出進行中和已完成的搜尋活動，並醒目顯示搜尋程序發現的趨勢。 前 10 大 MITRE ATT&CK® 技術 (對數比例) 
$rule_pack_name = detection.detection.rule_set_display_name
$rule_name = detection.detection.rule_name

re.regex($rule_pack_name, `^Mandiant.*`)

$mitre_technique = if(detection.detection.rule_labels["technique"] = "", "Unassigned", detection.detection.rule_labels["technique"])

match:
    $mitre_technique

outcome:
    $count = count_distinct(detection.id)

order:
    $count desc

limit:
    10
NIST 800-53 - 存取控管 提供 NIST 800-53 存取控管趨勢和地理位置風險的瀏覽權限。請確認已為圖表建立 NIST_Compliance_Assets 參照清單，以便載入及設定資料範圍。 偵測異常登入位置 
detection.collection_elements.references.event.security_result.action = "ALLOW"
detection.detection.rule_name = "Login from Country Never Before Seen for a User Group"

$Country = strings.coalesce(detection.collection_elements.references.event.principal.location.country_or_region, detection.collection_elements.references.event.principal.ip_geo_artifact.location.country_or_region)
$Rulename = detection.detection.rule_name
$User = strings.coalesce(detection.collection_elements.references.event.principal.user.userid,detection.collection_elements.references.event.principal.user.user_display_name,
detection.collection_elements.references.event.principal.user.email_addresses,detection.collection_elements.references.event.target.user.userid,detection.collection_elements.references.event.target.user.user_display_name,detection.collection_elements.references.event.target.user.email_addresses)

match:
     $User, $Rulename, $Country

outcome:
    $Count = count(detection.id)

order:
    $Count desc
NIST 800-53 - 存取控管 提供 NIST 800-53 存取控管趨勢和地理位置風險的瀏覽權限。請確認已為圖表建立 NIST_Compliance_Assets 參照清單，以便載入及設定資料範圍。 可疑的登入活動 
detection.detection.rule_name = "Brute Force then Successful Login by User"

$Country = strings.coalesce(detection.collection_elements.references.event.principal.location.country_or_region, detection.collection_elements.references.event.principal.ip_geo_artifact.location.country_or_region)
$Rulename = detection.detection.rule_name
$User = strings.coalesce(detection.collection_elements.references.event.principal.user.userid,detection.collection_elements.references.event.principal.user.user_display_name,
detection.collection_elements.references.event.principal.user.email_addresses,detection.collection_elements.references.event.target.user.userid,detection.collection_elements.references.event.target.user.user_display_name,detection.collection_elements.references.event.target.user.email_addresses)

match:
     $User, $Rulename, $Country

outcome:
    $Count = count(detection.id)

order:
    $Count desc
網路流量總覽 依 IP、通訊協定、供應商快訊和區域，即時監控雲端和地端部署網路流量，有效分析流量和潛在問題 地理區域精選偵測使用者 
detection.collection_elements.references.event.security_result.action = "ALLOW"

$Country = strings.coalesce(detection.collection_elements.references.event.principal.location.country_or_region, detection.collection_elements.references.event.principal.ip_geo_artifact.location.country_or_region)
$Rulename = detection.detection.rule_name
$Rulename = "Azure Multiple Geolocation Login Success" or $Rulename = "Login from Country Never Before Seen for a User Group"
$User = strings.coalesce(detection.collection_elements.references.event.principal.user.userid,detection.collection_elements.references.event.principal.user.user_display_name,
detection.collection_elements.references.event.principal.user.email_addresses,detection.collection_elements.references.event.target.user.userid,detection.collection_elements.references.event.target.user.user_display_name,detection.collection_elements.references.event.target.user.email_addresses)


match:
    $Country, $Rulename, $User, detection.collection_elements.references.event.metadata.event_type

outcome:
    $Count = count($Country)

order:
    $Count desc

limit:
    10
PCI - 警告總覽 集中顯示可能影響 PCI 標準的潛在安全性違規快訊和洞察資料。
附註：需要載入 PCI_ASSETS 參照清單，才能正確載入範圍資料。		 按照動作顯示一段時間內的快訊 
(detection.collection_elements.references.event.principal.hostname in %PCI_Assets or detection.collection_elements.references.event.principal.asset.hostname in %PCI_Assets or detection.collection_elements.references.event.target.hostname in %PCI_Assets or detection.collection_elements.references.event.target.asset.hostname in %PCI_Assets)

$Date = timestamp.get_date(detection.created_time.seconds)
$Action = detection.collection_elements.references.event.security_result.action

match:
    $Date,$Action

outcome:
    $Count = count(detection.id)

order:
    $Date asc
PCI - 警告總覽 集中顯示可能影響 PCI 標準的潛在安全性違規快訊和洞察資料。
附註：需要載入 PCI_ASSETS 參照清單，才能正確載入範圍資料。		 依說明顯示事件 
(detection.collection_elements.references.event.principal.hostname in %PCI_Assets or detection.collection_elements.references.event.principal.asset.hostname in %PCI_Assets or detection.collection_elements.references.event.target.hostname in %PCI_Assets or detection.collection_elements.references.event.target.asset.hostname in %PCI_Assets)

$Event_Name = detection.collection_elements.references.event.metadata.event_type
$Description = strings.coalesce(detection.collection_elements.references.event.security_result.summary,detection.collection_elements.references.event.security_result.description,detection.collection_elements.references.event.metadata.description)
$Log_Type = detection.collection_elements.references.event.metadata.log_type
$Source_IP = strings.coalesce(detection.collection_elements.references.event.principal.ip, detection.collection_elements.references.event.principal.asset.ip)
$Destination_IP = strings.coalesce(detection.collection_elements.references.event.target.ip, detection.collection_elements.references.event.target.asset.ip)
$Action = detection.collection_elements.references.event.security_result.action
$Destination_Hostname = strings.coalesce(detection.collection_elements.references.event.target.hostname, detection.collection_elements.references.event.target.asset.hostname)
$File = detection.collection_elements.references.event.target.process.file.full_path
$User = strings.coalesce(detection.collection_elements.references.event.principal.user.userid, detection.collection_elements.references.event.principal.user.user_display_name, detection.collection_elements.references.event.principal.user.email_addresses, detection.collection_elements.references.event.target.user.userid, detection.collection_elements.references.event.target.user.user_display_name, detection.collection_elements.references.event.target.user.email_addresses)

match:
    $Description, $Event_Name,$User, $Source_IP, $Destination_IP, $Action, $Destination_Hostname, $File, $Log_Type

outcome:
    $Count = count(detection.collection_elements.references.event.metadata.id)

order:
    $Count desc
PCI - 警告總覽 集中顯示可能影響 PCI 標準的潛在安全性違規快訊和洞察資料。
附註：需要載入 PCI_ASSETS 參照清單，才能正確載入範圍資料。		 前 10 大警報 
(detection.collection_elements.references.event.principal.hostname in %PCI_Assets or detection.collection_elements.references.event.principal.asset.hostname in %PCI_Assets or detection.collection_elements.references.event.target.hostname in %PCI_Assets or detection.collection_elements.references.event.target.asset.hostname in %PCI_Assets)

$Rule_Name = detection.detection.rule_name
$Severity = detection.detection.severity

match:
    $Rule_Name,$Severity

outcome:
    $Count = count(detection.id)

order:
    $Count desc

limit:
    10
PCI - 警告總覽 集中顯示可能影響 PCI 標準的潛在安全性違規快訊和洞察資料。
附註：需要載入 PCI_ASSETS 參照清單，才能正確載入範圍資料。		 前 10 名使用者 (產生快訊) 
(detection.collection_elements.references.event.principal.hostname in %PCI_Assets or detection.collection_elements.references.event.principal.asset.hostname in %PCI_Assets or detection.collection_elements.references.event.target.hostname in %PCI_Assets or detection.collection_elements.references.event.target.asset.hostname in %PCI_Assets)

$User = strings.coalesce(detection.collection_elements.references.event.principal.user.userid,detection.collection_elements.references.event.principal.user.user_display_name,detection.collection_elements.references.event.principal.user.email_addresses,detection.collection_elements.references.event.target.user.userid, detection.collection_elements.references.event.target.user.user_display_name,detection.collection_elements.references.event.target.user.email_addresses)

match:
    $User

outcome:
    $Count = count(detection.id)

order:
    $Count desc

limit:
    10
PCI - 警告總覽 集中顯示可能影響 PCI 標準的潛在安全性違規快訊和洞察資料。
附註：需要載入 PCI_ASSETS 參照清單，才能正確載入範圍資料。		 快訊數量 
(detection.collection_elements.references.event.principal.hostname in %PCI_Assets or detection.collection_elements.references.event.principal.asset.hostname in %PCI_Assets or detection.collection_elements.references.event.target.hostname in %PCI_Assets or detection.collection_elements.references.event.target.asset.hostname in %PCI_Assets)

outcome:
    $Count = count(detection.id)
PCI - 警告總覽 集中顯示可能影響 PCI 標準的潛在安全性違規快訊和洞察資料。
附註：需要載入 PCI_ASSETS 參照清單，才能正確載入範圍資料。		 端點數量 (產生快訊) 
(detection.collection_elements.references.event.principal.hostname in %PCI_Assets or detection.collection_elements.references.event.principal.asset.hostname in %PCI_Assets or detection.collection_elements.references.event.target.hostname in %PCI_Assets or detection.collection_elements.references.event.target.asset.hostname in %PCI_Assets)

$Hostname = strings.coalesce(detection.collection_elements.references.event.principal.hostname,detection.collection_elements.references.event.principal.asset.hostname,detection.collection_elements.references.event.target.hostname,detection.collection_elements.references.event.target.asset.hostname)

outcome:
    $Count = count_distinct($Hostname)
PCI - 警告總覽 集中顯示可能影響 PCI 標準的潛在安全性違規快訊和洞察資料。
附註：需要載入 PCI_ASSETS 參照清單，才能正確載入範圍資料。		 前 10 大端點 (產生快訊) 
(detection.collection_elements.references.event.principal.hostname in %PCI_Assets or detection.collection_elements.references.event.principal.asset.hostname in %PCI_Assets or detection.collection_elements.references.event.target.hostname in %PCI_Assets or detection.collection_elements.references.event.target.asset.hostname in %PCI_Assets)

$Hostname = strings.coalesce(detection.collection_elements.references.event.principal.hostname,detection.collection_elements.references.event.principal.asset.hostname,detection.collection_elements.references.event.target.hostname,detection.collection_elements.references.event.target.asset.hostname)

match:
    $Hostname

outcome:
    $Count = count(detection.id)

order:
    $Count desc

limit:
    10
PCI - 修補程式管理 提供修補程式管理生命週期的完整檢視畫面，協助您有效監控及管理系統更新。
注意：需要載入 Patch_UPDATES 和 PCI_ASSETS 參照清單，才能正確載入及設定資料範圍。		 系統未更新 - 48 小時內 
strings.coalesce($event.detection.collection_elements.references.event.principal.asset.hostname, $event.detection.collection_elements.references.event.principal.hostname) in %PCI_Assets
$Rule_Name = $event.detection.detection.rule_name
$Rule_Name = "systems_not_updating_within_48_hours"
$Hostname = strings.coalesce($event.detection.collection_elements.references.event.principal.asset.hostname, $event.detection.collection_elements.references.event.principal.hostname)


match:
    $Hostname
limit:
    50
規則偵測總覽 分析偵測規則和威脅模式，提升可視性。您可以運用這些洞察資料評估規則成效，並強化事件回應。
注意：套用篩選器可縮小結果範圍。		 隨時間推移依名稱偵測規則 
$rulename = detection.detection.rule_name
$date = timestamp.get_date(detection.detection_time.seconds)
match:
    $rulename, $date
outcome:
    $detection_count = count_distinct(detection.id)
order:
    $date
規則偵測總覽 分析偵測規則和威脅模式，提升可視性。您可以運用這些洞察資料評估規則成效，並強化事件回應。
注意：套用篩選器可縮小結果範圍。		 前 10 項有效規則 
$Rulename = detection.detection.rule_name

match:
    $Rulename

outcome:
    $Count = count_distinct(detection.id)

order:
    $Count desc

limit:
        10
規則偵測總覽 分析偵測規則和威脅模式，提升可視性。您可以運用這些洞察資料評估規則成效，並強化事件回應。
注意：套用篩選器可縮小結果範圍。		 觸發偵測的前 10 大供應商產品 
$Product_Name = detection.collection_elements.references.event.metadata.product_name

match:
    $Product_Name

outcome:
    $Count = count(detection.id)

order:
    $Count desc

limit:
    10
規則偵測總覽 分析偵測規則和威脅模式，提升可視性。您可以運用這些洞察資料評估規則成效，並強化事件回應。
注意：套用篩選器可縮小結果範圍。		 依嚴重性分組的偵測結果 
$Severity = detection.detection.severity
$Date = timestamp.get_date(detection.detection_time.seconds)

match:
    $Date, $Severity

outcome:
    $Count = count_distinct(detection.id)

order:
    $Date asc
規則偵測總覽 分析偵測規則和威脅模式，提升可視性。您可以運用這些洞察資料評估規則成效，並強化事件回應。
注意：套用篩選器可縮小結果範圍。		 依嚴重性分類的偵測結果 
$Rulename = detection.detection.rule_name
$Severity = detection.detection.severity

match:
    $Rulename,$Severity

outcome:
    $Count = count_distinct(detection.id)

order:
    $Severity desc
規則偵測總覽 分析偵測規則和威脅模式，提升可視性。您可以運用這些洞察資料評估規則成效，並強化事件回應。
注意：套用篩選器可縮小結果範圍。		 依規則偵測結果排序的前 10 個 IP 
$ip = group(
    detection.collection_elements.references.event.principal.ip,
    detection.collection_elements.references.event.target.ip,
    detection.collection_elements.references.event.src.ip
    )
$ip != ""
match:
  $ip
outcome:
  $count = count(detection.id)
order:
  $count desc
limit: 10
規則偵測總覽 分析偵測規則和威脅模式，提升可視性。您可以運用這些洞察資料評估規則成效，並強化事件回應。
注意：套用篩選器可縮小結果範圍。		 偵測次數前 10 名的裝置 
$Hostname = strings.coalesce(detection.collection_elements.references.event.principal.hostname, detection.collection_elements.references.event.principal.asset.hostname, detection.collection_elements.references.event.target.hostname,detection.collection_elements.references.event.target.asset.hostname)
$Severity = detection.detection.severity

match:
    $Hostname, $Severity

outcome:
    $Count = count(detection.id)

order:
    $Count desc

limit:
    10
規則偵測總覽 分析偵測規則和威脅模式，提升可視性。您可以運用這些洞察資料評估規則成效，並強化事件回應。
注意：套用篩選器可縮小結果範圍。		 平均風險分數 
$Rule_Set = detection.detection.rule_set_display_name

match:
    $Rule_Set

outcome:
    $Detection_Count = count(detection.id)
    $Average_Risk_Score = math.round(sum(detection.detection.risk_score)/count(detection.id),2)

order:
    $Average_Risk_Score desc
規則偵測總覽 分析偵測規則和威脅模式，提升可視性。您可以運用這些洞察資料評估規則成效，並強化事件回應。
注意：套用篩選器可縮小結果範圍。		 有風險的使用者 
detection.detection.risk_score > 0
detection.collection_elements.references.event.principal.user.userid != ""
detection.collection_elements.references.event.metadata.product_name != ""

$User = detection.collection_elements.references.event.principal.user.userid
$Product_Name = detection.collection_elements.references.event.metadata.product_name

match:
    $User, $Product_Name

outcome:
    $Risk_Score = max(detection.detection.risk_score)
    $Count = count(detection.id)
    $First_Time_Seen = timestamp.get_timestamp(min(detection.collection_elements.references.event.metadata.event_timestamp.seconds))
    $Last_Time_Seen = timestamp.get_timestamp(max(detection.collection_elements.references.event.metadata.event_timestamp.seconds))

order:
    $Risk_Score desc, $Count desc
規則偵測總覽 分析偵測規則和威脅模式，提升可視性。您可以運用這些洞察資料評估規則成效，並強化事件回應。
注意：套用篩選器可縮小結果範圍。		 依動作列出的前 10 大目的地 IP 
$Destination_IP = strings.coalesce(detection.collection_elements.references.event.target.ip,detection.collection_elements.references.event.target.asset.ip)
$Action = detection.collection_elements.references.event.security_result.action

match:
    $Destination_IP,$Action

 outcome:
    $Count = count(detection.id)

order:
    $Count desc

limit:
    10
規則偵測總覽 分析偵測規則和威脅模式，提升可視性。您可以運用這些洞察資料評估規則成效，並強化事件回應。
注意：套用篩選器可縮小結果範圍。		 最少 10 條有效規則 
$Rule_Name = detection.detection.rule_name

match:
    $Rule_Name

outcome:
    $Count = count_distinct(detection.id)

order:
    $Count asc

limit:
    10
規則偵測總覽 分析偵測規則和威脅模式，提升可視性。您可以運用這些洞察資料評估規則成效，並強化事件回應。
注意：套用篩選器可縮小結果範圍。		 依供應商產品列出的前 10 大威脅特徵 
$Threat_Signature = strings.coalesce(detection.collection_elements.references.event.security_result.threat_name, detection.detection.detection_fields["threat_signature"])

$Product_Name = detection.collection_elements.references.event.metadata.product_name

match:
    $Threat_Signature, $Product_Name

outcome:
    $Count = count(detection.id)

order:
    $Count desc

limit:
    10
規則偵測總覽 分析偵測規則和威脅模式，提升可視性。您可以運用這些洞察資料評估規則成效，並強化事件回應。
注意：套用篩選器可縮小結果範圍。		 常見的 MITRE ATT&CK 技術和策略 
$Tactic_ID = detection.collection_elements.references.event.security_result.attack_details.tactics.id
$Tactic_Name = detection.collection_elements.references.event.security_result.attack_details.tactics.name
$Tactic_Name != ""
$Technique_Name = detection.collection_elements.references.event.security_result.attack_details.techniques.name
$Tectinque_ID = detection.collection_elements.references.event.security_result.attack_details.techniques.id
$Sub_Technique = detection.collection_elements.references.event.security_result.attack_details.techniques.subtechnique_name

match:
    $Tactic_Name, $Tactic_ID, $Technique_Name, $Tectinque_ID, $Sub_Technique

outcome:

    $Ruleset_Count = count_distinct(detection.detection.rule_set_display_name)
    $Count = count_distinct(detection.id)


order:
    $Count desc
規則偵測總覽 分析偵測規則和威脅模式，提升可視性。您可以運用這些洞察資料評估規則成效，並強化事件回應。
注意：套用篩選器可縮小結果範圍。		 偵測次數最多的前 10 名使用者 
$User = strings.coalesce(detection.collection_elements.references.event.principal.user.userid,detection.collection_elements.references.event.principal.user.user_display_name,
detection.collection_elements.references.event.principal.user.email_addresses,detection.collection_elements.references.event.target.user.userid,detection.collection_elements.references.event.target.user.user_display_name,detection.collection_elements.references.event.target.user.email_addresses)
$Severity = detection.detection.severity

match:
    $User, $Severity

 outcome:
    $Count = count(detection.id)

order:
    $Count desc

limit:
    10
規則偵測總覽 分析偵測規則和威脅模式，提升可視性。您可以運用這些洞察資料評估規則成效，並強化事件回應。
注意：套用篩選器可縮小結果範圍。		 依規則偵測結果排序的前幾名使用者 
$user = group(
  detection.collection_elements.references.event.src.user.userid,
  detection.collection_elements.references.event.principal.user.userid,
  detection.collection_elements.references.event.target.user.userid
  )
$user != ""
match:
  $user
outcome:
  $count = count(detection.id)
order:
  $count desc
limit: 10
規則偵測總覽 分析偵測規則和威脅模式，提升可視性。您可以運用這些洞察資料評估規則成效，並強化事件回應。
注意：套用篩選器可縮小結果範圍。		 偵測次數排名前 10 的規則名稱 
$rulename = detection.detection.rule_name
match:
    $rulename
outcome:
    $detection_count = count_distinct(detection.id)
order:
    $detection_count desc
limit:
    10
規則偵測總覽 分析偵測規則和威脅模式，提升可視性。您可以運用這些洞察資料評估規則成效，並強化事件回應。
注意：套用篩選器可縮小結果範圍。		 依信賴水準偵測 
$Rule_Name = detection.detection.rule_name
$Confidence_Level = detection.detection.confidence
$Risk_Score = detection.detection.risk_score
$Threat_Name = detection.collection_elements.references.event.security_result.threat_name
$Severity = detection.detection.severity

match:
   $Rule_Name,$Severity,$Risk_Score, $Confidence_Level,$Threat_Name

outcome:
   $Count = count_distinct(detection.id)

order:
    $Risk_Score desc
規則偵測總覽 分析偵測規則和威脅模式，提升可視性。您可以運用這些洞察資料評估規則成效，並強化事件回應。
注意：套用篩選器可縮小結果範圍。		 排名前 10 的有效規則集 
$Ruleset = detection.detection.rule_set_display_name

match:
    $Ruleset

outcome:
    $Count = count_distinct(detection.id)

order:
    $Count desc

limit:
    10
規則偵測總覽 分析偵測規則和威脅模式，提升可視性。您可以運用這些洞察資料評估規則成效，並強化事件回應。
注意：套用篩選器可縮小結果範圍。		 依動作列出的前 10 大來源 IP 
$Action = detection.collection_elements.references.event.security_result.action
$Source_IP = strings.coalesce(detection.collection_elements.references.event.principal.ip,detection.collection_elements.references.event.principal.asset.ip)


match:
    $Action, $Source_IP

 outcome:
    $Count = count(detection.id)

order:
    $Count desc

limit:
    10
規則偵測總覽 分析偵測規則和威脅模式，提升可視性。您可以運用這些洞察資料評估規則成效，並強化事件回應。
注意：套用篩選器可縮小結果範圍。		 前 10 大威脅類別 
$Category = detection.collection_elements.references.event.security_result.category
$Category_Details= detection.collection_elements.references.event.security_result.category_details
$Threat_Name = detection.collection_elements.references.event.security_result.threat_name

match:
   $Category, $Category_Details

outcome:
    $Threat_Type = array_distinct($Threat_Name)
    $Count = count_distinct(detection.id)

order:
    $Count desc

limit:
    10
規則偵測總覽 分析偵測規則和威脅模式，提升可視性。您可以運用這些洞察資料評估規則成效，並強化事件回應。
注意：套用篩選器可縮小結果範圍。		 依規則偵測結果排序的前 10 個主機 
$host = group(detection.collection_elements.references.event.src.hostname,detection.collection_elements.references.event.principal.hostname,detection.collection_elements.references.event.target.hostname)
$host != ""
match:
  $host
outcome:
  $count = count(detection.id)
order:
  $count desc
limit: 10
規則偵測總覽 分析偵測規則和威脅模式，提升可視性。您可以運用這些洞察資料評估規則成效，並強化事件回應。
注意：套用篩選器可縮小結果範圍。		 隨時間推移依嚴重性分組的規則偵測項目 
$severity = detection.detection.rule_labels["severity"]
$severity != ""
$detection_time = timestamp.get_date(detection.detection_time.seconds)
match:
   $severity, $detection_time
outcome:
   $count = count_distinct(detection.id)

order:
    $detection_time
規則偵測總覽 分析偵測規則和威脅模式，提升可視性。您可以運用這些洞察資料評估規則成效，並強化事件回應。
注意：套用篩選器可縮小結果範圍。		 隨時間推移的規則偵測 
$date = timestamp.get_date(detection.detection_time.seconds)
match:
    $date
outcome:
    $total=count_distinct(detection.id)
order:
    $date
規則偵測總覽 分析偵測規則和威脅模式，提升可視性。您可以運用這些洞察資料評估規則成效，並強化事件回應。
注意：套用篩選器可縮小結果範圍。		 最少使用的 10 個規則集 
$Rule_Set = detection.detection.rule_set_display_name

match:
    $Rule_Set

outcome:
    $Count = count_distinct(detection.id)

order:
    $Count asc

limit:
    10
規則偵測總覽 分析偵測規則和威脅模式，提升可視性。您可以運用這些洞察資料評估規則成效，並強化事件回應。
注意：套用篩選器可縮小結果範圍。		 依嚴重性分組的規則偵測結果 
$severity = detection.detection.rule_labels["severity"]
$severity != ""
match:
   $severity
outcome:
   $count = count_distinct(detection.id)
規則偵測總覽 分析偵測規則和威脅模式，提升可視性。您可以運用這些洞察資料評估規則成效，並強化事件回應。
注意：套用篩選器可縮小結果範圍。		 有風險的資產 
detection.detection.risk_score > 0
detection.collection_elements.references.event.principal.hostname != ""
detection.collection_elements.references.event.metadata.product_name != ""

$Hostname = detection.collection_elements.references.event.principal.hostname
$IP_Address = detection.collection_elements.references.event.principal.ip
$Product_Name = detection.collection_elements.references.event.metadata.product_name

match:
    $Hostname, $IP_Address, $Product_Name

outcome:
    $Risk_Score = max(detection.detection.risk_score)
    $Count = count(detection.id)
    $First_Time_Seen = timestamp.get_timestamp(min(detection.collection_elements.references.event.metadata.event_timestamp.seconds))
    $Last_Time_Seen = timestamp.get_timestamp(max(detection.collection_elements.references.event.metadata.event_timestamp.seconds))

order:
    $Risk_Score desc, $Count desc
規則觀測能力 這個資訊主頁會顯示規則執行作業發出的基礎指標。 第 50 百分位數的擷取延遲時間 (分鐘) 
detection.type = "RULE_DETECTION"
detection.latency_metrics.newest_ingestion_time.seconds - detection.latency_metrics.newest_event_time.seconds < 3600
$rule_id = detection.detection.rule_id
$rule_name = detection.detection.rule_name

//detection.detection.rule_type = "MULTI_EVENT"

$did = detection.id
$day = timestamp.get_date(detection.created_time.seconds)


detection.latency_metrics.newest_ingestion_time.seconds != 0
detection.latency_metrics.newest_event_time.seconds != 0


match:
    $day
outcome:
    $p50_ingest_to_detection_delay = math.round(window.percentile(detection.latency_metrics.newest_ingestion_time.seconds - detection.latency_metrics.newest_event_time.seconds, 50) /60, 2)

order:
    $p50_ingest_to_detection_delay desc
規則觀測能力 這個資訊主頁會顯示規則執行作業發出的基礎指標。 每次偵測的延遲時間數字 - 前 20 名 
$detect_id = detection.id
$rule_name = detection.detection.rule_name
$rule_id = detection.detection.rule_id
$detectionTime = detection.created_time.seconds

detection.type = "RULE_DETECTION"

detection.latency_metrics.newest_ingestion_time.seconds != 0
detection.latency_metrics.newest_event_time.seconds != 0

detection.collection_elements.references.event.metadata.log_type != ""
$logType = detection.collection_elements.references.event.metadata.log_type

match:
  $rule_name, $detect_id

outcome:
  $ingestion_deleay = math.round( (max(detection.latency_metrics.newest_ingestion_time.seconds) - max(detection.latency_metrics.newest_event_time.seconds)) / 60, 1)
  $ingestion_to_detection = math.round((max(detection.created_time.seconds) - max(detection.latency_metrics.newest_ingestion_time.seconds)) / 60, 1)
  $event_to_deteciton = math.round((max(detection.created_time.seconds) - max(detection.latency_metrics.newest_event_time.seconds)) / 60, 1)

order:
  $ingestion_to_detection desc

limit:
  20
規則觀測能力 這個資訊主頁會顯示規則執行作業發出的基礎指標。 從擷取到偵測的延遲時間 (分鐘) (第 50 個百分位數) 
detection.type = "RULE_DETECTION"
detection.latency_metrics.newest_ingestion_time.seconds - detection.latency_metrics.newest_event_time.seconds < 3600
$rule_id = detection.detection.rule_id
$rule_name = detection.detection.rule_name

//detection.detection.rule_type = "MULTI_EVENT"

$did = detection.id
$day = timestamp.get_date(detection.created_time.seconds)

detection.created_time.seconds != 0
detection.latency_metrics.newest_ingestion_time.seconds != 0
detection.latency_metrics.newest_event_time.seconds != 0


match:
    $day
outcome:
    $p50_ingest_to_detection_delay = math.round(window.percentile(detection.created_time.seconds - detection.latency_metrics.newest_ingestion_time.seconds, 50) /60, 1)

order:
    $p50_ingest_to_detection_delay desc
規則觀測能力 這個資訊主頁會顯示規則執行作業發出的基礎指標。 偵測延遲 
detection.type = "RULE_DETECTION"
//$rule_id = detection.detection.rule_id
$rule_type = detection.detection.rule_type
$rule_name = detection.detection.rule_name
$rule_freq = detection.rule_run_frequency

//detection.detection.rule_type = "MULTI_EVENT"

detection.latency_metrics.newest_ingestion_time.seconds != 0
detection.latency_metrics.newest_event_time.seconds != 0
detection.created_time.seconds != 0

$did = detection.id

match:
    $rule_name, $rule_freq, $rule_type
outcome:
    $detect_count = count_distinct($did)

    $avg_ingest_delay = math.round(window.percentile(detection.latency_metrics.newest_ingestion_time.seconds - detection.latency_metrics.newest_event_time.seconds, 50) / 60, 2)
    $p50_ingest_to_detection_delay = math.round(window.percentile(detection.created_time.seconds - detection.latency_metrics.newest_ingestion_time.seconds, 50) /60, 1)
    $p90_ingest_to_detection_delay = math.round(window.percentile(detection.created_time.seconds - detection.latency_metrics.newest_ingestion_time.seconds, 90) /60, 1)

    $p50_event_to_detection_delay = math.round(window.percentile(detection.created_time.seconds - detection.latency_metrics.newest_event_time.seconds, 50) / 60, 1)
    $p90_event_to_detection_delay = math.round(window.percentile(detection.created_time.seconds - detection.latency_metrics.newest_event_time.seconds, 90) /60, 1)

order:
    $p50_ingest_to_detection_delay desc
規則觀測能力 這個資訊主頁會顯示規則執行作業發出的基礎指標。 P90 擷取到偵測的延遲時間 (分鐘) 
detection.type = "RULE_DETECTION"
$rule_id = detection.detection.rule_id
$rule_name = detection.detection.rule_name


$did = detection.id
$day = timestamp.get_date(detection.created_time.seconds)

detection.latency_metrics.newest_ingestion_time.seconds != 0
detection.latency_metrics.newest_event_time.seconds != 0
detection.created_time.seconds != 0

match:
    $day
outcome:
    $p90_ingest_to_detection_delay = math.round(window.percentile(detection.created_time.seconds - detection.latency_metrics.newest_ingestion_time.seconds, 90) /60, 1)

order:
    $p90_ingest_to_detection_delay desc
規則觀測能力 這個資訊主頁會顯示規則執行作業發出的基礎指標。 依時間詳細資料 (主要或重播) 顯示的偵測次數 
$detection_timing_details = detection.detection_timing_details
$detection_id = detection.id
detection.created_time.seconds != 0
$day = timestamp.get_date(detection.created_time.seconds)
$detection_type = detection.type

match:
    $day, $detection_timing_details

outcome:
    $total_detections = count_distinct($detection_id)


order:
    $day desc
安全性管理總覽 提供案件活動和事件趨勢的重要指標，協助主管監控安全進展。運用這些洞察資訊找出風險，並根據資料做出改善，提升安全成效。 觀察到的威脅活動 - 最近 7 天 
detection.detection.rule_name = /ioc/ nocase

$Threat_Campaign = detection.collection_elements.references.entity.metadata.threat.campaigns
$Threat_Campaign != ""

match:
    $Threat_Campaign

outcome:
    $Count = count_distinct(detection.id)

order:
    $Count desc
安全性管理總覽 提供案件活動和事件趨勢的重要指標，協助主管監控安全進展。運用這些洞察資訊找出風險，並根據資料做出改善，提升安全成效。 觀察到的威脅發動者 - 最近 7 天 
detection.detection.rule_name = /ioc/ nocase

$Threat_Actor = detection.collection_elements.references.entity.metadata.threat.associations.name
$Threat_Actor != ""

match:
    $Threat_Actor

outcome:
    $Count = count_distinct(detection.id)

order:
    $Count desc
安全性管理總覽 提供案件活動和事件趨勢的重要指標，協助主管監控安全進展。運用這些洞察資訊找出風險，並根據資料做出改善，提升安全成效。 
detection.detection.alert_state = "ALERTING"

outcome:
    $total = count_distinct(detection.id)
安全性管理總覽 提供案件活動和事件趨勢的重要指標，協助主管監控安全進展。運用這些洞察資訊找出風險，並根據資料做出改善，提升安全成效。 
outcome:
    $Count = count_distinct(detection.id)
安全防護措施管理 即時掌握威脅、事件和安全漏洞的概況，包括偵測結果和資產監控。資安團隊可藉此評估風險態勢，並實施有效的補救策略，簡化事件應變程序。 鎖定貴機構的前 10 大威脅發動者 
detection.detection.rule_name = /ioc/ nocase

$Threat_Actor = detection.collection_elements.references.entity.metadata.threat.associations.name
$Threat_Actor != ""
match:
    $Threat_Actor

outcome:
    $Count = count(detection.id)

order:
    $Count desc

limit:
    10
安全防護措施管理 即時掌握威脅、事件和安全漏洞的概況，包括偵測結果和資產監控。資安團隊可藉此評估風險態勢，並實施有效的補救策略，簡化事件應變程序。 UEBA 警示 
detection.detection.ruleset_category_display_name = "Risk Analytics for UEBA"
detection.detection.alert_state = "ALERTING"

$Rule_Name = detection.detection.rule_name
$Hostname = strings.coalesce(detection.collection_elements.references.event.principal.hostname, detection.collection_elements.references.event.principal.asset.hostname, detection.collection_elements.references.event.target.hostname, detection.collection_elements.references.event.target.asset.hostname)
$User = strings.coalesce(detection.collection_elements.references.event.principal.user.user_display_name, detection.collection_elements.references.event.principal.user.email_addresses, detection.collection_elements.references.event.principal.user.userid,detection.collection_elements.references.event.target.user.user_display_name, detection.collection_elements.references.event.target.user.email_addresses, detection.collection_elements.references.event.target.user.userid)

match:
  $Rule_Name, $Hostname, $User

outcome:
  $Count = count(detection.id)

order:
  $Count desc
安全防護措施管理 即時掌握威脅、事件和安全漏洞的概況，包括偵測結果和資產監控。資安團隊可藉此評估風險態勢，並實施有效的補救策略，簡化事件應變程序。 隨時間推移的偵測結果 
$Date = timestamp.get_date(detection.created_time.seconds)

match:
    $Date

outcome:
    $Detection_Count = count(detection.id)

order:
    $Date asc
安全防護措施管理 即時掌握威脅、事件和安全漏洞的概況，包括偵測結果和資產監控。資安團隊可藉此評估風險態勢，並實施有效的補救策略，簡化事件應變程序。 依嚴重程度分類的偵測項目 
$Rule_Name = detection.detection.rule_name
$Severity = detection.collection_elements.references.event.security_result.severity

match:
    $Severity, $Rule_Name

outcome:
    $Detection_Count = count(detection.id)

order:
    $Severity desc
安全防護措施管理 即時掌握威脅、事件和安全漏洞的概況，包括偵測結果和資產監控。資安團隊可藉此評估風險態勢，並實施有效的補救策略，簡化事件應變程序。 依名稱列出的前 10 項偵測結果 
$Rule_Name = detection.detection.rule_name

match:
    $Rule_Name

outcome:
    $Detection_Count = count(detection.id)

order:
    $Detection_Count desc

limit:
    10
安全防護措施管理 即時掌握威脅、事件和安全漏洞的概況，包括偵測結果和資產監控。資安團隊可藉此評估風險態勢，並實施有效的補救策略，簡化事件應變程序。 前 10 大雲端快訊 
detection.detection.ruleset_category_display_name = "Cloud Threats"
detection.detection.alert_state = "ALERTING"

$Rule_Name = detection.detection.rule_name
$Targeted_Resources = strings.coalesce(detection.collection_elements.references.event.target.application, detection.collection_elements.references.event.target.resource.name)
$User = strings.coalesce(detection.collection_elements.references.event.principal.user.user_display_name, detection.collection_elements.references.event.principal.user.email_addresses, detection.collection_elements.references.event.principal.user.userid,detection.collection_elements.references.event.target.user.user_display_name, detection.collection_elements.references.event.target.user.email_addresses, detection.collection_elements.references.event.target.user.userid)

match:
  $Rule_Name, $Targeted_Resources, $User

outcome:
  $Count = count(detection.id)

order:
  $Count desc

limit:
      10
安全防護措施管理 即時掌握威脅、事件和安全漏洞的概況，包括偵測結果和資產監控。資安團隊可藉此評估風險態勢，並實施有效的補救策略，簡化事件應變程序。 指定機構的前 10 大廣告活動 
detection.detection.rule_name = /ioc/ nocase

$Threat_Campaign = detection.collection_elements.references.entity.metadata.threat.campaigns
$Threat_Campaign != ""
match:
    $Threat_Campaign

outcome:
    $Count = count(detection.id)

order:
    $Count desc

limit:
    10
安全防護措施管理 即時掌握威脅、事件和安全漏洞的概況，包括偵測結果和資產監控。資安團隊可藉此評估風險態勢，並實施有效的補救策略，簡化事件應變程序。 偵測次數前 10 名的主機 
$Rule_Name = detection.detection.rule_name
$Hostname = strings.coalesce(detection.collection_elements.references.event.principal.hostname, detection.collection_elements.references.event.principal.asset.hostname, detection.collection_elements.references.event.target.hostname, detection.collection_elements.references.event.target.asset.hostname)
$Hostname != ""
match:
    $Hostname

outcome:
    $Detection_Count = count_distinct(detection.id)

order:
    $Detection_Count desc

limit:
    10
威脅情報總覽 提供 IOC 和風險分數的即時洞察資訊，有助於更快偵測新興基礎架構威脅。 依偵測次數劃分的威脅活動 
detection.detection.rule_name = /ioc/ nocase
detection.collection_elements.references.entity.metadata.threat.campaigns !=""

$Rule_Name = detection.detection.rule_name
$Campaigns = detection.collection_elements.references.entity.metadata.threat.campaigns
$Campaigns != ""
match:
    $Campaigns, $Rule_Name

outcome:
    $Count = count(detection.id)

order:
    $Count desc
威脅情報總覽 提供 IOC 和風險分數的即時洞察資訊，有助於更快偵測新興基礎架構威脅。 按威脅發動者劃分的偵測記錄 
detection.detection.rule_name = /ioc/
detection.collection_elements.references.entity.metadata.threat.associations.type = "THREAT_ACTOR"

$Date = timestamp.get_date(detection.collection_elements.references.entity.metadata.event_metadata.event_timestamp.seconds)
$Threat_Actor = detection.collection_elements.references.entity.metadata.threat.associations.name
$Threat_Actor != ""
match:
    $Date, $Threat_Actor

outcome:
    $Count = count(detection.id)

order:
    $Count asc
威脅情報總覽 提供 IOC 和風險分數的即時洞察資訊，有助於更快偵測新興基礎架構威脅。 依 IOC 類型劃分的偵測結果變化趨勢 
detection.detection.rule_name = /ioc/ nocase

$Date = timestamp.get_date(detection.collection_elements.references.entity.metadata.event_metadata.event_timestamp.seconds)
$IOC_Type = detection.collection_elements.references.entity.metadata.entity_type

match:
    $Date , $IOC_Type

outcome:
    $Count = count(detection.id)

order:
    $Count desc
威脅情報總覽 提供 IOC 和風險分數的即時洞察資訊，有助於更快偵測新興基礎架構威脅。 依偵測結果分類的威脅發動者 
detection.detection.rule_name = /ioc/ nocase
detection.collection_elements.references.entity.metadata.threat.associations.type = "THREAT_ACTOR"

$Rule_Name = detection.detection.rule_name
$Threat_Actor = detection.collection_elements.references.entity.metadata.threat.associations.name
$Threat_Actor != ""
match:
    $Threat_Actor, $Rule_Name

outcome:
    $Count = count(detection.id)

order:
    $Count desc
使用者生命週期稽核 提供使用者帳戶管理活動的詳細檢視畫面。這有助於確保在整個使用者生命週期中，佈建和取消佈建政策都能獲得遵守。
注意：套用篩選器可縮小結果範圍。		 近期停滯帳戶 
detection.collection_elements.references.event.metadata.event_type = "USER_LOGIN"

$User = strings.coalesce(detection.collection_elements.references.event.target.user.email_addresses, detection.collection_elements.references.event.target.user.userid, detection.collection_elements.references.event.target.user.windows_sid)
$User != ""

match:
    $User

outcome:
    $Last_Login_Time = max(detection.collection_elements.references.event.metadata.event_timestamp.seconds)
    $Last_Login_Timestamp = timestamp.get_timestamp($Last_Login_Time, "%F %T ")
    $Days_Since_Login = math.round((timestamp.current_seconds() - $Last_Login_Time )/ 86400)
    $Status = if($Last_Login_Time != 0 AND ($Days_Since_Login >= 180), "Dormant Account (≥180 Days)", if($Last_Login_Time != 0 AND ($Days_Since_Login >= 90), "Dormant Account (≥90 Days)", "Recently Dormant Account"))

order:
    $Days_Since_Login desc

unselect:
    $Last_Login_Time

還有其他問題嗎？向社群成員和 Google SecOps 專業人員尋求答案。