运行 UDM 查询
本文档面向安全运营中心 (SOC) 的经理和分析师，他们希望使用精选的信息中心（预定义的信息中心，旨在提高 Google Security Operations 中各种安全应用场景的可见性）来监控威胁形势和系统健康状况。本文档针对 UDM 源类型提供了一组精选的信息中心及其底层查询。
下表列出了每个精选信息中心的图表及其查询示例。您可以在查询编辑器中使用这些查询，也可以将其用作自定义 widget 的基准。
如需了解如何创建和管理信息中心，请参阅管理信息中心 。
应用控制
此信息中心可提供有关应用安全性的数据分析，帮助安全团队检测未经授权的软件并强制执行使用政策。
它支持查看风险行为、被阻止的尝试和异常活动模式。
注意 ：应用可用的过滤条件可精简数据并显示相关结果。
一段时间内的应用执行次数
排名前 10 的未获批准的应用执行（审核/允许模式）
通过可移动介质执行的应用（前 10 名）
按原因列出的被屏蔽的前 10 个应用执行
一段时间内的应用执行状态
被屏蔽的应用执行次数排名前 10
从非典型位置执行的应用
按被屏蔽的执行次数排序的前 10 个主机
按执行被屏蔽次数排名的前 10 位用户
被屏蔽的执行 - 每小时
图表名称
查询示例
一段时间内的应用执行次数
metadata.product_event_type = /(execution|application) (allow|block)/ nocase
or security_result.threat_name = /application control/ nocase
$Date = timestamp.get_timestamp(metadata.event_timestamp.seconds, "%F")
match:
$Date
outcome:
$Count = count(metadata.id)
排名前 10 的未获批准的应用执行（审核/允许模式）
metadata.product_event_type != /(execution|application) block/ nocase
metadata.product_event_type = /unapproved/ nocase
$Application = strings.coalesce(about.file.full_path, target.process.file.full_path, additional.fields["fname"])
match:
$Application
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
通过可移动介质执行的应用（前 10 名）
metadata.product_event_type = /(execution|application) (allow|block)/ nocase
or security_result.threat_name = /application control/ nocase
strings.coalesce(about.file.full_path, target.process.file.full_path, additional.fields["fname"]) = /(^(D|E|F|G):)|\/\/removable|usb/ nocase
$Application = strings.coalesce(about.file.full_path, target.process.file.full_path, additional.fields["fname"])
match:
$Application
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
按原因列出的被屏蔽的前 10 个应用执行
metadata.product_event_type = /(execution|application) block/ nocase
or security_result.threat_name = /application control/ nocase
security_result.action = "BLOCK"
$Application = strings.coalesce(about.file.full_path, target.process.file.full_path, additional.fields["fname"])
$Reason = strings.coalesce(target.resource.attribute.labels["categoryTupleDescription"], security_result.action_details, metadata.product_event_type)
match:
$Application, $Reason
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
一段时间内的应用执行状态
metadata.product_event_type = /(execution|application) (allow|block)/ nocase
or security_result.threat_name = /application control/ nocase
$Action = strings.coalesce(if(security_result.action = "BLOCK", "BLOCK", "ALLOW"), if(metadata.product_event_type = /(execution|application) block/ nocase, "BLOCK", "ALLOW"))
$Date = timestamp.get_timestamp(metadata.event_timestamp.seconds,"%F")
match:
$Action, $Date
outcome:
$Count = count(metadata.id)
order:
$Date desc
被屏蔽的应用执行次数排名前 10
metadata.product_event_type = /(execution|application) block/ nocase
or security_result.threat_name = /application control/ nocase
security_result.action = "BLOCK"
$Application = strings.coalesce(about.file.full_path, target.process.file.full_path, additional.fields["fname"])
match:
$Application
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
从非典型位置执行的应用
strings.coalesce(about.file.full_path, target.process.file.full_path, additional.fields["fname"]) = /C\:\\(?:Users|Temp|Windows)\\(?:.*\\(?:AppData|Downloads)?|Temp)?/ nocase
$File_Path = strings.coalesce(about.file.full_path, target.process.file.full_path, additional.fields["fname"])
match:
$File_Path
按被屏蔽的执行次数排序的前 10 个主机
metadata.product_event_type = /(execution|application) block/ nocase
or security_result.threat_name = /application control/ nocase
security_result.action = "BLOCK"
$Host = strings.coalesce(principal.hostname, principal.asset.hostname, target.hostname)
match:
$Host
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
按执行被屏蔽次数排名的前 10 位用户
metadata.product_event_type = /(execution|application) block/ nocase
or security_result.threat_name = /application control/ nocase
security_result.action = "BLOCK"
$User = strings.coalesce(target.user.userid, target.user.user_display_name, principal.user.userid, principal.user.user_display_name)
match:
$User
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
被屏蔽的执行 - 每小时
metadata.product_event_type = /(execution|application) block/ nocase
or security_result.threat_name = /application control/ nocase
security_result.action = "BLOCK"
$Hours = timestamp.get_timestamp(metadata.event_timestamp.seconds,"%F %H:00")
match:
$Hours
outcome:
$Count = count(metadata.id)
order:
$Hours desc
Cloud Access Security Broker
此信息中心可提供云应用使用情况、安全事件、威胁和未经授权的访问的概览。
它会监控热门提醒、用户活动和操作，以及来源和目标 IP 地址，以增强政策执行和风险应对能力。
前 10 大用户代理
10 大热门应用
10 大 CASB 活动
前 10 大目标 IP 地址
排名前 10 的目标主机名
按操作划分的事件：允许与屏蔽
身份验证类型分布情况
10 大供应商提醒
排名前 10 的来源主机名
操作系统发行版
前 10 位用户
被屏蔽最多的前 10 位用户
按日志类型划分的指定时间段内的事件
前 10 大来源 IP
10 大活动类型
前 10 个网址
排名前 10 的 CASB 事件来源位置
图表名称
查询示例
前 10 大用户代理
metadata.log_type = /_CASB|SMARTSHEET|CISCO_SDWAN|NETSKOPE_CLIENT|ORACLE_NETSUITE|TAILSCALE/
$User_Agent = network.http.user_agent
$Log_Type = metadata.log_type
match:
$User_Agent, $Log_Type
outcome:
$Count = count(network.http.user_agent)
order:
$Count desc
limit:
10
10 大热门应用
metadata.log_type = /_CASB|SMARTSHEET|CISCO_SDWAN|NETSKOPE_CLIENT|ORACLE_NETSUITE|TAILSCALE/
$Application = target.application
$Log_Type = metadata.log_type
$Application != ""
match:
$Application, $Log_Type
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
10 大 CASB 活动
metadata.log_type = /_CASB|SMARTSHEET|CISCO_SDWAN|NETSKOPE_CLIENT|ORACLE_NETSUITE|TAILSCALE/
$Activity = strings.coalesce(security_result.summary, metadata.description)
$Log_Type = metadata.log_type
$Activity != ""
match:
$Activity, $Log_Type
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
前 10 大目标 IP 地址
metadata.log_type = /_CASB|SMARTSHEET|CISCO_SDWAN|NETSKOPE_CLIENT|ORACLE_NETSUITE|TAILSCALE/
$IP_Address = target.ip
$Log_Type = metadata.log_type
$IP_Address != ""
match:
$IP_Address, $Log_Type
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
排名前 10 的目标主机名
metadata.log_type = /_CASB|SMARTSHEET|CISCO_SDWAN|NETSKOPE_CLIENT|ORACLE_NETSUITE|TAILSCALE/ nocase
$Hostname = target.hostname
$Log_Type = metadata.log_type
match:
$Hostname, $Log_Type
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
按操作划分的事件：允许与屏蔽
metadata.log_type = /_CASB|SMARTSHEET|CISCO_SDWAN|NETSKOPE_CLIENT|ORACLE_NETSUITE|TAILSCALE/
security_result.action = "ALLOW"
or security_result.action = "BLOCK"
$Action = security_result.action
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
match:
$Action, $Date
outcome:
$Count = count(security_result.action)
身份验证类型分布情况
metadata.log_type = /_CASB|SMARTSHEET|CISCO_SDWAN|NETSKOPE_CLIENT|ORACLE_NETSUITE|TAILSCALE/
$Log_Type = metadata.log_type
$Product_Event = metadata.product_event_type
$Authentication = extensions.auth.type
match:
$Log_Type, $Product_Event, $Authentication
outcome:
$Count = count(metadata.id)
10 大供应商提醒
metadata.log_type = /_CASB|SMARTSHEET|CISCO_SDWAN|NETSKOPE_CLIENT|ORACLE_NETSUITE|TAILSCALE/
$Rule_Name = security_result.rule_name
$Log_Type = metadata.log_type
$Rule_Name != ""
match:
$Rule_Name, $Log_Type
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
10 大 CASB 活动
metadata.log_type = /_CASB|SMARTSHEET|CISCO_SDWAN|NETSKOPE_CLIENT|ORACLE_NETSUITE|TAILSCALE/ nocase
$Activity = strings.coalesce(security_result.summary, metadata.description)
$Log_Type = metadata.log_type
match:
$Activity, $Log_Type
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
10 大供应商提醒
metadata.log_type = /_CASB|SMARTSHEET|CISCO_SDWAN|NETSKOPE_CLIENT|ORACLE_NETSUITE|TAILSCALE/ nocase
$Rule_Name = security_result.rule_name
$Log_Type = metadata.log_type
match:
$Rule_Name, $Log_Type
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
排名前 10 的来源主机名
metadata.log_type = /_CASB|SMARTSHEET|CISCO_SDWAN|NETSKOPE_CLIENT|ORACLE_NETSUITE|TAILSCALE/
$Hostname = principal.hostname
$Log_Type = metadata.log_type
$Hostname != ""
match:
$Hostname, $Log_Type
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
操作系统发行版
metadata.log_type = /_CASB|SMARTSHEET|CISCO_SDWAN|NETSKOPE_CLIENT|ORACLE_NETSUITE|TAILSCALE/ nocase
$Platform = principal.platform
match:
$Platform
outcome:
$Count = count(metadata.id)
order:
$Count desc
前 10 位用户
metadata.log_type = /_CASB|SMARTSHEET|CISCO_SDWAN|NETSKOPE_CLIENT|ORACLE_NETSUITE|TAILSCALE/ nocase
$User = principal.user.userid
$Log_Type = metadata.log_type
match:
$User, $Log_Type
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
排名前 10 的目标主机名
metadata.log_type = /_CASB|SMARTSHEET|CISCO_SDWAN|NETSKOPE_CLIENT|ORACLE_NETSUITE|TAILSCALE/
$Hostname = target.hostname
$Log_Type = metadata.log_type
$Hostname != ""
match:
$Hostname, $Log_Type
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
被屏蔽最多的前 10 位用户
metadata.log_type = /_CASB|SMARTSHEET|CISCO_SDWAN|NETSKOPE_CLIENT|ORACLE_NETSUITE|TAILSCALE/ nocase
security_result.action = "BLOCK"
$User = principal.user.userid
$Log_Type = metadata.log_type
match:
$User, $Log_Type
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
按日志类型划分的指定时间段内的事件
metadata.log_type = /_CASB|SMARTSHEET|CISCO_SDWAN|NETSKOPE_CLIENT|ORACLE_NETSUITE|TAILSCALE/ nocase
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
$Log_Type = metadata.log_type
match:
$Date, $Log_Type
outcome:
$Count = count(metadata.id)
order:
$Date asc
前 10 大用户代理
metadata.log_type = /_CASB|SMARTSHEET|CISCO_SDWAN|NETSKOPE_CLIENT|ORACLE_NETSUITE|TAILSCALE/ nocase
$User_Agent = network.http.user_agent
$Log_Type = metadata.log_type
match:
$User_Agent, $Log_Type
outcome:
$Count = count(network.http.user_agent)
order:
$Count desc
limit:
10
按操作划分的事件：允许与屏蔽
metadata.log_type = /_CASB|SMARTSHEET|CISCO_SDWAN|NETSKOPE_CLIENT|ORACLE_NETSUITE|TAILSCALE/ nocase
security_result.action = "ALLOW"
or security_result.action = "BLOCK"
$Action = security_result.action
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
match:
$Action, $Date
outcome:
$Count = count(security_result.action)
10 大热门应用
metadata.log_type = /_CASB|SMARTSHEET|CISCO_SDWAN|NETSKOPE_CLIENT|ORACLE_NETSUITE|TAILSCALE/ nocase
$Application = target.application
$Log_Type = metadata.log_type
match:
$Application, $Log_Type
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
前 10 大来源 IP
metadata.log_type = /_CASB|SMARTSHEET|CISCO_SDWAN|NETSKOPE_CLIENT|ORACLE_NETSUITE|TAILSCALE/ nocase
$IP_Address = principal.ip
$Log_Type = metadata.log_type
match:
$IP_Address, $Log_Type
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
前 10 大来源 IP
metadata.log_type = /_CASB|SMARTSHEET|CISCO_SDWAN|NETSKOPE_CLIENT|ORACLE_NETSUITE|TAILSCALE/
$IP_Address = principal.ip
$Log_Type = metadata.log_type
$IP_Address != ""
match:
$IP_Address, $Log_Type
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
10 大活动类型
metadata.log_type = /_CASB|SMARTSHEET|CISCO_SDWAN|NETSKOPE_CLIENT|ORACLE_NETSUITE|TAILSCALE/ nocase
$Event_Type = metadata.event_type
$Log_Type = metadata.log_type
match:
$Event_Type, $Log_Type
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
操作系统发行版
metadata.log_type = /_CASB|SMARTSHEET|CISCO_SDWAN|NETSKOPE_CLIENT|ORACLE_NETSUITE|TAILSCALE/
$Platform = principal.platform
match:
$Platform
outcome:
$Count = count(metadata.id)
order:
$Count desc
10 大活动类型
metadata.log_type = /_CASB|SMARTSHEET|CISCO_SDWAN|NETSKOPE_CLIENT|ORACLE_NETSUITE|TAILSCALE/
$Event_Type = metadata.event_type
$Log_Type = metadata.log_type
match:
$Event_Type, $Log_Type
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
前 10 个网址
metadata.log_type = /_CASB|SMARTSHEET|CISCO_SDWAN|NETSKOPE_CLIENT|ORACLE_NETSUITE|TAILSCALE/
$URL = target.url
$Log_Type = metadata.log_type
$URL != ""
match:
$URL, $Log_Type
outcome:
$Count = count(target.url)
order:
$Count desc
limit:
10
按日志类型划分的指定时间段内的事件
metadata.log_type = /_CASB|SMARTSHEET|CISCO_SDWAN|NETSKOPE_CLIENT|ORACLE_NETSUITE|TAILSCALE/
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
$Log_Type = metadata.log_type
match:
$Date, $Log_Type
outcome:
$Count = count(metadata.id)
order:
$Date asc
排名前 10 的 CASB 事件来源位置
metadata.log_type = /_CASB|SMARTSHEET|CISCO_SDWAN|NETSKOPE_CLIENT|ORACLE_NETSUITE|TAILSCALE/ nocase
$Country = principal.location.country_or_region
$Latitude = principal.location.region_latitude
$Latitude != 0
$Longitude = principal.location.region_longitude
$Longitude != 0
match:
$Country, $Latitude, $Longitude
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
排名前 10 的 CASB 事件来源位置
metadata.log_type = /_CASB|SMARTSHEET|CISCO_SDWAN|NETSKOPE_CLIENT|ORACLE_NETSUITE|TAILSCALE/
$Country = principal.location.country_or_region
$Latitude = principal.location.region_latitude
$Latitude != 0
$Longitude = principal.location.region_longitude
$Longitude != 0
match:
$Country, $Latitude, $Longitude
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
被屏蔽最多的前 10 位用户
metadata.log_type = /_CASB|SMARTSHEET|CISCO_SDWAN|NETSKOPE_CLIENT|ORACLE_NETSUITE|TAILSCALE/
security_result.action = "BLOCK"
$User = principal.user.userid
$Log_Type = metadata.log_type
$User != ""
match:
$User, $Log_Type
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
前 10 个网址
metadata.log_type = /_CASB|SMARTSHEET|CISCO_SDWAN|NETSKOPE_CLIENT|ORACLE_NETSUITE|TAILSCALE/ nocase
$URL = target.url
$Log_Type = metadata.log_type
match:
$URL, $Log_Type
outcome:
$Count = count(target.url)
order:
$Count desc
limit:
10
前 10 位用户
metadata.log_type = /_CASB|SMARTSHEET|CISCO_SDWAN|NETSKOPE_CLIENT|ORACLE_NETSUITE|TAILSCALE/
$User = principal.user.userid
$Log_Type = metadata.log_type
$User != ""
match:
$User, $Log_Type
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
身份验证类型分布情况
metadata.log_type = /_CASB|SMARTSHEET|CISCO_SDWAN|NETSKOPE_CLIENT|ORACLE_NETSUITE|TAILSCALE/ nocase
$Log_Type = metadata.log_type
$Product_Event = metadata.product_event_type
$Authentication = extensions.auth.type
match:
$Log_Type, $Product_Event, $Authentication
outcome:
$Count = count(metadata.id)
排名前 10 的来源主机名
metadata.log_type = /_CASB|SMARTSHEET|CISCO_SDWAN|NETSKOPE_CLIENT|ORACLE_NETSUITE|TAILSCALE/ nocase
$Hostname = principal.hostname
$Log_Type = metadata.log_type
match:
$Hostname, $Log_Type
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
前 10 大目标 IP 地址
metadata.log_type = /_CASB|SMARTSHEET|CISCO_SDWAN|NETSKOPE_CLIENT|ORACLE_NETSUITE|TAILSCALE/ nocase
$IP_Address = target.ip
$Log_Type = metadata.log_type
match:
$IP_Address, $Log_Type
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
Chrome 企业进阶版运营
此信息中心简要介绍了 Chrome 企业进阶版与 Google SecOps 的集成。这包括有关受管理的浏览器和个人资料的信息。
旁加载的浏览器扩展程序
安装次数最多的浏览器扩展程序
Chrome 活动
Chrome 遥测运行状况
按 Chrome 版本列出的前 10 个受管理的浏览器
按操作系统统计的前 10 个受管理的浏览器
管理组织
最常用的浏览器扩展程序
安装的浏览器扩展程序数量最多的前 10 位用户
按权限屏蔽浏览器扩展程序
安装次数最少的浏览器扩展程序
图表名称
查询示例
旁加载的浏览器扩展程序
metadata.log_type = "CHROME_MANAGEMENT"
metadata.product_event_type = "browserExtensionInstallEvent"
target.resource.attribute.labels["extension_source"] != "CHROME_WEBSTORE"
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
$Source_Store = target.resource.attribute.labels["extension_source"]
$Browser_Extension = target.resource.name
$Browser_Extension_ID = target.resource.product_object_id
match:
$Date, $Source_Store, $Browser_Extension, $Browser_Extension_ID
安装次数最多的浏览器扩展程序
metadata.log_type = "CHROME_MANAGEMENT"
metadata.product_event_type = "browserExtensionInstallEvent"
target.resource.attribute.labels["extension_action"] = "INSTALL"
$Browser_Extension = target.resource.name
$Browser_Extension_ID = target.resource.product_object_id
$Extension_Version = target.resource.attribute.labels["extension_version"]
$Extension_Source = target.resource.attribute.labels["extension_source"]
match:
$Browser_Extension, $Browser_Extension_ID, $Extension_Version, $Extension_Source
outcome:
$Count = count(metadata.id)
order:
$Count desc
Chrome 活动
metadata.log_type = "CHROME_MANAGEMENT"
metadata.product_event_type != ""
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
$Event_Type = metadata.product_event_type
match:
$Date, $Event_Type
outcome:
$Count = count(metadata.id)
Chrome 遥测运行状况
metadata.log_type = "CHROME_MANAGEMENT"
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
match:
$Date
outcome:
$Count = count(metadata.id)
order:
$Date desc
按 Chrome 版本列出的前 10 个受管理的浏览器
metadata.log_type = "CHROME_MANAGEMENT"
network.http.parsed_user_agent.browser_version != ""
principal.application != ""
$Browser_Version = network.http.parsed_user_agent.browser_version
$Application = principal.application
match:
$Browser_Version, $Application
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
按操作系统统计的前 10 个受管理的浏览器
metadata.log_type = "CHROME_MANAGEMENT"
network.http.parsed_user_agent.os != ""
principal.application != ""
$OS = network.http.parsed_user_agent.os
$Application = principal.application
match:
$OS, $Application
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
管理组织
metadata.log_type = "CHROME_MANAGEMENT"
target.domain.name != ""
$Organization = target.domain.name
match:
$Organization
outcome:
$Count = count(principal.user.email_addresses)
order:
$Count desc
最常用的浏览器扩展程序
metadata.log_type = "CHROME_MANAGEMENT"
metadata.product_event_type = "browserExtensionInstallEvent"
target.resource.attribute.labels["extension_action"] = "INSTALL"
or target.resource.attribute.labels["extension_action"] = "UPDATE"
$Browser_Extension = target.resource.name
$Browser_Extension_ID = target.resource.product_object_id
$Extension_Version = target.resource.attribute.labels["extension_version"]
$Extension_Source = target.resource.attribute.labels["extension_source"]
match:
$Browser_Extension, $Browser_Extension_ID, $Extension_Version, $Extension_Source
outcome:
$Total_Unique_Instances = count(metadata.id)
order:
$Total_Unique_Instances desc
安装的浏览器扩展程序数量最多的前 10 位用户
metadata.log_type = "CHROME_MANAGEMENT"
metadata.product_event_type = "browserExtensionInstallEvent"
$User = principal.user.email_addresses
match:
$User
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
按权限屏蔽浏览器扩展程序
metadata.log_type = "CHROME_MANAGEMENT"
metadata.product_event_type = "extensionTelemetryEvent"
target.resource.name = "COOKIES_GET_ALL_INFO"
or target.resource.name = "COOKIES_GET_INFO"
or target.resource.name = "TABS_API_INFO"
$Browser_Extension = target.resource_ancestors.name
$Browser_Extension_ID = target.resource_ancestors.product_object_id
$Extension_Version = target.resource_ancestors.attribute.labels["extension_version"]
$Extension_Source = target.resource_ancestors.attribute.labels["extension_source"]
$Severity = security_result.severity
match:
$Browser_Extension, $Browser_Extension_ID, $Extension_Version, $Extension_Source, $Severity
outcome:
$Permissions = array_distinct(target.resource.name)
$Count = count(metadata.id)
order:
$Browser_Extension asc
安装次数最少的浏览器扩展程序
metadata.log_type = "CHROME_MANAGEMENT"
metadata.product_event_type = "browserExtensionInstallEvent"
target.resource.attribute.labels["extension_action"] = "INSTALL"
$Browser_Extension = target.resource.name
$Browser_Extension_ID = target.resource.product_object_id
$Extension_Version = target.resource.attribute.labels["extension_version"]
$Extension_Source = target.resource.attribute.labels["extension_source"]
match:
$Browser_Extension, $Browser_Extension_ID, $Extension_Version, $Extension_Source
outcome:
$Count = count(metadata.id)
order:
$Count asc
Chrome 企业进阶版安全服务
此信息中心可实时提供与 Chrome 相关的安全事件的分析洞察，
例如敏感数据传输、访问高风险网域、数据保护事件、恶意软件和钓鱼式攻击尝试，以及密码安全问题。它使安全团队能够监控、调查和应对基于 Chrome 的威胁。
Chrome DLP：数据洞察
Chrome DLP：敏感网页传输总次数
Chrome DLP：敏感文件打印总数
Chrome DLP：敏感文件上传总数
密码重复使用事件
高风险 Chrome 网域
密码盗用事件
恶意软件事件
访问不安全的网站
钓鱼式攻击事件
Chrome DLP：敏感内容传输总次数
Chrome DLP：敏感文件下载总数
Chrome DLP：检测到敏感内容的用户
Chrome DLP：敏感内容网域
图表名称
查询示例
Chrome DLP：数据洞察
metadata.product_event_type = /sensitiveDataEvent|contentTransferEvent/ nocase
security_result.summary = /CONTENT_MATCHED_SENSITIVE_DATA_TYPES/ nocase or extracted.fields["reason"] = /CONTENT_MATCHED_SENSITIVE_DATA_TYPES/ nocase
$Sensitive_Data_Type = extracted.fields["matched_detectors[0].detector_id"]
$Trigger_Type = security_result.about.labels.value
match:
$Sensitive_Data_Type, $Trigger_Type
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
Chrome DLP：敏感网页传输总次数
metadata.product_event_type = /Sensitive data transfer|SENSITIVE_DATA_TRANSFER|sensitiveDataEvent|sensitiveDataTransferEvent/ nocase
security_result.about.labels.value = /web_content_upload/ nocase
outcome:
$Sensitive_Web_Transfer = count(metadata.id)
Chrome DLP：敏感文件打印总数
metadata.product_event_type = /Sensitive data transfer|SENSITIVE_DATA_TRANSFER|sensitiveDataEvent|sensitiveDataTransferEvent/ nocase
security_result.about.labels.value = /print/ nocase
outcome:
$Sensitive_File_Print = count(metadata.id)
Chrome DLP：敏感文件上传总数
metadata.product_event_type = /Sensitive data transfer|SENSITIVE_DATA_TRANSFER|sensitiveDataEvent|sensitiveDataTransferEvent/ nocase
security_result.about.labels.value = /file_upload/ nocase
outcome:
$Sensitive_File_Upload = count(metadata.id)
密码重复使用事件
metadata.product_event_type = /PASSWORD_REUSE|passwordReuseEvent/ nocase
$Action = security_result.action_details
$Severity = security_result.severity
$User = strings.coalesce(principal.user.userid , principal.user.user_display_name, principal.user.email_addresses)
$Summary = strings.coalesce(security_result.summary, security_result.description, metadata.product_event_type, security_result.category_details)
$URL = target.url
match:
$User, $Summary, $Severity, $Action, $URL
outcome:
$Date = timestamp.get_timestamp(max(metadata.event_timestamp.seconds), "%F %T")
$Count = count(metadata.id)
order:
$Count desc
高风险 Chrome 网域
extracted.fields["url_info.risk_infos[0].risk_level"] = "HIGH"
target.url != ""
$URL = target.url
$Category = security_result.category
$Action = security_result.action_details
$Severity = principal.security_result.severity
$Risk_Level = extracted.fields["url_info.risk_infos[0].risk_level"]
$Threat_Type = extracted.fields["url_info.risk_infos[0].threat_type"]
$Domain = re.capture(target.url, `^(?:https?:\/\/)?(?:www\.)?([^\/:]+)`)
match:
$URL, $Domain, $Category, $Severity, $Risk_Level, $Threat_Type, $Action
outcome:
$Date = timestamp.get_timestamp(max(metadata.event_timestamp.seconds), "%F %T")
$Count = count(metadata.id)
order:
$Count desc
密码盗用事件
metadata.product_event_type = /passwordBreachEvent/ nocase
$User = strings.coalesce(principal.user.userid, principal.user.user_display_name, principal.user.email_addresses, target.user.userid, target.user.user_display_name, target.user.email_addresses)
$Summary = strings.coalesce(security_result.summary, security_result.description, metadata.product_event_type, security_result.category_details)
$URL = target.url
$Action = security_result.action_details
$Severity = security_result.severity
match:
$User, $Summary, $URL, $Severity, $Action
outcome:
$Date = timestamp.get_timestamp(max(metadata.event_timestamp.seconds), "%F %T")
$Count = count(metadata.id)
order:
$Date desc
恶意软件事件
metadata.product_event_type = /dangerousDownloadEvent|contentTransferEvent/ nocase
(extracted.fields["content_risk[0].risk_level"] = "HIGH" or extracted.fields["content_risk_level"] = "HIGH")
(extracted.fields["content_risk[0].threat_type"] = "MALWARE")
$File_Hash = target.file.sha256
$File_Path = target.file.full_path
$Category = security_result.category
$Severity = security_result.severity
$Risk_Level = strings.coalesce(extracted.fields["content_risk[0].risk_level"],extracted.fields["content_risk_level"])
match:
$File_Path, $File_Hash, $Category, $Severity, $Risk_Level
outcome:
$Date = timestamp.get_timestamp(max(metadata.event_timestamp.seconds), "%F %T")
$Summary = array_distinct(security_result.summary)
$Action = array_distinct(security_result.action_details)
$Count = count(metadata.id)
order:
$Count desc
访问不安全的网站
metadata.product_event_type = /badNavigationEvent/ nocase
(extracted.fields["url_info.risk_infos[0].risk_level"] = "HIGH" OR extracted.fields["url_info.risk_level"] = "HIGH")
//(extracted.fields["content_risk[0].threat_type"] = "MALWARE" or extracted.fields["tab_url_info.threat_type"] = "MALWARE")
$URL = target.url
$Category = security_result.category
$Threat_Type = extracted.fields["url_info.risk_infos[0].threat_type"]
$User = strings.coalesce(principal.user.userid, principal.user.user_display_name, principal.user.email_addresses)
$Risk_Level = strings.coalesce(extracted.fields["url_info.risk_infos[0].risk_level"], extracted.fields["url_info.risk_level"])
match:
$User, $URL, $Category, $Threat_Type, $Risk_Level
outcome:
$Action = array_distinct(security_result.action_details)
$Date = timestamp.get_timestamp(max(metadata.event_timestamp.seconds), "%F %T")
$Count = count(metadata.id)
order:
$Count desc
钓鱼式攻击事件
extracted.fields["url_info.risk_infos[0].threat_type"] = "SOCIAL_ENGINEERING"
$URL = target.url
$Category = security_result.category
$Action = security_result.action_details
$Severity = principal.security_result.severity
$Risk_Level = extracted.fields["url_info.risk_infos[0].risk_level"]
$User = strings.coalesce(principal.user.userid, principal.user.user_display_name, principal.user.email_addresses, target.user.userid, target.user.user_display_name, target.user.email_addresses)
match:
$User, $URL, $Category, $Severity, $Risk_Level, $Action
outcome:
$Date = timestamp.get_timestamp(max(metadata.event_timestamp.seconds), "%F %T")
$Count = count(metadata.id)
order:
$Count desc
Chrome DLP：敏感内容传输总次数
metadata.product_event_type = /Sensitive data transfer|SENSITIVE_DATA_TRANSFER|sensitiveDataEvent|sensitiveDataTransferEvent/ nocase
outcome:
$Total_Sensitive_Content_Transfer = count(metadata.id)
Chrome DLP：敏感文件下载总数
metadata.product_event_type = /Sensitive data transfer|SENSITIVE_DATA_TRANSFER|sensitiveDataEvent|sensitiveDataTransferEvent/ nocase
security_result.about.labels.value = /file_download/ nocase
outcome:
$Sensitive_File_Download = count(metadata.id)
Chrome DLP：检测到敏感内容的用户
metadata.product_event_type = /sensitiveDataEvent/ nocase or security_result.summary = /CONTENT_MATCHED_SENSITIVE_DATA_TYPES/ nocase
$Device_IP = extracted.fields["remote_ip"]
$Device_ID = extracted.fields["device_id"]
$Action = security_result.action_details
$Severity = principal.security_result.severity
$Trigger_Type = security_result.about.labels.value
$Sensitive_Data_Type = extracted.fields["matched_detectors[0].display_name"]
$Device_User = strings.coalesce(extracted.fields["device_user"], extracted.fields["profile_user"])
match:
$Device_User, $Device_IP, $Device_ID, $Trigger_Type, $Sensitive_Data_Type, $Action, $Severity
outcome:
$Date = timestamp.get_timestamp(max(metadata.event_timestamp.seconds), "%F %T")
$Count = count(metadata.id)
order:
$Count desc
Chrome DLP：敏感内容网域
metadata.product_event_type = /Sensitive data transfer|SENSITIVE_DATA_TRANSFER|sensitiveDataEvent|sensitiveDataTransferEvent/ nocase
or security_result.summary = /CONTENT_MATCHED_SENSITIVE_DATA_TYPES/ nocase
target.url != ""
$Domain = target.url
$Action = security_result.action_details
$Severity = security_result.severity
$Sensitive_Data_Type = extracted.fields["matched_detectors[0].display_name"]
match:
$Domain, $Action, $Severity, $Sensitive_Data_Type
outcome:
$Date = timestamp.get_timestamp(max(metadata.event_timestamp.seconds), "%F %T")
$Count = count(metadata.id)
order:
$Count desc
CIS Controls 合规性概览
此信息中心可清晰显示 CIS 关键安全控制措施的遵从情况，从而加强安全治理。它会跟踪重要的合规性指标，例如资产清单准确性、漏洞修复进度、备份可靠性、访问权限控制执行情况和突发事件响应准备情况。
不活跃用户（超过 7 天）
最近被屏蔽的应用执行
单点登录身份验证摘要
IDS / IPS 事件分布
特权账号 MFA 事件随时间的变化趋势
存在严重/高严重程度漏洞的前 10 个系统
近期钓鱼式攻击事件
随着时间的推移，安全系数低的加密算法
权限随时间的变化
最近创建的用户账号
用户账号创建随时间的变化
VPN 连接成功与失败随时间变化的趋势
恶意软件检测随时间的变化
高严重程度/严重程度的漏洞（按存在时间划分）
按登录次数排名的前 10 个服务账号
恶意软件文件详细信息
基于网络的恶意活动
特权账号活动和修改
按操作统计的登录事件随时间的变化趋势
数据安全事件分布
数据删除和清除事件
随时间推移的漏洞扫描
一段时间内的钓鱼式攻击事件
近期备份事件
按严重程度划分的十大电子邮件威胁
指定时间段内的备份事件
设备总数随时间的变化情况
被屏蔽的应用执行次数排名前 10
针对特权账号的 MFA 尝试被阻止
图表名称
查询示例
不活跃用户（超过 7 天）
stage inactive_users {
(metadata.event_type = "USER_UNCATEGORIZED"
or metadata.event_type = "USER_LOGIN"
or metadata.event_type = "USER_LOGOUT"
or metadata.event_type = "USER_CREATION"
or metadata.event_type = "USER_CHANGE_PASSWORD"
or metadata.event_type = "USER_CHANGE_PERMISSIONS"
or metadata.event_type = "USER_BADGE_IN"
or metadata.event_type = "USER_DELETION"
or metadata.event_type = "USER_RESOURCE_CREATION"
or metadata.event_type = "USER_RESOURCE_UPDATE_CONTENT"
or metadata.event_type = "USER_RESOURCE_UPDATE_PERMISSIONS"
or metadata.event_type = "USER_COMMUNICATION"
or metadata.event_type = "USER_RESOURCE_ACCESS"
or metadata.event_type = "USER_RESOURCE_DELETION")
principal.user.last_login_time.seconds > 0
$Event_Type = metadata.event_type
$User = strings.coalesce(principal.user.userid, principal.user.user_display_name, principal.user.email_addresses)
$User != ""
$Log_Type = metadata.log_type
match:
$User, $Event_Type, $Log_Type
outcome:
$Logtime = max(metadata.event_timestamp.seconds)
$Lastime = max(principal.user.last_login_time.seconds)
$Time_Difference = cast.as_int(max(metadata.event_timestamp.seconds - principal.user.last_login_time.seconds)/86400)
condition:
$Time_Difference > 7
}
$User = $inactive_users.User
$Event_Type = $inactive_users.Event_Type
$Log_Type = $inactive_users.Log_Type
match:
$User, $Event_Type, $Log_Type
outcome:
$Last_Login = timestamp.get_timestamp(max($inactive_users.Lastime))
$Latest_Login = timestamp.get_timestamp(max($inactive_users.Logtime))
$Time_Difference = max($inactive_users.Time_Difference)
order:
$Time_Difference desc
最近被屏蔽的应用执行
(metadata.product_event_type = /(execution|application) block/ nocase or security_result.summary = /(execution|application) block/ or metadata.description = /(execution|application) block/ nocase or security_result.threat_name = /application control/ nocase)
(security_result.action = "BLOCK" or security_result.action_details = /block/ nocase or (target.resource.attribute.labels.key = "categoryBehavior" and target.resource.attribute.labels.value = /blocked/ nocase))
$Application = strings.coalesce(about.file.full_path, target.process.file.full_path, additional.fields["fname"], principal.application, target.application)
$Description = strings.coalesce(target.resource.attribute.labels["categoryTupleDescription"], security_result.summary, metadata.product_event_type, security_result.description, metadata.description, security_result.action_details)
$Log_Type = metadata.log_type
$Severity = security_result.severity
match:
$Application, $Description, $Severity, $Log_Type
outcome:
$Count = count(metadata.id)
$Date = timestamp.get_timestamp(max(metadata.event_timestamp.seconds), "%F %T")
order:
$Count desc
单点登录身份验证摘要
extensions.auth.type = "SSO"
(metadata.event_type = "USER_LOGIN" or metadata.event_type = "USER_LOGOUT")
$Description = strings.coalesce(security_result.summary, metadata.description, security_result.description, metadata.product_event_type)
$User = strings.coalesce(principal.user.userid, principal.user.user_display_name, principal.user.email_addresses,target.user.userid, target.user.user_display_name, target.user.email_addresses)
$Source_Hostname = strings.coalesce(principal.hostname, principal.asset.hostname)
$Source_IP = strings.coalesce(principal.ip,principal.asset.ip)
$Action = security_result.action
$Severity = security_result.severity
match:
$User, $Description, $Source_Hostname, $Source_IP, $Action, $Severity
outcome:
$Count = count(metadata.id)
$Date = timestamp.get_timestamp(max(metadata.event_timestamp.seconds), "%F %T")
order:
$Severity desc, $Date desc
IDS / IPS 事件分布
metadata.log_type = /_IDS|_IPS|AWS_SECURITY_HUB|EXTRAHOP|GUARDDUTY|MICROSOFT_ATA|ORCA|OSSEC|SURICATA_EVE|VMWARE_TANZU/ nocase
(metadata.event_type = "SCAN_UNCATEGORIZED"
or metadata.event_type = "SCAN_NETWORK"
or metadata.event_type = "NETWORK_CONNECTION"
or metadata.event_type = "NETWORK_DHCP"
or metadata.event_type = "NETWORK_DNS"
or metadata.event_type = "NETWORK_FLOW"
or metadata.event_type = "NETWORK_FTP"
or metadata.event_type = "NETWORK_HTTP"
or metadata.event_type = "NETWORK_HTTP"
or metadata.event_type = "NETWORK_SMTP")
$Category = security_result.category
match:
$Category
outcome:
$Count = count(metadata.id)
order:
$Count desc
特权账号 MFA 事件随时间的变化趋势
(re.regex(metadata.product_name, "MULTI-FACTOR_AUTHENTICATION") or re.regex(additional.fields["AuthenticationRequirement"], `multiFactorAuthentication`) nocase or re.regex(security_result.detection_fields.value, `MFA`) nocase or re.regex(metadata.product_event_type, `mfa(?:\S)?auth|auth(?:.*)?mfa`) nocase)
$User = strings.coalesce(principal.user.userid, principal.user.user_display_name, principal.user.email_addresses, target.user.userid, target.user.user_display_name,target.user.email_addresses)
$User = /admin|root|administrator|security|support|default/ nocase //It will be updated as per the client's environment.
$Action = security_result.action
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
match:
$Date, $Action
outcome:
$Count = count(metadata.id)
order:
$Date asc
存在严重/高严重程度漏洞的前 10 个系统
metadata.log_type = /ARMIS_VULNERABILITIES|FINGERPRINT_JS|NUCLEUS_VULNERABILITY|QUALYS_ASSET_CONTEXT|QUALYS_SCAN|QUALYS_VIRTUAL_SCANNER|QUALYS_VM|RAPID7_INSIGHT|RAPID7_NEXPOSE|SNYK_SDLC|SPUR_FEEDS|STACKHAWK|SUBLIMESECURITY|SYMANTEC_SA|TENABLE_IO|TENABLE_OT|TENABLE_SC|UPGUARD|URLSCAN_IO/ nocase
(principal.asset.vulnerabilities.severity = "HIGH" or extensions.vulns.vulnerabilities.severity = "HIGH" or security_result.severity = "HIGH"
or target.asset.vulnerabilities.severity = "HIGH") or (principal.asset.vulnerabilities.severity = "CRITICAL" or extensions.vulns.vulnerabilities.severity = "CRITICAL"
or security_result.severity = "CRITICAL" or target.asset.vulnerabilities.severity = "CRITICAL")
$Severity =
if (principal.asset.vulnerabilities.severity != "UNKNOWN_SEVERITY",
principal.asset.vulnerabilities.severity,
if (target.asset.vulnerabilities.severity != "UNKNOWN_SEVERITY",
target.asset.vulnerabilities.severity,
if (extensions.vulns.vulnerabilities.severity != "UNKNOWN_SEVERITY",
extensions.vulns.vulnerabilities.severity,
"UNKNOWN_SEVERITY")))
$Vulnerability = strings.coalesce(
if(principal.asset.vulnerabilities.name != "" and principal.asset.vulnerabilities.description != "",
strings.concat(principal.asset.vulnerabilities.name, " : ", principal.asset.vulnerabilities.description),
strings.coalesce(principal.asset.vulnerabilities.name, principal.asset.vulnerabilities.description)),
if(additional.fields["ScanReference"] != "" and metadata.description != "",
strings.concat(additional.fields["ScanReference"], " : ", metadata.description),
strings.coalesce(additional.fields["ScanReference"], metadata.description)),
if(extensions.vulns.vulnerabilities.vendor_vulnerability_id != "" and extensions.vulns.vulnerabilities.description != "",
strings.concat(extensions.vulns.vulnerabilities.vendor_vulnerability_id, " : ", extensions.vulns.vulnerabilities.description),
strings.coalesce(extensions.vulns.vulnerabilities.vendor_vulnerability_id, extensions.vulns.vulnerabilities.description)
)
)
($Vulnerability != " : " and $Vulnerability != "")
$Hostname = strings.coalesce(principal.hostname,principal.asset.hostname, target.hostname, target.asset.hostname)
$Log_Type = metadata.log_type
match:
$Hostname, $Vulnerability, $Severity, $Log_Type
outcome:
$Date = timestamp.get_timestamp(max(metadata.event_timestamp.seconds), "%F %T")
$Count = count(strings.coalesce(extensions.vulns.vulnerabilities.name, extensions.vulns.vulnerabilities.description, extensions.vulns.vulnerabilities.vendor_vulnerability_id,
principal.asset.vulnerabilities.name, target.asset.vulnerabilities.name, additional.fields["ScanReference"]))
order:
$Count desc
limit:
10
近期钓鱼式攻击事件
metadata.log_type = /MAIL|ABNORMAL_SECURITY|AREA1|COFENSE_TRIAGE|FIREEYE|FORCEPOINT|FORTINET|KNOWBE4_PHISHER|MICROSOFT_GRAPH_ALERT|MIMECAST_URL_LOGS|OBSERVEIT|OFFICE_365|PHISHLABS|PROOFPOINT|SYMANTEC_VIP|VOLTAGE|WORKSPACE_ALERTS/ nocase
(security_result.category = "MAIL_PHISHING" or re.regex(security_result.threat_name,`Phish`) nocase or re.regex(security_result.category_details,`Phish`)nocase)
security_result.threat_name != "NOT_PHISHING"
$Security_Event_Type = metadata.product_event_type
$Summary = strings.coalesce(security_result.summary, metadata.description, security_result.description)
$Sender = strings.coalesce(network.email.from, principal.user.email_addresses)
$Subject = network.email.subject
$File_Path = strings.coalesce(target.file.full_path, about.file.full_path, target.file.names)
$File_Type = strings.coalesce(about.file.mime_type, target.file.mime_type)
match:
$Security_Event_Type, $Sender, $Subject, $File_Path, $File_Type, $Summary
outcome:
$Count = count(metadata.id)
$Receiver_Count = count_distinct(strings.coalesce(network.email.to, network.email.reply_to, target.user.email_addresses))
$Date = timestamp.get_timestamp(max(metadata.event_timestamp.seconds), "%F %T")
order:
$Count desc
随着时间的推移，安全系数低的加密算法
(((target.resource.attribute.labels.key = "keyProperties_type" or target.resource.attribute.labels.key = "requestParameters.keySpec" or target.resource.attribute.labels.key = /key/ nocase) and target.resource.attribute.labels.value = /^(RSA-)|DES|RC4|MD5|SHA1|SHA-1/) or network.tls.cipher = /^(RSA-)|DES|RC4|MD5|SHA1|SHA-1/)
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
$Log_Type = metadata.log_type
match:
$Date, $Log_Type
outcome:
$Count = count(metadata.id)
order:
$Date asc
权限随时间的变化
(metadata.event_type = "RESOURCE_PERMISSIONS_CHANGE" or metadata.event_type = "USER_CHANGE_PERMISSIONS" or metadata.event_type = "USER_RESOURCE_UPDATE_PERMISSIONS")
security_result.action = "ALLOW"
$Log_Type = metadata.log_type
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
match:
$Date, $Log_Type
outcome:
$Count = count(metadata.id)
order:
$Date asc
最近创建的用户账号
metadata.event_type = "USER_CREATION"
security_result.action = "ALLOW"
$Log_Type = metadata.log_type
$Source_IP = strings.coalesce(principal.ip,principal.asset.ip)
$Source_Hostname = strings.coalesce(principal.hostname, principal.asset.hostname, principal.mac, principal.asset.mac, extracted.fields["access_device.hostname"],
if(target.resource.attribute.labels.key = "Private DnsName",target.resource.attribute.labels.value, ""),
principal.resource.product_object_id, target.resource.product_object_id,
if(security_result.detection_fields.key = "actor_2",security_result.detection_fields.value, "")
)
$Initiator = strings.coalesce(principal.user.userid, principal.user.user_display_name, principal.user.email_addresses)
$User_Created = strings.coalesce(target.user.userid, target.user.user_display_name, target.user.email_addresses)
match:
$Log_Type, $Source_IP, $Source_Hostname, $Initiator, $User_Created
outcome:
$Date = timestamp.get_timestamp(max(metadata.event_timestamp.seconds), "%F %T ")
order:
$Date desc
用户账号创建随时间的变化
metadata.event_type = "USER_CREATION"
security_result.action = "ALLOW"
$Log_Type = metadata.log_type
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
match:
$Date, $Log_Type
outcome:
$Count = count(metadata.id)
order:
$Date asc
VPN 连接成功与失败随时间变化的趋势
metadata.log_type = /VPN|ZSCALER_ZPA|ZSCALER_DECEPTION|TWINGATE|SYMANTEC_VIP_AUTHHUB/ nocase
$Action = if ((strings.coalesce(security_result.summary, metadata.product_event_type, extracted.fields["connection-attempt-status"]) = /Success|Authenticated/ nocase), "SUCCESS", "FAIL")
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
match:
$Date, $Action
outcome:
$Count = count(metadata.id)
order:
$Count desc
恶意软件检测随时间的变化
(metadata.product_event_type = /malware/ nocase or security_result.summary = /malware/ nocase or security_result.category_details = /malware/ nocase or metadata.description = /malware/ nocase or security_result.threat_name = /malware/ nocase or security_result.rule_name = /malware/ nocase or security_result.category = "SOFTWARE_MALICIOUS")
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
$Action = security_result.action
match :
$Date, $Action
outcome:
$Count = count(metadata.id)
order:
$Date asc
高严重程度/严重程度的漏洞（按存在时间划分）
(principal.asset.vulnerabilities.severity = "CRITICAL" or extensions.vulns.vulnerabilities.severity = "CRITICAL"
or security_result.severity = "CRITICAL" or target.asset.vulnerabilities.severity = "CRITICAL") OR
(principal.asset.vulnerabilities.severity = "HIGH" or extensions.vulns.vulnerabilities.severity = "HIGH"
or security_result.severity = "HIGH" or target.asset.vulnerabilities.severity = "HIGH")
(timestamp.as_unix_seconds(additional.fields["first_found"]) > 0 or extensions.vulns.vulnerabilities.first_found.seconds > 0)
$Severity =
if (principal.asset.vulnerabilities.severity != "UNKNOWN_SEVERITY",
principal.asset.vulnerabilities.severity,
if (target.asset.vulnerabilities.severity != "UNKNOWN_SEVERITY",
target.asset.vulnerabilities.severity,
if (extensions.vulns.vulnerabilities.severity != "UNKNOWN_SEVERITY",
extensions.vulns.vulnerabilities.severity,
"UNKNOWN_SEVERITY")))
$Vulnerability = strings.coalesce(
if(principal.asset.vulnerabilities.name != "" and principal.asset.vulnerabilities.description != "",
strings.concat(principal.asset.vulnerabilities.name, " : ", principal.asset.vulnerabilities.description),
strings.coalesce(principal.asset.vulnerabilities.name, principal.asset.vulnerabilities.description)),
if(additional.fields["ScanReference"] != "" and metadata.description != "",
strings.concat(additional.fields["ScanReference"], " : ", metadata.description),
strings.coalesce(additional.fields["ScanReference"], metadata.description)),
if(extensions.vulns.vulnerabilities.vendor_vulnerability_id != "" and extensions.vulns.vulnerabilities.description != "",
strings.concat(extensions.vulns.vulnerabilities.vendor_vulnerability_id, " : ", extensions.vulns.vulnerabilities.description),
strings.coalesce(extensions.vulns.vulnerabilities.vendor_vulnerability_id, extensions.vulns.vulnerabilities.description)
)
)
($Vulnerability != " : " and $Vulnerability != "")
$Log_Type = metadata.log_type
match:
$Vulnerability, $Log_Type, $Severity
outcome:
$Age_Max = max(cast.as_int((metadata.event_timestamp.seconds - if(timestamp.as_unix_seconds(additional.fields["first_found"]) > 0,
timestamp.as_unix_seconds(additional.fields["first_found"]), if(extensions.vulns.vulnerabilities.first_found.seconds > 0,
extensions.vulns.vulnerabilities.first_found.seconds, metadata.event_timestamp.seconds))) / 86400))
$Count = count(strings.coalesce(extensions.vulns.vulnerabilities.name, extensions.vulns.vulnerabilities.description, extensions.vulns.vulnerabilities.vendor_vulnerability_id,
principal.asset.vulnerabilities.name, target.asset.vulnerabilities.name, additional.fields["ScanReference"]))
order:
$Age_Max desc
按登录次数排名的前 10 个服务账号
metadata.event_type = "USER_LOGIN"
principal.user.account_type = "SERVICE_ACCOUNT_TYPE"
or principal.resource.resource_type = "SERVICE_ACCOUNT"
or principal.user.attribute.roles.type = "SERVICE_ACCOUNT"
or target.user.account_type = "SERVICE_ACCOUNT_TYPE"
or target.resource.resource_type = "SERVICE_ACCOUNT"
or target.user.attribute.roles.type = "SERVICE_ACCOUNT"
or strings.coalesce(principal.resource.type, principal.user.attribute.roles.name, principal.resource.resource_subtype, principal.user.userid, principal.user.user_display_name, principal.user.email_addresses,target.resource.type, target.user.attribute.roles.name, target.resource.resource_subtype, target.user.userid, target.user.user_display_name, target.user.email_addresses) = /(?i)service.*(?:account|^principal$)/ nocase
$Service_Account = strings.coalesce(principal.user.userid, principal.user.user_display_name, principal.user.email_addresses, target.user.userid, target.user.user_display_name, target.user.email_addresses)
$Service_Account != ""
$Action = security_result.action
match:
$Service_Account, $Action
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
恶意软件文件详细信息
(metadata.product_event_type = /malware/ nocase or security_result.summary = /malware/ nocase or security_result.category_details = /malware/ nocase or metadata.description = /malware/ nocase or security_result.threat_name = /malware/ nocase or security_result.rule_name = /malware/ nocase or security_result.category = "SOFTWARE_MALICIOUS")
$Source_User = strings.coalesce(principal.user.user_display_name, principal.user.userid, principal.user.email_addresses)
$File_Name = strings.coalesce(target.file.full_path, about.file.full_path)
$File_Name != ""
$File_Type = strings.coalesce(target.file.mime_type, about.file.mime_type)
$Severity = security_result.severity
$Action = security_result.action
match :
$File_Name, $File_Type, $Source_User, $Severity, $Action
outcome:
$Count = count(metadata.id)
$Date = timestamp.get_timestamp(max(metadata.event_timestamp.seconds), "%F %T")
order:
$Count desc
基于网络的恶意活动
(metadata.event_type = "NETWORK_UNCATEGORIZED"
or metadata.event_type = "NETWORK_FLOW"
or metadata.event_type = "NETWORK_CONNECTION"
or metadata.event_type = "NETWORK_FTP"
or metadata.event_type = "NETWORK_DHCP"
or metadata.event_type = "NETWORK_DNS"
or metadata.event_type = "NETWORK_HTTP"
or metadata.event_type = "NETWORK_SMTP")
(security_result.category = "NETWORK_DENIAL_OF_SERVICE" or security_result.category = "NETWORK_MALICIOUS" or security_result.category = "NETWORK_SUSPICIOUS" or
security_result.category = "SOFTWARE_MALICIOUS" or security_result.category = "SOFTWARE_SUSPICIOUS" or security_result.category = "NETWORK_RECON")
$Log_Type = metadata.log_type
$Category = security_result.category
$Summary = strings.coalesce(security_result.description, security_result.summary, metadata.description, security_result.rule_name, metadata.product_event_type)
$Hostname = strings.coalesce(principal.asset.hostname, principal.hostname, principal.mac, principal.asset.mac, target.hostname, target.asset.hostname, target.mac, target.asset.mac,
target.resource.product_object_id, principal.group.product_object_id, principal.ip, principal.asset.ip, target.ip, target.asset.ip)
$Action = security_result.action
match:
$Summary, $Category, $Hostname, $Log_Type, $Action
outcome:
$Count = count(metadata.id)
$Date = timestamp.get_timestamp(max(metadata.event_timestamp.seconds), "%F %T")
order:
$Count desc
特权账号活动和修改
metadata.event_type = "GROUP_CREATION" or metadata.event_type = "GROUP_MODIFICATION" or metadata.event_type = "GROUP_DELETION" or metadata.event_type = "USER_LOGIN" or metadata.product_event_type = /(RemoveUserFrom|AddUserTo|Add member to |Remove member from )|(?:group)/ nocase
$User = strings.coalesce(principal.user.userid, principal.user.user_display_name, principal.user.email_addresses, target.user.userid,target.user.user_display_name,target.user.email_addresses)
($User = /admin|root|svc|adm|privilege/ nocase or principal.user.attribute.roles.type = "SERVICE_ACCOUNT" or principal.user.attribute.roles.type = "ADMINISTRATOR" or principal.user.account_type = "DOMAIN_ACCOUNT_TYPE" or principal.user.account_type = "SERVICE_ACCOUNT_TYPE")
$Event_Type = metadata.event_type
$Source_IP = strings.coalesce(principal.ip, principal.asset.ip, principal.hostname, principal.asset.hostname, principal.mac)
$Target_Resource = strings.coalesce(target.resource.name, target.file.full_path, target.resource.product_object_id, target.group.product_object_id, target.user.group_identifiers, target.group.group_display_name)
$Target_Resourcetype = target.resource.resource_type
$Action = security_result.action
$Security_Event_Type = metadata.product_event_type
$Summary = strings.coalesce(additional.fields["Message"], security_result.summary, security_result.description, metadata.description)
match:
$Event_Type, $User,$Source_IP, $Target_Resource, $Action, $Security_Event_Type, $Summary
outcome:
$Count = count(metadata.id)
$Date = timestamp.get_timestamp(max(metadata.event_timestamp.seconds), "%F %H:%M:%S")
order:
$Count desc
按操作统计的登录事件随时间的变化趋势
metadata.event_type = "USER_LOGIN"
$Action = security_result.action
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
match:
$Date, $Action
outcome:
$Count = count(metadata.id)
order:
$Date asc
数据安全事件分布
metadata.log_type = /ARUBA_CENTRAL|CLOUDFLARE_WARP|DELL_CYBERSENSE|FORGEROCK_OPENIDM|IMPERVA_DRA|IMPERVA_SECURESPHERE|IBM_OPENPAGES|INTEL471_WATCHER_ALERTS|METABASE|OKERA_DAP|OPENCANARY|RUBRIK_POLARIS|SENTRY|TINES|TINTRI|VARONIS/ nocase
$Event_Type = metadata.event_type
match:
$Event_Type
outcome:
$Count = count(metadata.id)
order:
$Count desc
数据删除和清除事件
(metadata.event_type = "FILE_DELETION"
or metadata.event_type = "RESOURCE_DELETION"
or metadata.event_type = "SYSTEM_AUDIT_LOG_WIPE"
or metadata.event_type = "REGISTRY_DELETION"
or metadata.event_type = "SETTING_DELETION"
or metadata.event_type = "USER_RESOURCE_DELETION"
or metadata.event_type = "GROUP_DELETION"
or metadata.event_type = "SERVICE_DELETION"
or metadata.event_type = "SCHEDULED_TASK_DELETION"
or strings.coalesce(metadata.product_event_type, security_result.summary, security_result.description, security_result.action_details) = /delet(?:e|ed|ion|ing)|purge/ nocase)
security_result.action = "ALLOW"
$Description = strings.coalesce(security_result.summary, security_result.description, metadata.description, security_result.action_details)
$Product_Event_Type = metadata.product_event_type
$Event_Type = metadata.event_type
$Log_Type = metadata.log_type
$Target_Resource = strings.coalesce(target.resource.name, target.file.full_path, target.resource.product_object_id, target.group.product_object_id, target.user.group_identifiers)
$User = strings.coalesce(principal.user.user_display_name, principal.user.userid, principal.user.email_addresses, target.user.userid,target.user.user_display_name,target.user.email_addresses)
match:
$User, $Log_Type, $Description, $Product_Event_Type, $Event_Type, $Target_Resource
outcome:
$Date = timestamp.get_timestamp(max(metadata.event_timestamp.seconds), "%F %T")
$Count = count(metadata.id)
order:
$Date desc, $Count desc
随时间推移的漏洞扫描
metadata.log_type = /ARMIS_VULNERABILITIES|FINGERPRINT_JS|NUCLEUS_VULNERABILITY|QUALYS_ASSET_CONTEXT|QUALYS_SCAN|QUALYS_VIRTUAL_SCANNER|QUALYS_VM|RAPID7_INSIGHT|RAPID7_NEXPOSE|SNYK_SDLC|SPUR_FEEDS|STACKHAWK|SUBLIMESECURITY|SYMANTEC_SA|TENABLE_IO|TENABLE_OT|TENABLE_SC|UPGUARD|URLSCAN_IO/ nocase
(metadata.event_type = "SCAN_VULN_HOST" or additional.fields["Type"] = "Scan" or security_result.detection_fields.key = /scan/ nocase or security_result.detection_fields.value = /scan/ nocase)
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
$Log_Type = metadata.log_type
match:
$Log_Type, $Date
outcome:
$Count = count(metadata.id)
order:
$Date asc
一段时间内的钓鱼式攻击事件
metadata.log_type = /MAIL|ABNORMAL_SECURITY|AREA1|COFENSE_TRIAGE|FIREEYE|FORCEPOINT|FORTINET|KNOWBE4_PHISHER|MICROSOFT_GRAPH_ALERT|MIMECAST_URL_LOGS|OBSERVEIT|OFFICE_365|PHISHLABS|PROOFPOINT|SYMANTEC_VIP|VOLTAGE|WORKSPACE_ALERTS/ nocase
(security_result.category = "MAIL_PHISHING" or re.regex(security_result.threat_name,`Phish`) nocase or re.regex(security_result.category_details,`Phish`)nocase)
security_result.threat_name != "NOT_PHISHING"
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
$Severity = security_result.severity
match:
$Date, $Severity
outcome:
$Count = count(metadata.id)
order:
$Date asc
近期备份事件
(metadata.log_type = /COHESITY|DRUVA_BACKUP|VEEAM|VERITAS_NETBACKUP/ nocase or metadata.log_type = "RUBRIK")
$Description = strings.coalesce(metadata.description, security_result.description, security_result.summary)
$Log_Type = metadata.log_type
$Event_Type = metadata.event_type
$Security_Event_Type = metadata.product_event_type
$Action = security_result.action
match:
$Description, $Security_Event_Type, $Event_Type, $Action, $Log_Type
outcome:
$Count = count(metadata.id)
$Date = timestamp.get_timestamp(max(metadata.event_timestamp.seconds), "%F %T ")
order:
$Count desc
按严重程度划分的十大电子邮件威胁
metadata.log_type = /MAIL|ABNORMAL_SECURITY|AREA1|COFENSE_TRIAGE|FIREEYE|FORCEPOINT|FORTINET|KNOWBE4_PHISHER|MICROSOFT_GRAPH_ALERT|MIMECAST_URL_LOGS|OBSERVEIT|OFFICE_365|PHISHLABS|PROOFPOINT|SYMANTEC_VIP|VOLTAGE|WORKSPACE_ALERTS/ nocase
security_result.category = "MAIL_SPAM"
or security_result.category = "MAIL_SPOOFING"
or security_result.category = "SOFTWARE_MALICIOUS"
or (security_result.category = "MAIL_PHISHING" and security_result.threat_name!= "NOT_PHISHING")
or strings.coalesce(security_result.threat_name, security_result.category_details) = /Phish|Mail/ nocase
$Severity = security_result.severity
$Threat_Name = strings.coalesce(security_result.threat_name, security_result.category_details)
$Threat_Name != ""
match:
$Threat_Name, $Severity
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
指定时间段内的备份事件
(metadata.log_type = /COHESITY|DRUVA_BACKUP|VEEAM|VERITAS_NETBACKUP/ nocase or metadata.log_type = "RUBRIK")
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
$Log_Type = metadata.log_type
match:
$Date, $Log_Type
outcome:
$Count = count(metadata.id)
order:
$Date asc
设备总数随时间的变化情况
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
match:
$Date
outcome:
$Count = count_distinct(strings.coalesce(principal.hostname, principal.asset.hostname, target.hostname, target.asset.hostname))
order:
$Date asc
被屏蔽的应用执行次数排名前 10
(metadata.product_event_type = /(execution|application) block/ nocase or security_result.summary = /(execution|application) block/ or metadata.description = /(execution|application) block/ nocase or security_result.threat_name = /application control/ nocase)
(security_result.action = "BLOCK" or security_result.action_details = /block/ nocase or (target.resource.attribute.labels.key = "categoryBehavior" and target.resource.attribute.labels.value = /blocked/ nocase))
$Application = strings.coalesce(about.file.full_path, target.process.file.full_path, additional.fields["fname"], principal.application, target.application)
$Description = strings.coalesce(target.resource.attribute.labels["categoryTupleDescription"], security_result.summary, metadata.product_event_type, security_result.description, metadata.description, security_result.action_details)
match:
$Application, $Description, metadata.log_type
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
针对特权账号的 MFA 尝试被阻止
(re.regex(metadata.product_name, "MULTI-FACTOR_AUTHENTICATION") or re.regex(additional.fields["AuthenticationRequirement"], `multiFactorAuthentication`) nocase or re.regex(security_result.detection_fields.value, `MFA`) nocase or re.regex(metadata.product_event_type, `mfa(?:\S)?auth|auth(?:.*)?mfa`) nocase)
security_result.action = "BLOCK"
$User = strings.coalesce(principal.user.userid, principal.user.user_display_name, principal.user.email_addresses, target.user.userid, target.user.user_display_name,target.user.email_addresses)
$User = /admin|root|administrator|security|support|default/ nocase //It will be updated as per the client's environment.
$Reason = strings.coalesce(security_result.summary, metadata.product_event_type)
$Location = strings.coalesce(principal.location.country_or_region, principal.ip_geo_artifact.location.country_or_region)
$Source_IP = strings.coalesce(principal.ip, principal.asset.ip)
$Log_Type = metadata.log_type
$Severity = security_result.severity
match:
$Reason, $User, $Source_IP, $Location, $Severity, $Log_Type
outcome:
$Count = count(metadata.id)
$Date = timestamp.get_timestamp(max(metadata.event_timestamp.seconds), "%F %T")
order:
$Count desc
Cloud Key Management 概览
此信息中心可详细显示组织云基础架构中的密钥管理活动。该信息中心可监控密钥、证书和 Secret 在整个生命周期（创建、删除、启用、轮换和停用）中的状态，从而检测异常或未经授权的活动。
随时间推移停用的对象
按日志类型划分的事件总数
创建对象最多的前 10 位用户
随时间推移而删除的对象
随时间推移创建的对象
启用对象的 10 大来源 IP
旋转对象次数排名前 10 的用户
随时间旋转的对象
前 10 个来源 IP 地址的旋转对象
删除对象最多的 10 位用户
旋转次数最多的 10 个对象
停用的对象（前 10 名）
被屏蔽最多的前 10 位用户
启用对象的 10 位顶级用户
近期创建的对象（过去 24 小时）
已启用的前 10 个对象
前 10 大用户代理
创建对象最多的前 10 个来源 IP 地址
10 大对象位置
一段时间内启用的对象
排名前 10 的被屏蔽来源 IP
由地理定位功能创建的对象
停用对象的前 10 名用户
停用对象的前 10 个来源 IP
最近删除的对象（过去 24 小时）
前 10 个来源 IP 地址 - 删除对象
图表名称
查询示例
随时间推移停用的对象
((((metadata.log_type = /AZURE_KEYVAULT_AUDIT/ nocase and (additional.fields["resultType"] = /Allow|Success/ nocase or security_result.action = "ALLOW")) or
(target.application = "kms.amazonaws.com" and security_result.action = "ALLOW")) and metadata.product_event_type = /Disable/ nocase) or
(metadata.log_type = /GCP_CLOUDAUDIT/ nocase and metadata.product_event_type = /UpdateCryptoKeyVersion|Disable/ nocase and metadata.product_event_type = /key|secret|certificate/ nocase and
target.resource.attribute.labels.value = /DISABLED/ nocase and security_result.action = "ALLOW"))
$Log_Type = strings.coalesce(metadata.log_type, target.application)
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
match:
$Log_Type, $Date
outcome:
$Count = count(metadata.id)
order:
$Date asc
按日志类型划分的事件总数
(metadata.log_type = /AZURE_KEYVAULT_AUDIT|GCP_CLOUDAUDIT/ nocase or target.application = "kms.amazonaws.com")
$Log_Type = strings.coalesce(metadata.log_type, target.application)
match:
$Log_Type
outcome:
$Count = count(metadata.id)
order:
$Count desc
创建对象最多的前 10 位用户
((((metadata.log_type = /AZURE_KEYVAULT_AUDIT/ nocase and (additional.fields["resultType"] = /Allow|Success/ nocase or security_result.action = "ALLOW")) or
(target.application = "kms.amazonaws.com" and security_result.action = "ALLOW")) and metadata.product_event_type = /Create/ nocase) or
(metadata.log_type = /GCP_CLOUDAUDIT/ nocase and metadata.product_event_type = /Create/ nocase and metadata.product_event_type = /key|secret|certificate/ nocase and
metadata.product_event_type != /version/ nocase and security_result.action = "ALLOW"))
$User = strings.coalesce(principal.user.userid, principal.user.user_display_name, principal.user.email_addresses, principal.user.group_identifiers)
$Log_Type = strings.coalesce(metadata.log_type, target.application)
match:
$User, $Log_Type
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
随时间推移而删除的对象
((((metadata.log_type = /AZURE_KEYVAULT_AUDIT/ nocase and (additional.fields["resultType"] = /Allow|Success/ nocase or security_result.action = "ALLOW")) or
(target.application = "kms.amazonaws.com" and security_result.action = "ALLOW")) and metadata.product_event_type = /Delete/ nocase) or
(metadata.log_type = /GCP_CLOUDAUDIT/ nocase and metadata.product_event_type = /Delete|Destroy/ nocase and metadata.product_event_type = /key|secret|certificate/ nocase
and security_result.action = "ALLOW"))
$Log_Type = strings.coalesce(metadata.log_type, target.application)
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
match:
$Log_Type, $Date
outcome:
$Count = count(metadata.id)
order:
$Date asc
随时间推移创建的对象
((((metadata.log_type = /AZURE_KEYVAULT_AUDIT/ nocase and ((additional.fields["resultType"] = /Allow|Success/ nocase) or (security_result.action = "ALLOW"))) or
(target.application = "kms.amazonaws.com" and security_result.action = "ALLOW")) and metadata.product_event_type = /Create/ nocase) or
(metadata.log_type = /GCP_CLOUDAUDIT/ nocase and metadata.product_event_type = /Create/ nocase and metadata.product_event_type = /key|secret|certificate/ nocase and
metadata.product_event_type != /version/ nocase and security_result.action = "ALLOW"))
$Log_Type = strings.coalesce(metadata.log_type, target.application)
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
match:
$Log_Type, $Date
outcome:
$Count = count(metadata.id)
order:
$Date asc
启用对象的 10 大来源 IP
((((metadata.log_type = /AZURE_KEYVAULT_AUDIT/ nocase and (additional.fields["resultType"] = /Allow|Success/ nocase or security_result.action = "ALLOW")) or
(target.application = "kms.amazonaws.com" and security_result.action = "ALLOW")) and metadata.product_event_type = /Enable/ nocase) or
(metadata.log_type = /GCP_CLOUDAUDIT/ nocase and metadata.product_event_type = /UpdateCryptoKeyVersion|Enable/ nocase and metadata.product_event_type = /key|secret|certificate/ nocase and
target.resource.attribute.labels.value = /ENABLED/ nocase and security_result.action = "ALLOW"))
$Source_IP = strings.coalesce(principal.ip, principal.asset.ip)
$Log_Type = strings.coalesce(metadata.log_type, target.application)
match:
$Source_IP, $Log_Type
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
旋转对象次数排名前 10 的用户
((((metadata.log_type = /AZURE_KEYVAULT_AUDIT/ nocase and (additional.fields["resultType"] = /Allow|Success/ nocase or security_result.action = "ALLOW")) or
(target.application = "kms.amazonaws.com" and security_result.action = "ALLOW")) and metadata.product_event_type = /Rotate|KeyRotation/ nocase) or
(metadata.log_type = /GCP_CLOUDAUDIT/ nocase and metadata.product_event_type = /CreateCryptoKeyVersion|updateCryptoKeyPrimaryVersion|Rotate/ nocase and metadata.product_event_type = /key|secret|certificate/ nocase and security_result.action = "ALLOW"))
$User = strings.coalesce(principal.user.userid, principal.user.user_display_name, principal.user.email_addresses, principal.user.group_identifiers)
$Log_Type = strings.coalesce(metadata.log_type, target.application)
match:
$User, $Log_Type
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
随时间旋转的对象
((((metadata.log_type = /AZURE_KEYVAULT_AUDIT/ nocase and (additional.fields["resultType"] = /Allow|Success/ nocase or security_result.action = "ALLOW")) or
(target.application = "kms.amazonaws.com" and security_result.action = "ALLOW")) and metadata.product_event_type = /Rotate|KeyRotation/ nocase) or
(metadata.log_type = /GCP_CLOUDAUDIT/ nocase and metadata.product_event_type = /CreateCryptoKeyVersion|updateCryptoKeyPrimaryVersion|Rotate/ nocase and metadata.product_event_type = /key|secret|certificate/ nocase and security_result.action = "ALLOW"))
$Log_Type = strings.coalesce(metadata.log_type, target.application)
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
match:
$Log_Type, $Date
outcome:
$Count = count(metadata.id)
order:
$Date asc
前 10 个来源 IP 地址的旋转对象
((((metadata.log_type = /AZURE_KEYVAULT_AUDIT/ nocase and (additional.fields["resultType"] = /Allow|Success/ nocase or security_result.action = "ALLOW")) or
(target.application = "kms.amazonaws.com" and security_result.action = "ALLOW")) and metadata.product_event_type = /Rotate|KeyRotation/ nocase) or
(metadata.log_type = /GCP_CLOUDAUDIT/ nocase and metadata.product_event_type = /CreateCryptoKeyVersion|updateCryptoKeyPrimaryVersion|Rotate/ nocase and metadata.product_event_type = /key|secret|certificate/ nocase and security_result.action = "ALLOW"))
$Source_IP = strings.coalesce(principal.ip, principal.asset.ip)
$Log_Type = strings.coalesce(metadata.log_type, target.application)
match:
$Source_IP, $Log_Type
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
删除对象最多的 10 位用户
((((metadata.log_type = /AZURE_KEYVAULT_AUDIT/ nocase and (additional.fields["resultType"] = /Allow|Success/ nocase or security_result.action = "ALLOW")) or
(target.application = "kms.amazonaws.com" and security_result.action = "ALLOW")) and metadata.product_event_type = /Delete/ nocase) or
(metadata.log_type = /GCP_CLOUDAUDIT/ nocase and metadata.product_event_type = /Delete|Destroy/ nocase and metadata.product_event_type = /key|secret|certificate/ nocase
and security_result.action = "ALLOW"))
$User = strings.coalesce(principal.user.userid, principal.user.user_display_name, principal.user.email_addresses, principal.user.group_identifiers)
$Log_Type = strings.coalesce(metadata.log_type, target.application)
match:
$User, $Log_Type
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
旋转次数最多的 10 个对象
((((metadata.log_type = /AZURE_KEYVAULT_AUDIT/ nocase and (additional.fields["resultType"] = /Allow|Success/ nocase or security_result.action = "ALLOW")) or
(target.application = "kms.amazonaws.com" and security_result.action = "ALLOW")) and metadata.product_event_type = /Rotate|KeyRotation/ nocase) or
(metadata.log_type = /GCP_CLOUDAUDIT/ nocase and metadata.product_event_type = /CreateCryptoKeyVersion|updateCryptoKeyPrimaryVersion|Rotate/ nocase and metadata.product_event_type = /key|secret|certificate/ nocase and security_result.action = "ALLOW"))
$Object_ID = strings.coalesce(target.resource.product_object_id, principal.user.product_object_id, principal.resource.product_object_id)
$Log_Type = strings.coalesce(metadata.log_type, target.application)
match:
$Object_ID, $Log_Type
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
停用的对象（前 10 名）
((((metadata.log_type = /AZURE_KEYVAULT_AUDIT/ nocase and (additional.fields["resultType"] = /Allow|Success/ nocase or security_result.action = "ALLOW")) or
(target.application = "kms.amazonaws.com" and security_result.action = "ALLOW")) and metadata.product_event_type = /Disable/ nocase) or
(metadata.log_type = /GCP_CLOUDAUDIT/ nocase and metadata.product_event_type = /UpdateCryptoKeyVersion|Disable/ nocase and metadata.product_event_type = /key|secret|certificate/ nocase and
target.resource.attribute.labels.value = /DISABLED/ nocase and security_result.action = "ALLOW"))
$Object_ID = strings.coalesce(target.resource.product_object_id, principal.user.product_object_id, principal.resource.product_object_id)
$Log_Type = strings.coalesce(metadata.log_type, target.application)
match:
$Object_ID, $Log_Type
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
被屏蔽最多的前 10 位用户
((metadata.log_type = /AZURE_KEYVAULT_AUDIT|GCP_CLOUDAUDIT/ nocase and (additional.fields["resultType"] = /Fail/ nocase or security_result.action = "BLOCK")) or
(target.application = "kms.amazonaws.com" and security_result.action = "BLOCK"))
$Event_Type = metadata.event_type
$User = strings.coalesce(principal.user.userid, principal.user.user_display_name, principal.user.email_addresses, principal.user.group_identifiers)
match:
$User, $Event_Type
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
启用对象的 10 位顶级用户
((((metadata.log_type = /AZURE_KEYVAULT_AUDIT/ nocase and (additional.fields["resultType"] = /Allow|Success/ nocase or security_result.action = "ALLOW")) or
(target.application = "kms.amazonaws.com" and security_result.action = "ALLOW")) and metadata.product_event_type = /Enable/ nocase) or
(metadata.log_type = /GCP_CLOUDAUDIT/ nocase and metadata.product_event_type = /UpdateCryptoKeyVersion|Enable/ nocase and metadata.product_event_type = /key|secret|certificate/ nocase and
target.resource.attribute.labels.value = /ENABLED/ nocase and security_result.action = "ALLOW"))
$User = strings.coalesce(principal.user.userid, principal.user.user_display_name, principal.user.email_addresses, principal.user.group_identifiers)
$Log_Type = strings.coalesce(metadata.log_type, target.application)
match:
$User, $Log_Type
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
近期创建的对象（过去 24 小时）
((((metadata.log_type = /AZURE_KEYVAULT_AUDIT/ nocase and (additional.fields["resultType"] = /Allow|Success/ nocase or security_result.action = "ALLOW")) or
(target.application = "kms.amazonaws.com" and security_result.action = "ALLOW")) and metadata.product_event_type = /Create/ nocase) or
(metadata.log_type = /GCP_CLOUDAUDIT/ nocase and metadata.product_event_type = /Create/ nocase and metadata.product_event_type = /key|secret|certificate/ nocase and
metadata.product_event_type != /version/ nocase and security_result.action = "ALLOW"))
$Source_IP = strings.coalesce(principal.ip, principal.asset.ip)
$Security_Event_Type = metadata.product_event_type
$User = strings.coalesce(principal.user.userid, principal.user.user_display_name, principal.user.email_addresses, principal.user.group_identifiers)
$Object_ID = strings.coalesce(target.resource.product_object_id, principal.user.product_object_id, principal.resource.product_object_id)
$Log_Type = strings.coalesce(metadata.log_type, target.application)
$Location = principal.location.country_or_region
$Date = timestamp.get_timestamp(metadata.event_timestamp.seconds, "%F %T ")
match:
$Date , $Log_Type, $Object_ID, $Security_Event_Type, $User, $Source_IP, $Location
order:
$Date desc
已启用的前 10 个对象
((((metadata.log_type = /AZURE_KEYVAULT_AUDIT/ nocase and (additional.fields["resultType"] = /Allow|Success/ nocase or security_result.action = "ALLOW")) or
(target.application = "kms.amazonaws.com" and security_result.action = "ALLOW")) and metadata.product_event_type = /Enable/ nocase) or
(metadata.log_type = /GCP_CLOUDAUDIT/ nocase and metadata.product_event_type = /UpdateCryptoKeyVersion|Enable/ nocase and metadata.product_event_type = /key|secret|certificate/ nocase and
target.resource.attribute.labels.value = /ENABLED/ nocase and security_result.action = "ALLOW"))
$Object_ID = strings.coalesce(target.resource.product_object_id, principal.user.product_object_id, principal.resource.product_object_id)
$Log_Type = strings.coalesce(metadata.log_type, target.application)
match:
$Object_ID, $Log_Type
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
前 10 大用户代理
(metadata.log_type = /AZURE_KEYVAULT_AUDIT|GCP_CLOUDAUDIT/ nocase or target.application = "kms.amazonaws.com")
$User_Agent = network.http.user_agent
$Log_Type = strings.coalesce(metadata.log_type, target.application)
match:
$User_Agent, $Log_Type
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
创建对象最多的前 10 个来源 IP 地址
((((metadata.log_type = /AZURE_KEYVAULT_AUDIT/ nocase and (additional.fields["resultType"] = /Allow|Success/ nocase or security_result.action = "ALLOW")) or
(target.application = "kms.amazonaws.com" and security_result.action = "ALLOW")) and metadata.product_event_type = /Create/ nocase) or
(metadata.log_type = /GCP_CLOUDAUDIT/ nocase and metadata.product_event_type = /Create/ nocase and metadata.product_event_type = /key|secret|certificate/ nocase and
metadata.product_event_type != /version/ nocase and security_result.action = "ALLOW"))
$Source_IP = strings.coalesce(principal.ip, principal.asset.ip)
$Log_Type = strings.coalesce(metadata.log_type, target.application)
match:
$Source_IP, $Log_Type
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
10 大对象位置
(metadata.log_type = /AZURE_KEYVAULT_AUDIT|GCP_CLOUDAUDIT/ nocase or target.application = "kms.amazonaws.com")
$Object_ID = strings.coalesce(target.resource.product_object_id, principal.user.product_object_id, principal.resource.product_object_id)
$Log_Type = strings.coalesce(metadata.log_type, target.application)
$Location = target.location.name
match:
$Location, $Log_Type
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
一段时间内启用的对象
((((metadata.log_type = /AZURE_KEYVAULT_AUDIT/ nocase and (additional.fields["resultType"] = /Allow|Success/ nocase or security_result.action = "ALLOW")) or
(target.application = "kms.amazonaws.com" and security_result.action = "ALLOW")) and metadata.product_event_type = /Enable/ nocase) or
(metadata.log_type = /GCP_CLOUDAUDIT/ nocase and metadata.product_event_type = /UpdateCryptoKeyVersion|Enable/ nocase and metadata.product_event_type = /key|secret|certificate/ nocase and
target.resource.attribute.labels.value = /ENABLED/ nocase and security_result.action = "ALLOW"))
$Log_Type = strings.coalesce(metadata.log_type, target.application)
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
match:
$Log_Type, $Date
outcome:
$Count = count(metadata.id)
order:
$Date asc
排名前 10 的被屏蔽来源 IP
((metadata.log_type = /AZURE_KEYVAULT_AUDIT|GCP_CLOUDAUDIT/ nocase and (additional.fields["resultType"] = /Fail/ nocase or security_result.action = "BLOCK")) or
(target.application = "kms.amazonaws.com" and security_result.action = "BLOCK"))
$Event_Type = metadata.event_type
$Source_IP = strings.coalesce(principal.ip, principal.asset.ip)
match:
$Source_IP, $Event_Type
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
由地理定位功能创建的对象
((((metadata.log_type = /AZURE_KEYVAULT_AUDIT/ nocase and (additional.fields["resultType"] = /Allow|Success/ nocase or security_result.action = "ALLOW")) or
(target.application = "kms.amazonaws.com" and security_result.action = "ALLOW")) and metadata.product_event_type = /Create/ nocase) or
(metadata.log_type = /GCP_CLOUDAUDIT/ nocase and metadata.product_event_type = /Create/ nocase and metadata.product_event_type = /key|secret|certificate/ nocase and
metadata.product_event_type != /version/ nocase and security_result.action = "ALLOW"))
$Country = principal.ip_geo_artifact.location.country_or_region
$Country != ""
match:
$Country
outcome:
$Count = count(metadata.id)
$Latitude = max(principal.ip_geo_artifact.location.region_coordinates.latitude)
$Longitude = max(principal.ip_geo_artifact.location.region_coordinates.longitude)
order:
$Count desc
停用对象的前 10 名用户
((((metadata.log_type = /AZURE_KEYVAULT_AUDIT/ nocase and (additional.fields["resultType"] = /Allow|Success/ nocase or security_result.action = "ALLOW")) or
(target.application = "kms.amazonaws.com" and security_result.action = "ALLOW")) and metadata.product_event_type = /Disable/ nocase) or
(metadata.log_type = /GCP_CLOUDAUDIT/ nocase and metadata.product_event_type = /UpdateCryptoKeyVersion|Disable/ nocase and metadata.product_event_type = /key|secret|certificate/ nocase and
target.resource.attribute.labels.value = /DISABLED/ nocase and security_result.action = "ALLOW"))
$User = strings.coalesce(principal.user.userid, principal.user.user_display_name, principal.user.email_addresses, principal.user.group_identifiers)
$Log_Type = strings.coalesce(metadata.log_type, target.application)
match:
$User, $Log_Type
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
停用对象的前 10 个来源 IP
((((metadata.log_type = /AZURE_KEYVAULT_AUDIT/ nocase and (additional.fields["resultType"] = /Allow|Success/ nocase or security_result.action = "ALLOW")) or
(target.application = "kms.amazonaws.com" and security_result.action = "ALLOW")) and metadata.product_event_type = /Disable/ nocase) or
(metadata.log_type = /GCP_CLOUDAUDIT/ nocase and metadata.product_event_type = /UpdateCryptoKeyVersion|Disable/ nocase and metadata.product_event_type = /key|secret|certificate/ nocase and
target.resource.attribute.labels.value = /DISABLED/ nocase and security_result.action = "ALLOW"))
$Source_IP = strings.coalesce(principal.ip, principal.asset.ip)
$Log_Type = strings.coalesce(metadata.log_type, target.application)
match:
$Source_IP, $Log_Type
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
最近删除的对象（过去 24 小时）
((metadata.log_type = "AZURE_KEYVAULT_AUDIT" and additional.fields["resultType"] = /Allow|Success/ nocase) or
(target.application = "kms.amazonaws.com" and security_result.action = "ALLOW"))
metadata.product_event_type = /Delete/ nocase
$Source_IP = strings.coalesce(principal.ip, principal.asset.ip)
$Security_Event_Type = metadata.product_event_type
$User = strings.coalesce(principal.user.userid, principal.user.user_display_name, principal.user.email_addresses, principal.user.group_identifiers)
$Object_ID = strings.coalesce(target.resource.product_object_id, principal.user.product_object_id, principal.resource.product_object_id)
$Location = principal.location.country_or_region
$Log_Type = strings.coalesce(metadata.log_type, target.application)
$Date = timestamp.get_timestamp(metadata.event_timestamp.seconds, "%F %T ")
match:
$Date, $Log_Type, $Object_ID, $Security_Event_Type, $User, $Source_IP, $Location
order:
$Date desc
limit:
10
前 10 个来源 IP 地址 - 删除对象
((((metadata.log_type = /AZURE_KEYVAULT_AUDIT/ nocase and (additional.fields["resultType"] = /Allow|Success/ nocase or security_result.action = "ALLOW")) or
(target.application = "kms.amazonaws.com" and security_result.action = "ALLOW")) and metadata.product_event_type = /Delete/ nocase) or
(metadata.log_type = /GCP_CLOUDAUDIT/ nocase and metadata.product_event_type = /Delete|Destroy/ nocase and metadata.product_event_type = /key|secret|certificate/ nocase
and security_result.action = "ALLOW"))
$Source_IP = strings.coalesce(principal.ip, principal.asset.ip)
$Log_Type = strings.coalesce(metadata.log_type, target.application)
match:
$Source_IP, $Log_Type
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
云安全状况概览
此信息中心通过跟踪 Google Cloud、AWS 和 Azure 中的关键指标，提供 Cloud Security 态势洞见。
Cloud Storage 服务概览
此信息中心可提供有关云存储活动的宝贵数据分析，例如创建、删除、访问、更新的资源以及权限更改。它包含事件和提醒随时间变化的趋势可视化图表，并突出显示热门用户、IP 地址、用户代理和资源位置。这些信息有助于识别异常模式、监控提醒，以及在保护云环境的同时维护数据完整性。
访问资源的前 10 个来源 IP
按地理位置访问的资源
前 10 大用户代理
更新资源的前 10 个来源 IP
访问次数最多的 10 个资源
随时间推移而删除的资源
被屏蔽最多的前 10 位用户
最近创建的资源（过去 24 小时）
随时间推移访问的资源
更改资源权限的前 10 个来源 IP
最近删除的资源（过去 24 小时）
排名前 10 的被屏蔽来源 IP
一段时间内的事件
排名前 10 的资源位置
删除资源的前 10 个来源 IP
资源权限随时间的变化
创建资源最多的前 10 个来源 IP
访问资源最多的 10 位用户
权限发生变化的前 10 项资源
更新资源最多的前 10 位用户
更改资源权限的前 10 位用户
随时间推移创建的资源
更新了“热门 10 大资源”
删除资源最多的前 10 位用户
创建资源最多的 10 位用户
随时间推移而更新的资源
公开共享的存储分区
图表名称
查询示例
访问资源的前 10 个来源 IP
(
(metadata.log_type = /(AWS_CLOUDTRAIL|GCP_CLOUDAUDIT)/ nocase
and metadata.event_type = "RESOURCE_READ"
and metadata.product_event_type = /(storage|bucket)/ nocase)
or
(metadata.log_type = /AZURE/ nocase
and metadata.product_event_type = /microsoft\.storage\/storageaccounts\/read/ nocase)
)
security_result.action = "ALLOW"
$Log_Type = metadata.log_type
$IP_Address = principal.ip
match:
$Log_Type, $IP_Address
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
按地理位置访问的资源
(
(metadata.log_type = /(AWS_CLOUDTRAIL|GCP_CLOUDAUDIT)/ nocase
and metadata.event_type = "RESOURCE_READ"
and metadata.product_event_type = /(storage|bucket)/ nocase)
or
(metadata.log_type = /AZURE/ nocase
and metadata.product_event_type = /microsoft\.storage\/storageaccounts\/read/ nocase)
)
security_result.action = "ALLOW"
$Country = principal.location.country_or_region
$Country != ""
$Latitude = principal.location.region_coordinates.latitude
$Longitude = principal.location.region_coordinates.longitude
match:
$Country, $Latitude, $Longitude
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
前 10 大用户代理
(metadata.log_type = /AWS_CLOUDTRAIL|GCP_CLOUDAUDIT/ nocase
and metadata.product_event_type = /storage|bucket/ nocase
and (metadata.event_type = "RESOURCE_CREATION"
or metadata.event_type = "RESOURCE_DELETION"
or metadata.event_type = "RESOURCE_PERMISSIONS_CHANGE"
or metadata.event_type = "RESOURCE_READ"
or metadata.event_type = "RESOURCE_WRITTEN"))
or
(metadata.log_type = /AZURE/ nocase
and metadata.product_event_type = /microsoft\.storage\/storageaccounts\/(?:write|delete|read)/ nocase)
network.http.user_agent != ""
$Log_Type = metadata.log_type
$User_Agent = network.http.user_agent
match:
$Log_Type, $User_Agent
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
更新资源的前 10 个来源 IP
(
(metadata.log_type = /(AWS_CLOUDTRAIL|GCP_CLOUDAUDIT)/ nocase
and metadata.event_type = "RESOURCE_WRITTEN"
and metadata.product_event_type = /(storage|bucket)/ nocase)
or
(metadata.log_type = /AZURE/ nocase
and metadata.product_event_type = /microsoft\.storage\/storageaccounts\/(?:write|.*\/write)?/ nocase)
)
security_result.action = "ALLOW"
$Log_Type = metadata.log_type
$IP_Address = principal.ip
match:
$Log_Type, $IP_Address
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
访问次数最多的 10 个资源
(
(metadata.log_type = /(AWS_CLOUDTRAIL|GCP_CLOUDAUDIT)/ nocase
and metadata.event_type = "RESOURCE_READ"
and metadata.product_event_type = /(storage|bucket)/ nocase)
or
(metadata.log_type = /AZURE/ nocase
and metadata.product_event_type = /microsoft\.storage\/storageaccounts\/(?:write|.*\/write)?/ nocase)
)
security_result.action = "ALLOW"
$Log_Type = metadata.log_type
$Resource_Name = target.resource.name
match:
$Log_Type, $Resource_Name
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
随时间推移而删除的资源
(
(metadata.log_type = /(AWS_CLOUDTRAIL|GCP_CLOUDAUDIT)/ nocase
and metadata.event_type = "RESOURCE_DELETION"
and metadata.product_event_type = /(storage|bucket)/ nocase)
or
(metadata.log_type = /AZURE/ nocase
and metadata.product_event_type = /microsoft\.storage\/storageaccounts\/delete/ nocase)
)
security_result.action = "ALLOW"
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
$Log_Type = metadata.log_type
match:
$Date, $Log_Type
outcome:
$Count = count(metadata.id)
被屏蔽最多的前 10 位用户
(metadata.log_type = /AWS_CLOUDTRAIL|GCP_CLOUDAUDIT/ nocase
and metadata.product_event_type = /storage|bucket/ nocase
and (metadata.event_type = "RESOURCE_CREATION"
or metadata.event_type = "RESOURCE_DELETION"
or metadata.event_type = "RESOURCE_PERMISSIONS_CHANGE"
or metadata.event_type = "RESOURCE_READ"
or metadata.event_type = "RESOURCE_WRITTEN"))
or
(metadata.log_type = /AZURE/ nocase
and metadata.product_event_type = /microsoft\.storage\/storageaccounts\/(?:write|delete|read)/ nocase)
security_result.action = "BLOCK"
$Event_Type = metadata.event_type
$User = principal.user.userid
match:
$Event_Type, $User
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
最近创建的资源（过去 24 小时）
(
(metadata.log_type = /AWS_CLOUDTRAIL|GCP_CLOUDAUDIT/ nocase
and metadata.event_type = "RESOURCE_CREATION"
and metadata.product_event_type = /storage|bucket/ nocase)
or
(metadata.log_type = /AZURE/ nocase
and metadata.product_event_type = /microsoft\.storage\/storageaccounts\/write/ nocase)
)
security_result.action = "ALLOW"
$Log_Type = metadata.log_type
$IP_Address = principal.ip
$User = principal.user.userid
$Resource_Name = target.resource.name
$Location = principal.location.country_or_region
$Date = timestamp.get_timestamp(metadata.event_timestamp.seconds, "%F %T ")
match:
$Date, $Log_Type, $IP_Address, $User, $Location, $Resource_Name
order:
$Date desc
随时间推移访问的资源
(
(metadata.log_type = /(AWS_CLOUDTRAIL|GCP_CLOUDAUDIT)/ nocase
and metadata.event_type = "RESOURCE_READ"
and metadata.product_event_type = /(storage|bucket)/ nocase)
or
(metadata.log_type = /AZURE/ nocase
and metadata.product_event_type = /microsoft\.storage\/storageaccounts\/read/ nocase)
)
security_result.action = "ALLOW"
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
$Log_Type = metadata.log_type
match:
$Date, $Log_Type
outcome:
$Count = count(metadata.id)
更改资源权限的前 10 个来源 IP
(
(metadata.log_type = /AWS_CLOUDTRAIL|GCP_CLOUDAUDIT/ nocase
and metadata.event_type = "RESOURCE_PERMISSIONS_CHANGE"
and metadata.product_event_type = /storage|bucket/ nocase)
or
(metadata.log_type = /AZURE/ nocase
and metadata.product_event_type = /microsoft\.authorization\/(?:policyassignments|roledefinitions)?\/write/ nocase
and target.resource.resource_type = "STORAGE_BUCKET")
)
security_result.action = "ALLOW"
$Log_Type = metadata.log_type
$IP_Address = principal.ip
match:
$Log_Type, $IP_Address
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
最近删除的资源（过去 24 小时）
(
(metadata.log_type = /(AWS_CLOUDTRAIL|GCP_CLOUDAUDIT)/ nocase
and metadata.event_type = "RESOURCE_DELETION"
and metadata.product_event_type = /(storage|bucket)/ nocase)
or
(metadata.log_type = /AZURE/ nocase
and metadata.product_event_type = /microsoft\.storage\/storageaccounts\/delete/ nocase)
)
security_result.action = "ALLOW"
$Log_Type = metadata.log_type
$IP_Address = principal.ip
$User = principal.user.userid
$Resource_Name = target.resource.name
$Location = principal.location.country_or_region
$Date = timestamp.get_timestamp(metadata.event_timestamp.seconds, "%F %T ")
match:
$Date, $Log_Type, $IP_Address, $User, $Location, $Resource_Name
order:
$Date desc
排名前 10 的被屏蔽来源 IP
(metadata.log_type = /AWS_CLOUDTRAIL|GCP_CLOUDAUDIT/ nocase
and metadata.product_event_type = /storage|bucket/ nocase
and (metadata.event_type = "RESOURCE_CREATION"
or metadata.event_type = "RESOURCE_DELETION"
or metadata.event_type = "RESOURCE_PERMISSIONS_CHANGE"
or metadata.event_type = "RESOURCE_READ"
or metadata.event_type = "RESOURCE_WRITTEN"))
or
(metadata.log_type = /AZURE/ nocase
and metadata.product_event_type = /microsoft\.storage\/storageaccounts\/(?:write|delete|read)/ nocase)
security_result.action = "BLOCK"
$Event_Type = metadata.event_type
$IP_Address = principal.ip
match:
$Event_Type, $IP_Address
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
一段时间内的事件
(metadata.log_type = /AWS_CLOUDTRAIL|GCP_CLOUDAUDIT/ nocase
and metadata.product_event_type = /storage|bucket/ nocase
and (metadata.event_type = "RESOURCE_CREATION"
or metadata.event_type = "RESOURCE_DELETION"
or metadata.event_type = "RESOURCE_PERMISSIONS_CHANGE"
or metadata.event_type = "RESOURCE_READ"
or metadata.event_type = "RESOURCE_WRITTEN"))
or
(metadata.log_type = /AZURE/ nocase
and metadata.product_event_type = /microsoft\.storage\/storageaccounts\/(?:write|delete|read)/ nocase)
$Log_Type = metadata.log_type
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
match:
$Log_Type, $Date
outcome:
$Count = count(metadata.id)
排名前 10 的资源位置
(metadata.log_type = /AWS_CLOUDTRAIL|GCP_CLOUDAUDIT/ nocase
and metadata.product_event_type = /storage|bucket/ nocase
and (metadata.event_type = "RESOURCE_CREATION"
or metadata.event_type = "RESOURCE_DELETION"
or metadata.event_type = "RESOURCE_PERMISSIONS_CHANGE"
or metadata.event_type = "RESOURCE_READ"
or metadata.event_type = "RESOURCE_WRITTEN"))
or
(metadata.log_type = /AZURE/ nocase
and metadata.product_event_type = /microsoft\.storage[\/\.]storageaccounts[\/\.](?:write|delete|read)/ nocase)
target.location.name != ""
security_result.action = "ALLOW"
$Location = target.location.name
$Log_Type = metadata.log_type
match:
$Location, $Log_Type
outcome:
$Count = count_distinct(metadata.id)
order:
$Count desc
limit:
10
删除资源的前 10 个来源 IP
(
(metadata.log_type = /(AWS_CLOUDTRAIL|GCP_CLOUDAUDIT)/ nocase
and metadata.event_type = "RESOURCE_DELETION"
and metadata.product_event_type = /(storage|bucket)/ nocase)
or
(metadata.log_type = /AZURE/ nocase
and metadata.product_event_type = /microsoft\.storage\/storageaccounts\/delete/ nocase)
)
security_result.action = "ALLOW"
$Log_Type = metadata.log_type
$IP_Address = principal.ip
match:
$Log_Type, $IP_Address
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
资源权限随时间的变化
(
(metadata.log_type = /AWS_CLOUDTRAIL|GCP_CLOUDAUDIT/ nocase
and metadata.event_type = "RESOURCE_PERMISSIONS_CHANGE"
and metadata.product_event_type = /storage|bucket/ nocase)
or
(metadata.log_type = /AZURE/ nocase
and metadata.product_event_type = /microsoft\.authorization\/(?:policyassignments|roledefinitions)?\/write/ nocase
and target.resource.resource_type = "STORAGE_BUCKET")
)
security_result.action = "ALLOW"
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
$Log_Type = metadata.log_type
match:
$Date, $Log_Type
outcome:
$Count = count(metadata.id)
创建资源最多的前 10 个来源 IP
(
(metadata.log_type = /AWS_CLOUDTRAIL|GCP_CLOUDAUDIT/ nocase
and metadata.event_type = "RESOURCE_CREATION"
and metadata.product_event_type = /storage|bucket/ nocase)
or
(metadata.log_type = /AZURE/ nocase
and metadata.product_event_type = /microsoft\.storage\/storageaccounts\/write/ nocase)
)
security_result.action = "ALLOW"
$Log_Type = metadata.log_type
$IP_Address = principal.ip
match:
$Log_Type, $IP_Address
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
访问资源最多的 10 位用户
(
(metadata.log_type = /(AWS_CLOUDTRAIL|GCP_CLOUDAUDIT)/ nocase
and metadata.event_type = "RESOURCE_READ"
and metadata.product_event_type = /(storage|bucket)/ nocase)
or
(metadata.log_type = /AZURE/ nocase
and metadata.product_event_type = /microsoft\.storage\/storageaccounts\/read/ nocase)
)
security_result.action = "ALLOW"
$Log_Type = metadata.log_type
$User = principal.user.userid
match:
$Log_Type, $User
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
权限发生变化的前 10 项资源
(
(metadata.log_type = /AWS_CLOUDTRAIL|GCP_CLOUDAUDIT/ nocase
and metadata.event_type = "RESOURCE_PERMISSIONS_CHANGE"
and metadata.product_event_type = /storage|bucket/ nocase)
or
(metadata.log_type = /AZURE/ nocase
and metadata.product_event_type = /microsoft\.authorization\/(?:policyassignments|roledefinitions)?\/write/ nocase
and target.resource.resource_type = "STORAGE_BUCKET")
)
security_result.action = "ALLOW"
$Log_Type = metadata.log_type
$Resource_Name = target.resource.name
match:
$Log_Type, $Resource_Name
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
更新资源最多的前 10 位用户
(
(metadata.log_type = /(AWS_CLOUDTRAIL|GCP_CLOUDAUDIT)/ nocase
and metadata.event_type = "RESOURCE_WRITTEN"
and metadata.product_event_type = /(storage|bucket)/ nocase)
or
(metadata.log_type = /AZURE/ nocase
and metadata.product_event_type = /microsoft\.storage\/storageaccounts\/(?:write|.*\/write)?/ nocase)
)
security_result.action = "ALLOW"
$Log_Type = metadata.log_type
$User = principal.user.userid
match:
$Log_Type, $User
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
更改资源权限的前 10 位用户
(
(metadata.log_type = /AWS_CLOUDTRAIL|GCP_CLOUDAUDIT/ nocase
and metadata.event_type = "RESOURCE_PERMISSIONS_CHANGE"
and metadata.product_event_type = /storage|bucket/ nocase)
or
(metadata.log_type = /AZURE/ nocase
and metadata.product_event_type = /microsoft\.authorization\/(?:policyassignments|roledefinitions)?\/write/ nocase
and target.resource.resource_type = "STORAGE_BUCKET")
)
security_result.action = "ALLOW"
$Log_Type = metadata.log_type
$User = principal.user.userid
match:
$Log_Type, $User
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
随时间推移创建的资源
(
(metadata.log_type = /AWS_CLOUDTRAIL|GCP_CLOUDAUDIT/ nocase
and metadata.event_type = "RESOURCE_CREATION"
and metadata.product_event_type = /storage|bucket/ nocase)
or
(metadata.log_type = /AZURE/ nocase
and metadata.product_event_type = /microsoft\.storage\/storageaccounts\/write/ nocase)
)
security_result.action = "ALLOW"
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
$Log_Type = metadata.log_type
match:
$Date, $Log_Type
outcome:
$Count = count(metadata.id)
更新了“热门 10 大资源”
(
(metadata.log_type = /(AWS_CLOUDTRAIL|GCP_CLOUDAUDIT)/ nocase
and metadata.event_type = "RESOURCE_WRITTEN"
and metadata.product_event_type = /(storage|bucket)/ nocase)
or
(metadata.log_type = /AZURE/ nocase
and metadata.product_event_type = /microsoft\.storage\/storageaccounts\/(?:write|.*\/write)?/ nocase)
)
security_result.action = "ALLOW"
$Log_Type = metadata.log_type
$Resource_Name = target.resource.name
match:
$Log_Type, $Resource_Name
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
删除资源最多的前 10 位用户
(
(metadata.log_type = /(AWS_CLOUDTRAIL|GCP_CLOUDAUDIT)/ nocase
and metadata.event_type = "RESOURCE_DELETION"
and metadata.product_event_type = /(storage|bucket)/ nocase)
or
(metadata.log_type = /AZURE/ nocase
and metadata.product_event_type = /microsoft\.storage\/storageaccounts\/delete/ nocase)
)
security_result.action = "ALLOW"
$Log_Type = metadata.log_type
$User = principal.user.userid
match:
$Log_Type, $User
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
创建资源最多的 10 位用户
(
(metadata.log_type = /AWS_CLOUDTRAIL|GCP_CLOUDAUDIT/ nocase
and metadata.event_type = "RESOURCE_CREATION"
and metadata.product_event_type = /storage|bucket/ nocase)
or
(metadata.log_type = /AZURE/ nocase
and metadata.product_event_type = /microsoft\.storage\/storageaccounts\/write/ nocase)
)
security_result.action = "ALLOW"
$Log_Type = metadata.log_type
$User = principal.user.userid
match:
$Log_Type, $User
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
随时间推移而更新的资源
(
(metadata.log_type = /(AWS_CLOUDTRAIL|GCP_CLOUDAUDIT)/ nocase
and metadata.event_type = "RESOURCE_WRITTEN"
and metadata.product_event_type = /(storage|bucket)/ nocase)
or
(metadata.log_type = /AZURE/ nocase
and metadata.product_event_type = /microsoft\.storage\/storageaccounts\/(?:write|.*\/write)?/ nocase)
)
security_result.action = "ALLOW"
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
$Log_Type = metadata.log_type
match:
$Date, $Log_Type
outcome:
$Count = count(metadata.id)
公开共享的存储分区
(metadata.log_type = "AZURE_ACTIVITY"
and metadata.product_event_type = "Microsoft.Storage/storageAccounts/write" nocase
and security_result.detection_fields["allowBlobPublicAccess"] = "true")
or
(metadata.log_type = "GCP_CLOUDAUDIT"
and metadata.product_event_type = "storage.setIamPermissions"
and target.application = "storage.googleapis.com"
and security_result.action = "ALLOW"
and target.resource.attribute.labels["ser_binding_deltas_action"] = "ADD"
and target.resource.attribute.labels["ser_binding_deltas_role"] = /roles\/storage.*/
and target.resource.attribute.labels["ser_binding_deltas_member"] = /allUsers|allAuthenticatedUsers/
and target.resource.resource_type = "STORAGE_BUCKET"
)
or
(metadata.log_type = "AWS_CLOUDTRAIL"
and metadata.ingestion_labels["EventSource"] = "s3.amazonaws.com" nocase
and metadata.product_event_type = /PutBucketPublicAccessBlock/ nocase
and (target.resource.attribute.labels["BlockPublicAcls"] = "false"
or target.resource.attribute.labels["BlockPublicPolicy"] = "false"
or target.resource.attribute.labels["IgnorePublicAcls"] = "false"
or target.resource.attribute.labels["RestrictPublicBuckets"] = "false")
)
$Date = timestamp.get_timestamp(metadata.event_timestamp.seconds, "%F %T ")
$Log_Type = metadata.log_type
$User = principal.user.userid
$Resource_Name = target.resource.name
match:
$Date, $Log_Type, $User, $Resource_Name
DDoS 概览
此信息中心可全面分析分布式拒绝服务 (DDoS 攻击) 活动，深入了解攻击趋势、模式和行为。
它有助于识别网络中的威胁途径和高风险区域，使安全团队能够有效地检测、应对和缓解 DDoS 攻击。
10 大供应商提醒
按操作排序的前 10 个来源 IP
按事件类型划分的事件数
按日志类型划分的供应商随时间变化的提醒
按日志类型划分的指定时间段内的事件
按说明划分的活动
来源地理位置概览
图表名称
查询示例
10 大供应商提醒
(metadata.log_type = /ddos/ nocase or (security_result.description = /ddos/ nocase or security_result.summary = /ddos/ nocase or metadata.description = /ddos/ nocase))
$Rule_Name = security_result.rule_name
$Rule_Name != ""
$Log_Type = metadata.log_type
$Action = security_result.action
match:
$Rule_Name, $Log_Type, $Action
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
按操作排序的前 10 个来源 IP
(metadata.log_type = /ddos/ nocase or (security_result.description = /ddos/ nocase or security_result.summary = /ddos/ nocase or metadata.description = /ddos/ nocase))
$Source_Ip = strings.coalesce(principal.ip, principal.asset.ip)
$Action = security_result.action
match:
$Source_Ip, $Action
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
按事件类型划分的事件数
(metadata.log_type = /ddos/ nocase or (security_result.description = /ddos/ nocase or security_result.summary = /ddos/ nocase or metadata.description = /ddos/ nocase))
$Event_Type = metadata.event_type
match:
$Event_Type
outcome:
$Count = count(metadata.id)
order:
$Count desc
按日志类型划分的供应商随时间变化的提醒
(metadata.log_type = /ddos/ nocase or (security_result.description = /ddos/ nocase or security_result.summary = /ddos/ nocase or metadata.description = /ddos/ nocase))
security_result.rule_name != ""
$Log_Type = metadata.log_type
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
match:
$Date, $Log_Type
outcome:
$Count = count(metadata.id)
order:
$Date asc
按日志类型划分的指定时间段内的事件
(metadata.log_type = /ddos/ nocase or (security_result.description = /ddos/ nocase or security_result.summary = /ddos/ nocase or metadata.description = /ddos/ nocase))
$Log_Type = metadata.log_type
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
match:
$Date, $Log_Type
outcome:
$Count = count(metadata.id)
order:
$Date asc
按说明划分的活动
(metadata.log_type = /ddos/ nocase or (security_result.description = /ddos/ nocase or security_result.summary = /ddos/ nocase or metadata.description = /ddos/ nocase))
$Description = strings.coalesce(metadata.description,security_result.summary,security_result.description)
$Log_Type = metadata.log_type
$Source_IP = strings.coalesce(principal.ip, principal.asset.ip)
$Destination_IP = strings.coalesce(target.ip, target.asset.ip)
$Action = security_result.action
$Destination_Hostname = strings.coalesce(target.hostname, target.asset.hostname)
$File = principal.process.file.full_path
match:
$Description, $Source_IP, $Destination_IP, $Destination_Hostname, $Action, $Log_Type
outcome:
$Count = count(metadata.id)
$Date = timestamp.get_timestamp(max(metadata.event_timestamp.seconds), "%F %T")
order:
$Count desc
来源地理位置概览
(metadata.log_type = /ddos/ nocase or (security_result.description = /ddos/ nocase or security_result.summary = /ddos/ nocase or metadata.description = /ddos/ nocase))
$Country = principal.ip_geo_artifact.location.country_or_region
$Country !=""
match:
$Country
outcome:
$Count = count(metadata.id)
$Latitude = max(principal.ip_geo_artifact.location.region_latitude)
$Longitude = max(principal.ip_geo_artifact.location.region_longitude)
order:
$Count desc
DNS 监控
此信息中心详细概述了 DNS 活动和网络健康状况，可深入了解 DNS 事件、查询趋势以及允许和阻止的查询的分布情况。通过直观呈现异常情况、位置和 DNS 故障，实现高效的监控、威胁检测和问题排查。
注意 ：应用可用的过滤条件可精简数据并显示相关结果。
前 10 个允许的 DNS 查询
前 10 个 DNS 允许的类别
DNS 事件总数
报告主持人
10 大 DNS 问题
按日志类型划分的 DNS 事件总数
前 10 个被屏蔽的 DNS 类别
随时间变化的成功 DNS 响应数
常见 DNS 活动
被屏蔽的 DNS 查询（前 10 名）
按操作划分的 DNS 查询：允许与屏蔽
按日志类型统计的 DNS 事件随时间的变化趋势
DNS 记录类型细分
DNS 响应失败随时间的变化
前 10 大来源 IP
DNS 记录类型随时间的变化
DNS 事件的日志总量随时间的变化趋势
按记录类型划分的 DNS 查询
举报总数
随时间变化的 DNS 查询
按位置划分的 DNS 查询前 10 名
图表名称
查询示例
前 10 个允许的 DNS 查询
metadata.event_type = "NETWORK_DNS"
network.dns.questions.name != ""
security_result.action = "ALLOW"
$Log_Type = metadata.log_type
$DNS_Questions_Name = network.dns.questions.name
match:
$DNS_Questions_Name, $Log_Type
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
前 10 个 DNS 允许的类别
metadata.event_type = "NETWORK_DNS"
security_result.action = "ALLOW"
security_result.category_details != ""
$Log_Type = metadata.log_type
$Category = security_result.category_details
match:
$Category, $Log_Type
outcome:
$Count = count($Category)
order:
$Count desc
limit:
10
DNS 事件总数
metadata.event_type = "NETWORK_DNS"
outcome:
$Count = count(metadata.id)
报告主持人
metadata.event_type = "NETWORK_DNS"
$Hostname = principal.hostname
match:
$Hostname
10 大 DNS 问题
$event.metadata.log_type = /EXTRAHOP_DNS|UMBRELLA_DNS/ nocase
$event.metadata.event_type = "NETWORK_DNS"
$Questions_Name = $event.network.dns.questions.name
match:
$Questions_Name
outcome:
$Count = count($event.metadata.id)
order:
$Count desc
limit:
10
DNS 事件总数
$event.metadata.log_type = /EXTRAHOP_DNS|UMBRELLA_DNS/ nocase
$event.metadata.event_type = "NETWORK_DNS"
outcome:
$Count = count($event.metadata.id)
按日志类型划分的 DNS 事件总数
$event.metadata.log_type = /EXTRAHOP_DNS|UMBRELLA_DNS/ nocase
$event.metadata.event_type = "NETWORK_DNS"
$Log_Type = $event.metadata.log_type
$Event_Type = $event.metadata.event_type
match:
$Log_Type, $Event_Type
outcome:
$Count = count($event.metadata.id)
order:
$Count asc
前 10 个被屏蔽的 DNS 类别
metadata.event_type = "NETWORK_DNS"
security_result.action = "BLOCK"
security_result.category_details != ""
$Log_Type = metadata.log_type
$Category = security_result.category_details
match:
$Category, $Log_Type
outcome:
$Count = count($Category)
order:
$Count desc
limit:
10
随时间变化的成功 DNS 响应数
$event.metadata.log_type = /EXTRAHOP_DNS|UMBRELLA_DNS/ nocase
$event.metadata.event_type = "NETWORK_DNS"
$event.network.dns.response = true
$event.network.application_protocol = "DNS"
$Answered = $event.network.dns.response
$Date = timestamp.get_date($event.metadata.event_timestamp.seconds)
match:
$Date, $Answered
outcome:
$Count = count($event.metadata.id)
order:
$Date asc
常见 DNS 活动
metadata.event_type = "NETWORK_DNS"
$Log_Type = metadata.log_type
$Source_IP = principal.ip
$Description = strings.coalesce(metadata.description, security_result.summary)
$DNS_Questions_Name = network.dns.questions.name
match:
$Source_IP, $Log_Type, $Description, $DNS_Questions_Name
outcome:
$Count = count(metadata.id)
order:
$Count desc
被屏蔽的 DNS 查询（前 10 名）
metadata.event_type = "NETWORK_DNS"
network.dns.questions.name != ""
security_result.action = "BLOCK"
$Log_Type = metadata.log_type
$DNS_Questions_Name = network.dns.questions.name
match:
$DNS_Questions_Name, $Log_Type
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
按操作划分的 DNS 查询：允许与屏蔽
metadata.event_type = "NETWORK_DNS"
network.dns.questions.name != ""
security_result.action = "ALLOW"
or security_result.action = "BLOCK"
$Action = security_result.action
match:
$Action
outcome:
$Count = count(metadata.id)
order:
$Count desc
按日志类型统计的 DNS 事件随时间的变化趋势
metadata.event_type = "NETWORK_DNS"
$Log_Type = metadata.log_type
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
match:
$Date, $Log_Type
outcome:
$Count = count(metadata.id)
order:
$Date desc
DNS 记录类型细分
$event.metadata.log_type = /EXTRAHOP_DNS|UMBRELLA_DNS/ nocase
$event.metadata.event_type = "NETWORK_DNS"
$Log_Type = $event.metadata.log_type
$Event_Type = $event.metadata.event_type
$DNS_Record_Type = $event.additional.fields["dns_record_type"]
$DNS_Record_Type != ""
$Return_Message = $event.additional.fields["dns_return_message"]
$Date = timestamp.get_timestamp($event.metadata.event_timestamp.seconds)
$Description = $event.metadata.description
match:
$Date, $Log_Type, $DNS_Record_Type, $Description, $Return_Message
order:
$Date desc
limit:
50
DNS 响应失败随时间的变化
metadata.event_type = "NETWORK_DNS"
network.dns.response_code = 3
or network.dns.response_code = 5
$Denied = strings.concat(network.dns.response_code, " ")
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
match:
$Denied, $Date
outcome:
$Count = count(metadata.id)
order:
$Date desc
前 10 大来源 IP
$event.metadata.log_type = /EXTRAHOP_DNS|UMBRELLA_DNS/ nocase
$event.metadata.event_type = "NETWORK_DNS"
$Log_Type = $event.metadata.log_type
$Event_Type = $event.metadata.event_type
$Source_IP = $event.principal.ip
$Source_IP != ""
match:
$Source_IP, $Event_Type, $Log_Type
outcome:
$Count = count($event.metadata.id)
order:
$Count desc
limit:
10
DNS 记录类型随时间的变化
$event.metadata.log_type = /EXTRAHOP_DNS|UMBRELLA_DNS/ nocase
$event.metadata.event_type = "NETWORK_DNS"
$Record_Types = $event.additional.fields["dns_record_type"]
$Date = timestamp.get_date($event.metadata.event_timestamp.seconds)
match:
$Record_Types, $Date
outcome:
$Count = count($event.metadata.id)
order:
$Date asc
按日志类型划分的 DNS 事件总数
metadata.event_type = "NETWORK_DNS"
$Log_Type = metadata.log_type
match:
$Log_Type
outcome:
$Count = count(metadata.id)
order:
$Count desc
DNS 事件的日志总量随时间的变化趋势
$event.metadata.log_type = /EXTRAHOP_DNS|UMBRELLA_DNS/ nocase
$event.metadata.event_type = "NETWORK_DNS"
$Log_Type = $event.metadata.log_type
$Date = timestamp.get_date($event.metadata.event_timestamp.seconds)
match:
$Date, $Log_Type
outcome:
$Count = count($event.metadata.id)
order:
$Date asc
DNS 响应失败随时间的变化
$event.metadata.log_type = /EXTRAHOP_DNS|UMBRELLA_DNS/ nocase
$event.network.dns.response_code = 3
or $event.network.dns.response_code = 5
$event.metadata.event_type = "NETWORK_DNS"
$Denied = $event.network.dns.response_code
$Date = timestamp.get_date($event.metadata.event_timestamp.seconds)
match:
$Denied, $Date
outcome:
$Count = count($event.metadata.id)
order:
$Date asc
DNS 记录类型细分
metadata.event_type = "NETWORK_DNS"
$Log_Type = metadata.log_type
$Event_Type = metadata.event_type
$Source_IP = principal.ip
$Hostname = principal.hostname
$DNS_Record_Type = strings.coalesce(additional.fields["dns_record_type"], extracted.fields["query_type"], extracted.fields["qtype_name"])
$Return_Message = additional.fields["dns_return_message"]
$Date = timestamp.get_timestamp(metadata.event_timestamp.seconds)
$Description = strings.coalesce(metadata.description, security_result.summary)
match:
$Date, $Log_Type, $Source_IP, $Hostname, $DNS_Record_Type, $Description, $Return_Message
order:
$Date desc
前 10 大来源 IP
metadata.event_type = "NETWORK_DNS"
$Log_Type = metadata.log_type
$Source_IP = principal.ip
match:
$Source_IP, $Log_Type
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
按记录类型划分的 DNS 查询
metadata.event_type = "NETWORK_DNS"
network.dns.questions.name != ""
$Record_Types = strings.coalesce(additional.fields["dns_record_type"], extracted.fields["query_type"], extracted.fields["qtype_name"])
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
match:
$Date, $Record_Types
outcome:
$Count = count(metadata.id)
order:
$Date desc
举报总数
metadata.event_type = "NETWORK_DNS"
outcome:
$Count = count_distinct(principal.hostname)
随时间变化的 DNS 查询
metadata.event_type = "NETWORK_DNS"
network.dns.questions.name != ""
$Log_Type = metadata.log_type
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
match:
$Date, $Log_Type
outcome:
$Count = count(network.dns.questions.name)
order:
$Date desc
随时间变化的成功 DNS 响应数
metadata.event_type = "NETWORK_DNS"
network.dns.response = true
$Answered = network.dns.response
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
match:
$Date, $Answered
outcome:
$Count = count(metadata.id)
order:
$Date desc
常见 DNS 活动
$event.metadata.log_type = /EXTRAHOP_DNS|UMBRELLA_DNS/ nocase
$event.metadata.event_type = "NETWORK_DNS"
$Log_Type = $event.metadata.log_type
$Source_IP = $event.principal.ip
$Description = $event.metadata.description
$DQ_Name = $event.network.dns.questions.name
match:
$Source_IP, $Description, $DQ_Name
outcome:
$Count = count($event.metadata.id)
order:
$Count desc
limit:
50
按位置划分的 DNS 查询前 10 名
metadata.event_type = "NETWORK_DNS"
network.dns.questions.name != ""
$Questions_Name = network.dns.questions.name
$Country = principal.ip_geo_artifact.location.country_or_region
$Latitude = principal.ip_geo_artifact.location.region_latitude
$Longitude = principal.ip_geo_artifact.location.region_longitude
match:
$Questions_Name, $Country, $Latitude, $Longitude
outcome:
$Count = count(metadata.id)
limit:
10
数据注入和健康状况
此信息中心可提供有关数据流的关键数据洞见，显示已提取的事件和错误计数，以便清晰了解潜在问题。它包含日志类型分布和已注入事件状态的可视化图表，以及最近的注入活动和每日日志信息。通过跟踪不同时间范围内的提取吞吐量，该信息中心有助于发现趋势和问题，从而提高组织管理数据注入和保持顺畅运营的能力。
Bindplane 代理日志记录 - 按严重程度随时间变化的日志
自主持人报告活动以来的天数（过去 7 天）
Bindplane 代理日志记录 - 按数量显示的消息
图表名称
查询示例
Bindplane 代理日志记录 - 按严重程度随时间变化的日志
metadata.log_type = "BINDPLANE_AGENT"
metadata.ingestion_labels.key = "ingestion_source"
metadata.ingestion_labels.value = $agent
metadata.description = $message
security_result.severity = $severity
timestamp.get_timestamp(metadata.event_timestamp.seconds) = $timestamp
match:
$severity, $timestamp
outcome:
$total = count(metadata.id)
order :
$severity
自主持人报告活动以来的天数（过去 7 天）
$host = principal.hostname
$event_time = metadata.event_timestamp.seconds
match:
$host
outcome:
$last_seen_timestamp = timestamp.get_timestamp(max($event_time))
$days_since_last_seen = math.round((timestamp.current_seconds() - max($event_time)) / 86400, 0)
order:
$days_since_last_seen desc
Bindplane 代理日志记录 - 按数量显示的消息
metadata.log_type = "BINDPLANE_AGENT"
metadata.ingestion_labels.key = "ingestion_source"
metadata.ingestion_labels.value = $agent
metadata.description = $message
security_result.severity = $severity
match:
$severity, $message
outcome:
$total = count(metadata.id)
$first_seen = timestamp.get_timestamp(min(metadata.event_timestamp.seconds))
$last_seen = timestamp.get_timestamp(max(metadata.event_timestamp.seconds))
数据泄露防护 (DLP)
此信息中心提供与 DLP 事件相关的关键指标。
前 10 位用户
敏感数据访问尝试
DLP 事件随时间变化的趋势
按操作划分的事件
按严重程度划分的数据泄露防护违规行为
排名前 10 位的数据泄露防护政策违规事件类型
数据泄露防护违规次数随时间的变化
10 大热门主持人
前 10 大数据泄露防护规则
按数据渗漏尝试次数排名的前 10 名用户
10 大热门文件
图表名称
查询示例
前 10 位用户
$log_type = metadata.log_type
$log_type = /DLP/ nocase
$user= strings.coalesce(principal.user.user_display_name,principal.user.userid)
$user != ""
match:
$user
outcome:
$user_count = count(metadata.id)
order:
$user_count desc
limit: 10
敏感数据访问尝试
$log_type = metadata.log_type
$log_type = /DLP/ nocase
$event_type = metadata.event_type
$security_event_type = metadata.product_event_type
$security_event_type = /Sensitive/
$user = strings.coalesce(principal.user.user_display_name,principal.user.userid)
$action = security_result.action_details
$hostname = principal.hostname
$src_ip = principal.ip
$file_path = target.file.full_path
match:
$user,$action,$src_ip,$hostname,$file_path
outcome:
$event_count = count(metadata.id)
order:
$event_count desc
DLP 事件随时间变化的趋势
$date = timestamp.get_date(metadata.event_timestamp.seconds)
$log_type = metadata.log_type
$log_type = /DLP/ nocase
match:
$date
outcome:
$event_count = count(metadata.id)
按操作划分的事件
$log_type = metadata.log_type
$log_type = /DLP/ nocase
$action = security_result.action_details
$action != ""
match:
$action
outcome:
$event_count = count(metadata.id)
order:
$action asc
按严重程度划分的数据泄露防护违规行为
$date = timestamp.get_date(metadata.event_timestamp.seconds)
$log_type=metadata.log_type
$log_type = /DLP/ nocase
$severity =security_result.severity
$security_event_type=metadata.product_event_type
$security_event_type = /Violation/ nocase
match:
$severity
outcome:
$count = count(metadata.id)
order:
$severity desc
排名前 10 位的数据泄露防护政策违规事件类型
$log_type = metadata.log_type
$log_type = /DLP/ nocase
$event_type = metadata.product_event_type
$user = principal.user.user_display_name
$reason = strings.coalesce(security_result.summary,metadata.description,metadata.product_event_type)
$reason = /violation/ nocase
match:
$event_type
outcome:
$event_count = count(metadata.id)
$Count_user = count_distinct($user)
order:
$event_count desc
limit:
10
数据泄露防护违规次数随时间的变化
$date = timestamp.get_date(metadata.event_timestamp.seconds)
$log_type=metadata.log_type
$log_type = /DLP/ nocase
$security_event_type=metadata.product_event_type
$security_event_type = /Violation/ nocase
match:
$date
outcome:
$count = count(metadata.id)
order:
$date asc
10 大热门主持人
$log_type = metadata.log_type
$log_type = /DLP/ nocase
$hostname= strings.coalesce(principal.hostname, principal.asset.hostname)
$hostname != ""
match:
$hostname
outcome:
$event_count = count(metadata.id)
order:
$event_count desc
limit: 10
前 10 大数据泄露防护规则
$log_type = metadata.log_type
$log_type = /DLP/
$rule_name = security_result.rule_name
$rule_name != ""
match:
$rule_name
outcome:
$event_count = count(metadata.id)
order:
$event_count desc
limit: 10
按数据渗漏尝试次数排名的前 10 名用户
$log_type = metadata.log_type
$log_type = /DLP/ nocase
$user = strings.coalesce(principal.user.user_display_name,principal.user.userid)
$user !=""
$reason = strings.coalesce(metadata.product_event_type,security_result.summary,metadata.description)
$reason = /exfiltration/ nocase
$action = security_result.action_details
match:
$user
outcome:
$Action = array_distinct($action)
$Reason = array_distinct($reason)
$event_count = count(metadata.id)
order:
$event_count desc
limit:
10
10 大热门文件
$log_type = metadata.log_type
$log_type = /DLP/
$file_name = strings.coalesce(target.file.full_path, additional.fields["fname"])
match:
$file_name
outcome:
$event_count = count(metadata.id)
order:
$event_count desc
limit: 10
数据安全监控
此信息中心全面展示了数据安全工具提供的安全事件，重点关注事件严重程度、采取的措施和触发规则等指标。它会跟踪热门主机、用户和地理模式，以识别新出现的威胁和趋势。
按严重程度划分的事件
按日志类型划分的指定时间段内的事件
按操作划分的活动
来源地理位置热图
事件类型分布情况
事件总数
按说明排序的前 10 个活动
排名前 10 的来源主机名
前 10 个来源用户名
触发次数最多的 10 条数据安全产品规则
图表名称
查询示例
按严重程度划分的事件
metadata.log_type = /ARUBA_CENTRAL|CLOUDFLARE_WARP|DELL_CYBERSENSE|FORGEROCK_OPENIDM|IMPERVA_DRA|IMPERVA_SECURESPHERE|IBM_OPENPAGES|INTEL471_WATCHER_ALERTS|OKERA_DAP|OPENCANARY|RUBRIK_POLARIS|SENTRY|TINES|TINTRI|VARONIS/ nocase
$Severity = security_result.severity
match:
$Severity
outcome:
$Count = count(metadata.id)
order:
$Count desc
按日志类型划分的指定时间段内的事件
$Log_Type = metadata.log_type
$Log_Type = /ARUBA_CENTRAL|CLOUDFLARE_WARP|DELL_CYBERSENSE|FORGEROCK_OPENIDM|IMPERVA_DRA|IMPERVA_SECURESPHERE|IBM_OPENPAGES|INTEL471_WATCHER_ALERTS|OKERA_DAP|OPENCANARY|RUBRIK_POLARIS|SENTRY|TINES|TINTRI|VARONIS/ nocase
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
match:
$Date, $Log_Type
outcome:
$Count = count(metadata.id)
order:
$Date asc
按操作划分的活动
metadata.log_type = /ARUBA_CENTRAL|CLOUDFLARE_WARP|DELL_CYBERSENSE|FORGEROCK_OPENIDM|IMPERVA_DRA|IMPERVA_SECURESPHERE|IBM_OPENPAGES|INTEL471_WATCHER_ALERTS|OKERA_DAP|OPENCANARY|RUBRIK_POLARIS|SENTRY|TINES|TINTRI|VARONIS/ nocase
$Action = security_result.action
match:
$Action
outcome:
$Count = count(metadata.id)
order:
$Count desc
来源地理位置热图
metadata.log_type = /ARUBA_CENTRAL|CLOUDFLARE_WARP|DELL_CYBERSENSE|FORGEROCK_OPENIDM|IMPERVA_DRA|IMPERVA_SECURESPHERE|IBM_OPENPAGES|INTEL471_WATCHER_ALERTS|OKERA_DAP|OPENCANARY|RUBRIK_POLARIS|SENTRY|TINES|TINTRI|VARONIS/ nocase
$Country = principal.ip_geo_artifact.location.country_or_region
match:
$Country
outcome:
$Count = count(metadata.id)
$Latitude = max(principal.ip_geo_artifact.location.region_latitude)
$Longitude = max(principal.ip_geo_artifact.location.region_longitude)
order:
$Count desc
事件类型分布情况
metadata.log_type = /ARUBA_CENTRAL|CLOUDFLARE_WARP|DELL_CYBERSENSE|FORGEROCK_OPENIDM|IMPERVA_DRA|IMPERVA_SECURESPHERE|IBM_OPENPAGES|INTEL471_WATCHER_ALERTS|OKERA_DAP|OPENCANARY|RUBRIK_POLARIS|SENTRY|TINES|TINTRI|VARONIS/ nocase
$Event_Type = metadata.event_type
match:
$Event_Type
outcome:
$Count = count(metadata.id)
order:
$Count desc
事件总数
metadata.log_type = /ARUBA_CENTRAL|CLOUDFLARE_WARP|DELL_CYBERSENSE|FORGEROCK_OPENIDM|IMPERVA_DRA|IMPERVA_SECURESPHERE|IBM_OPENPAGES|INTEL471_WATCHER_ALERTS|OKERA_DAP|OPENCANARY|RUBRIK_POLARIS|SENTRY|TINES|TINTRI|VARONIS/
outcome:
$Count = count(metadata.id)
按说明排序的前 10 个活动
metadata.log_type = /ARUBA_CENTRAL|CLOUDFLARE_WARP|DELL_CYBERSENSE|FORGEROCK_OPENIDM|IMPERVA_DRA|IMPERVA_SECURESPHERE|IBM_OPENPAGES|INTEL471_WATCHER_ALERTS|OKERA_DAP|OPENCANARY|RUBRIK_POLARIS|SENTRY|TINES|TINTRI|VARONIS/ nocase
$Summary = strings.coalesce(metadata.description,security_result.description,security_result.summary)
$Summary != ""
match:
$Summary
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
排名前 10 的来源主机名
metadata.log_type = /ARUBA_CENTRAL|CLOUDFLARE_WARP|DELL_CYBERSENSE|FORGEROCK_OPENIDM|IMPERVA_DRA|IMPERVA_SECURESPHERE|IBM_OPENPAGES|INTEL471_WATCHER_ALERTS|OKERA_DAP|OPENCANARY|RUBRIK_POLARIS|SENTRY|TINES|TINTRI|VARONIS/ nocase
$Hostname= strings.coalesce(principal.hostname, principal.asset.hostname)
$Hostname!=""
match:
$Hostname
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
前 10 个来源用户名
metadata.log_type = /ARUBA_CENTRAL|CLOUDFLARE_WARP|DELL_CYBERSENSE|FORGEROCK_OPENIDM|IMPERVA_DRA|IMPERVA_SECURESPHERE|IBM_OPENPAGES|INTEL471_WATCHER_ALERTS|OKERA_DAP|OPENCANARY|RUBRIK_POLARIS|SENTRY|TINES|TINTRI|VARONIS/ nocase
$User = strings.coalesce(principal.user.user_display_name, principal.user.userid, principal.user.email_addresses)
$User != ""
match:
$User
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
触发次数最多的 10 条数据安全产品规则
metadata.log_type = /ARUBA_CENTRAL|CLOUDFLARE_WARP|DELL_CYBERSENSE|FORGEROCK_OPENIDM|IMPERVA_DRA|IMPERVA_SECURESPHERE|IBM_OPENPAGES|INTEL471_WATCHER_ALERTS|OKERA_DAP|OPENCANARY|RUBRIK_POLARIS|SENTRY|TINES|TINTRI|VARONIS/ nocase
$Rule_Name = security_result.rule_name
$Rule_Name !=""
match:
$Rule_Name
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
数据库监控
此信息中心通过跟踪用户活动、执行的 SQL 语句、登录趋势和事件严重程度，深入了解数据库操作、安全性、性能和运行状况。这有助于您发现异常行为、确保运营效率，并主动管理数据库环境中的风险。
注意 ： 您可以根据特定日志类型应用过滤条件，以便在信息中心内显示相关结果。
按操作划分的活动
对象（按严重程度划分）
一段时间内登录尝试失败的次数
按 CREATE 语句数排名的前 10 位用户
已授予特权访问权限
按 DROP 语句数排名的前 10 位用户
与数据库相关的 10 大文件路径
近期文件操作
按 CREATE 语句划分的近期用户
近期登录失败尝试
DDL 语句
执行次数最多的 10 条语句
近期成功登录尝试
按数据库连接数细分的近期用户数
一段时间内成功登录的次数
指定时间段内的授权事件
应用流量随时间的变化
按 DROP 语句统计的近期用户数
按日志类型划分的 DDL 语句随时间的变化
按应用列出的数据库事件
严重程度分布
图表名称
查询示例
按操作划分的活动
$Action = security_result.action
match:
$Action
outcome:
$Count = count(metadata.id)
order:
$Count desc
对象（按严重程度划分）
$Object_id = strings.coalesce(target.resource.product_object_id, principal.resource.product_object_id)
$Object_id != ""
$Severity = security_result.severity
$User = strings.coalesce(principal.user.userid, principal.user.user_display_name, principal.user.email_addresses, target.user.userid, target.user.user_display_name, target.user.email_addresses)
$Summary = strings.coalesce(target.process.command_line, security_result.action_details, security_result.description, extracted.fields["textPayload"], extracted.fields["cmd_line"])
$IP = strings.coalesce(principal.ip, principal.asset.ip, target.ip, target.asset.ip)
$Log_Type = metadata.log_type
match:
$Object_id, $Summary, $User, $IP, $Severity, $Log_Type
outcome:
$Count = count(metadata.id)
$Date = timestamp.get_timestamp(max(metadata.event_timestamp.seconds), "%F %T")
order:
$Count desc
一段时间内登录尝试失败的次数
((metadata.event_type = "USER_LOGIN" and security_result.action = "BLOCK") or (metadata.event_type = "GENERIC_EVENT" and (extracted.fields["token_metadata.event_type"] = "DB_LOGIN_FAILED")))
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
$Log_Type = metadata.log_type
match:
$Date, $Log_Type
outcome:
$Count = count(metadata.id)
order:
$Date asc
按 CREATE 语句数排名的前 10 位用户
(target.process.command_line = /create/ nocase or extracted.fields["textPayload"] = /create/ nocase or additional.fields["statement"] = /create/ nocase or security_result.description = /create/ nocase or metadata.product_event_type = /create/ nocase)
$User = strings.coalesce(principal.user.userid, principal.user.user_display_name, principal.user.email_addresses, target.user.userid, target.user.user_display_name, target.user.email_addresses)
$Log_Type = metadata.log_type
match:
$User, $Log_Type
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
已授予特权访问权限
$Summary = strings.coalesce(if (target.process.command_line = /grant|revoke|(alter|create|drop|delete)\s+(user|role|database|server\s+role|login|table|trigger|function)|set\s+(role|password)|rename|backup|restore|impersonate|superuser/ nocase,target.process.command_line, ""),
if (extracted.fields["textPayload"] = /grant|revoke|(alter|create|drop|delete)\s+(user|role|database|server\s+role|login|table|trigger|function)|set\s+(role|password)|rename|backup|restore|impersonate|superuser/ nocase,extracted.fields["textPayload"], ""),
if (additional.fields["statement"] = /grant|revoke|(alter|create|drop|delete)\s+(user|role|database|server\s+role|login|table|trigger|function)|set\s+(role|password)|rename|backup|restore|impersonate|superuser/ nocase,additional.fields["statement"], ""),
if (security_result.description = /grant|revoke|(alter|create|drop|delete)\s+(user|role|database|server\s+role|login|table|trigger|function)|set\s+(role|password)|rename|backup|restore|impersonate|superuser/ nocase,security_result.description, ""),
if (metadata.product_event_type = /grant|revoke|(alter|create|drop|delete)\s+(user|role|database|server\s+role|login|table|trigger|function)|set\s+(role|password)|rename|backup|restore|impersonate|superuser/ nocase, strings.concat(metadata.product_event_type, " : ", extracted.fields["cmd_line"]), ""))
$Summary != ""
$User = strings.coalesce(principal.user.userid, principal.user.user_display_name, principal.user.email_addresses, target.user.userid, target.user.user_display_name, target.user.email_addresses)
$Hostname = strings.coalesce(principal.hostname, principal.asset.hostname, target.hostname, target.asset.hostname, target.resource.name)
$Log_Type = metadata.log_type
match:
$User, $Hostname, $Summary, $Log_Type
outcome:
$Count = count(metadata.id)
$Date = timestamp.get_timestamp(max(metadata.event_timestamp.seconds), "%F %T")
order:
$Count desc
按 DROP 语句数排名的前 10 位用户
(target.process.command_line = /drop/ nocase or extracted.fields["textPayload"] = /drop/ nocase or additional.fields["statement"] = /drop/ nocase or security_result.description = /drop/ nocase or metadata.product_event_type = /drop/ nocase)
$User = strings.coalesce(principal.user.userid, principal.user.user_display_name, principal.user.email_addresses, target.user.userid, target.user.user_display_name, target.user.email_addresses)
$Log_Type = metadata.log_type
match:
$User, $Log_Type
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
与数据库相关的 10 大文件路径
$File_Path = target.file.full_path
$File_Path != ""
$Log_Type = metadata.log_type
match:
$File_Path, $Log_Type
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
近期文件操作
$File = target.file.full_path
$File != ""
$Summary = strings.coalesce(target.process.command_line, security_result.description, security_result.action_details, extracted.fields["textPayload"], extracted.fields["cmd_line"])
$User = strings.coalesce(principal.user.userid, principal.user.user_display_name, principal.user.email_addresses, target.user.userid, target.user.user_display_name, target.user.email_addresses)
$Log_Type = metadata.log_type
match:
$User, $File, $Summary, $Log_Type
outcome:
$Count = count(metadata.id)
$Date = timestamp.get_timestamp(max(metadata.event_timestamp.seconds), "%F %T")
order:
$Count desc
按 CREATE 语句划分的近期用户
$Summary = strings.coalesce(if (target.process.command_line = /create/ nocase, target.process.command_line, ""),
if (extracted.fields["textPayload"] = /create/ nocase, extracted.fields["textPayload"], ""),
if (additional.fields["statement"] = /create/ nocase, additional.fields["statement"], ""),
if (security_result.description = /create/ nocase, security_result.description, "" ),
if (metadata.product_event_type = /create/ nocase, strings.concat(metadata.product_event_type, " : " ,extracted.fields["cmd_line"]), ""))
$Summary != ""
$User = strings.coalesce(principal.user.userid, principal.user.user_display_name, principal.user.email_addresses, target.user.userid, target.user.user_display_name, target.user.email_addresses)
$Hostname = strings.coalesce(principal.hostname, principal.asset.hostname, target.hostname, target.asset.hostname, target.resource.name)
$Log_Type = metadata.log_type
match:
$User, $Hostname, $Summary, $Log_Type
outcome:
$Count = count(metadata.id)
$Date = timestamp.get_timestamp(max(metadata.event_timestamp.seconds), "%F %T")
order:
$Count desc
近期登录失败尝试
((metadata.event_type = "USER_LOGIN" and security_result.action = "BLOCK") or (metadata.event_type = "GENERIC_EVENT" and (extracted.fields["token_metadata.event_type"] = "DB_LOGIN_FAILED")))
$Log_Type = metadata.log_type
$User = strings.coalesce(principal.user.userid, principal.user.user_display_name, principal.user.email_addresses, target.user.userid, target.user.user_display_name, target.user.email_addresses)
$Hostname = strings.coalesce(principal.hostname, principal.asset.hostname, target.hostname, target.asset.hostname, target.resource.name)
$Summary = strings.coalesce(extracted.fields["textPayload"], extracted.fields["cmd_line"], principal.user.attribute.permissions.name, security_result.action_details, security_result.description)
match:
$User, $Hostname, $Summary, $Log_Type
outcome:
$Count = count(metadata.id)
$Date = timestamp.get_timestamp(max(metadata.event_timestamp.seconds), "%F %T")
order:
$Count desc
DDL 语句
$DDL_Statements = strings.coalesce(if (target.process.command_line = /alter|create|drop|rename|truncate|comment/ nocase, target.process.command_line, ""),
if (extracted.fields["textPayload"] = /alter|create|drop|rename|truncate|comment/ nocase, extracted.fields["textPayload"], ""),
if (additional.fields["statement"] = /alter|create|drop|rename|truncate|comment/ nocase, additional.fields["statement"], ""),
if (security_result.description = /alter|create|drop|rename|truncate|comment/ nocase, security_result.description, "" ),
if (metadata.product_event_type = /alter|create|drop|rename|truncate|comment/ nocase, strings.concat(metadata.product_event_type, " : " ,extracted.fields["cmd_line"]), ""))
$DDL_Statements != ""
$User = strings.coalesce(principal.user.userid, principal.user.user_display_name, principal.user.email_addresses, target.user.userid, target.user.user_display_name, target.user.email_addresses)
$Hostname = strings.coalesce(principal.hostname, principal.asset.hostname, target.hostname, target.asset.hostname, target.resource.name)
$Log_Type = metadata.log_type
match:
$DDL_Statements, $User, $Hostname, $Log_Type
outcome:
$Count = count(metadata.id)
$Date = timestamp.get_timestamp(max(metadata.event_timestamp.seconds), "%F %T")
order:
$Count desc
执行次数最多的 10 条语句
$Command_Line = strings.coalesce(target.process.command_line, extracted.fields["textPayload"], additional.fields["statement"], extracted.fields["cmd_line"] security_result.description)
$Log_Type = metadata.log_type
match:
$Command_Line ,$Log_Type
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
近期成功登录尝试
((metadata.event_type = "USER_LOGIN" and security_result.action = "ALLOW") or (metadata.event_type = "GENERIC_EVENT" and (extracted.fields["token_metadata.event_type"] = "DB_LOGIN_SUCCESS")))
$Log_Type = metadata.log_type
$User = strings.coalesce(principal.user.userid, principal.user.user_display_name, principal.user.email_addresses, target.user.userid, target.user.user_display_name, target.user.email_addresses)
$Hostname = strings.coalesce(principal.hostname, principal.asset.hostname, target.hostname, target.asset.hostname, target.resource.name)
$Summary = strings.coalesce(extracted.fields["textPayload"], extracted.fields["cmd_line"], principal.user.attribute.permissions.name, security_result.action_details, security_result.description)
match:
$User, $Hostname, $Summary, $Log_Type
outcome:
$Count = count(metadata.id)
$Date = timestamp.get_timestamp(max(metadata.event_timestamp.seconds), "%F %T")
order:
$Count desc
按数据库连接数细分的近期用户数
(metadata.product_event_type = /connection/ nocase or security_result.description = /Connection/ nocase or additional.fields["operation_name"]= /Connection/ nocase or extracted.fields["textPayload"] = /connection/ nocase or additional.fields["ctx"] = /conn/ nocase)
$User = strings.coalesce(principal.user.userid, principal.user.user_display_name, principal.user.email_addresses, target.user.userid, target.user.user_display_name, target.user.email_addresses)
$Summary = strings.coalesce(extracted.fields["textPayload"], security_result.description, security_result.action_details, metadata.description)
$Hostname = strings.coalesce(principal.hostname, principal.asset.hostname, target.hostname, target.asset.hostname, target.resource.name)
$Log_Type = metadata.log_type
match:
$User, $Hostname, $Summary, $Log_Type
outcome:
$Count = count(metadata.id)
$Date = timestamp.get_timestamp(max(metadata.event_timestamp.seconds), "%F %T")
order:
$Count desc
一段时间内成功登录的次数
((metadata.event_type = "USER_LOGIN" and security_result.action = "ALLOW") or (metadata.event_type = "GENERIC_EVENT" and (extracted.fields["token_metadata.event_type"] = "DB_LOGIN_SUCCESS")))
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
$Log_Type = metadata.log_type
match:
$Date, $Log_Type
outcome:
$Count = count(metadata.id)
order:
$Date asc
指定时间段内的授权事件
(target.process.command_line = /grant/ nocase or extracted.fields["textPayload"] = /grant/ nocase or additional.fields["statement"] = /grant/ nocase or security_result.description = /grant/ nocase or metadata.product_event_type = /grant/ nocase)
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
$Log_Type = metadata.log_type
match:
$Date, $Log_Type
outcome:
$Count = count(metadata.id)
order:
$Date asc
应用流量随时间的变化
$Application = target.application
$Application != ""
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
match:
$Application, $Date
outcome:
$Count = count(metadata.id)
order:
$Date asc
按 DROP 语句统计的近期用户数
$Summary = strings.coalesce(if (target.process.command_line = /drop/ nocase, additional.fields["statement"], ""),
if (extracted.fields["textPayload"] = /drop/ nocase, extracted.fields["textPayload"], ""),
if (additional.fields["statement"] = /drop/ nocase, additional.fields["statement"], ""),
if (security_result.description = /drop/ nocase, security_result.description, "" ),
if (metadata.product_event_type = /drop/ nocase, strings.concat(metadata.product_event_type, " : " ,extracted.fields["cmd_line"]), ""))
$Summary != ""
$User = strings.coalesce(principal.user.userid, principal.user.user_display_name, principal.user.email_addresses, target.user.userid, target.user.user_display_name, target.user.email_addresses)
$Hostname = strings.coalesce(principal.hostname, principal.asset.hostname, target.hostname, target.asset.hostname, target.resource.name)
$Log_Type = metadata.log_type
match:
$User, $Hostname, $Summary, $Log_Type
outcome:
$Count = count(metadata.id)
$Date = timestamp.get_timestamp(max(metadata.event_timestamp.seconds), "%F %T")
order:
$Count desc
按日志类型划分的 DDL 语句随时间的变化
(target.process.command_line = /alter|create|drop|rename|truncate|comment/ nocase or extracted.fields["textPayload"] = /alter|create|drop|rename|truncate|comment/ nocase or additional.fields["statement"] = /alter|create|drop|rename|truncate|comment/ nocase or security_result.description = /alter|create|drop|rename|truncate|comment/ nocase or metadata.product_event_type = /alter|create|drop|rename|truncate|comment/ nocase)
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
$Log_Type = metadata.log_type
match:
$Date, $Log_Type
outcome:
$Count = count(metadata.id)
order:
$Date asc
按应用列出的数据库事件
$Application = target.application
$Application != ""
$Log_Type = metadata.log_type
$User = strings.coalesce(principal.user.userid, principal.user.user_display_name, principal.user.email_addresses, target.user.userid, target.user.user_display_name, target.user.email_addresses)
$Hostname = strings.coalesce(principal.hostname, principal.asset.hostname, target.hostname, target.asset.hostname, target.resource.name)
$Summary = strings.coalesce(extracted.fields["textPayload"], extracted.fields["cmd_line"],target.process.command_line, security_result.action_details, security_result.description)
match:
$Application, $Summary, $User, $Hostname, $Log_Type
outcome:
$Count = count(metadata.id)
$Date = timestamp.get_timestamp(max(metadata.event_timestamp.seconds), "%F %T")
order:
$Count desc
严重程度分布
$Severity = security_result.severity
match:
$Severity
outcome:
$Count = count(metadata.id)
order:
$Count desc
欺骗监控
此信息中心全面概述了与欺骗相关的活动，可深入了解事件趋势、模式和行为。它还可以突出显示诱饵网络中的高风险区域，使安全团队能够有效分析、监控和应对威胁。
注意 ： 您可以根据特定日志类型应用过滤条件，以便在信息中心内显示相关结果。
前 10 大目标 IP 地址
前 10 大来源 IP
按日志类型划分的指定时间段内的事件
前 10 大端口和协议
来源地理位置概览
排名前 10 的目标主机名
诱饵的 Kill Chain 阶段细分（Zscaler Deception）
排名前 10 的来源用户
按日志类型划分的前 10 大事件类型
排名前 10 的目标诱饵资源类型 (Zscaler Deception)
高风险得分最高的 10 个诱饵（Zscaler Deception）
按诱饵网络细分的活动（Zscaler Deception）
按严重程度划分的事件
图表名称
查询示例
前 10 大目标 IP 地址
$Destination_IP = strings.coalesce(target.ip, target.asset.ip)
$Log_Type = metadata.log_type
match:
$Destination_IP, $Log_Type
outcome:
$Count = count(metadata.id)
Order:
$Count desc
limit:
10
前 10 大来源 IP
$Source_IP = strings.coalesce(principal.ip, principal.asset.ip)
$Log_Type = metadata.log_type
match:
$Source_IP, $Log_Type
outcome:
$Count = count(metadata.id)
Order:
$Count desc
limit:
10
按日志类型划分的指定时间段内的事件
$Log_Type = metadata.log_type
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
match:
$Date, $Log_Type
outcome:
$Count = count(metadata.id)
前 10 大端口和协议
$Port = target.port
match:
$Port
outcome:
$Protocol = array_distinct(network.application_protocol)
$Count = count(metadata.id)
order:
$Count desc
limit:
10
来源地理位置概览
$Country = principal.ip_geo_artifact.location.country_or_region
$Country != ""
match:
$Country
outcome:
$Count = count(metadata.id)
$Latitude = max(principal.ip_geo_artifact.location.region_latitude)
$Longitude = max(principal.ip_geo_artifact.location.region_longitude)
order:
$Count desc
排名前 10 的目标主机名
$Destination_Hostname = strings.coalesce(target.hostname,target.asset.hostname)
$Log_Type = metadata.log_type
match:
$Destination_Hostname, $Log_Type
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
诱饵的 Kill Chain 阶段细分（Zscaler Deception）
$Kill_Chain = strings.coalesce(additional.fields["kill_chain_phase"],extracted.fields["kill_chain_phase"])
$Decoy_Server = strings.coalesce(additional.fields["decoy_recon_server_type"],extracted.fields["decoy_recon_server_type"])
$Attack_Type = strings.coalesce(additional.fields["decoy_recon_dataset_type"],extracted.fields["decoy_recon_dataset_type"])
$Source_User = strings.coalesce(principal.user.user_display_name, principal.user.userid, principal.user.email_addresses)
$Destination_Hostname = strings.coalesce(target.hostname, target.asset.hostname)
$Source_IP = strings.coalesce(principal.ip, principal.asset.ip)
$Destination_IP = strings.coalesce(target.ip, target.asset.ip)
$Log_Type = metadata.log_type
match:
$Kill_Chain ,$Decoy_Server ,$Attack_Type, $Destination_Hostname, $Source_User, $Source_IP, $Destination_IP, $Log_Type
outcome:
$Count = count(metadata.id)
$Date = timestamp.get_timestamp(max(metadata.event_timestamp.seconds), "%F %T")
order:
$Count desc
排名前 10 的来源用户
$Source_User = strings.coalesce(principal.user.userid, principal.user.email_addresses, principal.user.user_display_name)
$Log_Type = metadata.log_type
match:
$Source_User, $Log_Type
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
按日志类型划分的前 10 大事件类型
$Log_Type = metadata.log_type
$Event_Type = metadata.event_type
match:
$Event_Type, $Log_Type
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
排名前 10 的目标诱饵资源类型 (Zscaler Deception)
$Resource_Type = target.resource.type
$Destination_Hostname = strings.coalesce(target.hostname, target.asset.hostname)
match:
$Resource_Type, $Destination_Hostname
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
高风险得分最高的 10 个诱饵（Zscaler Deception）
$Decoy_Server = strings.coalesce(additional.fields["decoy_recon_server_type"], extracted.fields["decoy_recon_server_type"])
$Attack_Type = strings.coalesce(additional.fields["decoy_recon_dataset_type"], extracted.fields["decoy_recon_dataset_type"])
$Risk_Score = security_result.risk_score
$Log_Type = metadata.log_type
match:
$Decoy_Server, $Attack_Type , $Risk_Score, $Log_Type
outcome:
$Count = count(metadata.id)
$Date = timestamp.get_timestamp(max(metadata.event_timestamp.seconds), "%F %T")
order:
$Risk_Score desc
limit :
10
按诱饵网络细分的活动（Zscaler Deception）
$Decoy_Network = strings.coalesce(additional.fields["decoy_network_name"],extracted.fields["decoy_network_name"])
$Attack_Type = strings.coalesce(additional.fields["decoy_recon_dataset_type"],extracted.fields["decoy_recon_dataset_type"])
$Log_Type = metadata.log_type
match:
$Decoy_Network, $Attack_Type, $Log_Type
outcome:
$Count = count(metadata.id)
$Date = timestamp.get_timestamp(max(metadata.event_timestamp.seconds), "%F %T")
order:
$Count desc
按严重程度划分的事件
$Severity = security_result.severity
match:
$Severity
outcome:
$Count = count(metadata.id)
EDR 提醒概览
此信息中心可全面展示资产、事件和检测到的活跃威胁，从而增强可见性和控制力。
前 10 个 EDR 提醒
EDR 提醒总数
有效 EDR 传感器
根据 EDR 提醒得出的前 10 名主机
EDR 传感器数量
10 大技巧
基于 EDR 提醒的严重程度
10 大策略
EDR 提醒总数随时间变化情况
基于 EDR 提醒的前 10 名用户
图表名称
查询示例
前 10 个 EDR 提醒
$event.metadata.log_type = /LIMACHARLIE_EDR|CS_EDR|CS_DETECTS|ESET_EDR|CHECKPOINT_EDR|SOPHOS_EDR|OSQUERY_EDR|DIGITALGUARDIAN_EDR|SENTINEL_DV|MICROSOFT_DEFENDER_ENDPOINT|SENTINEL_EDR|UPTYCS_EDR|SYMANTEC_EDR|FORTINET_FORTIEDR|REDCANARY_EDR|CYBEREASON_EDR|MICROSOFT_DEFENDER_IDENTITY|DEEP_INSTINCT_EDR|CB_EDR|PAN_EDR|FIREEYE_HX|WATCHGUARD_EDR/ nocase
$Log_Type = $event.metadata.log_type
$Detection = $event.security_result.summary
$Detection != ""
match:
$Detection, $Log_Type
outcome:
$Count = count($event.security_result.summary)
order:
$Count desc
limit:
10
前 10 个 EDR 提醒
$event.metadata.log_type = /LIMACHARLIE_EDR|CS_EDR|CS_DETECTS|ESET_EDR|CHECKPOINT_EDR|SOPHOS_EDR|OSQUERY_EDR|DIGITALGUARDIAN_EDR|SENTINEL_DV|MICROSOFT_DEFENDER_ENDPOINT|SENTINEL_EDR|UPTYCS_EDR|SYMANTEC_EDR|FORTINET_FORTIEDR|REDCANARY_EDR|CYBEREASON_EDR|MICROSOFT_DEFENDER_IDENTITY|DEEP_INSTINCT_EDR|CB_EDR|PAN_EDR|FIREEYE_HX|WATCHGUARD_EDR/ nocase
$Log_Type = $event.metadata.log_type
$Detection = $event.security_result.summary
$Detection != ""
match:
$Detection, $Log_Type
outcome:
$Count = count($event.security_result.summary)
order:
$Count desc
limit:
10
EDR 提醒总数
$event.metadata.log_type = /LIMACHARLIE_EDR|CS_EDR|CS_DETECTS|ESET_EDR|CHECKPOINT_EDR|SOPHOS_EDR|OSQUERY_EDR|DIGITALGUARDIAN_EDR|SENTINEL_DV|MICROSOFT_DEFENDER_ENDPOINT|SENTINEL_EDR|UPTYCS_EDR|SYMANTEC_EDR|FORTINET_FORTIEDR|REDCANARY_EDR|CYBEREASON_EDR|MICROSOFT_DEFENDER_IDENTITY|DEEP_INSTINCT_EDR|CB_EDR|PAN_EDR|FIREEYE_HX|WATCHGUARD_EDR/ nocase
outcome:
$Count = count($event.security_result.summary)
有效 EDR 传感器
$event.metadata.log_type = /LIMACHARLIE_EDR|CS_EDR|CS_DETECTS|ESET_EDR|CHECKPOINT_EDR|SOPHOS_EDR|OSQUERY_EDR|DIGITALGUARDIAN_EDR|SENTINEL_DV|MICROSOFT_DEFENDER_ENDPOINT|SENTINEL_EDR|UPTYCS_EDR|SYMANTEC_EDR|FORTINET_FORTIEDR|REDCANARY_EDR|CYBEREASON_EDR|MICROSOFT_DEFENDER_IDENTITY|DEEP_INSTINCT_EDR|CB_EDR|PAN_EDR|FIREEYE_HX|WATCHGUARD_EDR/ nocase
$EDR_Asset = strings.coalesce($event.principal.asset.hostname, $event.principal.hostname)
$EDR_Asset != ""
match:
$EDR_Asset
limit:
50
根据 EDR 提醒得出的前 10 名主机
$event.metadata.log_type = /LIMACHARLIE_EDR|CS_EDR|CS_DETECTS|ESET_EDR|CHECKPOINT_EDR|SOPHOS_EDR|OSQUERY_EDR|DIGITALGUARDIAN_EDR|SENTINEL_DV|MICROSOFT_DEFENDER_ENDPOINT|SENTINEL_EDR|UPTYCS_EDR|SYMANTEC_EDR|FORTINET_FORTIEDR|REDCANARY_EDR|CYBEREASON_EDR|MICROSOFT_DEFENDER_IDENTITY|DEEP_INSTINCT_EDR|CB_EDR|PAN_EDR|FIREEYE_HX|WATCHGUARD_EDR/ nocase
$Hostname = strings.coalesce($event.principal.asset.hostname, $event.principal.hostname)
$Hostname != ""
match:
$Hostname
outcome:
$Count = count($event.security_result.summary)
order:
$Count desc
limit:
10
EDR 传感器数量
$event.metadata.log_type = /LIMACHARLIE_EDR|CS_EDR|CS_DETECTS|ESET_EDR|CHECKPOINT_EDR|SOPHOS_EDR|OSQUERY_EDR|DIGITALGUARDIAN_EDR|SENTINEL_DV|MICROSOFT_DEFENDER_ENDPOINT|SENTINEL_EDR|UPTYCS_EDR|SYMANTEC_EDR|FORTINET_FORTIEDR|REDCANARY_EDR|CYBEREASON_EDR|MICROSOFT_DEFENDER_IDENTITY|DEEP_INSTINCT_EDR|CB_EDR|PAN_EDR|FIREEYE_HX|WATCHGUARD_EDR/ nocase
outcome:
$Count = count_distinct(strings.coalesce($event.principal.asset.hostname, $event.principal.hostname))
10 大技巧
$event.metadata.log_type = /LIMACHARLIE_EDR|CS_EDR|CS_DETECTS|ESET_EDR|CHECKPOINT_EDR|SOPHOS_EDR|OSQUERY_EDR|DIGITALGUARDIAN_EDR|SENTINEL_DV|MICROSOFT_DEFENDER_ENDPOINT|SENTINEL_EDR|UPTYCS_EDR|SYMANTEC_EDR|FORTINET_FORTIEDR|REDCANARY_EDR|CYBEREASON_EDR|MICROSOFT_DEFENDER_IDENTITY|DEEP_INSTINCT_EDR|CB_EDR|PAN_EDR|FIREEYE_HX|WATCHGUARD_EDR/ nocase
$Technique_ID = strings.coalesce($event.security_result.attack_details.techniques.id, $event.security_result.detection_fields["Technique ID"])
$Technique = strings.coalesce($event.security_result.attack_details.techniques.name, $event.security_result.detection_fields["Technique"])
$Technique_ID != ""
$Technique != ""
match:
$Technique_ID, $Technique
outcome:
$Count = count($event.security_result.summary)
order:
$Count desc
limit:
10
基于 EDR 提醒的严重程度
$event.metadata.log_type = /LIMACHARLIE_EDR|CS_EDR|CS_DETECTS|ESET_EDR|CHECKPOINT_EDR|SOPHOS_EDR|OSQUERY_EDR|DIGITALGUARDIAN_EDR|SENTINEL_DV|MICROSOFT_DEFENDER_ENDPOINT|SENTINEL_EDR|UPTYCS_EDR|SYMANTEC_EDR|FORTINET_FORTIEDR|REDCANARY_EDR|CYBEREASON_EDR|MICROSOFT_DEFENDER_IDENTITY|DEEP_INSTINCT_EDR|CB_EDR|PAN_EDR|FIREEYE_HX|WATCHGUARD_EDR/ nocase
$event.security_result.summary != ""
$Severity = $event.security_result.severity
match:
$Severity
outcome:
$Count = count($event.security_result.summary)
order:
$Severity asc
limit:
10
基于 EDR 提醒的严重程度
$event.metadata.log_type = /LIMACHARLIE_EDR|CS_EDR|CS_DETECTS|ESET_EDR|CHECKPOINT_EDR|SOPHOS_EDR|OSQUERY_EDR|DIGITALGUARDIAN_EDR|SENTINEL_DV|MICROSOFT_DEFENDER_ENDPOINT|SENTINEL_EDR|UPTYCS_EDR|SYMANTEC_EDR|FORTINET_FORTIEDR|REDCANARY_EDR|CYBEREASON_EDR|MICROSOFT_DEFENDER_IDENTITY|DEEP_INSTINCT_EDR|CB_EDR|PAN_EDR|FIREEYE_HX|WATCHGUARD_EDR/ nocase
$event.security_result.summary != ""
$Severity = $event.security_result.severity
match:
$Severity
outcome:
$Count = count($event.security_result.summary)
order:
$Severity asc
limit:
10
10 大策略
$event.metadata.log_type = /LIMACHARLIE_EDR|CS_EDR|CS_DETECTS|ESET_EDR|CHECKPOINT_EDR|SOPHOS_EDR|OSQUERY_EDR|DIGITALGUARDIAN_EDR|SENTINEL_DV|MICROSOFT_DEFENDER_ENDPOINT|SENTINEL_EDR|UPTYCS_EDR|SYMANTEC_EDR|FORTINET_FORTIEDR|REDCANARY_EDR|CYBEREASON_EDR|MICROSOFT_DEFENDER_IDENTITY|DEEP_INSTINCT_EDR|CB_EDR|PAN_EDR|FIREEYE_HX|WATCHGUARD_EDR/ nocase
$Tactic_ID = strings.coalesce($event.security_result.attack_details.tactics.id, $event.security_result.detection_fields["Tactic ID"])
$Tactic_Name = strings.coalesce($event.security_result.attack_details.tactics.name, $event.security_result.detection_fields["Tactic"])
$Tactic_ID != ""
$Tactic_Name != ""
match:
$Tactic_ID, $Tactic_Name
outcome:
$Count = count($event.security_result.summary)
order:
$Count desc
limit:
10
EDR 提醒总数随时间变化情况
$event.metadata.log_type = /LIMACHARLIE_EDR|CS_EDR|CS_DETECTS|ESET_EDR|CHECKPOINT_EDR|SOPHOS_EDR|OSQUERY_EDR|DIGITALGUARDIAN_EDR|SENTINEL_DV|MICROSOFT_DEFENDER_ENDPOINT|SENTINEL_EDR|UPTYCS_EDR|SYMANTEC_EDR|FORTINET_FORTIEDR|REDCANARY_EDR|CYBEREASON_EDR|MICROSOFT_DEFENDER_IDENTITY|DEEP_INSTINCT_EDR|CB_EDR|PAN_EDR|FIREEYE_HX|WATCHGUARD_EDR/ nocase
$Log_Type = $event.metadata.log_type
$Date = timestamp.get_date($event.metadata.event_timestamp.seconds)
match:
$Date, $Log_Type
outcome:
$Count = count($event.security_result.summary)
order:
$Date asc
有效 EDR 传感器
$event.metadata.log_type = /LIMACHARLIE_EDR|CS_EDR|CS_DETECTS|ESET_EDR|CHECKPOINT_EDR|SOPHOS_EDR|OSQUERY_EDR|DIGITALGUARDIAN_EDR|SENTINEL_DV|MICROSOFT_DEFENDER_ENDPOINT|SENTINEL_EDR|UPTYCS_EDR|SYMANTEC_EDR|FORTINET_FORTIEDR|REDCANARY_EDR|CYBEREASON_EDR|MICROSOFT_DEFENDER_IDENTITY|DEEP_INSTINCT_EDR|CB_EDR|PAN_EDR|FIREEYE_HX|WATCHGUARD_EDR/ nocase
$EDR_Asset = strings.coalesce($event.principal.asset.hostname, $event.principal.hostname)
$EDR_Asset != ""
match:
$EDR_Asset
limit:
50
EDR 提醒总数随时间变化情况
$event.metadata.log_type = /LIMACHARLIE_EDR|CS_EDR|CS_DETECTS|ESET_EDR|CHECKPOINT_EDR|SOPHOS_EDR|OSQUERY_EDR|DIGITALGUARDIAN_EDR|SENTINEL_DV|MICROSOFT_DEFENDER_ENDPOINT|SENTINEL_EDR|UPTYCS_EDR|SYMANTEC_EDR|FORTINET_FORTIEDR|REDCANARY_EDR|CYBEREASON_EDR|MICROSOFT_DEFENDER_IDENTITY|DEEP_INSTINCT_EDR|CB_EDR|PAN_EDR|FIREEYE_HX|WATCHGUARD_EDR/ nocase
$Log_Type = $event.metadata.log_type
$Date = timestamp.get_date($event.metadata.event_timestamp.seconds)
match:
$Date, $Log_Type
outcome:
$Count = count($event.security_result.summary)
order:
$Date asc
10 大技巧
$event.metadata.log_type = /LIMACHARLIE_EDR|CS_EDR|CS_DETECTS|ESET_EDR|CHECKPOINT_EDR|SOPHOS_EDR|OSQUERY_EDR|DIGITALGUARDIAN_EDR|SENTINEL_DV|MICROSOFT_DEFENDER_ENDPOINT|SENTINEL_EDR|UPTYCS_EDR|SYMANTEC_EDR|FORTINET_FORTIEDR|REDCANARY_EDR|CYBEREASON_EDR|MICROSOFT_DEFENDER_IDENTITY|DEEP_INSTINCT_EDR|CB_EDR|PAN_EDR|FIREEYE_HX|WATCHGUARD_EDR/ nocase
$Technique_ID = strings.coalesce($event.security_result.attack_details.techniques.id, $event.security_result.detection_fields["Technique ID"])
$Technique = strings.coalesce($event.security_result.attack_details.techniques.name, $event.security_result.detection_fields["Technique"])
$Technique_ID != ""
$Technique != ""
match:
$Technique_ID, $Technique
outcome:
$Count = count($event.security_result.summary)
order:
$Count desc
limit:
10
基于 EDR 提醒的前 10 名用户
$event.metadata.log_type = /LIMACHARLIE_EDR|CS_EDR|CS_DETECTS|ESET_EDR|CHECKPOINT_EDR|SOPHOS_EDR|OSQUERY_EDR|DIGITALGUARDIAN_EDR|SENTINEL_DV|MICROSOFT_DEFENDER_ENDPOINT|SENTINEL_EDR|UPTYCS_EDR|SYMANTEC_EDR|FORTINET_FORTIEDR|REDCANARY_EDR|CYBEREASON_EDR|MICROSOFT_DEFENDER_IDENTITY|DEEP_INSTINCT_EDR|CB_EDR|PAN_EDR|FIREEYE_HX|WATCHGUARD_EDR/ nocase
$User = $event.principal.user.user_display_name
$User != ""
match:
$User
outcome:
$Count = count($event.security_result.summary)
order:
$Count desc
limit:
10
基于 EDR 提醒的前 10 名用户
$event.metadata.log_type = /LIMACHARLIE_EDR|CS_EDR|CS_DETECTS|ESET_EDR|CHECKPOINT_EDR|SOPHOS_EDR|OSQUERY_EDR|DIGITALGUARDIAN_EDR|SENTINEL_DV|MICROSOFT_DEFENDER_ENDPOINT|SENTINEL_EDR|UPTYCS_EDR|SYMANTEC_EDR|FORTINET_FORTIEDR|REDCANARY_EDR|CYBEREASON_EDR|MICROSOFT_DEFENDER_IDENTITY|DEEP_INSTINCT_EDR|CB_EDR|PAN_EDR|FIREEYE_HX|WATCHGUARD_EDR/ nocase
$User = $event.principal.user.user_display_name
$User != ""
match:
$User
outcome:
$Count = count($event.security_result.summary)
order:
$Count desc
limit:
10
10 大策略
$event.metadata.log_type = /LIMACHARLIE_EDR|CS_EDR|CS_DETECTS|ESET_EDR|CHECKPOINT_EDR|SOPHOS_EDR|OSQUERY_EDR|DIGITALGUARDIAN_EDR|SENTINEL_DV|MICROSOFT_DEFENDER_ENDPOINT|SENTINEL_EDR|UPTYCS_EDR|SYMANTEC_EDR|FORTINET_FORTIEDR|REDCANARY_EDR|CYBEREASON_EDR|MICROSOFT_DEFENDER_IDENTITY|DEEP_INSTINCT_EDR|CB_EDR|PAN_EDR|FIREEYE_HX|WATCHGUARD_EDR/ nocase
$Tactic_ID = strings.coalesce($event.security_result.attack_details.tactics.id, $event.security_result.detection_fields["Tactic ID"])
$Tactic_Name = strings.coalesce($event.security_result.attack_details.tactics.name, $event.security_result.detection_fields["Tactic"])
$Tactic_ID != ""
$Tactic_Name != ""
match:
$Tactic_ID, $Tactic_Name
outcome:
$Count = count($event.security_result.summary)
order:
$Count desc
limit:
10
EDR 提醒总数
$event.metadata.log_type = /LIMACHARLIE_EDR|CS_EDR|CS_DETECTS|ESET_EDR|CHECKPOINT_EDR|SOPHOS_EDR|OSQUERY_EDR|DIGITALGUARDIAN_EDR|SENTINEL_DV|MICROSOFT_DEFENDER_ENDPOINT|SENTINEL_EDR|UPTYCS_EDR|SYMANTEC_EDR|FORTINET_FORTIEDR|REDCANARY_EDR|CYBEREASON_EDR|MICROSOFT_DEFENDER_IDENTITY|DEEP_INSTINCT_EDR|CB_EDR|PAN_EDR|FIREEYE_HX|WATCHGUARD_EDR/ nocase
outcome:
$Count = count($event.security_result.summary)
EDR 传感器数量
$event.metadata.log_type = /LIMACHARLIE_EDR|CS_EDR|CS_DETECTS|ESET_EDR|CHECKPOINT_EDR|SOPHOS_EDR|OSQUERY_EDR|DIGITALGUARDIAN_EDR|SENTINEL_DV|MICROSOFT_DEFENDER_ENDPOINT|SENTINEL_EDR|UPTYCS_EDR|SYMANTEC_EDR|FORTINET_FORTIEDR|REDCANARY_EDR|CYBEREASON_EDR|MICROSOFT_DEFENDER_IDENTITY|DEEP_INSTINCT_EDR|CB_EDR|PAN_EDR|FIREEYE_HX|WATCHGUARD_EDR/ nocase
outcome:
$Count = count_distinct(strings.coalesce($event.principal.asset.hostname, $event.principal.hostname))
根据 EDR 提醒得出的前 10 名主机
$event.metadata.log_type = /LIMACHARLIE_EDR|CS_EDR|CS_DETECTS|ESET_EDR|CHECKPOINT_EDR|SOPHOS_EDR|OSQUERY_EDR|DIGITALGUARDIAN_EDR|SENTINEL_DV|MICROSOFT_DEFENDER_ENDPOINT|SENTINEL_EDR|UPTYCS_EDR|SYMANTEC_EDR|FORTINET_FORTIEDR|REDCANARY_EDR|CYBEREASON_EDR|MICROSOFT_DEFENDER_IDENTITY|DEEP_INSTINCT_EDR|CB_EDR|PAN_EDR|FIREEYE_HX|WATCHGUARD_EDR/ nocase
$Hostname = strings.coalesce($event.principal.asset.hostname, $event.principal.hostname)
$Hostname != ""
match:
$Hostname
outcome:
$Count = count($event.security_result.summary)
order:
$Count desc
limit:
10
电子邮件活动概览
此信息中心详细汇总了电子邮件流量，包括总数量、允许的电子邮件与被屏蔽的电子邮件、唯一身份发件人、唯一身份收件人，以及有关热门发件人和收件人的关键统计信息。它可提供有关通信模式的宝贵数据分析，并增强电子邮件安全性、过滤效果和整体电子邮件管理。
近期的电子邮件事件
已屏蔽的电子邮件地址
按日志类型划分的收件人前 5 名
允许的电子邮件事件
电子邮件事件总数
按事件类型划分的电子邮件日志来源前 10 名
按日志类型划分的前 5 大发送者
唯一身份发件人
唯一身份收件人
图表名称
查询示例
近期的电子邮件事件
$event.metadata.event_type = "EMAIL_UNCATEGORIZED"
or $event.metadata.event_type = "EMAIL_TRANSACTION"
$Sender = $event.network.email.from
$Recipient = $event.network.email.to
$Subject = $event.network.email.subject
$Subject != ""
$Date = timestamp.get_timestamp($event.metadata.event_timestamp.seconds)
$Action = $event.security_result.action
match:
$Date, $Sender, $Recipient, $Subject, $Action
order:
$Date desc
limit:
50
已屏蔽的电子邮件地址
$event.metadata.event_type = "EMAIL_UNCATEGORIZED"
or $event.metadata.event_type = "EMAIL_TRANSACTION"
$event.security_result.action = "BLOCK"
outcome:
$Count = count($event.metadata.id)
按日志类型划分的收件人前 5 名
$event.metadata.event_type = "EMAIL_UNCATEGORIZED"
or $event.metadata.event_type = "EMAIL_TRANSACTION"
$Log_Type = $event.metadata.log_type
$Recipients = $event.network.email.to
$Recipients != ""
match:
$Log_Type, $Recipients
outcome:
$Count = count($event.metadata.id)
order:
$Count desc
limit:
5
允许的电子邮件事件
$event.metadata.event_type = "EMAIL_UNCATEGORIZED"
or $event.metadata.event_type = "EMAIL_TRANSACTION"
$event.security_result.action = "ALLOW"
outcome:
$Count = count($event.metadata.id)
按日志类型划分的收件人前 5 名
$event.metadata.event_type = "EMAIL_UNCATEGORIZED"
or $event.metadata.event_type = "EMAIL_TRANSACTION"
$Log_Type = $event.metadata.log_type
$Recipients = $event.network.email.to
$Recipients != ""
match:
$Log_Type, $Recipients
outcome:
$Count = count($event.metadata.id)
order:
$Count desc
limit:
5
电子邮件事件总数
$event.metadata.event_type = "EMAIL_UNCATEGORIZED"
or $event.metadata.event_type = "EMAIL_TRANSACTION"
outcome:
$Count = count($event.metadata.id)
按事件类型划分的电子邮件日志来源前 10 名
$event.metadata.event_type = "EMAIL_UNCATEGORIZED"
or $event.metadata.event_type = "EMAIL_TRANSACTION"
$Event_Type = $event.metadata.event_type
$Log_Type = $event.metadata.log_type
match:
$Log_Type, $Event_Type
outcome:
$Count = count($event.metadata.id)
order:
$Count desc
limit:
10
允许的电子邮件事件
$event.metadata.event_type = "EMAIL_UNCATEGORIZED"
or $event.metadata.event_type = "EMAIL_TRANSACTION"
$event.security_result.action = "ALLOW"
outcome:
$Count = count($event.metadata.id)
按日志类型划分的前 5 大发送者
$event.metadata.event_type = "EMAIL_UNCATEGORIZED"
or $event.metadata.event_type = "EMAIL_TRANSACTION"
$Log_Type = $event.metadata.log_type
$Sender = $event.network.email.from
$Sender != ""
match:
$Log_Type, $Sender
outcome:
$Count = count($event.metadata.id)
order:
$Count desc
limit:
5
唯一身份发件人
$event.metadata.event_type = "EMAIL_UNCATEGORIZED"
or $event.metadata.event_type = "EMAIL_TRANSACTION"
outcome:
$Count = count_distinct($event.network.email.from)
唯一身份发件人
$event.metadata.event_type = "EMAIL_UNCATEGORIZED"
or $event.metadata.event_type = "EMAIL_TRANSACTION"
outcome:
$Count = count_distinct($event.network.email.from)
电子邮件事件总数
$event.metadata.event_type = "EMAIL_UNCATEGORIZED"
or $event.metadata.event_type = "EMAIL_TRANSACTION"
outcome:
$Count = count($event.metadata.id)
按日志类型划分的前 5 大发送者
$event.metadata.event_type = "EMAIL_UNCATEGORIZED"
or $event.metadata.event_type = "EMAIL_TRANSACTION"
$Log_Type = $event.metadata.log_type
$Sender = $event.network.email.from
$Sender != ""
match:
$Log_Type, $Sender
outcome:
$Count = count($event.metadata.id)
order:
$Count desc
limit:
5
近期的电子邮件事件
$event.metadata.event_type = "EMAIL_UNCATEGORIZED"
or $event.metadata.event_type = "EMAIL_TRANSACTION"
$Sender = $event.network.email.from
$Recipient = $event.network.email.to
$Subject = $event.network.email.subject
$Subject != ""
$Date = timestamp.get_timestamp($event.metadata.event_timestamp.seconds)
$Action = $event.security_result.action
match:
$Date, $Sender, $Recipient, $Subject, $Action
order:
$Date desc
limit:
50
唯一身份收件人
$event.metadata.event_type = "EMAIL_UNCATEGORIZED"
or $event.metadata.event_type = "EMAIL_TRANSACTION"
outcome:
$Count = count_distinct($event.network.email.to)
已屏蔽的电子邮件地址
$event.metadata.event_type = "EMAIL_UNCATEGORIZED"
or $event.metadata.event_type = "EMAIL_TRANSACTION"
$event.security_result.action = "BLOCK"
outcome:
$Count = count($event.metadata.id)
唯一身份收件人
$event.metadata.event_type = "EMAIL_UNCATEGORIZED"
or $event.metadata.event_type = "EMAIL_TRANSACTION"
outcome:
$Count = count_distinct($event.network.email.to)
按事件类型划分的电子邮件日志来源前 10 名
$event.metadata.event_type = "EMAIL_UNCATEGORIZED"
or $event.metadata.event_type = "EMAIL_TRANSACTION"
$Event_Type = $event.metadata.event_type
$Log_Type = $event.metadata.log_type
match:
$Log_Type, $Event_Type
outcome:
$Count = count($event.metadata.id)
order:
$Count desc
limit:
10
电子邮件安全概览
此信息中心可提供有关电子邮件威胁（例如钓鱼式攻击、恶意软件、勒索软件和商业电子邮件泄密 [BEC]）的信息。它会提供与安全相关的事件、恶意发件人、来源 IP 和目标电子邮件地址的概览。
排名前 10 的已识别网域
检测到的钓鱼式攻击总数
电子邮件类别随时间的变化
10 大可疑网址
检测到钓鱼式攻击
10 大恶意来源 IP 地址
电子邮件威胁（按类别划分）
一段时间内的行动
电子邮件威胁随时间的变化情况
近期的活跃威胁
被屏蔽的网址与允许的网址
十大恶意发件人
最近的恶意附件
10 大有针对性的电子邮件
十大高严重程度威胁
十大恶意位置
按严重程度划分的十大电子邮件威胁
威胁状态分布
安全结果操作分布
图表名称
查询示例
排名前 10 的已识别网域
$event.metadata.log_type = /ABNORMAL_SECURITY|AREA1|AVANAN_EMAIL|BARRACUDA_EMAIL|CISCO_EMAIL_SECURITY|COFENSE_TRIAGE|EXCHANGE_MAIL|FIREEYE_EMPS|FIREEYE_ETP|FORCEPOINT_EMAILSECURITY|FORCEPOINT_MAIL_RELAY|FORTINET_FORTIMAIL|KNOWBE4_PHISHER|MAILMARSHAL|MICROSOFT_DEFENDER_MAIL|MIMECAST_MAIL|MIMECAST_URL_LOGS|OBSERVEIT|OFFICE_365|POSTFIX_MAIL|PROOFPOINT_MAIL|PROOFPOINT_MAIL_FILTER|PROOFPOINT_ON_DEMAND|PROOFPOINT_SENDMAIL_SENTRION|PROOFPOINT_SER|PROOFPOINT_TAP_FORENSICS|PROOFPOINT_TRAP|SENDMAIL|SEPPMAIL|SYMANTEC_VIP|VIRTRU_EMAIL_ENCRYPTION|VOLTAGE|WORKSPACE_ALERTS|ZIX_EMAIL_ENCRYPTION|PHISHLABS/ nocase
$event.metadata.event_type = "EMAIL_UNCATEGORIZED"
or $event.metadata.event_type = "EMAIL_TRANSACTION"
or $event.metadata.event_type = "NETWORK_HTTP"
$event.principal.administrative_domain != ""
$Domain = $event.principal.administrative_domain
match:
$Domain
outcome:
$Count = count($event.metadata.id)
order:
$Count desc
limit:
10
检测到的钓鱼式攻击总数
$event.metadata.log_type = /ABNORMAL_SECURITY|AREA1|AVANAN_EMAIL|BARRACUDA_EMAIL|CISCO_EMAIL_SECURITY|COFENSE_TRIAGE|EXCHANGE_MAIL|FIREEYE_EMPS|FIREEYE_ETP|FORCEPOINT_EMAILSECURITY|FORCEPOINT_MAIL_RELAY|FORTINET_FORTIMAIL|KNOWBE4_PHISHER|MAILMARSHAL|MICROSOFT_DEFENDER_MAIL|MIMECAST_MAIL|MIMECAST_URL_LOGS|OBSERVEIT|OFFICE_365|POSTFIX_MAIL|PROOFPOINT_MAIL|PROOFPOINT_MAIL_FILTER|PROOFPOINT_ON_DEMAND|PROOFPOINT_SENDMAIL_SENTRION|PROOFPOINT_SER|PROOFPOINT_TAP_FORENSICS|PROOFPOINT_TRAP|SENDMAIL|SEPPMAIL|SYMANTEC_VIP|VIRTRU_EMAIL_ENCRYPTION|VOLTAGE|WORKSPACE_ALERTS|ZIX_EMAIL_ENCRYPTION|PHISHLABS/ nocase
$event.metadata.event_type = "EMAIL_UNCATEGORIZED"
or $event.metadata.event_type = "EMAIL_TRANSACTION"
or $event.metadata.event_type = "NETWORK_HTTP"
$event.security_result.category = "MAIL_PHISHING"
outcome:
$Count = count_distinct($event.principal.user.email_addresses)
电子邮件类别随时间的变化
$event.metadata.log_type = /ABNORMAL_SECURITY|AREA1|AVANAN_EMAIL|BARRACUDA_EMAIL|CISCO_EMAIL_SECURITY|COFENSE_TRIAGE|EXCHANGE_MAIL|FIREEYE_EMPS|FIREEYE_ETP|FORCEPOINT_EMAILSECURITY|FORCEPOINT_MAIL_RELAY|FORTINET_FORTIMAIL|KNOWBE4_PHISHER|MAILMARSHAL|MICROSOFT_DEFENDER_MAIL|MIMECAST_MAIL|MIMECAST_URL_LOGS|OBSERVEIT|OFFICE_365|POSTFIX_MAIL|PROOFPOINT_MAIL|PROOFPOINT_MAIL_FILTER|PROOFPOINT_ON_DEMAND|PROOFPOINT_SENDMAIL_SENTRION|PROOFPOINT_SER|PROOFPOINT_TAP_FORENSICS|PROOFPOINT_TRAP|SENDMAIL|SEPPMAIL|SYMANTEC_VIP|VIRTRU_EMAIL_ENCRYPTION|VOLTAGE|WORKSPACE_ALERTS|ZIX_EMAIL_ENCRYPTION|PHISHLABS/ nocase
$event.metadata.event_type = "EMAIL_UNCATEGORIZED"
or $event.metadata.event_type = "EMAIL_TRANSACTION"
or $event.metadata.event_type = "NETWORK_HTTP"
$Category = $event.security_result.category
$Date = timestamp.get_date($event.metadata.event_timestamp.seconds)
match:
$Date, $Category
outcome:
$Count = count($event.metadata.id)
order:
$Date asc
10 大可疑网址
$event.metadata.log_type = /ABNORMAL_SECURITY|AREA1|AVANAN_EMAIL|BARRACUDA_EMAIL|CISCO_EMAIL_SECURITY|COFENSE_TRIAGE|EXCHANGE_MAIL|FIREEYE_EMPS|FIREEYE_ETP|FORCEPOINT_EMAILSECURITY|FORCEPOINT_MAIL_RELAY|FORTINET_FORTIMAIL|KNOWBE4_PHISHER|MAILMARSHAL|MICROSOFT_DEFENDER_MAIL|MIMECAST_MAIL|MIMECAST_URL_LOGS|OBSERVEIT|OFFICE_365|POSTFIX_MAIL|PROOFPOINT_MAIL|PROOFPOINT_MAIL_FILTER|PROOFPOINT_ON_DEMAND|PROOFPOINT_SENDMAIL_SENTRION|PROOFPOINT_SER|PROOFPOINT_TAP_FORENSICS|PROOFPOINT_TRAP|SENDMAIL|SEPPMAIL|SYMANTEC_VIP|VIRTRU_EMAIL_ENCRYPTION|VOLTAGE|WORKSPACE_ALERTS|ZIX_EMAIL_ENCRYPTION|PHISHLABS/ nocase
$event.metadata.event_type = "EMAIL_UNCATEGORIZED"
or $event.metadata.event_type = "EMAIL_TRANSACTION"
or $event.metadata.event_type = "NETWORK_HTTP"
$event.security_result.category = "MAIL_PHISHING"
or $event.security_result.category = "MAIL_SPAM"
or $event.security_result.category = "MAIL_SPOOFING"
or $event.security_result.category = "SOFTWARE_MALICIOUS"
strings.coalesce($event.target.url, $event.security_result.about.url,$event.security_result.detection_fields["detectedUrls"]) != ""
$URL = strings.coalesce($event.target.url, $event.security_result.about.url,$event.security_result.detection_fields["detectedUrls"])
match:
$URL
outcome:
$Count = count($event.metadata.id)
order:
$Count desc
limit:
10
检测到钓鱼式攻击
$event.metadata.log_type = /ABNORMAL_SECURITY|AREA1|AVANAN_EMAIL|BARRACUDA_EMAIL|CISCO_EMAIL_SECURITY|COFENSE_TRIAGE|EXCHANGE_MAIL|FIREEYE_EMPS|FIREEYE_ETP|FORCEPOINT_EMAILSECURITY|FORCEPOINT_MAIL_RELAY|FORTINET_FORTIMAIL|KNOWBE4_PHISHER|MAILMARSHAL|MICROSOFT_DEFENDER_MAIL|MIMECAST_MAIL|MIMECAST_URL_LOGS|OBSERVEIT|OFFICE_365|POSTFIX_MAIL|PROOFPOINT_MAIL|PROOFPOINT_MAIL_FILTER|PROOFPOINT_ON_DEMAND|PROOFPOINT_SENDMAIL_SENTRION|PROOFPOINT_SER|PROOFPOINT_TAP_FORENSICS|PROOFPOINT_TRAP|SENDMAIL|SEPPMAIL|SYMANTEC_VIP|VIRTRU_EMAIL_ENCRYPTION|VOLTAGE|WORKSPACE_ALERTS|ZIX_EMAIL_ENCRYPTION|PHISHLABS/ nocase
$event.metadata.event_type = "EMAIL_UNCATEGORIZED"
or $event.metadata.event_type = "EMAIL_TRANSACTION"
or $event.metadata.event_type = "NETWORK_HTTP"
$event.security_result.category = "MAIL_PHISHING"
$Email = $event.principal.user.email_addresses
match:
$Email
10 大恶意来源 IP 地址
$event.metadata.log_type = /ABNORMAL_SECURITY|AREA1|AVANAN_EMAIL|BARRACUDA_EMAIL|CISCO_EMAIL_SECURITY|COFENSE_TRIAGE|EXCHANGE_MAIL|FIREEYE_EMPS|FIREEYE_ETP|FORCEPOINT_EMAILSECURITY|FORCEPOINT_MAIL_RELAY|FORTINET_FORTIMAIL|KNOWBE4_PHISHER|MAILMARSHAL|MICROSOFT_DEFENDER_MAIL|MIMECAST_MAIL|MIMECAST_URL_LOGS|OBSERVEIT|OFFICE_365|POSTFIX_MAIL|PROOFPOINT_MAIL|PROOFPOINT_MAIL_FILTER|PROOFPOINT_ON_DEMAND|PROOFPOINT_SENDMAIL_SENTRION|PROOFPOINT_SER|PROOFPOINT_TAP_FORENSICS|PROOFPOINT_TRAP|SENDMAIL|SEPPMAIL|SYMANTEC_VIP|VIRTRU_EMAIL_ENCRYPTION|VOLTAGE|WORKSPACE_ALERTS|ZIX_EMAIL_ENCRYPTION|PHISHLABS/ nocase
$event.metadata.event_type = "EMAIL_UNCATEGORIZED"
or $event.metadata.event_type = "EMAIL_TRANSACTION"
or $event.metadata.event_type = "NETWORK_HTTP"
$event.security_result.detection_fields["judgement"] = /MALICIOUS/ nocase
$event.principal.ip != ""
$Source_IP = $event.principal.ip
match:
$Source_IP
outcome:
$Count = count($event.principal.ip)
order:
$Count desc
limit:
10
电子邮件威胁（按类别划分）
$event.metadata.log_type = /ABNORMAL_SECURITY|AREA1|AVANAN_EMAIL|BARRACUDA_EMAIL|CISCO_EMAIL_SECURITY|COFENSE_TRIAGE|EXCHANGE_MAIL|FIREEYE_EMPS|FIREEYE_ETP|FORCEPOINT_EMAILSECURITY|FORCEPOINT_MAIL_RELAY|FORTINET_FORTIMAIL|KNOWBE4_PHISHER|MAILMARSHAL|MICROSOFT_DEFENDER_MAIL|MIMECAST_MAIL|MIMECAST_URL_LOGS|OBSERVEIT|OFFICE_365|POSTFIX_MAIL|PROOFPOINT_MAIL|PROOFPOINT_MAIL_FILTER|PROOFPOINT_ON_DEMAND|PROOFPOINT_SENDMAIL_SENTRION|PROOFPOINT_SER|PROOFPOINT_TAP_FORENSICS|PROOFPOINT_TRAP|SENDMAIL|SEPPMAIL|SYMANTEC_VIP|VIRTRU_EMAIL_ENCRYPTION|VOLTAGE|WORKSPACE_ALERTS|ZIX_EMAIL_ENCRYPTION|PHISHLABS/ nocase
$Threat_Name = $event.security_result.category_details
$Category = $event.security_result.category
match:
$Threat_Name, $Category
outcome:
$Count = count($event.security_result.threat_name)
order:
$Count desc
limit:
50
一段时间内的行动
$event.metadata.log_type = /ABNORMAL_SECURITY|AREA1|AVANAN_EMAIL|BARRACUDA_EMAIL|CISCO_EMAIL_SECURITY|COFENSE_TRIAGE|EXCHANGE_MAIL|FIREEYE_EMPS|FIREEYE_ETP|FORCEPOINT_EMAILSECURITY|FORCEPOINT_MAIL_RELAY|FORTINET_FORTIMAIL|KNOWBE4_PHISHER|MAILMARSHAL|MICROSOFT_DEFENDER_MAIL|MIMECAST_MAIL|MIMECAST_URL_LOGS|OBSERVEIT|OFFICE_365|POSTFIX_MAIL|PROOFPOINT_MAIL|PROOFPOINT_MAIL_FILTER|PROOFPOINT_ON_DEMAND|PROOFPOINT_SENDMAIL_SENTRION|PROOFPOINT_SER|PROOFPOINT_TAP_FORENSICS|PROOFPOINT_TRAP|SENDMAIL|SEPPMAIL|SYMANTEC_VIP|VIRTRU_EMAIL_ENCRYPTION|VOLTAGE|WORKSPACE_ALERTS|ZIX_EMAIL_ENCRYPTION|PHISHLABS/ nocase
$event.metadata.event_type = "EMAIL_UNCATEGORIZED"
or $event.metadata.event_type = "EMAIL_TRANSACTION"
or $event.metadata.event_type = "NETWORK_HTTP"
$Action = $event.security_result.action
$Date = timestamp.get_date($event.metadata.event_timestamp.seconds)
match:
$Date, $Action
outcome:
$Count = count($event.metadata.id)
order:
$Date asc
电子邮件威胁随时间的变化情况
$event.metadata.log_type = /ABNORMAL_SECURITY|AREA1|AVANAN_EMAIL|BARRACUDA_EMAIL|CISCO_EMAIL_SECURITY|COFENSE_TRIAGE|EXCHANGE_MAIL|FIREEYE_EMPS|FIREEYE_ETP|FORCEPOINT_EMAILSECURITY|FORCEPOINT_MAIL_RELAY|FORTINET_FORTIMAIL|KNOWBE4_PHISHER|MAILMARSHAL|MICROSOFT_DEFENDER_MAIL|MIMECAST_MAIL|MIMECAST_URL_LOGS|OBSERVEIT|OFFICE_365|POSTFIX_MAIL|PROOFPOINT_MAIL|PROOFPOINT_MAIL_FILTER|PROOFPOINT_ON_DEMAND|PROOFPOINT_SENDMAIL_SENTRION|PROOFPOINT_SER|PROOFPOINT_TAP_FORENSICS|PROOFPOINT_TRAP|SENDMAIL|SEPPMAIL|SYMANTEC_VIP|VIRTRU_EMAIL_ENCRYPTION|VOLTAGE|WORKSPACE_ALERTS|ZIX_EMAIL_ENCRYPTION|PHISHLABS/ nocase
$event.metadata.event_type = "EMAIL_UNCATEGORIZED"
or $event.metadata.event_type = "EMAIL_TRANSACTION"
or $event.metadata.event_type = "NETWORK_HTTP"
$Threat_Name = $event.security_result.threat_name
$Date = timestamp.get_date($event.metadata.event_timestamp.seconds)
match:
$Date, $Threat_Name
outcome:
$Count = count($event.metadata.id)
order:
$Date asc
电子邮件威胁随时间的变化情况
$event.metadata.log_type = /ABNORMAL_SECURITY|AREA1|AVANAN_EMAIL|BARRACUDA_EMAIL|CISCO_EMAIL_SECURITY|COFENSE_TRIAGE|EXCHANGE_MAIL|FIREEYE_EMPS|FIREEYE_ETP|FORCEPOINT_EMAILSECURITY|FORCEPOINT_MAIL_RELAY|FORTINET_FORTIMAIL|KNOWBE4_PHISHER|MAILMARSHAL|MICROSOFT_DEFENDER_MAIL|MIMECAST_MAIL|MIMECAST_URL_LOGS|OBSERVEIT|OFFICE_365|POSTFIX_MAIL|PROOFPOINT_MAIL|PROOFPOINT_MAIL_FILTER|PROOFPOINT_ON_DEMAND|PROOFPOINT_SENDMAIL_SENTRION|PROOFPOINT_SER|PROOFPOINT_TAP_FORENSICS|PROOFPOINT_TRAP|SENDMAIL|SEPPMAIL|SYMANTEC_VIP|VIRTRU_EMAIL_ENCRYPTION|VOLTAGE|WORKSPACE_ALERTS|ZIX_EMAIL_ENCRYPTION|PHISHLABS/ nocase
$event.metadata.event_type = "EMAIL_UNCATEGORIZED"
or $event.metadata.event_type = "EMAIL_TRANSACTION"
or $event.metadata.event_type = "NETWORK_HTTP"
$Threat_Name = $event.security_result.threat_name
$Date = timestamp.get_date($event.metadata.event_timestamp.seconds)
match:
$Date, $Threat_Name
outcome:
$Count = count($event.metadata.id)
order:
$Date asc
近期的活跃威胁
$event.metadata.log_type = /ABNORMAL_SECURITY|AREA1|AVANAN_EMAIL|BARRACUDA_EMAIL|CISCO_EMAIL_SECURITY|COFENSE_TRIAGE|EXCHANGE_MAIL|FIREEYE_EMPS|FIREEYE_ETP|FORCEPOINT_EMAILSECURITY|FORCEPOINT_MAIL_RELAY|FORTINET_FORTIMAIL|KNOWBE4_PHISHER|MAILMARSHAL|MICROSOFT_DEFENDER_MAIL|MIMECAST_MAIL|MIMECAST_URL_LOGS|OBSERVEIT|OFFICE_365|POSTFIX_MAIL|PROOFPOINT_MAIL|PROOFPOINT_MAIL_FILTER|PROOFPOINT_ON_DEMAND|PROOFPOINT_SENDMAIL_SENTRION|PROOFPOINT_SER|PROOFPOINT_TAP_FORENSICS|PROOFPOINT_TRAP|SENDMAIL|SEPPMAIL|SYMANTEC_VIP|VIRTRU_EMAIL_ENCRYPTION|VOLTAGE|WORKSPACE_ALERTS|ZIX_EMAIL_ENCRYPTION|PHISHLABS/ nocase
$event.metadata.event_type = "EMAIL_UNCATEGORIZED"
or $event.metadata.event_type = "EMAIL_TRANSACTION"
or $event.metadata.event_type = "NETWORK_HTTP"
$Threat_Name = $event.security_result.threat_name
$Status = $event.security_result.threat_status
match:
$Threat_Name, $Status
outcome:
$Count = count($event.metadata.id)
$Date = timestamp.get_timestamp(max($event.metadata.event_timestamp.seconds))
order:
$Date desc
limit:
50
被屏蔽的网址与允许的网址
$event.metadata.log_type = /ABNORMAL_SECURITY|AREA1|AVANAN_EMAIL|BARRACUDA_EMAIL|CISCO_EMAIL_SECURITY|COFENSE_TRIAGE|EXCHANGE_MAIL|FIREEYE_EMPS|FIREEYE_ETP|FORCEPOINT_EMAILSECURITY|FORCEPOINT_MAIL_RELAY|FORTINET_FORTIMAIL|KNOWBE4_PHISHER|MAILMARSHAL|MICROSOFT_DEFENDER_MAIL|MIMECAST_MAIL|MIMECAST_URL_LOGS|OBSERVEIT|OFFICE_365|POSTFIX_MAIL|PROOFPOINT_MAIL|PROOFPOINT_MAIL_FILTER|PROOFPOINT_ON_DEMAND|PROOFPOINT_SENDMAIL_SENTRION|PROOFPOINT_SER|PROOFPOINT_TAP_FORENSICS|PROOFPOINT_TRAP|SENDMAIL|SEPPMAIL|SYMANTEC_VIP|VIRTRU_EMAIL_ENCRYPTION|VOLTAGE|WORKSPACE_ALERTS|ZIX_EMAIL_ENCRYPTION|PHISHLABS/ nocase
$event.metadata.event_type = "EMAIL_UNCATEGORIZED"
or $event.metadata.event_type = "EMAIL_TRANSACTION"
or $event.metadata.event_type = "NETWORK_HTTP"
$event.security_result.action = "ALLOW"
or $event.security_result.action = "BLOCK"
$Action = $event.security_result.action
$Date = timestamp.get_date($event.metadata.event_timestamp.seconds)
match:
$Date, $Action
outcome:
$Count = count($event.target.url)
order:
$Count desc
检测到钓鱼式攻击
$event.metadata.log_type = /ABNORMAL_SECURITY|AREA1|AVANAN_EMAIL|BARRACUDA_EMAIL|CISCO_EMAIL_SECURITY|COFENSE_TRIAGE|EXCHANGE_MAIL|FIREEYE_EMPS|FIREEYE_ETP|FORCEPOINT_EMAILSECURITY|FORCEPOINT_MAIL_RELAY|FORTINET_FORTIMAIL|KNOWBE4_PHISHER|MAILMARSHAL|MICROSOFT_DEFENDER_MAIL|MIMECAST_MAIL|MIMECAST_URL_LOGS|OBSERVEIT|OFFICE_365|POSTFIX_MAIL|PROOFPOINT_MAIL|PROOFPOINT_MAIL_FILTER|PROOFPOINT_ON_DEMAND|PROOFPOINT_SENDMAIL_SENTRION|PROOFPOINT_SER|PROOFPOINT_TAP_FORENSICS|PROOFPOINT_TRAP|SENDMAIL|SEPPMAIL|SYMANTEC_VIP|VIRTRU_EMAIL_ENCRYPTION|VOLTAGE|WORKSPACE_ALERTS|ZIX_EMAIL_ENCRYPTION|PHISHLABS/ nocase
$event.metadata.event_type = "EMAIL_UNCATEGORIZED"
or $event.metadata.event_type = "EMAIL_TRANSACTION"
or $event.metadata.event_type = "NETWORK_HTTP"
$event.security_result.category = "MAIL_PHISHING"
$Email = $event.principal.user.email_addresses
match:
$Email
十大恶意发件人
$event.metadata.log_type = /ABNORMAL_SECURITY|AREA1|AVANAN_EMAIL|BARRACUDA_EMAIL|CISCO_EMAIL_SECURITY|COFENSE_TRIAGE|EXCHANGE_MAIL|FIREEYE_EMPS|FIREEYE_ETP|FORCEPOINT_EMAILSECURITY|FORCEPOINT_MAIL_RELAY|FORTINET_FORTIMAIL|KNOWBE4_PHISHER|MAILMARSHAL|MICROSOFT_DEFENDER_MAIL|MIMECAST_MAIL|MIMECAST_URL_LOGS|OBSERVEIT|OFFICE_365|POSTFIX_MAIL|PROOFPOINT_MAIL|PROOFPOINT_MAIL_FILTER|PROOFPOINT_ON_DEMAND|PROOFPOINT_SENDMAIL_SENTRION|PROOFPOINT_SER|PROOFPOINT_TAP_FORENSICS|PROOFPOINT_TRAP|SENDMAIL|SEPPMAIL|SYMANTEC_VIP|VIRTRU_EMAIL_ENCRYPTION|VOLTAGE|WORKSPACE_ALERTS|ZIX_EMAIL_ENCRYPTION|PHISHLABS/ nocase
$event.metadata.event_type = "EMAIL_UNCATEGORIZED"
or $event.metadata.event_type = "EMAIL_TRANSACTION"
or $event.metadata.event_type = "NETWORK_HTTP"
$event.security_result.detection_fields["judgement"] = /MALICIOUS/ nocase
$event.network.email.from != ""
$Sender = $event.network.email.from
match:
$Sender
outcome:
$Count = count($event.network.email.from)
order:
$Count desc
limit:
10
最近的恶意附件
$event.metadata.log_type = /ABNORMAL_SECURITY|AREA1|AVANAN_EMAIL|BARRACUDA_EMAIL|CISCO_EMAIL_SECURITY|COFENSE_TRIAGE|EXCHANGE_MAIL|FIREEYE_EMPS|FIREEYE_ETP|FORCEPOINT_EMAILSECURITY|FORCEPOINT_MAIL_RELAY|FORTINET_FORTIMAIL|KNOWBE4_PHISHER|MAILMARSHAL|MICROSOFT_DEFENDER_MAIL|MIMECAST_MAIL|MIMECAST_URL_LOGS|OBSERVEIT|OFFICE_365|POSTFIX_MAIL|PROOFPOINT_MAIL|PROOFPOINT_MAIL_FILTER|PROOFPOINT_ON_DEMAND|PROOFPOINT_SENDMAIL_SENTRION|PROOFPOINT_SER|PROOFPOINT_TAP_FORENSICS|PROOFPOINT_TRAP|SENDMAIL|SEPPMAIL|SYMANTEC_VIP|VIRTRU_EMAIL_ENCRYPTION|VOLTAGE|WORKSPACE_ALERTS|ZIX_EMAIL_ENCRYPTION|PHISHLABS/ nocase
$event.metadata.event_type = "EMAIL_UNCATEGORIZED"
or $event.metadata.event_type = "EMAIL_TRANSACTION"
or $event.metadata.event_type = "NETWORK_HTTP"
strings.coalesce($event.about.file.full_path, $event.security_result.detection_fields["attachmentNames"]) != ""
$Attachment = strings.coalesce($event.about.file.full_path, $event.security_result.detection_fields["attachmentNames"])
$Category = $event.security_result.category
$Sender = $event.network.email.from
$Receiver = $event.network.email.to
$Status = $event.additional.fields["remediationStatus"]
$Date = timestamp.get_date($event.metadata.event_timestamp.seconds)
match:
$Date, $Sender, $Receiver, $Attachment, $Category, $Status
order:
$Date desc
limit:
50
检测到的钓鱼式攻击总数
$event.metadata.log_type = /ABNORMAL_SECURITY|AREA1|AVANAN_EMAIL|BARRACUDA_EMAIL|CISCO_EMAIL_SECURITY|COFENSE_TRIAGE|EXCHANGE_MAIL|FIREEYE_EMPS|FIREEYE_ETP|FORCEPOINT_EMAILSECURITY|FORCEPOINT_MAIL_RELAY|FORTINET_FORTIMAIL|KNOWBE4_PHISHER|MAILMARSHAL|MICROSOFT_DEFENDER_MAIL|MIMECAST_MAIL|MIMECAST_URL_LOGS|OBSERVEIT|OFFICE_365|POSTFIX_MAIL|PROOFPOINT_MAIL|PROOFPOINT_MAIL_FILTER|PROOFPOINT_ON_DEMAND|PROOFPOINT_SENDMAIL_SENTRION|PROOFPOINT_SER|PROOFPOINT_TAP_FORENSICS|PROOFPOINT_TRAP|SENDMAIL|SEPPMAIL|SYMANTEC_VIP|VIRTRU_EMAIL_ENCRYPTION|VOLTAGE|WORKSPACE_ALERTS|ZIX_EMAIL_ENCRYPTION|PHISHLABS/ nocase
$event.metadata.event_type = "EMAIL_UNCATEGORIZED"
or $event.metadata.event_type = "EMAIL_TRANSACTION"
or $event.metadata.event_type = "NETWORK_HTTP"
$event.security_result.category = "MAIL_PHISHING"
outcome:
$Count = count_distinct($event.principal.user.email_addresses)
10 大有针对性的电子邮件
$event.metadata.log_type = /ABNORMAL_SECURITY|AREA1|AVANAN_EMAIL|BARRACUDA_EMAIL|CISCO_EMAIL_SECURITY|COFENSE_TRIAGE|EXCHANGE_MAIL|FIREEYE_EMPS|FIREEYE_ETP|FORCEPOINT_EMAILSECURITY|FORCEPOINT_MAIL_RELAY|FORTINET_FORTIMAIL|KNOWBE4_PHISHER|MAILMARSHAL|MICROSOFT_DEFENDER_MAIL|MIMECAST_MAIL|MIMECAST_URL_LOGS|OBSERVEIT|OFFICE_365|POSTFIX_MAIL|PROOFPOINT_MAIL|PROOFPOINT_MAIL_FILTER|PROOFPOINT_ON_DEMAND|PROOFPOINT_SENDMAIL_SENTRION|PROOFPOINT_SER|PROOFPOINT_TAP_FORENSICS|PROOFPOINT_TRAP|SENDMAIL|SEPPMAIL|SYMANTEC_VIP|VIRTRU_EMAIL_ENCRYPTION|VOLTAGE|WORKSPACE_ALERTS|ZIX_EMAIL_ENCRYPTION|PHISHLABS/ nocase
$event.metadata.event_type = "EMAIL_UNCATEGORIZED"
or $event.metadata.event_type = "EMAIL_TRANSACTION"
or $event.metadata.event_type = "NETWORK_HTTP"
$event.target.user.email_addresses != ""
$Target = $event.target.user.email_addresses
match:
$Target
outcome:
$Count = count($event.target.user.email_addresses)
order:
$Count desc
limit:
10
电子邮件类别随时间的变化
$event.metadata.log_type = /ABNORMAL_SECURITY|AREA1|AVANAN_EMAIL|BARRACUDA_EMAIL|CISCO_EMAIL_SECURITY|COFENSE_TRIAGE|EXCHANGE_MAIL|FIREEYE_EMPS|FIREEYE_ETP|FORCEPOINT_EMAILSECURITY|FORCEPOINT_MAIL_RELAY|FORTINET_FORTIMAIL|KNOWBE4_PHISHER|MAILMARSHAL|MICROSOFT_DEFENDER_MAIL|MIMECAST_MAIL|MIMECAST_URL_LOGS|OBSERVEIT|OFFICE_365|POSTFIX_MAIL|PROOFPOINT_MAIL|PROOFPOINT_MAIL_FILTER|PROOFPOINT_ON_DEMAND|PROOFPOINT_SENDMAIL_SENTRION|PROOFPOINT_SER|PROOFPOINT_TAP_FORENSICS|PROOFPOINT_TRAP|SENDMAIL|SEPPMAIL|SYMANTEC_VIP|VIRTRU_EMAIL_ENCRYPTION|VOLTAGE|WORKSPACE_ALERTS|ZIX_EMAIL_ENCRYPTION|PHISHLABS/ nocase
$event.metadata.event_type = "EMAIL_UNCATEGORIZED"
or $event.metadata.event_type = "EMAIL_TRANSACTION"
or $event.metadata.event_type = "NETWORK_HTTP"
$Category = $event.security_result.category
$Date = timestamp.get_date($event.metadata.event_timestamp.seconds)
match:
$Date, $Category
outcome:
$Count = count($event.metadata.id)
order:
$Date asc
10 大可疑网址
$event.metadata.log_type = /ABNORMAL_SECURITY|AREA1|AVANAN_EMAIL|BARRACUDA_EMAIL|CISCO_EMAIL_SECURITY|COFENSE_TRIAGE|EXCHANGE_MAIL|FIREEYE_EMPS|FIREEYE_ETP|FORCEPOINT_EMAILSECURITY|FORCEPOINT_MAIL_RELAY|FORTINET_FORTIMAIL|KNOWBE4_PHISHER|MAILMARSHAL|MICROSOFT_DEFENDER_MAIL|MIMECAST_MAIL|MIMECAST_URL_LOGS|OBSERVEIT|OFFICE_365|POSTFIX_MAIL|PROOFPOINT_MAIL|PROOFPOINT_MAIL_FILTER|PROOFPOINT_ON_DEMAND|PROOFPOINT_SENDMAIL_SENTRION|PROOFPOINT_SER|PROOFPOINT_TAP_FORENSICS|PROOFPOINT_TRAP|SENDMAIL|SEPPMAIL|SYMANTEC_VIP|VIRTRU_EMAIL_ENCRYPTION|VOLTAGE|WORKSPACE_ALERTS|ZIX_EMAIL_ENCRYPTION|PHISHLABS/ nocase
$event.metadata.event_type = "EMAIL_UNCATEGORIZED"
or $event.metadata.event_type = "EMAIL_TRANSACTION"
or $event.metadata.event_type = "NETWORK_HTTP"
$event.security_result.category = "MAIL_PHISHING"
or $event.security_result.category = "MAIL_SPAM"
or $event.security_result.category = "MAIL_SPOOFING"
or $event.security_result.category = "SOFTWARE_MALICIOUS"
strings.coalesce($event.target.url, $event.security_result.about.url,$event.security_result.detection_fields["detectedUrls"]) != ""
$URL = strings.coalesce($event.target.url, $event.security_result.about.url,$event.security_result.detection_fields["detectedUrls"])
match:
$URL
outcome:
$Count = count($event.metadata.id)
order:
$Count desc
limit:
10
一段时间内的行动
$event.metadata.log_type = /ABNORMAL_SECURITY|AREA1|AVANAN_EMAIL|BARRACUDA_EMAIL|CISCO_EMAIL_SECURITY|COFENSE_TRIAGE|EXCHANGE_MAIL|FIREEYE_EMPS|FIREEYE_ETP|FORCEPOINT_EMAILSECURITY|FORCEPOINT_MAIL_RELAY|FORTINET_FORTIMAIL|KNOWBE4_PHISHER|MAILMARSHAL|MICROSOFT_DEFENDER_MAIL|MIMECAST_MAIL|MIMECAST_URL_LOGS|OBSERVEIT|OFFICE_365|POSTFIX_MAIL|PROOFPOINT_MAIL|PROOFPOINT_MAIL_FILTER|PROOFPOINT_ON_DEMAND|PROOFPOINT_SENDMAIL_SENTRION|PROOFPOINT_SER|PROOFPOINT_TAP_FORENSICS|PROOFPOINT_TRAP|SENDMAIL|SEPPMAIL|SYMANTEC_VIP|VIRTRU_EMAIL_ENCRYPTION|VOLTAGE|WORKSPACE_ALERTS|ZIX_EMAIL_ENCRYPTION|PHISHLABS/ nocase
$event.metadata.event_type = "EMAIL_UNCATEGORIZED"
or $event.metadata.event_type = "EMAIL_TRANSACTION"
or $event.metadata.event_type = "NETWORK_HTTP"
$Action = $event.security_result.action
$Date = timestamp.get_date($event.metadata.event_timestamp.seconds)
match:
$Date, $Action
outcome:
$Count = count($event.metadata.id)
order:
$Date asc
十大高严重程度威胁
$event.metadata.log_type = /ABNORMAL_SECURITY|AREA1|AVANAN_EMAIL|BARRACUDA_EMAIL|CISCO_EMAIL_SECURITY|COFENSE_TRIAGE|EXCHANGE_MAIL|FIREEYE_EMPS|FIREEYE_ETP|FORCEPOINT_EMAILSECURITY|FORCEPOINT_MAIL_RELAY|FORTINET_FORTIMAIL|KNOWBE4_PHISHER|MAILMARSHAL|MICROSOFT_DEFENDER_MAIL|MIMECAST_MAIL|MIMECAST_URL_LOGS|OBSERVEIT|OFFICE_365|POSTFIX_MAIL|PROOFPOINT_MAIL|PROOFPOINT_MAIL_FILTER|PROOFPOINT_ON_DEMAND|PROOFPOINT_SENDMAIL_SENTRION|PROOFPOINT_SER|PROOFPOINT_TAP_FORENSICS|PROOFPOINT_TRAP|SENDMAIL|SEPPMAIL|SYMANTEC_VIP|VIRTRU_EMAIL_ENCRYPTION|VOLTAGE|WORKSPACE_ALERTS|ZIX_EMAIL_ENCRYPTION|PHISHLABS/ nocase
$event.metadata.event_type = "EMAIL_UNCATEGORIZED"
or $event.metadata.event_type = "EMAIL_TRANSACTION"
or $event.metadata.event_type = "NETWORK_HTTP"
$event.security_result.category_details != ""
$event.security_result.severity = "HIGH"
$Category = $event.security_result.category_details
$Category != ""
match:
$Category
outcome:
$Count = count($event.metadata.id)
order:
$Count desc
limit:
10
10 大恶意来源 IP 地址
$event.metadata.log_type = /ABNORMAL_SECURITY|AREA1|AVANAN_EMAIL|BARRACUDA_EMAIL|CISCO_EMAIL_SECURITY|COFENSE_TRIAGE|EXCHANGE_MAIL|FIREEYE_EMPS|FIREEYE_ETP|FORCEPOINT_EMAILSECURITY|FORCEPOINT_MAIL_RELAY|FORTINET_FORTIMAIL|KNOWBE4_PHISHER|MAILMARSHAL|MICROSOFT_DEFENDER_MAIL|MIMECAST_MAIL|MIMECAST_URL_LOGS|OBSERVEIT|OFFICE_365|POSTFIX_MAIL|PROOFPOINT_MAIL|PROOFPOINT_MAIL_FILTER|PROOFPOINT_ON_DEMAND|PROOFPOINT_SENDMAIL_SENTRION|PROOFPOINT_SER|PROOFPOINT_TAP_FORENSICS|PROOFPOINT_TRAP|SENDMAIL|SEPPMAIL|SYMANTEC_VIP|VIRTRU_EMAIL_ENCRYPTION|VOLTAGE|WORKSPACE_ALERTS|ZIX_EMAIL_ENCRYPTION|PHISHLABS/ nocase
$event.metadata.event_type = "EMAIL_UNCATEGORIZED"
or $event.metadata.event_type = "EMAIL_TRANSACTION"
or $event.metadata.event_type = "NETWORK_HTTP"
$event.security_result.detection_fields["judgement"] = /MALICIOUS/ nocase
$event.principal.ip != ""
$Source_IP = $event.principal.ip
match:
$Source_IP
outcome:
$Count = count($event.principal.ip)
order:
$Count desc
limit:
10
十大恶意发件人
$event.metadata.log_type = /ABNORMAL_SECURITY|AREA1|AVANAN_EMAIL|BARRACUDA_EMAIL|CISCO_EMAIL_SECURITY|COFENSE_TRIAGE|EXCHANGE_MAIL|FIREEYE_EMPS|FIREEYE_ETP|FORCEPOINT_EMAILSECURITY|FORCEPOINT_MAIL_RELAY|FORTINET_FORTIMAIL|KNOWBE4_PHISHER|MAILMARSHAL|MICROSOFT_DEFENDER_MAIL|MIMECAST_MAIL|MIMECAST_URL_LOGS|OBSERVEIT|OFFICE_365|POSTFIX_MAIL|PROOFPOINT_MAIL|PROOFPOINT_MAIL_FILTER|PROOFPOINT_ON_DEMAND|PROOFPOINT_SENDMAIL_SENTRION|PROOFPOINT_SER|PROOFPOINT_TAP_FORENSICS|PROOFPOINT_TRAP|SENDMAIL|SEPPMAIL|SYMANTEC_VIP|VIRTRU_EMAIL_ENCRYPTION|VOLTAGE|WORKSPACE_ALERTS|ZIX_EMAIL_ENCRYPTION|PHISHLABS/ nocase
$event.metadata.event_type = "EMAIL_UNCATEGORIZED"
or $event.metadata.event_type = "EMAIL_TRANSACTION"
or $event.metadata.event_type = "NETWORK_HTTP"
$event.security_result.detection_fields["judgement"] = /MALICIOUS/ nocase
$event.network.email.from != ""
$Sender = $event.network.email.from
match:
$Sender
outcome:
$Count = count($event.network.email.from)
order:
$Count desc
limit:
10
被屏蔽的网址与允许的网址
$event.metadata.log_type = /ABNORMAL_SECURITY|AREA1|AVANAN_EMAIL|BARRACUDA_EMAIL|CISCO_EMAIL_SECURITY|COFENSE_TRIAGE|EXCHANGE_MAIL|FIREEYE_EMPS|FIREEYE_ETP|FORCEPOINT_EMAILSECURITY|FORCEPOINT_MAIL_RELAY|FORTINET_FORTIMAIL|KNOWBE4_PHISHER|MAILMARSHAL|MICROSOFT_DEFENDER_MAIL|MIMECAST_MAIL|MIMECAST_URL_LOGS|OBSERVEIT|OFFICE_365|POSTFIX_MAIL|PROOFPOINT_MAIL|PROOFPOINT_MAIL_FILTER|PROOFPOINT_ON_DEMAND|PROOFPOINT_SENDMAIL_SENTRION|PROOFPOINT_SER|PROOFPOINT_TAP_FORENSICS|PROOFPOINT_TRAP|SENDMAIL|SEPPMAIL|SYMANTEC_VIP|VIRTRU_EMAIL_ENCRYPTION|VOLTAGE|WORKSPACE_ALERTS|ZIX_EMAIL_ENCRYPTION|PHISHLABS/ nocase
$event.metadata.event_type = "EMAIL_UNCATEGORIZED"
or $event.metadata.event_type = "EMAIL_TRANSACTION"
or $event.metadata.event_type = "NETWORK_HTTP"
$event.security_result.action = "ALLOW"
or $event.security_result.action = "BLOCK"
$Action = $event.security_result.action
$Date = timestamp.get_date($event.metadata.event_timestamp.seconds)
match:
$Date, $Action
outcome:
$Count = count($event.target.url)
order:
$Count desc
最近的恶意附件
$event.metadata.log_type = /ABNORMAL_SECURITY|AREA1|AVANAN_EMAIL|BARRACUDA_EMAIL|CISCO_EMAIL_SECURITY|COFENSE_TRIAGE|EXCHANGE_MAIL|FIREEYE_EMPS|FIREEYE_ETP|FORCEPOINT_EMAILSECURITY|FORCEPOINT_MAIL_RELAY|FORTINET_FORTIMAIL|KNOWBE4_PHISHER|MAILMARSHAL|MICROSOFT_DEFENDER_MAIL|MIMECAST_MAIL|MIMECAST_URL_LOGS|OBSERVEIT|OFFICE_365|POSTFIX_MAIL|PROOFPOINT_MAIL|PROOFPOINT_MAIL_FILTER|PROOFPOINT_ON_DEMAND|PROOFPOINT_SENDMAIL_SENTRION|PROOFPOINT_SER|PROOFPOINT_TAP_FORENSICS|PROOFPOINT_TRAP|SENDMAIL|SEPPMAIL|SYMANTEC_VIP|VIRTRU_EMAIL_ENCRYPTION|VOLTAGE|WORKSPACE_ALERTS|ZIX_EMAIL_ENCRYPTION|PHISHLABS/ nocase
$event.metadata.event_type = "EMAIL_UNCATEGORIZED"
or $event.metadata.event_type = "EMAIL_TRANSACTION"
or $event.metadata.event_type = "NETWORK_HTTP"
strings.coalesce($event.about.file.full_path, $event.security_result.detection_fields["attachmentNames"]) != ""
$Attachment = strings.coalesce($event.about.file.full_path, $event.security_result.detection_fields["attachmentNames"])
$Category = $event.security_result.category
$Sender = $event.network.email.from
$Receiver = $event.network.email.to
$Status = $event.additional.fields["remediationStatus"]
$Date = timestamp.get_date($event.metadata.event_timestamp.seconds)
match:
$Date, $Sender, $Receiver, $Attachment, $Category, $Status
order:
$Date desc
limit:
50
十大恶意位置
$event.metadata.log_type = /ABNORMAL_SECURITY|AREA1|AVANAN_EMAIL|BARRACUDA_EMAIL|CISCO_EMAIL_SECURITY|COFENSE_TRIAGE|EXCHANGE_MAIL|FIREEYE_EMPS|FIREEYE_ETP|FORCEPOINT_EMAILSECURITY|FORCEPOINT_MAIL_RELAY|FORTINET_FORTIMAIL|KNOWBE4_PHISHER|MAILMARSHAL|MICROSOFT_DEFENDER_MAIL|MIMECAST_MAIL|MIMECAST_URL_LOGS|OBSERVEIT|OFFICE_365|POSTFIX_MAIL|PROOFPOINT_MAIL|PROOFPOINT_MAIL_FILTER|PROOFPOINT_ON_DEMAND|PROOFPOINT_SENDMAIL_SENTRION|PROOFPOINT_SER|PROOFPOINT_TAP_FORENSICS|PROOFPOINT_TRAP|SENDMAIL|SEPPMAIL|SYMANTEC_VIP|VIRTRU_EMAIL_ENCRYPTION|VOLTAGE|WORKSPACE_ALERTS|ZIX_EMAIL_ENCRYPTION|PHISHLABS/ nocase
$event.metadata.event_type = "EMAIL_UNCATEGORIZED"
or $event.metadata.event_type = "EMAIL_TRANSACTION"
or $event.metadata.event_type = "NETWORK_HTTP"
$event.security_result.detection_fields["judgement"] = /MALICIOUS/ nocase
$event.principal.location.country_or_region != ""
$Countries = $event.principal.location.country_or_region
$Latitude = $event.principal.location.region_coordinates.latitude
$Longitude = $event.principal.location.region_coordinates.longitude
match:
$Countries, $Latitude, $Longitude
outcome:
$Count = count($event.metadata.id)
order:
$Count desc
limit:
10
电子邮件威胁（按类别划分）
$event.metadata.log_type = /ABNORMAL_SECURITY|AREA1|AVANAN_EMAIL|BARRACUDA_EMAIL|CISCO_EMAIL_SECURITY|COFENSE_TRIAGE|EXCHANGE_MAIL|FIREEYE_EMPS|FIREEYE_ETP|FORCEPOINT_EMAILSECURITY|FORCEPOINT_MAIL_RELAY|FORTINET_FORTIMAIL|KNOWBE4_PHISHER|MAILMARSHAL|MICROSOFT_DEFENDER_MAIL|MIMECAST_MAIL|MIMECAST_URL_LOGS|OBSERVEIT|OFFICE_365|POSTFIX_MAIL|PROOFPOINT_MAIL|PROOFPOINT_MAIL_FILTER|PROOFPOINT_ON_DEMAND|PROOFPOINT_SENDMAIL_SENTRION|PROOFPOINT_SER|PROOFPOINT_TAP_FORENSICS|PROOFPOINT_TRAP|SENDMAIL|SEPPMAIL|SYMANTEC_VIP|VIRTRU_EMAIL_ENCRYPTION|VOLTAGE|WORKSPACE_ALERTS|ZIX_EMAIL_ENCRYPTION|PHISHLABS/ nocase
$Threat_Name = $event.security_result.category_details
$Category = $event.security_result.category
match:
$Threat_Name, $Category
outcome:
$Count = count($event.security_result.threat_name)
order:
$Count desc
limit:
50
按严重程度划分的十大电子邮件威胁
$event.metadata.log_type = /ABNORMAL_SECURITY|AREA1|AVANAN_EMAIL|BARRACUDA_EMAIL|CISCO_EMAIL_SECURITY|COFENSE_TRIAGE|EXCHANGE_MAIL|FIREEYE_EMPS|FIREEYE_ETP|FORCEPOINT_EMAILSECURITY|FORCEPOINT_MAIL_RELAY|FORTINET_FORTIMAIL|KNOWBE4_PHISHER|MAILMARSHAL|MICROSOFT_DEFENDER_MAIL|MIMECAST_MAIL|MIMECAST_URL_LOGS|OBSERVEIT|OFFICE_365|POSTFIX_MAIL|PROOFPOINT_MAIL|PROOFPOINT_MAIL_FILTER|PROOFPOINT_ON_DEMAND|PROOFPOINT_SENDMAIL_SENTRION|PROOFPOINT_SER|PROOFPOINT_TAP_FORENSICS|PROOFPOINT_TRAP|SENDMAIL|SEPPMAIL|SYMANTEC_VIP|VIRTRU_EMAIL_ENCRYPTION|VOLTAGE|WORKSPACE_ALERTS|ZIX_EMAIL_ENCRYPTION|PHISHLABS/ nocase
$event.metadata.event_type = "EMAIL_UNCATEGORIZED"
or $event.metadata.event_type = "EMAIL_TRANSACTION"
or $event.metadata.event_type = "NETWORK_HTTP"
$event.security_result.category_details != ""
$Severity = $event.security_result.severity
$Threat_Name = $event.security_result.category_details
$Threat_Name != ""
match:
$Threat_Name, $Severity
outcome:
$Count = count($event.security_result.severity)
order:
$Count desc
limit:
10
近期的活跃威胁
$event.metadata.log_type = /ABNORMAL_SECURITY|AREA1|AVANAN_EMAIL|BARRACUDA_EMAIL|CISCO_EMAIL_SECURITY|COFENSE_TRIAGE|EXCHANGE_MAIL|FIREEYE_EMPS|FIREEYE_ETP|FORCEPOINT_EMAILSECURITY|FORCEPOINT_MAIL_RELAY|FORTINET_FORTIMAIL|KNOWBE4_PHISHER|MAILMARSHAL|MICROSOFT_DEFENDER_MAIL|MIMECAST_MAIL|MIMECAST_URL_LOGS|OBSERVEIT|OFFICE_365|POSTFIX_MAIL|PROOFPOINT_MAIL|PROOFPOINT_MAIL_FILTER|PROOFPOINT_ON_DEMAND|PROOFPOINT_SENDMAIL_SENTRION|PROOFPOINT_SER|PROOFPOINT_TAP_FORENSICS|PROOFPOINT_TRAP|SENDMAIL|SEPPMAIL|SYMANTEC_VIP|VIRTRU_EMAIL_ENCRYPTION|VOLTAGE|WORKSPACE_ALERTS|ZIX_EMAIL_ENCRYPTION|PHISHLABS/ nocase
$event.metadata.event_type = "EMAIL_UNCATEGORIZED"
or $event.metadata.event_type = "EMAIL_TRANSACTION"
or $event.metadata.event_type = "NETWORK_HTTP"
$Threat_Name = $event.security_result.threat_name
$Status = $event.security_result.threat_status
match:
$Threat_Name, $Status
outcome:
$Count = count($event.metadata.id)
$Date = timestamp.get_timestamp(max($event.metadata.event_timestamp.seconds))
order:
$Date desc
limit:
50
威胁状态分布
$event.metadata.log_type = /ABNORMAL_SECURITY|AREA1|AVANAN_EMAIL|BARRACUDA_EMAIL|CISCO_EMAIL_SECURITY|COFENSE_TRIAGE|EXCHANGE_MAIL|FIREEYE_EMPS|FIREEYE_ETP|FORCEPOINT_EMAILSECURITY|FORCEPOINT_MAIL_RELAY|FORTINET_FORTIMAIL|KNOWBE4_PHISHER|MAILMARSHAL|MICROSOFT_DEFENDER_MAIL|MIMECAST_MAIL|MIMECAST_URL_LOGS|OBSERVEIT|OFFICE_365|POSTFIX_MAIL|PROOFPOINT_MAIL|PROOFPOINT_MAIL_FILTER|PROOFPOINT_ON_DEMAND|PROOFPOINT_SENDMAIL_SENTRION|PROOFPOINT_SER|PROOFPOINT_TAP_FORENSICS|PROOFPOINT_TRAP|SENDMAIL|SEPPMAIL|SYMANTEC_VIP|VIRTRU_EMAIL_ENCRYPTION|VOLTAGE|WORKSPACE_ALERTS|ZIX_EMAIL_ENCRYPTION|PHISHLABS/ nocase
$event.metadata.event_type = "EMAIL_UNCATEGORIZED"
or $event.metadata.event_type = "EMAIL_TRANSACTION"
or $event.metadata.event_type = "NETWORK_HTTP"
$Status = $event.security_result.threat_status
match:
$Status
outcome:
$Count = count($event.security_result.threat_name)
order:
$Count desc
安全结果操作分布
$event.metadata.log_type = /ABNORMAL_SECURITY|AREA1|AVANAN_EMAIL|BARRACUDA_EMAIL|CISCO_EMAIL_SECURITY|COFENSE_TRIAGE|EXCHANGE_MAIL|FIREEYE_EMPS|FIREEYE_ETP|FORCEPOINT_EMAILSECURITY|FORCEPOINT_MAIL_RELAY|FORTINET_FORTIMAIL|KNOWBE4_PHISHER|MAILMARSHAL|MICROSOFT_DEFENDER_MAIL|MIMECAST_MAIL|MIMECAST_URL_LOGS|OBSERVEIT|OFFICE_365|POSTFIX_MAIL|PROOFPOINT_MAIL|PROOFPOINT_MAIL_FILTER|PROOFPOINT_ON_DEMAND|PROOFPOINT_SENDMAIL_SENTRION|PROOFPOINT_SER|PROOFPOINT_TAP_FORENSICS|PROOFPOINT_TRAP|SENDMAIL|SEPPMAIL|SYMANTEC_VIP|VIRTRU_EMAIL_ENCRYPTION|VOLTAGE|WORKSPACE_ALERTS|ZIX_EMAIL_ENCRYPTION|PHISHLABS/ nocase
$event.metadata.event_type = "EMAIL_UNCATEGORIZED"
or $event.metadata.event_type = "EMAIL_TRANSACTION"
or $event.metadata.event_type = "NETWORK_HTTP"
$Action = $event.security_result.action
match:
$Action
outcome:
$Count = count($event.security_result.action)
order:
$Count desc
安全结果操作分布
$event.metadata.log_type = /ABNORMAL_SECURITY|AREA1|AVANAN_EMAIL|BARRACUDA_EMAIL|CISCO_EMAIL_SECURITY|COFENSE_TRIAGE|EXCHANGE_MAIL|FIREEYE_EMPS|FIREEYE_ETP|FORCEPOINT_EMAILSECURITY|FORCEPOINT_MAIL_RELAY|FORTINET_FORTIMAIL|KNOWBE4_PHISHER|MAILMARSHAL|MICROSOFT_DEFENDER_MAIL|MIMECAST_MAIL|MIMECAST_URL_LOGS|OBSERVEIT|OFFICE_365|POSTFIX_MAIL|PROOFPOINT_MAIL|PROOFPOINT_MAIL_FILTER|PROOFPOINT_ON_DEMAND|PROOFPOINT_SENDMAIL_SENTRION|PROOFPOINT_SER|PROOFPOINT_TAP_FORENSICS|PROOFPOINT_TRAP|SENDMAIL|SEPPMAIL|SYMANTEC_VIP|VIRTRU_EMAIL_ENCRYPTION|VOLTAGE|WORKSPACE_ALERTS|ZIX_EMAIL_ENCRYPTION|PHISHLABS/ nocase
$event.metadata.event_type = "EMAIL_UNCATEGORIZED"
or $event.metadata.event_type = "EMAIL_TRANSACTION"
or $event.metadata.event_type = "NETWORK_HTTP"
$Action = $event.security_result.action
match:
$Action
outcome:
$Count = count($event.security_result.action)
order:
$Count desc
10 大有针对性的电子邮件
$event.metadata.log_type = /ABNORMAL_SECURITY|AREA1|AVANAN_EMAIL|BARRACUDA_EMAIL|CISCO_EMAIL_SECURITY|COFENSE_TRIAGE|EXCHANGE_MAIL|FIREEYE_EMPS|FIREEYE_ETP|FORCEPOINT_EMAILSECURITY|FORCEPOINT_MAIL_RELAY|FORTINET_FORTIMAIL|KNOWBE4_PHISHER|MAILMARSHAL|MICROSOFT_DEFENDER_MAIL|MIMECAST_MAIL|MIMECAST_URL_LOGS|OBSERVEIT|OFFICE_365|POSTFIX_MAIL|PROOFPOINT_MAIL|PROOFPOINT_MAIL_FILTER|PROOFPOINT_ON_DEMAND|PROOFPOINT_SENDMAIL_SENTRION|PROOFPOINT_SER|PROOFPOINT_TAP_FORENSICS|PROOFPOINT_TRAP|SENDMAIL|SEPPMAIL|SYMANTEC_VIP|VIRTRU_EMAIL_ENCRYPTION|VOLTAGE|WORKSPACE_ALERTS|ZIX_EMAIL_ENCRYPTION|PHISHLABS/ nocase
$event.metadata.event_type = "EMAIL_UNCATEGORIZED"
or $event.metadata.event_type = "EMAIL_TRANSACTION"
or $event.metadata.event_type = "NETWORK_HTTP"
$event.target.user.email_addresses != ""
$Target = $event.target.user.email_addresses
match:
$Target
outcome:
$Count = count($event.target.user.email_addresses)
order:
$Count desc
limit:
10
十大恶意位置
$event.metadata.log_type = /ABNORMAL_SECURITY|AREA1|AVANAN_EMAIL|BARRACUDA_EMAIL|CISCO_EMAIL_SECURITY|COFENSE_TRIAGE|EXCHANGE_MAIL|FIREEYE_EMPS|FIREEYE_ETP|FORCEPOINT_EMAILSECURITY|FORCEPOINT_MAIL_RELAY|FORTINET_FORTIMAIL|KNOWBE4_PHISHER|MAILMARSHAL|MICROSOFT_DEFENDER_MAIL|MIMECAST_MAIL|MIMECAST_URL_LOGS|OBSERVEIT|OFFICE_365|POSTFIX_MAIL|PROOFPOINT_MAIL|PROOFPOINT_MAIL_FILTER|PROOFPOINT_ON_DEMAND|PROOFPOINT_SENDMAIL_SENTRION|PROOFPOINT_SER|PROOFPOINT_TAP_FORENSICS|PROOFPOINT_TRAP|SENDMAIL|SEPPMAIL|SYMANTEC_VIP|VIRTRU_EMAIL_ENCRYPTION|VOLTAGE|WORKSPACE_ALERTS|ZIX_EMAIL_ENCRYPTION|PHISHLABS/ nocase
$event.metadata.event_type = "EMAIL_UNCATEGORIZED"
or $event.metadata.event_type = "EMAIL_TRANSACTION"
or $event.metadata.event_type = "NETWORK_HTTP"
$event.security_result.detection_fields["judgement"] = /MALICIOUS/ nocase
$event.principal.location.country_or_region != ""
$Countries = $event.principal.location.country_or_region
$Latitude = $event.principal.location.region_coordinates.latitude
$Longitude = $event.principal.location.region_coordinates.longitude
match:
$Countries, $Latitude, $Longitude
outcome:
$Count = count($event.metadata.id)
order:
$Count desc
limit:
10
十大高严重程度威胁
$event.metadata.log_type = /ABNORMAL_SECURITY|AREA1|AVANAN_EMAIL|BARRACUDA_EMAIL|CISCO_EMAIL_SECURITY|COFENSE_TRIAGE|EXCHANGE_MAIL|FIREEYE_EMPS|FIREEYE_ETP|FORCEPOINT_EMAILSECURITY|FORCEPOINT_MAIL_RELAY|FORTINET_FORTIMAIL|KNOWBE4_PHISHER|MAILMARSHAL|MICROSOFT_DEFENDER_MAIL|MIMECAST_MAIL|MIMECAST_URL_LOGS|OBSERVEIT|OFFICE_365|POSTFIX_MAIL|PROOFPOINT_MAIL|PROOFPOINT_MAIL_FILTER|PROOFPOINT_ON_DEMAND|PROOFPOINT_SENDMAIL_SENTRION|PROOFPOINT_SER|PROOFPOINT_TAP_FORENSICS|PROOFPOINT_TRAP|SENDMAIL|SEPPMAIL|SYMANTEC_VIP|VIRTRU_EMAIL_ENCRYPTION|VOLTAGE|WORKSPACE_ALERTS|ZIX_EMAIL_ENCRYPTION|PHISHLABS/ nocase
$event.metadata.event_type = "EMAIL_UNCATEGORIZED"
or $event.metadata.event_type = "EMAIL_TRANSACTION"
or $event.metadata.event_type = "NETWORK_HTTP"
$event.security_result.category_details != ""
$event.security_result.severity = "HIGH"
$Category = $event.security_result.category_details
match:
$Category
outcome:
$Count = count($event.metadata.id)
order:
$Count desc
limit:
10
威胁状态分布
$event.metadata.log_type = /ABNORMAL_SECURITY|AREA1|AVANAN_EMAIL|BARRACUDA_EMAIL|CISCO_EMAIL_SECURITY|COFENSE_TRIAGE|EXCHANGE_MAIL|FIREEYE_EMPS|FIREEYE_ETP|FORCEPOINT_EMAILSECURITY|FORCEPOINT_MAIL_RELAY|FORTINET_FORTIMAIL|KNOWBE4_PHISHER|MAILMARSHAL|MICROSOFT_DEFENDER_MAIL|MIMECAST_MAIL|MIMECAST_URL_LOGS|OBSERVEIT|OFFICE_365|POSTFIX_MAIL|PROOFPOINT_MAIL|PROOFPOINT_MAIL_FILTER|PROOFPOINT_ON_DEMAND|PROOFPOINT_SENDMAIL_SENTRION|PROOFPOINT_SER|PROOFPOINT_TAP_FORENSICS|PROOFPOINT_TRAP|SENDMAIL|SEPPMAIL|SYMANTEC_VIP|VIRTRU_EMAIL_ENCRYPTION|VOLTAGE|WORKSPACE_ALERTS|ZIX_EMAIL_ENCRYPTION|PHISHLABS/ nocase
$event.metadata.event_type = "EMAIL_UNCATEGORIZED"
or $event.metadata.event_type = "EMAIL_TRANSACTION"
or $event.metadata.event_type = "NETWORK_HTTP"
$Status = $event.security_result.threat_status
match:
$Status
outcome:
$Count = count($event.security_result.threat_name)
order:
$Count desc
按严重程度划分的十大电子邮件威胁
$event.metadata.log_type = /ABNORMAL_SECURITY|AREA1|AVANAN_EMAIL|BARRACUDA_EMAIL|CISCO_EMAIL_SECURITY|COFENSE_TRIAGE|EXCHANGE_MAIL|FIREEYE_EMPS|FIREEYE_ETP|FORCEPOINT_EMAILSECURITY|FORCEPOINT_MAIL_RELAY|FORTINET_FORTIMAIL|KNOWBE4_PHISHER|MAILMARSHAL|MICROSOFT_DEFENDER_MAIL|MIMECAST_MAIL|MIMECAST_URL_LOGS|OBSERVEIT|OFFICE_365|POSTFIX_MAIL|PROOFPOINT_MAIL|PROOFPOINT_MAIL_FILTER|PROOFPOINT_ON_DEMAND|PROOFPOINT_SENDMAIL_SENTRION|PROOFPOINT_SER|PROOFPOINT_TAP_FORENSICS|PROOFPOINT_TRAP|SENDMAIL|SEPPMAIL|SYMANTEC_VIP|VIRTRU_EMAIL_ENCRYPTION|VOLTAGE|WORKSPACE_ALERTS|ZIX_EMAIL_ENCRYPTION|PHISHLABS/ nocase
$event.metadata.event_type = "EMAIL_UNCATEGORIZED"
or $event.metadata.event_type = "EMAIL_TRANSACTION"
or $event.metadata.event_type = "NETWORK_HTTP"
$event.security_result.category_details != ""
$Severity = $event.security_result.severity
$Threat_Name = $event.security_result.category_details
match:
$Threat_Name, $Severity
outcome:
$Count = count($event.security_result.severity)
order:
$Count desc
limit:
10
排名前 10 的已识别网域
$event.metadata.log_type = /ABNORMAL_SECURITY|AREA1|AVANAN_EMAIL|BARRACUDA_EMAIL|CISCO_EMAIL_SECURITY|COFENSE_TRIAGE|EXCHANGE_MAIL|FIREEYE_EMPS|FIREEYE_ETP|FORCEPOINT_EMAILSECURITY|FORCEPOINT_MAIL_RELAY|FORTINET_FORTIMAIL|KNOWBE4_PHISHER|MAILMARSHAL|MICROSOFT_DEFENDER_MAIL|MIMECAST_MAIL|MIMECAST_URL_LOGS|OBSERVEIT|OFFICE_365|POSTFIX_MAIL|PROOFPOINT_MAIL|PROOFPOINT_MAIL_FILTER|PROOFPOINT_ON_DEMAND|PROOFPOINT_SENDMAIL_SENTRION|PROOFPOINT_SER|PROOFPOINT_TAP_FORENSICS|PROOFPOINT_TRAP|SENDMAIL|SEPPMAIL|SYMANTEC_VIP|VIRTRU_EMAIL_ENCRYPTION|VOLTAGE|WORKSPACE_ALERTS|ZIX_EMAIL_ENCRYPTION|PHISHLABS/ nocase
$event.metadata.event_type = "EMAIL_UNCATEGORIZED"
or $event.metadata.event_type = "EMAIL_TRANSACTION"
or $event.metadata.event_type = "NETWORK_HTTP"
$event.principal.administrative_domain != ""
$Domain = $event.principal.administrative_domain
match:
$Domain
outcome:
$Count = count($event.metadata.id)
order:
$Count desc
limit:
10
FedRAMP 持续监控
此信息中心可清晰显示系统合规性和安全状况。
它会跟踪漏洞以及针对 FedRAMP 标准的控制有效性，帮助您保持合规性并确定补救工作的优先级。
入站连接总数
有可用更新的系统
近期媒体保护供应商提醒
10 大被屏蔽的网域
按方向划分的不同时间段的网络流量
漏洞（按严重程度划分）
按原因列出的被屏蔽的前 10 个应用执行
弱 TLS 版本的使用情况随时间的变化
登录次数（按状态随时间变化）
MFA 注册状态
按严重程度较高的提醒排序的前 10 个端点
前 10 大入站 IP 地址
媒体保护供应商提醒（按时间段和操作）
最近 10 次用户签到的徽章
高严重程度的端点检测结果随时间的变化
出站连接总数
按登录失败次数排名的前 10 名用户
TLS 加密套件分布
按严重程度划分的数据泄露防护违规行为
按年龄划分的漏洞
用户账号权限变更
前 10 大出站 IP 地址
按特权操作划分的前 10 名用户
图表名称
查询示例
入站连接总数
metadata.event_type = "NETWORK_CONNECTION"
network.direction = "INBOUND"
outcome:
$Count = count_distinct(principal.ip)
有可用更新的系统
metadata.product_event_type = "40"
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
$Hostname = strings.coalesce(principal.asset.hostname, principal.hostname)
match:
$Hostname, $Date
outcome:
$Count = count(metadata.id)
order:
$Date asc
近期媒体保护供应商提醒
strings.coalesce(metadata.product_event_type, security_result.rule_name, security_result.summary) = /\busb|removable|drive\b/ nocase
$Vendor_Alert = strings.coalesce(metadata.product_event_type, security_result.rule_name, security_result.summary)
$User = strings.coalesce(principal.user.user_display_name, target.user.user_display_name)
$Source_IP = strings.coalesce(principal.asset.ip, principal.ip)
$File_Name = target.file.full_path
$Action = security_result.action
$Date = timestamp.get_timestamp(metadata.event_timestamp.seconds, "%F %T ")
match:
$Date, $Vendor_Alert, $Source_IP, $User, $File_Name, $Action
order:
$Date desc
10 大被屏蔽的网域
security_result.action = "BLOCK"
$Destination_Domain = strings.coalesce(target.administrative_domain, about.administrative_domain, target.ip_geo_artifact.network.dns_domain)
$Destination_Domain != ""
match:
$Destination_Domain
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
按方向划分的不同时间段的网络流量
metadata.event_type = "NETWORK_UNCATEGORIZED"
or metadata.event_type = "NETWORK_FLOW"
or metadata.event_type = "NETWORK_CONNECTION"
or metadata.event_type = "NETWORK_FTP"
or metadata.event_type = "NETWORK_DHCP"
or metadata.event_type = "NETWORK_DNS"
or metadata.event_type = "NETWORK_HTTP"
or metadata.event_type = "NETWORK_SMTP"
$Direction = network.direction
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
match:
$Direction, $Date
outcome:
$Count = count(metadata.id)
order:
$Date desc
漏洞（按严重程度划分）
$Severity =
if (principal.asset.vulnerabilities.severity != "UNKNOWN_SEVERITY",
principal.asset.vulnerabilities.severity,
if (target.asset.vulnerabilities.severity != "UNKNOWN_SEVERITY",
target.asset.vulnerabilities.severity,
if (extensions.vulns.vulnerabilities.severity != "UNKNOWN_SEVERITY",
extensions.vulns.vulnerabilities.severity,
"UNKNOWN_SEVERITY")))
match:
$Severity
outcome:
$Event_Count = count(strings.coalesce(extensions.vulns.vulnerabilities.name, extensions.vulns.vulnerabilities.description, extensions.vulns.vulnerabilities.vendor_vulnerability_id, principal.asset.vulnerabilities.name, target.asset.vulnerabilities.name, additional.fields["ScanReference"]))
order:
$Severity desc
按原因列出的被屏蔽的前 10 个应用执行
metadata.product_event_type = /(execution|application) block/ nocase
or security_result.threat_name = /application control/ nocase
security_result.action = "BLOCK"
$Application = strings.coalesce(about.file.full_path, target.process.file.full_path, additional.fields["fname"])
$Reason = strings.coalesce(target.resource.attribute.labels["categoryTupleDescription"], security_result.action_details, metadata.product_event_type)
match:
$Application, $Reason
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
弱 TLS 版本的使用情况随时间的变化
network.tls.version != /1(\.|_)?(2|3)/ nocase
$Cipher_Version = network.tls.version
$Cipher_Version != ""
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
match:
$Cipher_Version, $Date
outcome:
$Count = count(metadata.id)
order:
$Date desc
登录次数（按状态随时间变化）
metadata.event_type = "USER_LOGIN"
$Action = security_result.action
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
match:
$Action, $Date
outcome:
$Count = count(metadata.id)
order:
$Date desc
MFA 注册状态
metadata.product_name = "MULTI-FACTOR_AUTHENTICATION"
or strings.coalesce(additional.fields["AuthenticationRequirement"], security_result.detection_fields.value) = /mfa|multi(?:\s|\S)?factor(?:\s|\S)?authentication|/ nocase
metadata.product_event_type = "enrollment"
or target.resource_ancestors.resource_subtype = "AuthenticatorEnrollment"
$Result = security_result.summary
match:
$Result
outcome:
$Count = count(metadata.id)
order:
$Count desc
按严重程度较高的提醒排序的前 10 个端点
principal.hostname != ""
$Hostname = principal.hostname
$Severity = security_result.severity
$Severity = "CRITICAL" or $Severity = "HIGH"
match:
$Hostname, $Severity
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
前 10 大入站 IP 地址
network.direction = "INBOUND"
$Log_Type = metadata.log_type
$Source_IP = principal.ip
match:
$Log_Type, $Source_IP
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
媒体保护供应商提醒（按时间段和操作）
strings.coalesce(metadata.product_event_type, security_result.rule_name, security_result.summary) = /\busb|removable|drive\b/ nocase
$Action = security_result.action
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
match:
$Date, $Action
outcome:
$Count = count(metadata.id)
order:
$Date desc
最近 10 次用户签到的徽章
(metadata.event_type = "USER_BADGE_IN"
or metadata.event_type = "USER_RESOURCE_ACCESS"
or metadata.event_type = "USER_UNCATEGORIZED")
strings.coalesce(metadata.description, security_result.action_details, security_result.description, security_result.summary, additional.fields["plasectrxEvtypename"]) = /(?:access\sgranted|badge\sin)/ nocase
$User = strings.coalesce(principal.user.user_display_name, principal.user.email_addresses, additional.fields["person"], principal.user.userid)
$Location = strings.coalesce(security_result.rule_labels["Place"], additional.fields["site"], target.location.name, principal.resource.name)
$Date = timestamp.get_timestamp(metadata.event_timestamp.seconds, "%F %H:%M:%S ")
match:
$Date, $User, $Location
order:
$Date desc
limit:
10
高严重程度的端点检测结果随时间的变化
principal.hostname != ""
$Severity = security_result.severity
$Severity = "CRITICAL" or $Severity = "HIGH"
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
match:
$Severity, $Date
outcome:
$Count = count(metadata.id)
order:
$Count desc
出站连接总数
metadata.event_type = "NETWORK_CONNECTION"
network.direction = "OUTBOUND"
outcome:
$Count = count_distinct(target.ip)
按登录失败次数排名的前 10 名用户
metadata.event_type = "USER_LOGIN"
security_result.action = "BLOCK"
target.user.userid != ""
$User = target.user.userid
match:
$User
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
TLS 加密套件分布
network.tls.cipher != /1(\.|_)?(2|3)/ nocase
$TLS_Cipher = network.tls.cipher
$TLS_Cipher != ""
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
match:
$TLS_Cipher, $Date
outcome:
$Count = count(metadata.id)
order:
$Count desc
按严重程度划分的数据泄露防护违规行为
metadata.log_type = /DLP/ nocase
metadata.product_event_type = /Violation/ nocase
$Severity = security_result.severity
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
match:
$Severity
outcome:
$Count = count(metadata.id)
order:
$Severity desc
按年龄划分的漏洞
(timestamp.as_unix_seconds(additional.fields["first_found"]) > 0
or extensions.vulns.vulnerabilities.first_found.seconds > 0
or principal.asset.vulnerabilities.first_found.seconds > 0)
$Vulnerability = strings.coalesce(
if(principal.asset.vulnerabilities.name != "" and principal.asset.vulnerabilities.description != "",
strings.concat(principal.asset.vulnerabilities.name, " : ", principal.asset.vulnerabilities.description),
strings.coalesce(principal.asset.vulnerabilities.name, principal.asset.vulnerabilities.description)),
if(additional.fields["ScanReference"] != "" and metadata.description != "",
strings.concat(additional.fields["ScanReference"], " : ", metadata.description),
strings.coalesce(additional.fields["ScanReference"], metadata.description)),
if(extensions.vulns.vulnerabilities.vendor_vulnerability_id != "" and extensions.vulns.vulnerabilities.description != "",
strings.concat(extensions.vulns.vulnerabilities.vendor_vulnerability_id, " : ", extensions.vulns.vulnerabilities.description),
strings.coalesce(extensions.vulns.vulnerabilities.vendor_vulnerability_id, extensions.vulns.vulnerabilities.description)
)
)
$Vulnerability != " : "
$Vulnerability != ""
$Log_Type = metadata.log_type
match:
$Vulnerability, $Log_Type
outcome:
$Age = max(cast.as_int((metadata.event_timestamp.seconds - if(timestamp.as_unix_seconds(additional.fields["first_found"]) > 0, timestamp.as_unix_seconds(additional.fields["first_found"]), if(extensions.vulns.vulnerabilities.first_found.seconds > 0, extensions.vulns.vulnerabilities.first_found.seconds, if(principal.asset.vulnerabilities.first_found.seconds > 0, principal.asset.vulnerabilities.first_found.seconds, metadata.event_timestamp.seconds)))) / 86400))
$Days_Range = if($Age <= 30, "0-30 Days",
if($Age <= 60, "31-60 Days",
if($Age <= 90, "61-90 Days", "> 90 Days")))
$Count = count(strings.coalesce(extensions.vulns.vulnerabilities.name, extensions.vulns.vulnerabilities.description, extensions.vulns.vulnerabilities.vendor_vulnerability_id, principal.asset.vulnerabilities.name, additional.fields["ScanReference"]))
order:
$Age desc
用户账号权限变更
metadata.event_type = "USER_CHANGE_PERMISSIONS"
principal.user.userid != ""
outcome:
$Count = count_distinct(metadata.id)
前 10 大出站 IP 地址
network.direction = "OUTBOUND"
$Log_Type = metadata.log_type
$Destination_IP = target.ip
match:
$Log_Type, $Destination_IP
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
按特权操作划分的前 10 名用户
principal.user.attribute.roles.type = "ADMINISTRATOR"
or strings.coalesce(principal.user.attribute.roles.name, principal.user.userid) = /Admin|Root|Super/ nocase
$User = principal.user.userid
$Action = metadata.product_event_type
match:
$User, $Action
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
防火墙活动监控
此信息中心提供有关防火墙活动的信息，以增强安全性和性能管理。它通过跟踪与防火墙活动相关的各种指标和事件，提供有关网络安全的实时洞察，帮助用户有效管理潜在威胁并做出响应。
触发了罕见的防火墙规则
触发次数最多的 10 条防火墙规则
按地理位置划分的连接数
热门连接目的地
按 IP 地址列出的数据流入量
按 IP 地址划分的数据流出量
热门连接来源
被屏蔽的流量与允许的流量
被屏蔽次数最多的 10 个 IP 地址
图表名称
查询示例
触发了罕见的防火墙规则
$event_type = metadata.event_type
$event_type >= 16000 and $event_type <= 16007
$log_type = metadata.log_type
$rule_name = security_result.rule_name
$rule_name !=""
$date = timestamp.get_date(metadata.event_timestamp.seconds)
match:
$rule_name
outcome:
$Count = count($rule_name)
order: $Count asc
limit: 10
触发次数最多的 10 条防火墙规则
$event_type = metadata.event_type
$event_type >= 16000 and $event_type <= 16007
$log_type = metadata.log_type
$rule_name = security_result.rule_name
$rule_name !=""
match:
$rule_name
outcome:
$Count = count(metadata.id)
order: $Count desc
limit: 10
按地理位置划分的连接数
$event_type = metadata.event_type
$event_type >= 16000 and $event_type <= 16007
$log_type = metadata.log_type
$rule_name = security_result.rule_name
$rule_name !=""
$country = principal.location.country_or_region
$country != ""
$direction = network.direction
match:
$country
outcome:
$event_count = count_distinct($country)
$latitude = max(principal.location.region_coordinates.latitude)
$longitude = max(principal.location.region_coordinates.longitude)
热门连接目的地
$event_type = metadata.event_type
$event_type >= 16000 and $event_type <= 16007
$log_type = metadata.log_type
$rule_name = security_result.rule_name
$Dest_IP = target.ip
$Dest_IP != ""
match:
$Dest_IP
outcome:
$event_count = count(metadata.id)
order: $event_count desc
limit: 10
按 IP 地址列出的数据流入量
$event_type = metadata.event_type
$event_type >= 16000 and $event_type <= 16007
$ruleN = security_result.rule_name
$IP = principal.ip
$byte = network.received_bytes
$byte != 0
$Vendor = metadata.vendor_name
$Vendor != ""
match:
$IP, $Vendor
outcome:
$byte_sum=sum($byte)
$Data_in_mb = math.round($byte_sum/1048576)
order: $Data_in_mb desc
limit: 10
按地理位置划分的连接数
$event_type = metadata.event_type
$event_type >= 16000 and $event_type <= 16007
$log_type = metadata.log_type
$rule_name = security_result.rule_name
$rule_name !=""
$country = principal.location.country_or_region
$country != ""
$direction = network.direction
match:
$country
outcome:
$event_count = count_distinct($country)
$latitude = max(principal.location.region_coordinates.latitude)
$longitude = max(principal.location.region_coordinates.longitude)
按 IP 地址划分的数据流出量
$event_type = metadata.event_type
$event_type >= 16000 and $event_type <= 16007
$IP = principal.ip
$byte = network.sent_bytes
$byte != 0
$Vendor = metadata.vendor_name
metadata.vendor_name != ""
match:
$IP, $Vendor
outcome:
$byte_sum=sum($byte)
$data_in_mb = math.round($byte_sum/1048576)
order: $data_in_mb desc
limit:10
触发了罕见的防火墙规则
$event_type = metadata.event_type
$event_type >= 16000 and $event_type <= 16007
$log_type = metadata.log_type
$rule_name = security_result.rule_name
$rule_name !=""
$date = timestamp.get_date(metadata.event_timestamp.seconds)
match:
$rule_name
outcome:
$Count = count($rule_name)
order: $Count asc
limit: 10
热门连接来源
$event_type = metadata.event_type
$event_type >= 16000 and $event_type <= 16007
$log_type = metadata.log_type
$rule_name = security_result.rule_name
$Src_IP = principal.ip
match:
$Src_IP
outcome:
$event_count = count(metadata.id)
order: $event_count desc
limit: 10
被屏蔽的流量与允许的流量
$event_type = metadata.event_type
$event_type >= 16000 and $event_type <= 16007
$log_type = metadata.log_type
$rule_name = security_result.rule_name
$action = security_result.action
$action = "BLOCK" OR $action = "ALLOW"
match:
$action
outcome:
$event_count = count(metadata.id)
order: $event_count desc
触发次数最多的 10 条防火墙规则
$event_type = metadata.event_type
$event_type >= 16000 and $event_type <= 16007
$log_type = metadata.log_type
$rule_name = security_result.rule_name
$rule_name !=""
match:
$rule_name
outcome:
$Count = count(metadata.id)
order: $Count desc
limit: 10
被屏蔽的流量与允许的流量
$event_type = metadata.event_type
$event_type >= 16000 and $event_type <= 16007
$log_type = metadata.log_type
$rule_name = security_result.rule_name
$action = security_result.action
$action = "BLOCK" OR $action = "ALLOW"
match:
$action
outcome:
$event_count = count(metadata.id)
order: $event_count desc
按 IP 地址划分的数据流出量
$event_type = metadata.event_type
$event_type >= 16000 and $event_type <= 16007
$IP = principal.ip
$byte = network.sent_bytes
$byte != 0
$Vendor = metadata.vendor_name
metadata.vendor_name != ""
match:
$IP, $Vendor
outcome:
$byte_sum=sum($byte)
$data_in_mb = math.round($byte_sum/1048576)
order: $data_in_mb desc
limit:10
按 IP 地址列出的数据流入量
$event_type = metadata.event_type
$event_type >= 16000 and $event_type <= 16007
$ruleN = security_result.rule_name
$IP = principal.ip
$byte = network.received_bytes
$byte != 0
$Vendor = metadata.vendor_name
$Vendor != ""
match:
$IP, $Vendor
outcome:
$byte_sum=sum($byte)
$Data_in_mb = math.round($byte_sum/1048576)
order: $Data_in_mb desc
limit: 10
热门连接来源
$event_type = metadata.event_type
$event_type >= 16000 and $event_type <= 16007
$log_type = metadata.log_type
$rule_name = security_result.rule_name
$Src_IP = principal.ip
$Src_IP != ""
match:
$Src_IP
outcome:
$event_count = count(metadata.id)
order: $event_count desc
limit: 10
热门连接目的地
$event_type = metadata.event_type
$event_type >= 16000 and $event_type <= 16007
$log_type = metadata.log_type
$rule_name = security_result.rule_name
$Dest_IP = target.ip
$Dest_IP != "EMPTY"
match:
$Dest_IP
outcome:
$event_count = count(metadata.id)
order: $event_count desc
limit: 10
被屏蔽次数最多的 10 个 IP 地址
$event_type = metadata.event_type
$event_type >= 16000 and $event_type <= 16007
$log_type = metadata.log_type
$rule_name = security_result.rule_name
$action = security_result.action
$action = "BLOCK"
$IP = principal.ip
match:
$IP, $action
outcome:
$event_count = count_distinct(metadata.id)
order: $event_count desc
limit: 10
被屏蔽次数最多的 10 个 IP 地址
$event_type = metadata.event_type
$event_type >= 16000 and $event_type <= 16007
$log_type = metadata.log_type
$rule_name = security_result.rule_name
$action = security_result.action
$action = "BLOCK"
$IP = principal.ip
match:
$IP, $action
outcome:
$event_count = count_distinct(metadata.id)
order: $event_count desc
limit: 10
GDPR 数据治理
此信息中心可让您了解欧盟各区域的数据访问情况，包括访问趋势、非欧盟访问尝试和热门地理位置。它有助于监控 GDPR 法规的合规情况、检测未经授权的数据访问权限，并确保欧盟数据的安全处理。
访问欧盟资源的特权账号
弱 TLS 版本分布
访问欧盟资源的前 10 个非欧盟 IP 地址
访问欧盟资源的前 10 名用户
按来源地理位置划分的欧盟数据访问权限
欧盟资源随时间推移的数据删除和清除事件
欧盟资源上弱加密的演变
欧盟资源上的数据删除和清除事件
访问欧盟资源的前 10 个特权账号
欧盟境内的数据泄露防护事件
接收欧盟数据的前 10 大外部网域
恶意软件文件摘要
欧盟境内数据泄露防护事件随时间的变化
欧盟数据访问事件随时间的变化
触发次数最多的 10 项政策
未经授权访问欧盟资源
从非欧盟国家/地区访问欧盟资源
访问欧盟数据的前 10 个非欧盟国家/地区
欧盟资源的特权访问权限随时间的变化
威胁检测随时间的变化趋势
敏感数据访问事件
图表名称
查询示例
访问欧盟资源的特权账号
strings.coalesce(target.location.country_or_region, target.ip_geo_artifact.location.country_or_region, target.location.name) = /Austria|Belgium|Bulgaria|Croatia|Cyprus|Czechia|Denmark|Estonia|Finland|France|Germany|Greece|Hungary|Ireland|Italy|Latvia|Lithuania|Luxembourg|Malta|Netherlands|Poland|Portugal|Romania|Slovakia|Slovenia|Spain|Sweden|eu-(west-1|west-3|central-1|north-1|south-1|south-2)|europe-(west1|west3|west4|west8|west9|west10|west12|central2|north1|north2|southwest1)|austriaeast|denmarkeast|francecentral|germanywestcentral|greececentral|italynorth|northeurope|spaincentral|swedencentral|westeurope|polandcentral/ nocase
(metadata.event_type = "RESOURCE_READ" OR metadata.event_type = "RESOURCE_WRITTEN" OR metadata.event_type = "RESOURCE_CREATION" OR metadata.event_type = "RESOURCE_DELETION" OR metadata.event_type = "RESOURCE_PERMISSIONS_CHANGE" OR metadata.event_type = "FILE_UNCATEGORIZED" OR metadata.event_type = "FILE_CREATION" OR metadata.event_type = "FILE_DELETION" OR metadata.event_type = "FILE_MODIFICATION" OR metadata.event_type = "FILE_READ" OR metadata.event_type = "FILE_COPY" OR metadata.event_type = "FILE_OPEN" OR metadata.event_type = "FILE_MOVE" OR metadata.event_type = "FILE_SYNC" OR metadata.event_type = "EVENTTYPE_UNSPECIFIED" OR metadata.event_type = "SETTING_UNCATEGORIZED" OR metadata.event_type = "USER_UNCATEGORIZED" OR metadata.event_type = "SYSTEM_AUDIT_LOG_UNCATEGORIZED" OR metadata.event_type = "SYSTEM_AUDIT_LOG_WIPE" OR metadata.event_type = "USER_RESOURCE_CREATION" OR metadata.event_type = "USER_RESOURCE_UPDATE_CONTENT" OR metadata.event_type = "USER_RESOURCE_UPDATE_PERMISSIONS" OR metadata.event_type = "USER_RESOURCE_ACCESS" OR metadata.event_type = "USER_RESOURCE_DELETION" OR metadata.log_type = "GENERIC_EVENT" OR metadata.event_type ="USER_LOGIN" or metadata.log_type = "USER_CHANGE_PERMISSIONS")
$User = strings.coalesce(principal.user.userid, principal.user.user_display_name, principal.user.email_addresses, target.user.userid,target.user.user_display_name,target.user.email_addresses)
($User = /admin|root|svc|adm|privilege/ nocase or principal.user.attribute.roles.type = "SERVICE_ACCOUNT" or principal.user.attribute.roles.type = "ADMINISTRATOR" or principal.user.account_type = "DOMAIN_ACCOUNT_TYPE" or principal.user.account_type = "SERVICE_ACCOUNT_TYPE")
$Target_EU_Country = strings.coalesce(target.location.country_or_region, target.ip_geo_artifact.location.country_or_region, target.location.name)
$Event_Type = metadata.event_type
$Source_IP = strings.coalesce(principal.ip,principal.asset.ip)
$Target_Resource = strings.coalesce(target.resource.name, target.file.full_path, target.resource.product_object_id, target.group.product_object_id, target.user.group_identifiers)
$Target_Resourcetype = target.resource.resource_type
$Action = security_result.action
match:
$Event_Type, $User,$Source_IP, $Target_EU_Country, $Target_Resource, $Target_Resourcetype, $Action
outcome:
$Count = count(metadata.id)
$Date = timestamp.get_timestamp(max(metadata.event_timestamp.seconds))
order:
$Count desc
弱 TLS 版本分布
strings.coalesce(target.location.country_or_region, target.ip_geo_artifact.location.country_or_region, target.location.name) = /Austria|Belgium|Bulgaria|Croatia|Cyprus|Czechia|Denmark|Estonia|Finland|France|Germany|Greece|Hungary|Ireland|Italy|Latvia|Lithuania|Luxembourg|Malta|Netherlands|Poland|Portugal|Romania|Slovakia|Slovenia|Spain|Sweden|eu-(west-1|west-3|central-1|north-1|south-1|south-2)|europe-(west1|west3|west4|west8|west9|west10|west12|central2|north1|north2|southwest1)|austriaeast|denmarkeast|francecentral|germanywestcentral|greececentral|italynorth|northeurope|spaincentral|swedencentral|westeurope|polandcentral/ nocase
(metadata.event_type = "RESOURCE_READ" OR metadata.event_type = "RESOURCE_WRITTEN" OR metadata.event_type = "RESOURCE_CREATION" OR metadata.event_type = "RESOURCE_DELETION" OR metadata.event_type = "RESOURCE_PERMISSIONS_CHANGE" OR metadata.event_type = "FILE_UNCATEGORIZED" OR metadata.event_type = "FILE_CREATION" OR metadata.event_type = "FILE_DELETION" OR metadata.event_type = "FILE_MODIFICATION" OR metadata.event_type = "FILE_READ" OR metadata.event_type = "FILE_COPY" OR metadata.event_type = "FILE_OPEN" OR metadata.event_type = "FILE_MOVE" OR metadata.event_type = "FILE_SYNC" OR metadata.event_type = "EVENTTYPE_UNSPECIFIED" OR metadata.event_type = "SETTING_UNCATEGORIZED" OR metadata.event_type = "USER_UNCATEGORIZED" OR metadata.event_type = "SYSTEM_AUDIT_LOG_UNCATEGORIZED" OR metadata.event_type = "SYSTEM_AUDIT_LOG_WIPE" OR metadata.event_type = "USER_RESOURCE_CREATION" OR metadata.event_type = "USER_RESOURCE_UPDATE_CONTENT" OR metadata.event_type = "USER_RESOURCE_UPDATE_PERMISSIONS" OR metadata.event_type = "USER_RESOURCE_ACCESS" OR metadata.event_type = "USER_RESOURCE_DELETION" OR metadata.event_type = "GENERIC_EVENT")
network.tls.version != /1(\.|_)?(2|3)/ nocase
$TLS_Version = network.tls.version
$TLS_Version != ""
match:
$TLS_Version
outcome:
$Count = count(metadata.id)
访问欧盟资源的前 10 个非欧盟 IP 地址
(strings.coalesce(target.location.country_or_region, target.ip_geo_artifact.location.country_or_region, target.location.name) = /Austria|Belgium|Bulgaria|Croatia|Cyprus|Czechia|Denmark|Estonia|Finland|France|Germany|Greece|Hungary|Ireland|Italy|Latvia|Lithuania|Luxembourg|Malta|Netherlands|Poland|Portugal|Romania|Slovakia|Slovenia|Spain|Sweden|eu-(west-1|west-3|central-1|north-1|south-1|south-2)|europe-(west1|west3|west4|west8|west9|west10|west12|central2|north1|north2|southwest1)|austriaeast|denmarkeast|francecentral|germanywestcentral|greececentral|italynorth|northeurope|spaincentral|swedencentral|westeurope|polandcentral/ nocase
and strings.coalesce(principal.location.country_or_region, principal.ip_geo_artifact.location.country_or_region, principal.location.name) != /Austria|Belgium|Bulgaria|Croatia|Cyprus|Czechia|Denmark|Estonia|Finland|France|Germany|Greece|Hungary|Ireland|Italy|Latvia|Lithuania|Luxembourg|Malta|Netherlands|Poland|Portugal|Romania|Slovakia|Slovenia|Spain|Sweden|eu-(west-1|west-3|central-1|north-1|south-1|south-2)|europe-(west1|west3|west4|west8|west9|west10|west12|central2|north1|north2|southwest1)|austriaeast|denmarkeast|francecentral|germanywestcentral|greececentral|italynorth|northeurope|spaincentral|swedencentral|westeurope|polandcentral/ nocase)
(metadata.event_type = "RESOURCE_READ" OR metadata.event_type = "RESOURCE_WRITTEN" OR metadata.event_type = "RESOURCE_CREATION" OR metadata.event_type = "RESOURCE_DELETION" OR metadata.event_type = "RESOURCE_PERMISSIONS_CHANGE" OR metadata.event_type = "FILE_UNCATEGORIZED" OR metadata.event_type = "FILE_CREATION" OR metadata.event_type = "FILE_DELETION" OR metadata.event_type = "FILE_MODIFICATION" OR metadata.event_type = "FILE_READ" OR metadata.event_type = "FILE_COPY" OR metadata.event_type = "FILE_OPEN" OR metadata.event_type = "FILE_MOVE" OR metadata.event_type = "FILE_SYNC" OR metadata.event_type = "EVENTTYPE_UNSPECIFIED" OR metadata.event_type = "SETTING_UNCATEGORIZED" OR metadata.event_type = "USER_UNCATEGORIZED" OR metadata.event_type = "SYSTEM_AUDIT_LOG_UNCATEGORIZED" OR metadata.event_type = "SYSTEM_AUDIT_LOG_WIPE" OR metadata.event_type = "USER_RESOURCE_CREATION" OR metadata.event_type = "USER_RESOURCE_UPDATE_CONTENT" OR metadata.event_type = "USER_RESOURCE_UPDATE_PERMISSIONS" OR metadata.event_type = "USER_RESOURCE_ACCESS" OR metadata.event_type = "USER_RESOURCE_DELETION" OR metadata.log_type = "GENERIC_EVENT" OR metadata.event_type ="USER_LOGIN" or metadata.log_type = "USER_CHANGE_PERMISSIONS")
$Principal_IP = strings.coalesce(principal.ip, principal.asset.ip)
$Principal_IP != ""
$Principal_Country = strings.coalesce(principal.location.country_or_region, principal.ip_geo_artifact.location.country_or_region, principal.location.name)
match:
$Principal_IP, $Principal_Country
outcome:
$Count = count(metadata.id)
order :
$Count desc
limit:
10
访问欧盟资源的前 10 名用户
strings.coalesce(target.location.country_or_region, target.ip_geo_artifact.location.country_or_region, target.location.name) = /Austria|Belgium|Bulgaria|Croatia|Cyprus|Czechia|Denmark|Estonia|Finland|France|Germany|Greece|Hungary|Ireland|Italy|Latvia|Lithuania|Luxembourg|Malta|Netherlands|Poland|Portugal|Romania|Slovakia|Slovenia|Spain|Sweden|eu-(west-1|west-3|central-1|north-1|south-1|south-2)|europe-(west1|west3|west4|west8|west9|west10|west12|central2|north1|north2|southwest1)|austriaeast|denmarkeast|francecentral|germanywestcentral|greececentral|italynorth|northeurope|spaincentral|swedencentral|westeurope|polandcentral/ nocase
(metadata.event_type = "RESOURCE_READ" OR metadata.event_type = "RESOURCE_WRITTEN" OR metadata.event_type = "RESOURCE_CREATION" OR metadata.event_type = "RESOURCE_DELETION" OR metadata.event_type = "RESOURCE_PERMISSIONS_CHANGE" OR metadata.event_type = "FILE_UNCATEGORIZED" OR metadata.event_type = "FILE_CREATION" OR metadata.event_type = "FILE_DELETION" OR metadata.event_type = "FILE_MODIFICATION" OR metadata.event_type = "FILE_READ" OR metadata.event_type = "FILE_COPY" OR metadata.event_type = "FILE_OPEN" OR metadata.event_type = "FILE_MOVE" OR metadata.event_type = "FILE_SYNC" OR metadata.event_type = "EVENTTYPE_UNSPECIFIED" OR metadata.event_type = "SETTING_UNCATEGORIZED" OR metadata.event_type = "USER_UNCATEGORIZED" OR metadata.event_type = "SYSTEM_AUDIT_LOG_UNCATEGORIZED" OR metadata.event_type = "SYSTEM_AUDIT_LOG_WIPE" OR metadata.event_type = "USER_RESOURCE_CREATION" OR metadata.event_type = "USER_RESOURCE_UPDATE_CONTENT" OR metadata.event_type = "USER_RESOURCE_UPDATE_PERMISSIONS" OR metadata.event_type = "USER_RESOURCE_ACCESS" OR metadata.event_type = "USER_RESOURCE_DELETION" OR metadata.event_type = "GENERIC_EVENT")
$User = strings.coalesce(principal.user.user_display_name, principal.user.userid, principal.user.email_addresses,target.user.userid,target.user.user_display_name,target.user.email_addresses)
$Source_Country = strings.coalesce(principal.location.country_or_region, principal.ip_geo_artifact.location.country_or_region, principal.location.name)
$User != ""
match:
$User, $Source_Country
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
按来源地理位置划分的欧盟数据访问权限
strings.coalesce(target.location.country_or_region, target.ip_geo_artifact.location.country_or_region, target.location.name) = /Austria|Belgium|Bulgaria|Croatia|Cyprus|Czechia|Denmark|Estonia|Finland|France|Germany|Greece|Hungary|Ireland|Italy|Latvia|Lithuania|Luxembourg|Malta|Netherlands|Poland|Portugal|Romania|Slovakia|Slovenia|Spain|Sweden|eu-(west-1|west-3|central-1|north-1|south-1|south-2)|europe-(west1|west3|west4|west8|west9|west10|west12|central2|north1|north2|southwest1)|austriaeast|denmarkeast|francecentral|germanywestcentral|greececentral|italynorth|northeurope|spaincentral|swedencentral|westeurope|polandcentral/ nocase
principal.ip_geo_artifact.location.region_coordinates.latitude != 0
principal.ip_geo_artifact.location.region_coordinates.longitude != 0
$Source_Country = strings.coalesce(principal.location.country_or_region, principal.ip_geo_artifact.location.country_or_region, principal.location.name)
match:
$Source_Country
outcome:
$Count = count(metadata.id)
$Latitude = max(principal.ip_geo_artifact.location.region_coordinates.latitude)
$Longitude = max(principal.ip_geo_artifact.location.region_coordinates.longitude)
欧盟资源随时间推移的数据删除和清除事件
strings.coalesce(target.location.country_or_region, target.ip_geo_artifact.location.country_or_region, target.location.name) = /Austria|Belgium|Bulgaria|Croatia|Cyprus|Czechia|Denmark|Estonia|Finland|France|Germany|Greece|Hungary|Ireland|Italy|Latvia|Lithuania|Luxembourg|Malta|Netherlands|Poland|Portugal|Romania|Slovakia|Slovenia|Spain|Sweden|eu-(west-1|west-3|central-1|north-1|south-1|south-2)|europe-(west1|west3|west4|west8|west9|west10|west12|central2|north1|north2|southwest1)|austriaeast|denmarkeast|francecentral|germanywestcentral|greececentral|italynorth|northeurope|spaincentral|swedencentral|westeurope|polandcentral/ nocase
(metadata.event_type = "FILE_DELETION" or metadata.event_type = "RESOURCE_DELETION" OR metadata.event_type = "SYSTEM_AUDIT_LOG_WIPE" or metadata.event_type = "USER_RESOURCE_DELETION"
or metadata.product_event_type = /delete|purge/ nocase or security_result.summary = /delete|purge/ nocase or security_result.description = /delete|purge/ nocase)
security_result.action = "ALLOW"
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
$Log_Type = metadata.log_type
match:
$Date, $Log_Type
outcome:
$Count = count(metadata.id)
order:
$Date asc
欧盟资源上弱加密的演变
strings.coalesce(target.location.country_or_region, target.ip_geo_artifact.location.country_or_region, target.location.name) = /Austria|Belgium|Bulgaria|Croatia|Cyprus|Czechia|Denmark|Estonia|Finland|France|Germany|Greece|Hungary|Ireland|Italy|Latvia|Lithuania|Luxembourg|Malta|Netherlands|Poland|Portugal|Romania|Slovakia|Slovenia|Spain|Sweden|eu-(west-1|west-3|central-1|north-1|south-1|south-2)|europe-(west1|west3|west4|west8|west9|west10|west12|central2|north1|north2|southwest1)|austriaeast|denmarkeast|francecentral|germanywestcentral|greececentral|italynorth|northeurope|spaincentral|swedencentral|westeurope|polandcentral/ nocase
(((target.resource.attribute.labels.key = "keyProperties_type" or target.resource.attribute.labels.key = "requestParameters.keySpec" or target.resource.attribute.labels.key = /key/ nocase) and target.resource.attribute.labels.value = /^(RSA-)|DES|RC4|MD5|SHA1|SHA-1/) or network.tls.cipher = /^(RSA-)|DES|RC4|MD5|SHA1|SHA-1/)
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
$Log_Type = metadata.log_type
match:
$Log_Type, $Date
outcome:
$Count = count(metadata.id)
order:
$Date asc
欧盟资源上的数据删除和清除事件
strings.coalesce(target.location.country_or_region, target.ip_geo_artifact.location.country_or_region, target.location.name) = /Austria|Belgium|Bulgaria|Croatia|Cyprus|Czechia|Denmark|Estonia|Finland|France|Germany|Greece|Hungary|Ireland|Italy|Latvia|Lithuania|Luxembourg|Malta|Netherlands|Poland|Portugal|Romania|Slovakia|Slovenia|Spain|Sweden|eu-(west-1|west-3|central-1|north-1|south-1|south-2)|europe-(west1|west3|west4|west8|west9|west10|west12|central2|north1|north2|southwest1)|austriaeast|denmarkeast|francecentral|germanywestcentral|greececentral|italynorth|northeurope|spaincentral|swedencentral|westeurope|polandcentral/ nocase
(metadata.event_type = "FILE_DELETION" or metadata.event_type = "RESOURCE_DELETION" OR metadata.event_type = "SYSTEM_AUDIT_LOG_WIPE" or metadata.event_type = "USER_RESOURCE_DELETION"
or metadata.product_event_type = /delete|purge/ nocase or security_result.summary = /delete|purge/ nocase or security_result.description = /delete|purge/ nocase)
security_result.action = "ALLOW"
$Description = strings.coalesce(security_result.summary, security_result.description, metadata.description, security_result.action_details)
$Product_Event_Type = metadata.product_event_type
$Event_Type = metadata.event_type
$Log_Type = metadata.log_type
$Target_Resource = strings.coalesce(target.resource.name, target.file.full_path, target.resource.product_object_id, target.group.product_object_id, target.user.group_identifiers)
$User = strings.coalesce(principal.user.user_display_name, principal.user.userid, principal.user.email_addresses, target.user.userid,target.user.user_display_name,target.user.email_addresses)
match:
$User, $Log_Type, $Target_Resource, $Description, $Product_Event_Type, $Event_Type
outcome:
$Date = timestamp.get_timestamp(max(metadata.event_timestamp.seconds))
$Count = count(metadata.id)
order:
$Date desc, $Count desc
访问欧盟资源的前 10 个特权账号
strings.coalesce(target.location.country_or_region, target.ip_geo_artifact.location.country_or_region, target.location.name) = /Austria|Belgium|Bulgaria|Croatia|Cyprus|Czechia|Denmark|Estonia|Finland|France|Germany|Greece|Hungary|Ireland|Italy|Latvia|Lithuania|Luxembourg|Malta|Netherlands|Poland|Portugal|Romania|Slovakia|Slovenia|Spain|Sweden|eu-(west-1|west-3|central-1|north-1|south-1|south-2)|europe-(west1|west3|west4|west8|west9|west10|west12|central2|north1|north2|southwest1)|austriaeast|denmarkeast|francecentral|germanywestcentral|greececentral|italynorth|northeurope|spaincentral|swedencentral|westeurope|polandcentral/ nocase
(metadata.event_type = "RESOURCE_READ" OR metadata.event_type = "RESOURCE_WRITTEN" OR metadata.event_type = "RESOURCE_CREATION" OR metadata.event_type = "RESOURCE_DELETION" OR metadata.event_type = "RESOURCE_PERMISSIONS_CHANGE" OR metadata.event_type = "FILE_UNCATEGORIZED" OR metadata.event_type = "FILE_CREATION" OR metadata.event_type = "FILE_DELETION" OR metadata.event_type = "FILE_MODIFICATION" OR metadata.event_type = "FILE_READ" OR metadata.event_type = "FILE_COPY" OR metadata.event_type = "FILE_OPEN" OR metadata.event_type = "FILE_MOVE" OR metadata.event_type = "FILE_SYNC" OR metadata.event_type = "EVENTTYPE_UNSPECIFIED" OR metadata.event_type = "SETTING_UNCATEGORIZED" OR metadata.event_type = "USER_UNCATEGORIZED" OR metadata.event_type = "SYSTEM_AUDIT_LOG_UNCATEGORIZED" OR metadata.event_type = "SYSTEM_AUDIT_LOG_WIPE" OR metadata.event_type = "USER_RESOURCE_CREATION" OR metadata.event_type = "USER_RESOURCE_UPDATE_CONTENT" OR metadata.event_type = "USER_RESOURCE_UPDATE_PERMISSIONS" OR metadata.event_type = "USER_RESOURCE_ACCESS" OR metadata.event_type = "USER_RESOURCE_DELETION" OR metadata.event_type = "GENERIC_EVENT" OR metadata.event_type ="USER_LOGIN" or metadata.event_type = "USER_CHANGE_PERMISSIONS")
$User = strings.coalesce(principal.user.userid, principal.user.user_display_name, principal.user.email_addresses, target.user.userid,target.user.user_display_name,target.user.email_addresses)
($User = /admin|root|svc|adm|privilege/ nocase or principal.user.attribute.roles.type = "SERVICE_ACCOUNT" or principal.user.attribute.roles.type = "ADMINISTRATOR" or principal.user.account_type = "DOMAIN_ACCOUNT_TYPE" or principal.user.account_type = "SERVICE_ACCOUNT_TYPE")
$Target_EU_Country = strings.coalesce(target.location.country_or_region, target.ip_geo_artifact.location.country_or_region, target.location.name)
match:
$User, $Target_EU_Country
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
欧盟境内的数据泄露防护事件
strings.coalesce(target.location.country_or_region, target.ip_geo_artifact.location.country_or_region, target.location.name) = /Austria|Belgium|Bulgaria|Croatia|Cyprus|Czechia|Denmark|Estonia|Finland|France|Germany|Greece|Hungary|Ireland|Italy|Latvia|Lithuania|Luxembourg|Malta|Netherlands|Poland|Portugal|Romania|Slovakia|Slovenia|Spain|Sweden|eu-(west-1|west-3|central-1|north-1|south-1|south-2)|europe-(west1|west3|west4|west8|west9|west10|west12|central2|north1|north2|southwest1)|austriaeast|denmarkeast|francecentral|germanywestcentral|greececentral|italynorth|northeurope|spaincentral|swedencentral|westeurope|polandcentral/ nocase
(metadata.event_type = "RESOURCE_READ" OR metadata.event_type = "RESOURCE_WRITTEN" OR metadata.event_type = "RESOURCE_CREATION" OR metadata.event_type = "RESOURCE_DELETION" OR metadata.event_type = "RESOURCE_PERMISSIONS_CHANGE" OR metadata.event_type = "FILE_UNCATEGORIZED" OR metadata.event_type = "FILE_CREATION" OR metadata.event_type = "FILE_DELETION" OR metadata.event_type = "FILE_MODIFICATION" OR metadata.event_type = "FILE_READ" OR metadata.event_type = "FILE_COPY" OR metadata.event_type = "FILE_OPEN" OR metadata.event_type = "FILE_MOVE" OR metadata.event_type = "FILE_SYNC" OR metadata.event_type = "EVENTTYPE_UNSPECIFIED" OR metadata.event_type = "SETTING_UNCATEGORIZED" OR metadata.event_type = "USER_UNCATEGORIZED" OR metadata.event_type = "SYSTEM_AUDIT_LOG_UNCATEGORIZED" OR metadata.event_type = "SYSTEM_AUDIT_LOG_WIPE" OR metadata.event_type = "USER_RESOURCE_CREATION" OR metadata.event_type = "USER_RESOURCE_UPDATE_CONTENT" OR metadata.event_type = "USER_RESOURCE_UPDATE_PERMISSIONS" OR metadata.event_type = "USER_RESOURCE_ACCESS" OR metadata.event_type = "USER_RESOURCE_DELETION" OR metadata.event_type = "GENERIC_EVENT" OR metadata.event_type = "NETWORK_UNCATEGORIZED" OR metadata.event_type = "NETWORK_FLOW" OR metadata.event_type = "NETWORK_CONNECTION" OR metadata.event_type = "NETWORK_FTP" OR metadata.event_type = "NETWORK_DHCP" OR metadata.event_type = "NETWORK_DNS" OR metadata.event_type = "NETWORK_HTTP" OR metadata.event_type = "NETWORK_SMTP")
(metadata.log_type = /DLP|ACCELLION|CODE42_INCYDR|GUARDIUM|TRIPWIRE_FIM/ nocase OR metadata.product_event_type = /dlp/ nocase OR security_result.outcomes.value = /dlp/ nocase OR security_result.rule_type = /dlp/ nocase OR security_result.rule_name = /dlp/ nocase OR security_result.category_details = /dlp|data loss prevention/ nocase OR security_result.category = "DATA_EXFILTRATION" or security_result.category = "DATA_DESTRUCTION")
outcome:
$Count = count(metadata.id)
接收欧盟数据的前 10 大外部网域
strings.coalesce(principal.location.country_or_region, principal.ip_geo_artifact.location.country_or_region, principal.location.name) = /Austria|Belgium|Bulgaria|Croatia|Cyprus|Czechia|Denmark|Estonia|Finland|France|Germany|Greece|Hungary|Ireland|Italy|Latvia|Lithuania|Luxembourg|Malta|Netherlands|Poland|Portugal|Romania|Slovakia|Slovenia|Spain|Sweden|eu-(west-1|west-3|central-1|north-1|south-1|south-2)|europe-(west1|west3|west4|west8|west9|west10|west12|central2|north1|north2|southwest1)|austriaeast|denmarkeast|francecentral|germanywestcentral|greececentral|italynorth|northeurope|spaincentral|swedencentral|westeurope|polandcentral/ nocase
(metadata.event_type = "RESOURCE_READ" OR metadata.event_type = "RESOURCE_WRITTEN" OR metadata.event_type = "RESOURCE_CREATION" OR metadata.event_type = "RESOURCE_DELETION" OR metadata.event_type = "RESOURCE_PERMISSIONS_CHANGE" OR metadata.event_type = "FILE_UNCATEGORIZED" OR metadata.event_type = "FILE_CREATION" OR metadata.event_type = "FILE_DELETION" OR metadata.event_type = "FILE_MODIFICATION" OR metadata.event_type = "FILE_READ" OR metadata.event_type = "FILE_COPY" OR metadata.event_type = "FILE_OPEN" OR metadata.event_type = "FILE_MOVE" OR metadata.event_type = "FILE_SYNC" OR metadata.event_type = "EVENTTYPE_UNSPECIFIED" OR metadata.event_type = "SETTING_UNCATEGORIZED" OR metadata.event_type = "USER_UNCATEGORIZED" OR metadata.event_type = "SYSTEM_AUDIT_LOG_UNCATEGORIZED" OR metadata.event_type = "SYSTEM_AUDIT_LOG_WIPE" OR metadata.event_type = "USER_RESOURCE_CREATION" OR metadata.event_type = "USER_RESOURCE_UPDATE_CONTENT" OR metadata.event_type = "USER_RESOURCE_UPDATE_PERMISSIONS" OR metadata.event_type = "USER_RESOURCE_ACCESS" OR metadata.event_type = "USER_RESOURCE_DELETION" OR metadata.event_type = "GENERIC_EVENT" OR metadata.event_type = "NETWORK_UNCATEGORIZED" OR metadata.event_type = "NETWORK_FLOW" OR metadata.event_type = "NETWORK_CONNECTION" OR metadata.event_type = "NETWORK_FTP" OR metadata.event_type = "NETWORK_DHCP" OR metadata.event_type = "NETWORK_DNS" OR metadata.event_type = "NETWORK_HTTP"
OR metadata.event_type = "NETWORK_SMTP")
network.direction = "OUTBOUND"
network.sent_bytes > 0
$Target_Domain = re.capture(strings.coalesce(target.url, target.administrative_domain), `^(?:https?:\/\/)?(?:www\.)?([^\/:]+)`)
$Target_Domain != ""
$Target_EU_Country = strings.coalesce(target.location.country_or_region, target.ip_geo_artifact.location.country_or_region, target.location.name)
match:
$Target_Domain, $Target_EU_Country
outcome:
$Size_in_MB = math.round((sum(network.sent_bytes)/1000000), 2)
order :
$Size_in_MB desc
limit:
10
恶意软件文件摘要
strings.coalesce(target.location.country_or_region, target.ip_geo_artifact.location.country_or_region, target.location.name) = /Austria|Belgium|Bulgaria|Croatia|Cyprus|Czechia|Denmark|Estonia|Finland|France|Germany|Greece|Hungary|Ireland|Italy|Latvia|Lithuania|Luxembourg|Malta|Netherlands|Poland|Portugal|Romania|Slovakia|Slovenia|Spain|Sweden|eu-(west-1|west-3|central-1|north-1|south-1|south-2)|europe-(west1|west3|west4|west8|west9|west10|west12|central2|north1|north2|southwest1)|austriaeast|denmarkeast|francecentral|germanywestcentral|greececentral|italynorth|northeurope|spaincentral|swedencentral|westeurope|polandcentral/ nocase
(metadata.event_type = "RESOURCE_READ" OR metadata.event_type = "RESOURCE_WRITTEN" OR metadata.event_type = "RESOURCE_CREATION" OR metadata.event_type = "RESOURCE_DELETION" OR metadata.event_type = "RESOURCE_PERMISSIONS_CHANGE" OR metadata.event_type = "FILE_UNCATEGORIZED" OR metadata.event_type = "FILE_CREATION" OR metadata.event_type = "FILE_DELETION" OR metadata.event_type = "FILE_MODIFICATION" OR metadata.event_type = "FILE_READ" OR metadata.event_type = "FILE_COPY" OR metadata.event_type = "FILE_OPEN" OR metadata.event_type = "FILE_MOVE" OR metadata.event_type = "FILE_SYNC" OR metadata.event_type = "EVENTTYPE_UNSPECIFIED" OR metadata.event_type = "SETTING_UNCATEGORIZED" OR metadata.event_type = "USER_UNCATEGORIZED" OR metadata.event_type = "SYSTEM_AUDIT_LOG_UNCATEGORIZED" OR metadata.event_type = "SYSTEM_AUDIT_LOG_WIPE" OR metadata.event_type = "USER_RESOURCE_CREATION" OR metadata.event_type = "USER_RESOURCE_UPDATE_CONTENT" OR metadata.event_type = "USER_RESOURCE_UPDATE_PERMISSIONS" OR metadata.event_type = "USER_RESOURCE_ACCESS" OR metadata.event_type = "USER_RESOURCE_DELETION" OR metadata.event_type = "GENERIC_EVENT")
(metadata.product_event_type = /malware/ nocase or security_result.summary = /malware/ nocase or security_result.category_details = /malware/ nocase or metadata.description = /malware/ nocase or security_result.threat_name = /malware/ nocase or security_result.rule_name = /malware/ nocase or security_result.category = "SOFTWARE_MALICIOUS")
$Source_User = strings.coalesce(principal.user.user_display_name, principal.user.userid, principal.user.email_addresses)
$File_Name = strings.coalesce(target.file.full_path, about.file.full_path)
$File_Name != ""
$File_Type = target.file.file_type
$Severity = security_result.severity
$Action = security_result.action
$Hostname = strings.coalesce(principal.hostname, principal.asset.hostname)
$Threat_Name = security_result.threat_name
match :
$Hostname,$File_Name, $File_Type, $Threat_Name, $Source_User, $Severity, $Action
outcome:
$Count = count(metadata.id)
$Date = timestamp.get_timestamp(max(metadata.event_timestamp.seconds), "%F %T")
order:
$Count desc
欧盟境内数据泄露防护事件随时间的变化
strings.coalesce(target.location.country_or_region, target.ip_geo_artifact.location.country_or_region, target.location.name) = /Austria|Belgium|Bulgaria|Croatia|Cyprus|Czechia|Denmark|Estonia|Finland|France|Germany|Greece|Hungary|Ireland|Italy|Latvia|Lithuania|Luxembourg|Malta|Netherlands|Poland|Portugal|Romania|Slovakia|Slovenia|Spain|Sweden|eu-(west-1|west-3|central-1|north-1|south-1|south-2)|europe-(west1|west3|west4|west8|west9|west10|west12|central2|north1|north2|southwest1)|austriaeast|denmarkeast|francecentral|germanywestcentral|greececentral|italynorth|northeurope|spaincentral|swedencentral|westeurope|polandcentral/ nocase
(metadata.event_type = "RESOURCE_READ" OR metadata.event_type = "RESOURCE_WRITTEN" OR metadata.event_type = "RESOURCE_CREATION" OR metadata.event_type = "RESOURCE_DELETION" OR metadata.event_type = "RESOURCE_PERMISSIONS_CHANGE" OR metadata.event_type = "FILE_UNCATEGORIZED" OR metadata.event_type = "FILE_CREATION" OR metadata.event_type = "FILE_DELETION" OR metadata.event_type = "FILE_MODIFICATION" OR metadata.event_type = "FILE_READ" OR metadata.event_type = "FILE_COPY" OR metadata.event_type = "FILE_OPEN" OR metadata.event_type = "FILE_MOVE" OR metadata.event_type = "FILE_SYNC" OR metadata.event_type = "EVENTTYPE_UNSPECIFIED" OR metadata.event_type = "SETTING_UNCATEGORIZED" OR metadata.event_type = "USER_UNCATEGORIZED" OR metadata.event_type = "SYSTEM_AUDIT_LOG_UNCATEGORIZED" OR metadata.event_type = "SYSTEM_AUDIT_LOG_WIPE" OR metadata.event_type = "USER_RESOURCE_CREATION" OR metadata.event_type = "USER_RESOURCE_UPDATE_CONTENT" OR metadata.event_type = "USER_RESOURCE_UPDATE_PERMISSIONS" OR metadata.event_type = "USER_RESOURCE_ACCESS" OR metadata.event_type = "USER_RESOURCE_DELETION" OR metadata.event_type = "GENERIC_EVENT" OR metadata.event_type = "NETWORK_UNCATEGORIZED" OR metadata.event_type = "NETWORK_FLOW" OR metadata.event_type = "NETWORK_CONNECTION" OR metadata.event_type = "NETWORK_FTP" OR metadata.event_type = "NETWORK_DHCP" OR metadata.event_type = "NETWORK_DNS" OR metadata.event_type = "NETWORK_HTTP" OR metadata.event_type = "NETWORK_SMTP")
(metadata.log_type = /DLP|ACCELLION|CODE42_INCYDR|GUARDIUM|TRIPWIRE_FIM/ nocase OR metadata.product_event_type = /dlp/ nocase OR security_result.outcomes.value = /dlp/ nocase OR security_result.rule_type = /dlp/ nocase OR security_result.rule_name = /dlp/ nocase OR security_result.category_details = /dlp|data loss prevention/ nocase OR security_result.category = "DATA_EXFILTRATION" or security_result.category = "DATA_DESTRUCTION")
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
$Log_Type = metadata.log_type
match:
$Date, $Log_Type
outcome:
$Count = count(metadata.id)
order:
$Date asc
欧盟数据访问事件随时间的变化
strings.coalesce(target.location.country_or_region, target.ip_geo_artifact.location.country_or_region, target.location.name) = /Austria|Belgium|Bulgaria|Croatia|Cyprus|Czechia|Denmark|Estonia|Finland|France|Germany|Greece|Hungary|Ireland|Italy|Latvia|Lithuania|Luxembourg|Malta|Netherlands|Poland|Portugal|Romania|Slovakia|Slovenia|Spain|Sweden|eu-(west-1|west-3|central-1|north-1|south-1|south-2)|europe-(west1|west3|west4|west8|west9|west10|west12|central2|north1|north2|southwest1)|austriaeast|denmarkeast|francecentral|germanywestcentral|greececentral|italynorth|northeurope|spaincentral|swedencentral|westeurope|polandcentral/ nocase
(metadata.event_type = "RESOURCE_READ" OR metadata.event_type = "RESOURCE_WRITTEN" OR metadata.event_type = "RESOURCE_CREATION" OR metadata.event_type = "RESOURCE_DELETION" OR metadata.event_type = "RESOURCE_PERMISSIONS_CHANGE" OR metadata.event_type = "FILE_UNCATEGORIZED" OR metadata.event_type = "FILE_CREATION" OR metadata.event_type = "FILE_DELETION" OR metadata.event_type = "FILE_MODIFICATION" OR metadata.event_type = "FILE_READ" OR metadata.event_type = "FILE_COPY" OR metadata.event_type = "FILE_OPEN" OR metadata.event_type = "FILE_MOVE" OR metadata.event_type = "FILE_SYNC" OR metadata.event_type = "EVENTTYPE_UNSPECIFIED" OR metadata.event_type = "SETTING_UNCATEGORIZED" OR metadata.event_type = "USER_UNCATEGORIZED" OR metadata.event_type = "SYSTEM_AUDIT_LOG_UNCATEGORIZED" OR metadata.event_type = "SYSTEM_AUDIT_LOG_WIPE" OR metadata.event_type = "USER_RESOURCE_CREATION" OR metadata.event_type = "USER_RESOURCE_UPDATE_CONTENT" OR metadata.event_type = "USER_RESOURCE_UPDATE_PERMISSIONS" OR metadata.event_type = "USER_RESOURCE_ACCESS" OR metadata.event_type = "USER_RESOURCE_DELETION" OR metadata.event_type = "GENERIC_EVENT")
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
$Action = security_result.action
match:
$Date, $Action
outcome:
$Count = count(metadata.id)
order:
$Date asc
触发次数最多的 10 项政策
strings.coalesce(target.location.country_or_region, target.ip_geo_artifact.location.country_or_region, target.location.name) = /Austria|Belgium|Bulgaria|Croatia|Cyprus|Czechia|Denmark|Estonia|Finland|France|Germany|Greece|Hungary|Ireland|Italy|Latvia|Lithuania|Luxembourg|Malta|Netherlands|Poland|Portugal|Romania|Slovakia|Slovenia|Spain|Sweden|eu-(west-1|west-3|central-1|north-1|south-1|south-2)|europe-(west1|west3|west4|west8|west9|west10|west12|central2|north1|north2|southwest1)|austriaeast|denmarkeast|francecentral|germanywestcentral|greececentral|italynorth|northeurope|spaincentral|swedencentral|westeurope|polandcentral/ nocase
(metadata.event_type = "RESOURCE_READ" OR metadata.event_type = "RESOURCE_WRITTEN" OR metadata.event_type = "RESOURCE_CREATION" OR metadata.event_type = "RESOURCE_DELETION" OR metadata.event_type = "RESOURCE_PERMISSIONS_CHANGE" OR metadata.event_type = "FILE_UNCATEGORIZED" OR metadata.event_type = "FILE_CREATION" OR metadata.event_type = "FILE_DELETION" OR metadata.event_type = "FILE_MODIFICATION" OR metadata.event_type = "FILE_READ" OR metadata.event_type = "FILE_COPY" OR metadata.event_type = "FILE_OPEN" OR metadata.event_type = "FILE_MOVE" OR metadata.event_type = "FILE_SYNC" OR metadata.event_type = "EVENTTYPE_UNSPECIFIED" OR metadata.event_type = "SETTING_UNCATEGORIZED" OR metadata.event_type = "USER_UNCATEGORIZED" OR metadata.event_type = "SYSTEM_AUDIT_LOG_UNCATEGORIZED" OR metadata.event_type = "SYSTEM_AUDIT_LOG_WIPE" OR metadata.event_type = "USER_RESOURCE_CREATION" OR metadata.event_type = "USER_RESOURCE_UPDATE_CONTENT" OR metadata.event_type = "USER_RESOURCE_UPDATE_PERMISSIONS" OR metadata.event_type = "USER_RESOURCE_ACCESS" OR metadata.event_type = "USER_RESOURCE_DELETION" OR metadata.event_type = "GENERIC_EVENT")
security_result.rule_name = /Policy/ nocase
$Policy = security_result.rule_name
$Policy != ""
$Target_EU_Country = strings.coalesce(target.location.country_or_region, target.ip_geo_artifact.location.country_or_region, target.location.name)
match:
$Policy, $Target_EU_Country
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
未经授权访问欧盟资源
strings.coalesce(target.location.country_or_region, target.ip_geo_artifact.location.country_or_region, target.location.name) = /Austria|Belgium|Bulgaria|Croatia|Cyprus|Czechia|Denmark|Estonia|Finland|France|Germany|Greece|Hungary|Ireland|Italy|Latvia|Lithuania|Luxembourg|Malta|Netherlands|Poland|Portugal|Romania|Slovakia|Slovenia|Spain|Sweden|eu-(west-1|west-3|central-1|north-1|south-1|south-2)|europe-(west1|west3|west4|west8|west9|west10|west12|central2|north1|north2|southwest1)|austriaeast|denmarkeast|francecentral|germanywestcentral|greececentral|italynorth|northeurope|spaincentral|swedencentral|westeurope|polandcentral/ nocase
(metadata.event_type = "RESOURCE_READ" OR metadata.event_type = "RESOURCE_WRITTEN" OR metadata.event_type = "RESOURCE_CREATION" OR metadata.event_type = "RESOURCE_DELETION" OR metadata.event_type = "RESOURCE_PERMISSIONS_CHANGE" OR metadata.event_type = "FILE_UNCATEGORIZED" OR metadata.event_type = "FILE_CREATION" OR metadata.event_type = "FILE_DELETION" OR metadata.event_type = "FILE_MODIFICATION" OR metadata.event_type = "FILE_READ" OR metadata.event_type = "FILE_COPY" OR metadata.event_type = "FILE_OPEN" OR metadata.event_type = "FILE_MOVE" OR metadata.event_type = "FILE_SYNC" OR metadata.event_type = "EVENTTYPE_UNSPECIFIED" OR metadata.event_type = "SETTING_UNCATEGORIZED" OR metadata.event_type = "USER_UNCATEGORIZED" OR metadata.event_type = "SYSTEM_AUDIT_LOG_UNCATEGORIZED" OR metadata.event_type = "SYSTEM_AUDIT_LOG_WIPE" OR metadata.event_type = "USER_RESOURCE_CREATION" OR metadata.event_type = "USER_RESOURCE_UPDATE_CONTENT" OR metadata.event_type = "USER_RESOURCE_UPDATE_PERMISSIONS" OR metadata.event_type = "USER_RESOURCE_ACCESS" OR metadata.event_type = "USER_RESOURCE_DELETION" OR metadata.event_type = "GENERIC_EVENT")
$User = strings.coalesce(principal.user.userid, principal.user.user_display_name, principal.user.email_addresses,target.user.userid, target.user.user_display_name, target.user.email_addresses)
$Source_IP = strings.coalesce(principal.ip, principal.asset.ip)
$Hostname = strings.coalesce(principal.hostname, principal.asset.hostname)
$Action = security_result.action
$Action != "ALLOW"
$Summary = strings.coalesce(security_result.summary, metadata.description, security_result.description)
$Severity = security_result.severity
match:
$Summary, $User, $Source_IP ,$Action , $Severity, $Hostname
outcome :
$Count = count(metadata.id)
$Date = timestamp.get_timestamp(max(metadata.event_timestamp.seconds))
order:
$Count desc
从非欧盟国家/地区访问欧盟资源
(strings.coalesce(target.location.country_or_region, target.ip_geo_artifact.location.country_or_region, target.location.name) = /Austria|Belgium|Bulgaria|Croatia|Cyprus|Czechia|Denmark|Estonia|Finland|France|Germany|Greece|Hungary|Ireland|Italy|Latvia|Lithuania|Luxembourg|Malta|Netherlands|Poland|Portugal|Romania|Slovakia|Slovenia|Spain|Sweden|eu-(west-1|west-3|central-1|north-1|south-1|south-2)|europe-(west1|west3|west4|west8|west9|west10|west12|central2|north1|north2|southwest1)|austriaeast|denmarkeast|francecentral|germanywestcentral|greececentral|italynorth|northeurope|spaincentral|swedencentral|westeurope|polandcentral/ nocase
and strings.coalesce(principal.location.country_or_region, principal.ip_geo_artifact.location.country_or_region, principal.location.name) != /Austria|Belgium|Bulgaria|Croatia|Cyprus|Czechia|Denmark|Estonia|Finland|France|Germany|Greece|Hungary|Ireland|Italy|Latvia|Lithuania|Luxembourg|Malta|Netherlands|Poland|Portugal|Romania|Slovakia|Slovenia|Spain|Sweden|eu-(west-1|west-3|central-1|north-1|south-1|south-2)|europe-(west1|west3|west4|west8|west9|west10|west12|central2|north1|north2|southwest1)|austriaeast|denmarkeast|francecentral|germanywestcentral|greececentral|italynorth|northeurope|spaincentral|swedencentral|westeurope|polandcentral/ nocase)
(metadata.event_type = "RESOURCE_READ" OR metadata.event_type = "RESOURCE_WRITTEN" OR metadata.event_type = "RESOURCE_CREATION" OR metadata.event_type = "RESOURCE_DELETION" OR metadata.event_type = "RESOURCE_PERMISSIONS_CHANGE" OR metadata.event_type = "FILE_UNCATEGORIZED" OR metadata.event_type = "FILE_CREATION" OR metadata.event_type = "FILE_DELETION" OR metadata.event_type = "FILE_MODIFICATION" OR metadata.event_type = "FILE_READ" OR metadata.event_type = "FILE_COPY" OR metadata.event_type = "FILE_OPEN" OR metadata.event_type = "FILE_MOVE" OR metadata.event_type = "FILE_SYNC" OR metadata.event_type = "EVENTTYPE_UNSPECIFIED" OR metadata.event_type = "SETTING_UNCATEGORIZED" OR metadata.event_type = "USER_UNCATEGORIZED" OR metadata.event_type = "SYSTEM_AUDIT_LOG_UNCATEGORIZED" OR metadata.event_type = "SYSTEM_AUDIT_LOG_WIPE" OR metadata.event_type = "USER_RESOURCE_CREATION" OR metadata.event_type = "USER_RESOURCE_UPDATE_CONTENT" OR metadata.event_type = "USER_RESOURCE_UPDATE_PERMISSIONS" OR metadata.event_type = "USER_RESOURCE_ACCESS" OR metadata.event_type = "USER_RESOURCE_DELETION" OR metadata.event_type = "GENERIC_EVENT")
$Source_Country = strings.coalesce(principal.location.country_or_region, principal.ip_geo_artifact.location.country_or_region, principal.location.name)
$Target_EU_Country = strings.coalesce(target.location.country_or_region, target.ip_geo_artifact.location.country_or_region, target.location.name)
$Target_EU_Resource = strings.coalesce(target.resource.name, target.file.full_path, target.resource.product_object_id, target.group.product_object_id, target.user.group_identifiers)
$Event_Type = metadata.event_type
$Description = strings.coalesce(metadata.description,security_result.description,security_result.summary,metadata.product_event_type)
$HTTP_Method = network.http.method
$Log_Type = metadata.log_type
$Action = security_result.action
$User = strings.coalesce(principal.user.user_display_name, principal.user.userid, principal.user.email_addresses,target.user.userid,target.user.user_display_name,target.user.email_addresses)
$Source_Country != ""
match:
$User, $Description, $Event_Type, $Log_Type, $Source_Country, $Target_EU_Resource, $Target_EU_Country, $HTTP_Method, $Action
outcome:
$Count = count(metadata.id)
$Date = timestamp.get_timestamp(max(metadata.event_timestamp.seconds))
order:
$Count desc
访问欧盟数据的前 10 个非欧盟国家/地区
(strings.coalesce(target.location.country_or_region, target.ip_geo_artifact.location.country_or_region, target.location.name) = /Austria|Belgium|Bulgaria|Croatia|Cyprus|Czechia|Denmark|Estonia|Finland|France|Germany|Greece|Hungary|Ireland|Italy|Latvia|Lithuania|Luxembourg|Malta|Netherlands|Poland|Portugal|Romania|Slovakia|Slovenia|Spain|Sweden|eu-(west-1|west-3|central-1|north-1|south-1|south-2)|europe-(west1|west3|west4|west8|west9|west10|west12|central2|north1|north2|southwest1)|austriaeast|denmarkeast|francecentral|germanywestcentral|greececentral|italynorth|northeurope|spaincentral|swedencentral|westeurope|polandcentral/ nocase
and strings.coalesce(principal.location.country_or_region, principal.ip_geo_artifact.location.country_or_region, principal.location.name) != /Austria|Belgium|Bulgaria|Croatia|Cyprus|Czechia|Denmark|Estonia|Finland|France|Germany|Greece|Hungary|Ireland|Italy|Latvia|Lithuania|Luxembourg|Malta|Netherlands|Poland|Portugal|Romania|Slovakia|Slovenia|Spain|Sweden|eu-(west-1|west-3|central-1|north-1|south-1|south-2)|europe-(west1|west3|west4|west8|west9|west10|west12|central2|north1|north2|southwest1)|austriaeast|denmarkeast|francecentral|germanywestcentral|greececentral|italynorth|northeurope|spaincentral|swedencentral|westeurope|polandcentral/ nocase)
(metadata.event_type = "RESOURCE_READ" OR metadata.event_type = "RESOURCE_WRITTEN" OR metadata.event_type = "RESOURCE_CREATION" OR metadata.event_type = "RESOURCE_DELETION" OR metadata.event_type = "RESOURCE_PERMISSIONS_CHANGE" OR metadata.event_type = "FILE_UNCATEGORIZED" OR metadata.event_type = "FILE_CREATION" OR metadata.event_type = "FILE_DELETION" OR metadata.event_type = "FILE_MODIFICATION" OR metadata.event_type = "FILE_READ" OR metadata.event_type = "FILE_COPY" OR metadata.event_type = "FILE_OPEN" OR metadata.event_type = "FILE_MOVE" OR metadata.event_type = "FILE_SYNC" OR metadata.event_type = "EVENTTYPE_UNSPECIFIED" OR metadata.event_type = "SETTING_UNCATEGORIZED" OR metadata.event_type = "USER_UNCATEGORIZED" OR metadata.event_type = "SYSTEM_AUDIT_LOG_UNCATEGORIZED" OR metadata.event_type = "SYSTEM_AUDIT_LOG_WIPE" OR metadata.event_type = "USER_RESOURCE_CREATION" OR metadata.event_type = "USER_RESOURCE_UPDATE_CONTENT" OR metadata.event_type = "USER_RESOURCE_UPDATE_PERMISSIONS" OR metadata.event_type = "USER_RESOURCE_ACCESS" OR metadata.event_type = "USER_RESOURCE_DELETION" OR metadata.event_type = "GENERIC_EVENT")
$Source_Country = strings.coalesce(principal.location.country_or_region, principal.ip_geo_artifact.location.country_or_region, principal.location.name)
$Log_Type = metadata.log_type
$Source_Country != ""
match:
$Source_Country, $Log_Type
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
欧盟资源的特权访问权限随时间的变化
strings.coalesce(target.location.country_or_region, target.ip_geo_artifact.location.country_or_region, target.location.name) = /Austria|Belgium|Bulgaria|Croatia|Cyprus|Czechia|Denmark|Estonia|Finland|France|Germany|Greece|Hungary|Ireland|Italy|Latvia|Lithuania|Luxembourg|Malta|Netherlands|Poland|Portugal|Romania|Slovakia|Slovenia|Spain|Sweden|eu-(west-1|west-3|central-1|north-1|south-1|south-2)|europe-(west1|west3|west4|west8|west9|west10|west12|central2|north1|north2|southwest1)|austriaeast|denmarkeast|francecentral|germanywestcentral|greececentral|italynorth|northeurope|spaincentral|swedencentral|westeurope|polandcentral/ nocase
(metadata.event_type = "RESOURCE_READ" OR metadata.event_type = "RESOURCE_WRITTEN" OR metadata.event_type = "RESOURCE_CREATION" OR metadata.event_type = "RESOURCE_DELETION" OR metadata.event_type = "RESOURCE_PERMISSIONS_CHANGE" OR metadata.event_type = "FILE_UNCATEGORIZED" OR metadata.event_type = "FILE_CREATION" OR metadata.event_type = "FILE_DELETION" OR metadata.event_type = "FILE_MODIFICATION" OR metadata.event_type = "FILE_READ" OR metadata.event_type = "FILE_COPY" OR metadata.event_type = "FILE_OPEN" OR metadata.event_type = "FILE_MOVE" OR metadata.event_type = "FILE_SYNC" OR metadata.event_type = "EVENTTYPE_UNSPECIFIED" OR metadata.event_type = "SETTING_UNCATEGORIZED" OR metadata.event_type = "USER_UNCATEGORIZED" OR metadata.event_type = "SYSTEM_AUDIT_LOG_UNCATEGORIZED" OR metadata.event_type = "SYSTEM_AUDIT_LOG_WIPE" OR metadata.event_type = "USER_RESOURCE_CREATION" OR metadata.event_type = "USER_RESOURCE_UPDATE_CONTENT" OR metadata.event_type = "USER_RESOURCE_UPDATE_PERMISSIONS" OR metadata.event_type = "USER_RESOURCE_ACCESS" OR metadata.event_type = "USER_RESOURCE_DELETION" OR metadata.event_type = "GENERIC_EVENT" OR metadata.event_type ="USER_LOGIN" or metadata.event_type = "USER_CHANGE_PERMISSIONS")
$User = strings.coalesce(principal.user.userid,principal.user.user_display_name,principal.user.email_addresses,target.user.userid,target.user.user_display_name,target.user.email_addresses)
($User = /admin|root|svc|adm|privilege/ nocase or principal.user.attribute.roles.type = "SERVICE_ACCOUNT" or principal.user.attribute.roles.type = "ADMINISTRATOR" or principal.user.account_type = "DOMAIN_ACCOUNT_TYPE" or principal.user.account_type = "SERVICE_ACCOUNT_TYPE")
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
$Target_EU_Country = strings.coalesce(target.location.country_or_region, target.ip_geo_artifact.location.country_or_region, target.location.name)
match:
$Target_EU_Country, $Date
outcome:
$Count = count(metadata.id)
order:
$Date asc
威胁检测随时间的变化趋势
strings.coalesce(target.location.country_or_region, target.ip_geo_artifact.location.country_or_region, target.location.name) = /Austria|Belgium|Bulgaria|Croatia|Cyprus|Czechia|Denmark|Estonia|Finland|France|Germany|Greece|Hungary|Ireland|Italy|Latvia|Lithuania|Luxembourg|Malta|Netherlands|Poland|Portugal|Romania|Slovakia|Slovenia|Spain|Sweden|eu-(west-1|west-3|central-1|north-1|south-1|south-2)|europe-(west1|west3|west4|west8|west9|west10|west12|central2|north1|north2|southwest1)|austriaeast|denmarkeast|francecentral|germanywestcentral|greececentral|italynorth|northeurope|spaincentral|swedencentral|westeurope|polandcentral/ nocase
(metadata.event_type = "RESOURCE_READ" OR metadata.event_type = "RESOURCE_WRITTEN" OR metadata.event_type = "RESOURCE_CREATION" OR metadata.event_type = "RESOURCE_DELETION" OR metadata.event_type = "RESOURCE_PERMISSIONS_CHANGE" OR metadata.event_type = "FILE_UNCATEGORIZED" OR metadata.event_type = "FILE_CREATION" OR metadata.event_type = "FILE_DELETION" OR metadata.event_type = "FILE_MODIFICATION" OR metadata.event_type = "FILE_READ" OR metadata.event_type = "FILE_COPY" OR metadata.event_type = "FILE_OPEN" OR metadata.event_type = "FILE_MOVE" OR metadata.event_type = "FILE_SYNC" OR metadata.event_type = "EVENTTYPE_UNSPECIFIED" OR metadata.event_type = "SETTING_UNCATEGORIZED" OR metadata.event_type = "USER_UNCATEGORIZED" OR metadata.event_type = "SYSTEM_AUDIT_LOG_UNCATEGORIZED" OR metadata.event_type = "SYSTEM_AUDIT_LOG_WIPE" OR metadata.event_type = "USER_RESOURCE_CREATION" OR metadata.event_type = "USER_RESOURCE_UPDATE_CONTENT" OR metadata.event_type = "USER_RESOURCE_UPDATE_PERMISSIONS" OR metadata.event_type = "USER_RESOURCE_ACCESS" OR metadata.event_type = "USER_RESOURCE_DELETION" OR metadata.event_type = "GENERIC_EVENT")
$Threat_Name = security_result.threat_name
$Threat_Name != ""
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
match:
$Threat_Name, $Date
outcome:
$Count = count(metadata.id)
order:
$Date asc
敏感数据访问事件
strings.coalesce(principal.location.country_or_region, principal.ip_geo_artifact.location.country_or_region, principal.location.name) = /Austria|Belgium|Bulgaria|Croatia|Cyprus|Czechia|Denmark|Estonia|Finland|France|Germany|Greece|Hungary|Ireland|Italy|Latvia|Lithuania|Luxembourg|Malta|Netherlands|Poland|Portugal|Romania|Slovakia|Slovenia|Spain|Sweden|eu-(west-1|west-3|central-1|north-1|south-1|south-2)|europe-(west1|west3|west4|west8|west9|west10|west12|central2|north1|north2|southwest1)|austriaeast|denmarkeast|francecentral|germanywestcentral|greececentral|italynorth|northeurope|spaincentral|swedencentral|westeurope|polandcentral/ nocase
(metadata.event_type = "RESOURCE_READ" OR metadata.event_type = "RESOURCE_WRITTEN" OR metadata.event_type = "RESOURCE_CREATION" OR metadata.event_type = "RESOURCE_DELETION" OR metadata.event_type = "RESOURCE_PERMISSIONS_CHANGE" OR metadata.event_type = "FILE_UNCATEGORIZED" OR metadata.event_type = "FILE_CREATION" OR metadata.event_type = "FILE_DELETION" OR metadata.event_type = "FILE_MODIFICATION" OR metadata.event_type = "FILE_READ" OR metadata.event_type = "FILE_COPY" OR metadata.event_type = "FILE_OPEN" OR metadata.event_type = "FILE_MOVE" OR metadata.event_type = "FILE_SYNC" OR metadata.event_type = "EVENTTYPE_UNSPECIFIED" OR metadata.event_type = "SETTING_UNCATEGORIZED" OR metadata.event_type = "USER_UNCATEGORIZED" OR metadata.event_type = "SYSTEM_AUDIT_LOG_UNCATEGORIZED" OR metadata.event_type = "SYSTEM_AUDIT_LOG_WIPE" OR metadata.event_type = "USER_RESOURCE_CREATION" OR metadata.event_type = "USER_RESOURCE_UPDATE_CONTENT" OR metadata.event_type = "USER_RESOURCE_UPDATE_PERMISSIONS" OR metadata.event_type = "USER_RESOURCE_ACCESS" OR metadata.event_type = "USER_RESOURCE_DELETION" OR metadata.log_type = "GENERIC_EVENT" OR metadata.event_type ="USER_LOGIN" or metadata.log_type = "USER_CHANGE_PERMISSIONS")
(metadata.product_event_type = /SENSITIVE/ nocase OR security_result.rule_name = /SENSITIVE/ nocase OR metadata.description = /SENSITIVE/ nocase OR security_result.summary = /SENSITIVE/ nocase OR security_result.description = /SENSITIVE/ nocase)
$Description = strings.coalesce(security_result.summary, security_result.description,metadata.description)
$Source_User = strings.coalesce(principal.user.userid,principal.user.user_display_name,principal.user.email_addresses)
$Target_User = strings.coalesce(target.user.userid,target.user.user_display_name,target.user.email_addresses)
$Source_Country = strings.coalesce(principal.location.country_or_region, principal.ip_geo_artifact.location.country_or_region, principal.location.name)
$Source_IP = strings.coalesce(principal.ip, principal.asset.ip)
$Destination_IP = strings.coalesce(target.ip, target.asset.ip)
$Protocol = network.application_protocol
$Action = security_result.action
$Log_Type = metadata.log_type
match:
$Description,$Source_User, $Target_User, $Source_IP,$Source_Country, $Destination_IP ,$Protocol , $Log_Type, $Action
outcome:
$Count = count(metadata.id)
$Date = timestamp.get_timestamp(max(metadata.event_timestamp.seconds))
order:
$Count desc
Google Workspace 提醒
此信息中心可让您大致了解安全事件和潜在威胁，并跟踪工作区中与用户活动相关的严重提醒和趋势。
十大高严重程度提醒
10 大提醒
一段时间内的提醒
近期提醒详情
按严重程度划分的提醒
按提醒数量排名的前 10 名用户
图表名称
查询示例
十大高严重程度提醒
metadata.log_type = "WORKSPACE_ALERTS"
security_result.severity = "HIGH"
security_result.summary != ""
$Alert = security_result.summary
$Alert != ""
match:
$Alert
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
10 大提醒
metadata.log_type = "WORKSPACE_ALERTS"
security_result.summary != ""
$Alert = security_result.summary
$Alert != ""
match:
$Alert
outcome:
$Count = count(security_result.summary)
order:
$Count desc
limit:
10
一段时间内的提醒
metadata.log_type = "WORKSPACE_ALERTS"
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
match:
$Date
outcome:
$Count = count(metadata.id)
order:
$Date desc
近期提醒详情
metadata.log_type = "WORKSPACE_ALERTS"
$Alert = security_result.summary
$Category_Details = security_result.category_details
$Category = security_result.category
$Severity = security_result.severity
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
match:
$Date, $Alert, $Category, $Category_Details, $Severity
outcome:
$Count = count(metadata.id)
order:
$Date desc
limit:
50
按严重程度划分的提醒
metadata.log_type = "WORKSPACE_ALERTS"
$Severity = security_result.severity
match:
$Severity
outcome:
$Count = count(metadata.id)
order:
$Count desc
按提醒数量排名的前 10 名用户
metadata.log_type = "WORKSPACE_ALERTS"
target.user.userid != ""
$User = target.user.userid
match:
$User
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
Google Workspace 云端硬盘
此信息中心可全面展示用户活动和资源管理情况。该报告会突出显示不同位置的关键安全事件、用户和访问模式，以便安全团队确保合规性并降低潜在风险。
注意 ： 应用过滤条件可优化结果，以便获得有针对性的数据洞见。
下载事件的数据泄露防护摘要
下载指定时间段内的活动
下载事件中的前 10 位用户
指定时间段内的资源删除事件
10 大热门活动
资源创建事件随时间的变化
排名前 10 的地点
来源地理位置概览
上传事件的数据泄露防护摘要
按操作统计的指定时间段内的事件
访问次数最多的 10 大资源
上传事件中排名前 10 的用户
前 10 位用户
图表名称
查询示例
下载事件的数据泄露防护摘要
metadata.product_event_type = "download"
target.resource.attribute.labels.key = "dlp_info"
$DLP_Signature = target.resource.attribute.labels.value
$URL = target.url
$Source_IP = principal.ip
$User = strings.coalesce(principal.user.userid, principal.user.user_display_name, principal.user.email_addresses)
match:
$DLP_Signature,$User,$Source_IP, $URL
outcome:
$Storage_Used_in_MB = max(math.round(cast.as_float(additional.fields["storage_usage_in_bytes"])/(1000*1000), 2))
$Date = timestamp.get_timestamp(max(metadata.event_timestamp.seconds), "%F %T")
$Count = count(metadata.id)
order:
$Date desc
下载指定时间段内的活动
metadata.product_event_type = "download"
$User = strings.coalesce(principal.user.userid, principal.user.user_display_name, principal.user.email_addresses)
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
match:
$Date,$User
outcome:
$Count = count(metadata.id)
order:
$Date asc
下载事件中的前 10 位用户
metadata.product_event_type = "download"
$User = strings.coalesce(principal.user.userid, principal.user.user_display_name, principal.user.email_addresses)
match:
$User
outcome:
$Storage_Used_in_MB = sum(math.round(cast.as_float(additional.fields["storage_usage_in_bytes"])/(1000*1000), 2))
order:
$Storage_Used_in_MB desc
limit:
10
指定时间段内的资源删除事件
(metadata.event_type = "RESOURCE_DELETION" or metadata.event_type = "USER_RESOURCE_DELETION")
(metadata.product_event_type = "trash" or metadata.product_event_type = "delete")
$User = strings.coalesce(principal.user.userid, principal.user.user_display_name, principal.user.email_addresses)
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
match:
$Date,$User
outcome:
$Count = count(metadata.id)
order:
$Date asc
10 大热门活动
$Security_Event_Type = metadata.product_event_type
$User = strings.coalesce(principal.user.userid, principal.user.user_display_name, principal.user.email_addresses, target.user.userid, target.user.user_display_name, target.user.email_addresses)
match:
$Security_Event_Type,$User
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
资源创建事件随时间的变化
(metadata.event_type = "RESOURCE_CREATION" or metadata.event_type = "USER_RESOURCE_CREATION")
metadata.product_event_type = "create"
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
$User = strings.coalesce(principal.user.userid, principal.user.user_display_name, principal.user.email_addresses)
match:
$Date,$User
outcome:
$Count = count(metadata.id)
order:
$Date asc
排名前 10 的地点
$Location = strings.coalesce(principal.location.country_or_region, principal.ip_geo_artifact.location.country_or_region)
match:
$Location
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
来源地理位置概览
(metadata.event_type = "USER_RESOURCE_ACCESS" or metadata.event_type = "RESOURCE_READ" or metadata.event_type = "USER_RESOURCE_UPDATE_CONTENT")
$Country = principal.ip_geo_artifact.location.country_or_region
$Country !=""
match:
$Country
outcome:
$Count = count(metadata.id)
$Latitude = max(principal.ip_geo_artifact.location.region_coordinates.latitude)
$Longitude = max(principal.ip_geo_artifact.location.region_coordinates.longitude)
order:
$Count desc
上传事件的数据泄露防护摘要
metadata.product_event_type = "upload"
target.resource.attribute.labels.key = "dlp_info"
$DLP_Signature = target.resource.attribute.labels.value
$URL = target.url
$Source_IP = principal.ip
$User = strings.coalesce(principal.user.userid, principal.user.user_display_name, principal.user.email_addresses)
match:
$DLP_Signature,$User,$Source_IP, $URL
outcome:
$Storage_Used_in_MB = max(math.round(cast.as_float(additional.fields["storage_usage_in_bytes"])/(1000*1000), 2))
$Date = timestamp.get_timestamp(max(metadata.event_timestamp.seconds), "%F %T")
$Count = count(metadata.id)
order:
$Date desc
按操作统计的指定时间段内的事件
$Security_Event_Type = metadata.product_event_type
$Action = security_result.action
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
match:
$Date ,$Action
outcome:
$Count = count(metadata.id)
order:
$Date asc
访问次数最多的 10 大资源
(metadata.event_type = "USER_RESOURCE_ACCESS" or metadata.event_type = "RESOURCE_READ" or metadata.event_type = "USER_RESOURCE_UPDATE_CONTENT")
$Security_Event_Type = metadata.product_event_type
$Resource_Id = target.resource.product_object_id
$Resource_Id != ""
$Source_User = strings.coalesce(principal.user.email_addresses, principal.user.userid, principal.user.user_display_name)
$Source_IP = strings.coalesce(principal.ip,principal.asset.ip)
$Action = security_result.action
match:
$Resource_Id,$Source_User,$Source_IP ,$Security_Event_Type, $Action
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
上传事件中排名前 10 的用户
metadata.product_event_type = "upload"
$User = strings.coalesce(principal.user.userid, principal.user.user_display_name, principal.user.email_addresses)
match:
$User
outcome:
$Storage_Used_in_MB = sum(math.round(cast.as_float(additional.fields["storage_usage_in_bytes"])/(1000*1000), 2))
order:
$Storage_Used_in_MB desc
limit:
10
前 10 位用户
$User = strings.coalesce(principal.user.userid, principal.user.user_display_name, principal.user.email_addresses)
$Action = security_result.action
match:
$User, $Action
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
Google Workspace 身份管理
此信息中心可提供用户和群组活动的概览，让您深入了解登录模式、修改和权限变更，同时还能跟踪一段时间内的趋势。
一段时间内的群组修改事件
用户删除事件随时间的变化趋势
权限变更事件随时间的变化趋势
成功登录次数与登录失败次数
处理管理任务的前 10 位管理员
前 10 名用户登录失败趋势
用户创建事件随时间的变化趋势
成功登录的用户数排名前 10 的趋势
图表名称
查询示例
一段时间内的群组修改事件
metadata.log_type = "WORKSPACE_ACTIVITY"
metadata.product_event_type = /modify_group/ nocase
$Event = metadata.product_event_type
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
match:
$Date, $Event
outcome:
$Count = count(metadata.id)
order:
$Date desc
用户删除事件随时间的变化趋势
metadata.log_type = "WORKSPACE_ACTIVITY"
metadata.product_event_type = /delete_user/ nocase
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
match:
$Date
outcome:
$Count = count(target.user.email_addresses)
order:
$Count desc
权限变更事件随时间的变化趋势
metadata.log_type = "WORKSPACE_ACTIVITY"
metadata.event_type = "RESOURCE_PERMISSIONS_CHANGE"
or metadata.event_type = "USER_CHANGE_PERMISSIONS"
or metadata.event_type = "USER_RESOURCE_UPDATE_PERMISSIONS"
$Permission = metadata.event_type
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
match:
$Permission, $Date
outcome:
$Count = count(metadata.id)
order:
$Date desc
成功登录次数与登录失败次数
metadata.log_type = "WORKSPACE_ACTIVITY"
metadata.product_event_type = "LOGIN_SUCCESS"
or metadata.product_event_type = "LOGIN_FAILURE"
$User_Login = metadata.product_event_type
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
match:
$Date, $User_Login
outcome:
$Count = count(metadata.id)
order:
$Count desc
处理管理任务的前 10 位管理员
metadata.log_type = "WORKSPACE_ACTIVITY"
target.application = /admin/ nocase
$Event = metadata.event_type
$Admin = principal.user.email_addresses
match:
$Admin, $Event
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
前 10 名用户登录失败趋势
metadata.log_type = "WORKSPACE_ACTIVITY"
metadata.product_event_type = "LOGIN_FAILURE"
principal.user.email_addresses != ""
$User_Account = principal.user.email_addresses
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
match:
$User_Account, $Date
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
用户创建事件随时间的变化趋势
metadata.log_type = "WORKSPACE_ACTIVITY"
metadata.product_event_type = /create_user/ nocase
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
match:
$Date
outcome:
$Count = count(target.user.email_addresses)
order:
$Count desc
成功登录的用户数排名前 10 的趋势
metadata.log_type = "WORKSPACE_ACTIVITY"
metadata.product_event_type = "LOGIN_SUCCESS"
principal.user.email_addresses != ""
$User_Account = principal.user.email_addresses
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
match:
$User_Account, $Date
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
群组活动摘要
此信息中心可详细查看用户和群组互动情况，跟踪不同的用户、群组和成员资格变更。它会突出显示最活跃的用户和群组、群组变化，并监控群组活动趋势。
注意 ： 应用过滤条件可优化结果，以便获得有针对性的数据洞见。
随时间推移创建的群组
按群组管理事件统计的前 10 个主机
已创建群组
从群组中移除了用户
最近删除的群组
指定时间段内被屏蔽的群组活动
已将用户添加到管理员群组
最近从群组中移除的用户
群组更改活动次数
群组活动中被屏蔽的前 10 名用户
已删除群组
最近创建的群组
10 大活跃主机
删除群组的前 10 位用户
流量最多的 10 大群组操作
按登录事件数排名的前 10 名用户
添加到群组的用户数量
群组活动中被屏蔽的前 10 个来源 IP
登录事件中的唯一身份用户
修改群组的前 10 个来源 IP
添加到管理员群组的用户总数
一段时间内的群组活动
添加了新群组
最近添加到群组的用户
随时间变化的群组
最近修改过的群组
创建群组最多的 10 位用户
修改群组最多的 10 位用户
已将用户添加到群组
删除群组最多的 10 个来源 IP
唯一身份用户登录次数
创建群组的前 10 个来源 IP
活跃度排名前 10 位的群组
从群组中移除的用户数量
随时间推移而删除的群组
按事件数排名的前 10 个群组
活跃用户登录次数最多的前 10 个国家/地区
图表名称
查询示例
随时间推移创建的群组
metadata.event_type = "GROUP_CREATION"
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
match:
$Date
outcome:
$Count = count(metadata.id)
order:
$Count desc
按群组管理事件统计的前 10 个主机
metadata.event_type = "GROUP_UNCATEGORIZED"
or metadata.event_type = "GROUP_CREATION"
or metadata.event_type = "GROUP_DELETION"
or metadata.event_type = "GROUP_MODIFICATION"
$Hostname = principal.hostname
$Hostname != ""
$Event_Type = metadata.event_type
match:
$Hostname, $Event_Type
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
已创建群组
metadata.event_type = "GROUP_CREATION"
outcome:
$Count = count_distinct(target.group.group_display_name)
从群组中移除了用户
$event.metadata.product_event_type = /4733|4729|4757/
or $event.metadata.product_event_type = /remove.*(?:user|member).*(?:from|to).*group/ nocase
$Initiator = strings.coalesce($event.principal.user.windows_sid, $event.principal.user.userid)
$AffectedUser = strings.coalesce($event.target.user.windows_sid, $event.target.user.userid)
$Group = $event.target.group.group_display_name
$Description = strings.coalesce($event.metadata.description, $event.security_result.summary)
match:
$Initiator, $Group, $AffectedUser, $Description
outcome:
$Date = timestamp.get_timestamp(max($event.metadata.event_timestamp.seconds))
order:
$Date desc
limit:
50
最近删除的群组
metadata.event_type = "GROUP_DELETION"
or metadata.product_event_type = /delete(?:\s)?group/ nocase
security_result.action = "ALLOW"
$Log_Type = metadata.log_type
$Group = target.group.group_display_name
$Initiator = strings.coalesce(principal.user.windows_sid, principal.user.userid, principal.user.email_addresses)
$IP_Address = principal.ip
$Date = timestamp.get_timestamp(metadata.event_timestamp.seconds, "%F %T ")
match:
$Date, $Log_Type, $Initiator, $IP_Address, $Group
order:
$Date desc
指定时间段内被屏蔽的群组活动
metadata.event_type = "GROUP_CREATION"
or metadata.event_type = "GROUP_DELETION"
or metadata.product_event_type = /add group/ nocase
or metadata.product_event_type = /delete group/ nocase
or metadata.event_type = "GROUP_MODIFICATION"
or metadata.product_event_type = /(RemoveUserFrom|AddUserTo|Add member to |Remove member from )|(?:group)/ nocase
security_result.action = "BLOCK"
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
match:
$Date
outcome:
$Count = count(metadata.id)
order:
$Date desc
已将用户添加到管理员群组
metadata.product_event_type = /4732|4728|4756/
or metadata.product_event_type = /add.*(?:user|member).*to.*group/ nocase
$Initiator = strings.coalesce(principal.user.user_display_name, principal.user.userid, principal.user.windows_sid, target.user.userid, re.capture(additional.fields["Message"], `Account Name:(?:\W?)([A-Za-z0-9._%+-]+)`))
$Affected_User = strings.coalesce(re.capture(additional.fields["Message"], `Member Name:(?:\W?)([A-Za-z0-9._%+-]+)`), re.capture(security_result.description, `\b[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\.[A-Za-z]+`), target.user.user_display_name, target.user.userid, target.user.windows_sid)
$Group = strings.coalesce(target.group.group_display_name, re.capture(security_result.description, `group\W([A-Za-z0-9._%+-]+\W+[A-Za-z0-9._%+-]+)`), re.capture(additional.fields["Message"], `Group Name:(?:\W?)([A-Za-z0-9._%+-]+)`))
$Group = /admin/ nocase
$Description = strings.coalesce(metadata.description, security_result.summary)
$Date = timestamp.get_timestamp((metadata.event_timestamp.seconds))
match:
$Date, $Initiator, $Group, $Affected_User, $Description
order:
$Date desc
最近从群组中移除的用户
metadata.product_event_type = /4733|4729|4757/
or metadata.product_event_type = /remove.*(?:user|member).*(?:from|to).*group/ nocase
$Initiator = strings.coalesce(principal.user.user_display_name, principal.user.userid, principal.user.windows_sid, target.user.userid, re.capture(additional.fields["Message"], `Account Name:(?:\W?)([A-Za-z0-9._%+-]+)`))
$Affected_User = strings.coalesce(re.capture(additional.fields["Message"], `Member Name:(?:\W?)([A-Za-z0-9._%+-]+)`), re.capture(security_result.description, `\b[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\.[A-Za-z]+`), target.user.user_display_name, target.user.userid, target.user.windows_sid)
$Group = strings.coalesce(target.group.group_display_name, re.capture(security_result.description, `group\W([A-Za-z0-9._%+-]+\W+[A-Za-z0-9._%+-]+)`), re.capture(additional.fields["Message"], `Group Name:(?:\W?)([A-Za-z0-9._%+-]+)`))
$Description = strings.coalesce(metadata.description, security_result.summary)
$Date = timestamp.get_timestamp((metadata.event_timestamp.seconds))
match:
$Date, $Initiator, $Group, $Affected_User, $Description
order:
$Date desc
群组更改活动次数
metadata.event_type = "GROUP_CREATION"
or metadata.event_type = "GROUP_DELETION"
or metadata.event_type = "GROUP_MODIFICATION"
outcome:
$Count = count(metadata.id)
群组活动中被屏蔽的前 10 名用户
metadata.event_type = "GROUP_CREATION"
or metadata.event_type = "GROUP_DELETION"
or metadata.product_event_type = /add group/ nocase
or metadata.product_event_type = /delete group/ nocase
or metadata.event_type = "GROUP_MODIFICATION"
or metadata.product_event_type = /(RemoveUserFrom|AddUserTo|Add member to |Remove member from )|(?:group)/ nocase
security_result.action = "BLOCK"
$Event_Type = metadata.event_type
$User = strings.coalesce(principal.user.windows_sid, principal.user.userid, principal.user.email_addresses)
match:
$Event_Type, $User
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
已删除群组
$event.metadata.event_type = "GROUP_DELETION"
outcome:
$Count = count_distinct($event.target.group.group_display_name)
最近创建的群组
metadata.event_type = "GROUP_CREATION"
or metadata.product_event_type = /(?:add|create)(?:\s)?group/ nocase
security_result.action = "ALLOW"
$Log_Type = metadata.log_type
$Group = target.group.group_display_name
$Initiator = strings.coalesce(principal.user.windows_sid, principal.user.userid, principal.user.email_addresses)
$IP_Address = principal.ip
$Date = timestamp.get_timestamp(metadata.event_timestamp.seconds, "%F %T ")
match:
$Date, $Log_Type, $Initiator, $IP_Address, $Group
order:
$Date desc
10 大活跃主机
$event.metadata.event_type = "GROUP_UNCATEGORIZED"
or $event.metadata.event_type = "GROUP_CREATION"
or $event.metadata.event_type = "GROUP_DELETION"
or $event.metadata.event_type = "GROUP_MODIFICATION"
$Hostname = $event.principal.hostname
$Hostname != ""
$Event_Type = $event.metadata.event_type
$Log_type = $event.metadata.log_type
match:
$Hostname, $Event_Type, $Log_type
outcome:
$Count = count($event.metadata.id)
order:
$Count desc
limit:
10
删除群组的前 10 位用户
metadata.event_type = "GROUP_DELETION"
or metadata.product_event_type = /delete(?:\s)?group/ nocase
security_result.action = "ALLOW"
$Log_Type = metadata.log_type
$User = strings.coalesce(principal.user.windows_sid, principal.user.userid, principal.user.email_addresses)
match:
$Log_Type, $User
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
流量最多的 10 大群组操作
metadata.event_type = "GROUP_CREATION"
or metadata.event_type = "GROUP_DELETION"
or metadata.event_type = "GROUP_MODIFICATION"
$Description = strings.coalesce(metadata.description, security_result.summary)
$Description != ""
match:
$Description
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
按登录事件数排名的前 10 名用户
metadata.event_type = "USER_LOGIN"
$User = strings.concat(target.user.userid, " ")
$User != " "
match:
$User
outcome:
$Count = count(target.user.userid)
order:
$Count desc
limit:
10
添加到群组的用户数量
$event.metadata.event_type = "GROUP_MODIFICATION"
$event.metadata.product_event_type = /4720|4728|4732|4746|4751|4756|4761|4785/
or $event.metadata.product_event_type = /add.*(?:user|member).*to.*group/ nocase
outcome:
$Count = count($event.metadata.id)
群组活动中被屏蔽的前 10 个来源 IP
metadata.event_type = "GROUP_CREATION"
or metadata.event_type = "GROUP_DELETION"
or metadata.product_event_type = /add group/ nocase
or metadata.product_event_type = /delete group/ nocase
or metadata.event_type = "GROUP_MODIFICATION"
or metadata.product_event_type = /(RemoveUserFrom|AddUserTo|Add member to |Remove member from )|(?:group)/ nocase
security_result.action = "BLOCK"
$Event_Type = metadata.event_type
$IP_Address = principal.ip
match:
$Event_Type, $IP_Address
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
登录事件中的唯一身份用户
metadata.event_type = "USER_LOGIN"
outcome:
$Count = count_distinct(principal.user.userid)
修改群组的前 10 个来源 IP
metadata.event_type = "GROUP_MODIFICATION"
$Log_Type = metadata.log_type
$IP_Address = principal.ip
match:
$IP_Address, $Log_Type
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
添加到管理员群组的用户总数
metadata.product_event_type = /4732|4728|4756/
or metadata.product_event_type = /add.*(?:user|member).*to.*group/ nocase
$Group = strings.coalesce(target.group.group_display_name, re.capture(security_result.description, `group\W([A-Za-z0-9._%+-]+\W+[A-Za-z0-9._%+-]+)`), re.capture(additional.fields["Message"], `Group Name:(?:\W?)([A-Za-z0-9._%+-]+)`))
$Group = /admin/ nocase
outcome:
$Count = count(metadata.id)
一段时间内的群组活动
$event.metadata.event_type = "GROUP_CREATION"
or $event.metadata.event_type = "GROUP_DELETION"
or $event.metadata.event_type = "GROUP_MODIFICATION"
or $event.metadata.event_type = "GROUP_UNCATEGORIZED"
$User = $event.target.user.windows_sid
$Hostname = $event.principal.hostname
$Group = $event.target.group.group_display_name
$Event = $event.metadata.event_type
$Action = $event.metadata.description
$Action != "A security-enabled local group membership was enumerated"
match:
$Event, $User, $Hostname, $Group, $Action
outcome:
$Date = timestamp.get_timestamp(max($event.metadata.event_timestamp.seconds))
order:
$Date desc
limit:
50
添加了新群组
$event.metadata.event_type = "GROUP_CREATION"
outcome:
$Count = count_distinct($event.target.group.group_display_name)
已删除群组
metadata.event_type = "GROUP_DELETION"
outcome:
$Count = count_distinct(target.group.group_display_name)
最近添加到群组的用户
metadata.product_event_type = /4732|4728|4756/
or metadata.product_event_type = /add.*(?:user|member).*to.*group/ nocase
$Initiator = strings.coalesce(principal.user.user_display_name, principal.user.userid, principal.user.windows_sid, target.user.userid, re.capture(additional.fields["Message"], `Account Name:(?:\W?)([A-Za-z0-9._%+-]+)`))
$Affected_User = strings.coalesce(re.capture(additional.fields["Message"], `Member Name:(?:\W?)([A-Za-z0-9._%+-]+)`), re.capture(security_result.description, `\b[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\.[A-Za-z]+`), target.user.user_display_name, target.user.userid, target.user.windows_sid)
$Group = strings.coalesce(target.group.group_display_name, re.capture(security_result.description, `group\W([A-Za-z0-9._%+-]+\W+[A-Za-z0-9._%+-]+)`), re.capture(additional.fields["Message"], `Group Name:(?:\W?)([A-Za-z0-9._%+-]+)`))
$Description = strings.coalesce(metadata.description, security_result.summary)
$Date = timestamp.get_timestamp((metadata.event_timestamp.seconds))
match:
$Date, $Initiator, $Group, $Affected_User, $Description
order:
$Date desc
随时间变化的群组
metadata.event_type = "GROUP_MODIFICATION"
or metadata.product_event_type = /(RemoveUserFrom|AddUserTo|Add member to |Remove member from )|(?:group)/ nocase
security_result.action = "ALLOW"
$Log_Type = metadata.log_type
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
match:
$Log_Type, $Date
outcome:
$Count = count(metadata.id)
order:
$Date desc
最近修改过的群组
metadata.event_type = "GROUP_MODIFICATION"
or metadata.product_event_type = /(RemoveUserFrom|AddUserTo|Add member to |Remove member from )|(?:group)/ nocase
security_result.action = "ALLOW"
$Log_Type = metadata.log_type
$Event = metadata.product_event_type
$Initiator = strings.coalesce(principal.user.windows_sid, principal.user.userid, principal.user.email_addresses)
$IP_Address = principal.ip
$User = strings.coalesce(target.user.userid, target.user.email_addresses)
$Group = target.group.group_display_name
$Description = strings.coalesce(metadata.description, security_result.summary)
$Date = timestamp.get_timestamp(metadata.event_timestamp.seconds, "%F %T ")
match:
$Date, $Log_Type, $Initiator, $IP_Address, $User, $Group, $Event, $Description
order:
$Date desc
从群组中移除了用户
metadata.event_type = "GROUP_MODIFICATION"
metadata.product_event_type = /4729|4733|4747|4752|4757|4762|4786/
or metadata.product_event_type = /remove.*(?:user|member).*to.*group/ nocase
outcome:
$Count = count(metadata.id)
创建群组最多的 10 位用户
metadata.event_type = "GROUP_CREATION"
or metadata.product_event_type = /(?:add|create)(?:\s)?group/ nocase
security_result.action = "ALLOW"
$Log_Type = metadata.log_type
$User = strings.coalesce(principal.user.windows_sid, principal.user.userid, principal.user.email_addresses)
match:
$Log_Type, $User
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
修改群组最多的 10 位用户
metadata.event_type = "GROUP_MODIFICATION"
$Log_Type = metadata.log_type
$User = principal.user.userid
match:
$User, $Log_Type
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
已将用户添加到管理员群组
$event.metadata.product_event_type = /4732|4728|4756/
or $event.metadata.product_event_type = /add.*(?:user|member).*to.*group/ nocase
$Initiator = strings.coalesce($event.principal.user.windows_sid, $event.principal.user.userid)
$User = strings.coalesce($event.target.user.windows_sid, $event.target.user.userid)
$Group = $event.target.group.group_display_name
$Group = /admin/ nocase
$Description = strings.coalesce($event.metadata.description, $event.security_result.summary)
match:
$Initiator, $User, $Group, $Description
outcome:
$Date = timestamp.get_timestamp(max($event.metadata.event_timestamp.seconds))
order:
$Date desc
limit:
50
群组更改活动次数
$event.metadata.event_type = "GROUP_CREATION"
or $event.metadata.event_type = "GROUP_DELETION"
or $event.metadata.event_type = "GROUP_MODIFICATION"
outcome:
$Count = count($event.metadata.id)
已将用户添加到群组
metadata.event_type = "GROUP_MODIFICATION"
metadata.product_event_type = /4720|4728|4732|4746|4751|4756|4761|4785/
or metadata.product_event_type = /add.*(?:user|member).*to.*group/ nocase
outcome:
$Count = count(metadata.id)
流量最多的 10 大群组操作
$event.metadata.event_type = "GROUP_CREATION"
or $event.metadata.event_type = "GROUP_DELETION"
or $event.metadata.event_type = "GROUP_MODIFICATION"
$Description = strings.coalesce($event.metadata.description, $event.security_result.summary)
$Group_Name = $event.target.group.group_display_name
match:
$Description, $Group_Name
outcome:
$Count = count($event.metadata.id)
order:
$Count desc
limit:
10
删除群组最多的 10 个来源 IP
metadata.event_type = "GROUP_DELETION"
or metadata.product_event_type = /delete(?:\s)?group/ nocase
security_result.action = "ALLOW"
$Log_Type = metadata.log_type
$IP_Address = principal.ip
match:
$Log_Type, $IP_Address
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
唯一身份用户登录次数
$event.metadata.event_type = "USER_LOGIN"
outcome:
$Count = count_distinct($event.principal.user.userid)
创建群组的前 10 个来源 IP
metadata.event_type = "GROUP_CREATION"
or metadata.product_event_type = /(?:add|create)(?:\s)?group/ nocase
security_result.action = "ALLOW"
$Log_Type = metadata.log_type
$IP_Address = principal.ip
match:
$Log_Type, $IP_Address
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
活跃度排名前 10 位的群组
$event.metadata.event_type = "GROUP_UNCATEGORIZED"
or $event.metadata.event_type = "GROUP_CREATION"
or $event.metadata.event_type = "GROUP_DELETION"
or $event.metadata.event_type = "GROUP_MODIFICATION"
$Log_Type = $event.metadata.log_type
$Event = $event.metadata.event_type
$Group_Name = $event.target.group.group_display_name
$Group_Name != ""
match:
$Group_Name, $Event, $Log_Type
outcome:
$Count = count($event.metadata.id)
order:
$Count desc
limit:
10
从群组中移除的用户数量
$event.metadata.event_type = "GROUP_MODIFICATION"
$event.metadata.product_event_type = /4729|4733|4747|4752|4757|4762|4786/
or $event.metadata.product_event_type = /remove.*(?:user|member).*to.*group/ nocase
outcome:
$Count = count($event.metadata.id)
随时间推移而删除的群组
metadata.event_type = "GROUP_DELETION"
or metadata.product_event_type = /delete(?:\s)?group/ nocase
security_result.action = "ALLOW"
$Log_Type = metadata.log_type
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
match:
$Log_Type, $Date
outcome:
$Count = count(metadata.id)
order:
$Date desc
按事件数排名的前 10 个群组
metadata.event_type = "GROUP_UNCATEGORIZED"
or metadata.event_type = "GROUP_CREATION"
or metadata.event_type = "GROUP_DELETION"
or metadata.event_type = "GROUP_MODIFICATION"
$Event_Type = metadata.event_type
$Group_Name = target.group.group_display_name
$Group_Name != ""
match:
$Group_Name, $Event_Type
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
活跃用户登录次数最多的前 10 个国家/地区
$event.metadata.event_type = "USER_LOGIN"
$Event_Type = $event.metadata.event_type
$User = strings.concat($event.target.user.userid, " ")
$User != " "
$Date = timestamp.get_date($event.metadata.event_timestamp.seconds)
match:
$User, $Event_Type, $Date over every day
outcome:
$Count = count($event.target.user.userid)
order:
$Date desc, $Count desc
limit:
10
已将用户添加到群组
$event.metadata.product_event_type = /4732|4728|4756/
or $event.metadata.product_event_type = /add.*(?:user|member).*to.*group/ nocase
$Initiator = strings.coalesce($event.principal.user.windows_sid, $event.principal.user.userid)
$AffectedUser = strings.coalesce($event.target.user.windows_sid, $event.target.user.userid)
$Group = $event.target.group.group_display_name
$Description = strings.coalesce($event.metadata.description, $event.security_result.summary)
match:
$Initiator, $Group, $AffectedUser, $Description
outcome:
$Date = timestamp.get_timestamp(max($event.metadata.event_timestamp.seconds))
order:
$Date desc
limit:
50
群组管理审核
这是一个专用信息中心，用于审核用户群组的整个生命周期。
这有助于确保群组的创建、修改和删除得到妥善管理，从而大规模防止意外的访问权限。
创建群组最多的 10 位用户
创建群组的前 10 个来源 IP
修改群组最多的 10 位用户
近期群组修改
修改的唯一组总数
随时间推移而删除的群组
随时间推移创建的群组
随时间变化的群组
一段时间内的群组活动
删除群组最多的 10 个来源 IP
创建的唯一群组总数
最近删除的群组
修改群组的前 10 个来源 IP
群组活动中被屏蔽的前 10 名用户
删除群组的前 10 位用户
近期创建的群组
群组活动中被屏蔽的前 10 个来源 IP
已删除的唯一群组总数
图表名称
查询示例
创建群组最多的 10 位用户
metadata.event_type = "GROUP_CREATION"
or metadata.product_event_type = /(?:add|create)(?:\s)?group/ nocase
security_result.action = "ALLOW"
$Log_Type = metadata.log_type
$User = strings.coalesce(principal.user.windows_sid, principal.user.userid, principal.user.email_addresses)
match:
$Log_Type, $User
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
创建群组的前 10 个来源 IP
metadata.event_type = "GROUP_CREATION"
or metadata.product_event_type = /(?:add|create)(?:\s)?group/ nocase
security_result.action = "ALLOW"
$Log_Type = metadata.log_type
$IP_Address = principal.ip
match:
$Log_Type, $IP_Address
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
修改群组最多的 10 位用户
metadata.event_type = "GROUP_MODIFICATION"
or metadata.product_event_type = /(RemoveUserFrom|AddUserTo|Add member to |Remove member from )|(?:group)/ nocase
security_result.action = "ALLOW"
$Log_Type = metadata.log_type
$User = strings.coalesce(principal.user.windows_sid, principal.user.userid, principal.user.email_addresses)
match:
$Log_Type, $User
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
近期群组修改
metadata.event_type = "GROUP_MODIFICATION"
or metadata.product_event_type = /(RemoveUserFrom|AddUserTo|Add member to |Remove member from )|(?:group)/ nocase
security_result.action = "ALLOW"
$Log_Type = metadata.log_type
$Event = metadata.product_event_type
$Initiator = strings.coalesce(principal.user.windows_sid, principal.user.userid, principal.user.email_addresses)
$IP_Address = principal.ip
$User = strings.coalesce(target.user.userid, target.user.email_addresses)
$Group = target.group.group_display_name
$Description = strings.coalesce(metadata.description, security_result.summary)
$Date = timestamp.get_timestamp(metadata.event_timestamp.seconds, "%F %T ")
match:
$Date, $Log_Type, $Initiator, $IP_Address, $User, $Group, $Event, $Description
order:
$Date desc
修改的唯一组总数
metadata.event_type = "GROUP_MODIFICATION"
or metadata.product_event_type = /(RemoveUserFrom|AddUserTo|Add member to |Remove member from )|(?:group)/ nocase
security_result.action = "ALLOW"
outcome:
$Count = count_distinct(target.group.group_display_name)
随时间推移而删除的群组
metadata.event_type = "GROUP_DELETION"
or metadata.product_event_type = /delete(?:\s)?group/ nocase
security_result.action = "ALLOW"
$Log_Type = metadata.log_type
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
match:
$Log_Type, $Date
outcome:
$Count = count(metadata.id)
order:
$Date desc
随时间推移创建的群组
metadata.event_type = "GROUP_CREATION"
or metadata.product_event_type = /(?:add|create)(?:\s)?group/ nocase
security_result.action = "ALLOW"
$Log_Type = metadata.log_type
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
match:
$Log_Type, $Date
outcome:
$Count = count(metadata.id)
order:
$Date desc
随时间变化的群组
metadata.event_type = "GROUP_MODIFICATION"
or metadata.product_event_type = /(RemoveUserFrom|AddUserTo|Add member to |Remove member from )|(?:group)/ nocase
security_result.action = "ALLOW"
$Log_Type = metadata.log_type
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
match:
$Log_Type, $Date
outcome:
$Count = count(metadata.id)
order:
$Date desc
一段时间内的群组活动
metadata.event_type = "GROUP_CREATION"
or metadata.event_type = "GROUP_DELETION"
or metadata.product_event_type = /(?:add|create|delete)(?:\s)?group/ nocase
or metadata.event_type = "GROUP_MODIFICATION"
or metadata.product_event_type = /(RemoveUserFrom|AddUserTo|Add member to |Remove member from )|(?:group)/ nocase
security_result.action = "ALLOW"
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
$Event = metadata.event_type
match:
$Date, $Event
outcome:
$Count = count(metadata.id)
order:
$Date desc
删除群组最多的 10 个来源 IP
metadata.event_type = "GROUP_DELETION"
or metadata.product_event_type = /delete(?:\s)?group/ nocase
security_result.action = "ALLOW"
$Log_Type = metadata.log_type
$IP_Address = principal.ip
match:
$Log_Type, $IP_Address
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
创建的唯一群组总数
metadata.event_type = "GROUP_CREATION"
or metadata.product_event_type = /(?:add|create)(?:\s)?group/ nocase
security_result.action = "ALLOW"
outcome:
$Count = count_distinct(target.group.group_display_name)
最近删除的群组
metadata.event_type = "GROUP_DELETION"
or metadata.product_event_type = /delete(?:\s)?group/ nocase
security_result.action = "ALLOW"
$Log_Type = metadata.log_type
$Group = target.group.group_display_name
$Initiator = strings.coalesce(principal.user.windows_sid, principal.user.userid, principal.user.email_addresses)
$IP_Address = principal.ip
$Date = timestamp.get_timestamp(metadata.event_timestamp.seconds, "%F %T ")
match:
$Date, $Log_Type, $Initiator, $IP_Address, $Group
order:
$Date desc
修改群组的前 10 个来源 IP
metadata.event_type = "GROUP_MODIFICATION"
or metadata.product_event_type = /(RemoveUserFrom|AddUserTo|Add member to |Remove member from )|(?:group)/ nocase
security_result.action = "ALLOW"
$Log_Type = metadata.log_type
$IP_Address = principal.ip
match:
$Log_Type, $IP_Address
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
群组活动中被屏蔽的前 10 名用户
metadata.event_type = "GROUP_CREATION"
or metadata.event_type = "GROUP_DELETION"
or metadata.product_event_type = /add group/ nocase
or metadata.product_event_type = /delete group/ nocase
or metadata.event_type = "GROUP_MODIFICATION"
or metadata.product_event_type = /(RemoveUserFrom|AddUserTo|Add member to |Remove member from )|(?:group)/ nocase
security_result.action = "BLOCK"
$Event_Type = metadata.event_type
$User = strings.coalesce(principal.user.windows_sid, principal.user.userid, principal.user.email_addresses)
match:
$Event_Type, $User
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
删除群组的前 10 位用户
metadata.event_type = "GROUP_DELETION"
or metadata.product_event_type = /delete(?:\s)?group/ nocase
security_result.action = "ALLOW"
$Log_Type = metadata.log_type
$User = strings.coalesce(principal.user.windows_sid, principal.user.userid, principal.user.email_addresses)
match:
$Log_Type, $User
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
近期创建的群组
metadata.event_type = "GROUP_CREATION"
or metadata.product_event_type = /(?:add|create)(?:\s)?group/ nocase
security_result.action = "ALLOW"
$Log_Type = metadata.log_type
$Group = target.group.group_display_name
$Initiator = strings.coalesce(principal.user.windows_sid, principal.user.userid, principal.user.email_addresses)
$IP_Address = principal.ip
$Date = timestamp.get_timestamp(metadata.event_timestamp.seconds, "%F %T ")
match:
$Date, $Log_Type, $Initiator, $IP_Address, $Group
order:
$Date desc
群组活动中被屏蔽的前 10 个来源 IP
metadata.event_type = "GROUP_CREATION"
or metadata.event_type = "GROUP_DELETION"
or metadata.product_event_type = /add group/ nocase
or metadata.product_event_type = /delete group/ nocase
or metadata.event_type = "GROUP_MODIFICATION"
or metadata.product_event_type = /(RemoveUserFrom|AddUserTo|Add member to |Remove member from )|(?:group)/ nocase
security_result.action = "BLOCK"
$Event_Type = metadata.event_type
$IP_Address = principal.ip
match:
$Event_Type, $IP_Address
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
已删除的唯一群组总数
metadata.event_type = "GROUP_DELETION"
or metadata.product_event_type = /delete group/ nocase
security_result.action = "ALLOW"
outcome:
$Count = count_distinct(target.group.group_display_name)
HIPAA 信息中心
此信息中心可实时监控安全和合规性指标，以确保遵守 HIPAA 法规。它可帮助您了解涉及受保护健康信息 (PHI) 的潜在风险、违规行为和数据访问活动。这有助于主动进行风险管理，并有助于维护敏感健康数据的机密性、完整性和可用性。此信息中心使用 ePHI_assets.Hostname 数据表根据 HIPAA 标准确定数据范围。在此信息中心内，只有在创建所需的数据表后，图表才会加载。
漏洞（按严重程度划分）
按日志类型划分的权限随时间变化情况
按操作统计的 MFA 事件随时间的变化趋势
按操作统计的登录事件随时间的变化趋势
发生数据泄露防护违规事件次数最多的 10 个 ePHI 主机
按严重程度划分的 EDR 提醒随时间变化情况
按操作划分的备份事件随时间的变化趋势
按操作划分的密码更改次数随时间变化情况
近期的备份事件（过去 24 小时）
近期的 EDR 提醒（过去 24 小时）
最近创建的用户账号（过去 24 小时）
按日志类型划分的弱加密通信随时间的变化
最近 24 小时内更改密码的用户
10 大 SaaS 应用
前 10 项关键操作
图表名称
查询示例
漏洞（按严重程度划分）
metadata.log_type = /ARMIS_VULNERABILITIES|FINGERPRINT_JS|NUCLEUS_VULNERABILITY|QUALYS_ASSET_CONTEXT|QUALYS_SCAN|QUALYS_VIRTUAL_SCANNER|QUALYS_VM|RAPID7_INSIGHT|RAPID7_NEXPOSE|SNYK_SDLC|SPUR_FEEDS|STACKHAWK|SUBLIMESECURITY|SYMANTEC_SA|TENABLE_IO|TENABLE_OT|TENABLE_SC|TRENDMICRO_VISION_ONE_CONTAINER_VULNERABILITIES|UPGUARD|URLSCAN_IO/ nocase
strings.coalesce(principal.hostname, principal.asset.hostname, target.hostname, target.asset.hostname) in %ePHI_assets.Hostname
$Severity =
if (principal.asset.vulnerabilities.severity != "UNKNOWN_SEVERITY",
principal.asset.vulnerabilities.severity,
if (target.asset.vulnerabilities.severity != "UNKNOWN_SEVERITY",
target.asset.vulnerabilities.severity,
if (extensions.vulns.vulnerabilities.severity != "UNKNOWN_SEVERITY",
extensions.vulns.vulnerabilities.severity,
"UNKNOWN_SEVERITY")))
match:
$Severity
outcome:
$Count = count(strings.coalesce(extensions.vulns.vulnerabilities.name, extensions.vulns.vulnerabilities.description, extensions.vulns.vulnerabilities.vendor_vulnerability_id,
principal.asset.vulnerabilities.name, target.asset.vulnerabilities.name, additional.fields["ScanReference"]))
order:
$Severity desc
按日志类型划分的权限随时间变化情况
metadata.event_type = "RESOURCE_PERMISSIONS_CHANGE"
or metadata.event_type = "USER_CHANGE_PERMISSIONS"
or metadata.event_type = "USER_RESOURCE_UPDATE_PERMISSIONS"
security_result.action = "ALLOW"
strings.coalesce(principal.hostname, principal.asset.hostname, target.hostname, target.asset.hostname) in %ePHI_assets.Hostname
$Log_Type = metadata.log_type
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
match:
$Date, $Log_Type
outcome:
$Count = count(metadata.id)
order:
$Date asc
按操作统计的 MFA 事件随时间的变化趋势
(re.regex(metadata.product_name, "MULTI-FACTOR_AUTHENTICATION") or re.regex(additional.fields["AuthenticationRequirement"], `multiFactorAuthentication`) nocase or re.regex(security_result.detection_fields.value, `MFA`) nocase )
strings.coalesce(principal.hostname, principal.asset.hostname, target.hostname,target.asset.hostname) in %ePHI_assets.Hostname
$Action = security_result.action
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
match:
$Date, $Action
outcome:
$Count = count(metadata.id)
order:
$Date asc
按操作统计的登录事件随时间的变化趋势
metadata.event_type = "USER_LOGIN"
strings.coalesce(principal.hostname, principal.asset.hostname, target.hostname, target.asset.hostname) in %ePHI_assets.Hostname
$Action = security_result.action
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
match:
$Date, $Action
outcome:
$Count = count(metadata.id)
order:
$Date asc
发生数据泄露防护违规事件次数最多的 10 个 ePHI 主机
metadata.log_type = /DLP|ACCELLION|CODE42_INCYDR|GUARDIUM|TRIPWIRE_FIM/ nocase
metadata.product_event_type = /Violation/ nocase
strings.coalesce(principal.hostname, principal.asset.hostname, target.hostname, target.asset.hostname) in %ePHI_assets.Hostname
$Severity = security_result.severity
$Hostname= strings.coalesce(principal.hostname, principal.asset.hostname, target.hostname, target.asset.hostname)
match:
$Hostname, $Severity
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
按严重程度划分的 EDR 提醒随时间变化情况
metadata.log_type = /EDR|CS_ALERTS|CS_DETECTS|FIREEYE_HX|MICROSOFT_DEFENDER_ENDPOINT|MICROSOFT_DEFENDER_IDENTITY|SENTINEL_DV/ nocase
strings.coalesce(security_result.rule_name, security_result.threat_name) != ""
strings.coalesce(principal.hostname, principal.asset.hostname, target.hostname, target.asset.hostname) in %ePHI_assets.Hostname
$Severity = security_result.severity
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
match:
$Date, $Severity
outcome:
$Count = count(metadata.id)
order:
$Date asc
按操作划分的备份事件随时间的变化趋势
(metadata.log_type = /COHESITY|DRUVA_BACKUP|VEEAM|VERITAS_NETBACKUP/ nocase or metadata.log_type = "RUBRIK")
strings.coalesce(principal.hostname, principal.asset.hostname, target.hostname, target.asset.hostname) in %ePHI_assets.Hostname
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
$Action = security_result.action
match:
$Date, $Action
outcome:
$Count = count(metadata.id)
order:
$Date asc
按操作划分的密码更改次数随时间变化情况
metadata.event_type = "USER_CHANGE_PASSWORD"
strings.coalesce(principal.hostname, principal.asset.hostname, target.hostname, target.asset.hostname) in %ePHI_assets.Hostname
$Log_Type = metadata.log_type
$Action = security_result.action
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
match :
$Date, $Action
outcome :
$Count = count(metadata.id)
order:
$Date asc
近期的备份事件（过去 24 小时）
(metadata.log_type = /COHESITY|DRUVA_BACKUP|VEEAM|VERITAS_NETBACKUP/ nocase or metadata.log_type = "RUBRIK")
strings.coalesce(principal.hostname, principal.asset.hostname, target.hostname, target.asset.hostname) in %ePHI_assets.Hostname
$Description = strings.coalesce(metadata.description, security_result.description, security_result.summary)
$Log_Type = metadata.log_type
$Event_Type = metadata.event_type
$Security_Event_Type = metadata.product_event_type
$Action = security_result.action
match:
$Description, $Security_Event_Type, $Event_Type, $Action, $Log_Type
outcome:
$Count = count(metadata.id)
$Date = timestamp.get_timestamp(max(metadata.event_timestamp.seconds), "%F %T ")
order:
$Date desc
近期的 EDR 提醒（过去 24 小时）
metadata.log_type = /EDR|CS_ALERTS|CS_DETECTS|FIREEYE_HX|MICROSOFT_DEFENDER_ENDPOINT|MICROSOFT_DEFENDER_IDENTITY|SENTINEL_DV/ nocase
strings.coalesce(principal.hostname, principal.asset.hostname, target.hostname, target.asset.hostname) in %ePHI_assets.Hostname
$Log_Type = metadata.log_type
$EDR_Alerts = strings.coalesce(security_result.rule_name, security_result.threat_name)
$EDR_Alerts != ""
$Severity = security_result.severity
$User = strings.coalesce(principal.user.user_display_name, principal.user.email_addresses, principal.user.userid, target.user.userid, target.user.user_display_name, target.user.email_addresses)
$Hostname = strings.coalesce(principal.hostname, principal.asset.hostname, target.hostname, target.asset.hostname)
match:
$EDR_Alerts, $Hostname, $User, $Severity, $Log_Type
outcome:
$Count = count(metadata.id)
$Date = timestamp.get_timestamp(max(metadata.event_timestamp.seconds), "%F %T")
order:
$Date desc
最近创建的用户账号（过去 24 小时）
metadata.event_type = "USER_CREATION"
strings.coalesce(principal.hostname, principal.asset.hostname, target.hostname, target.asset.hostname) in %ePHI_assets.Hostname
$Log_Type = metadata.log_type
$Source_IP = strings.coalesce(principal.ip, principal.asset.ip)
$Source_Hostname = strings.coalesce(principal.hostname, principal.asset.hostname)
$Initiator = strings.coalesce(principal.user.userid, principal.user.user_display_name, principal.user.email_addresses)
$User_Created = strings.coalesce(target.user.userid, target.user.user_display_name, target.user.email_addresses)
$Action = security_result.action
match:
$Initiator, $User_Created, $Source_Hostname, $Source_IP, $Action, $Log_Type
outcome:
$Count = count(metadata.id)
$Date = timestamp.get_timestamp(max(metadata.event_timestamp.seconds), "%F %T ")
order:
$Date desc
按日志类型划分的弱加密通信随时间的变化
(((target.resource.attribute.labels.key = "keyProperties_type" or target.resource.attribute.labels.key = "requestParameters.keySpec" or target.resource.attribute.labels.key = /key/ nocase) and target.resource.attribute.labels.value = /^(RSA-)|DES|RC4|MD5|SHA1|SHA-1/) or network.tls.cipher = /^(RSA-)|DES|RC4|MD5|SHA1|SHA-1/)
strings.coalesce(principal.hostname, principal.asset.hostname, target.hostname, target.asset.hostname) in %ePHI_assets.Hostname
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
$Log_Type = metadata.log_type
match:
$Date, $Log_Type
outcome:
$Count = count(metadata.id)
order:
$Date asc
最近 24 小时内更改密码的用户
metadata.event_type = "USER_CHANGE_PASSWORD"
strings.coalesce(principal.hostname, principal.asset.hostname, target.hostname, target.asset.hostname) in %ePHI_assets.Hostname
$Log_Type = metadata.log_type
$Security_Event_Type = metadata.product_event_type
$User = strings.coalesce(principal.user.userid, principal.user.user_display_name, principal.user.email_addresses, target.user.userid, target.user.user_display_name, target.user.email_addresses)
$Source_Hostname = strings.coalesce(principal.hostname, principal.asset.hostname)
$Source_IP = strings.coalesce(principal.ip, principal.asset.ip)
$Action = security_result.action
match :
$User, $Source_Hostname, $Source_IP, $Security_Event_Type, $Action, $Log_Type
outcome :
$Date = timestamp.get_timestamp(max(metadata.event_timestamp.seconds ), "%F %T")
$Count = count(metadata.id)
order :
$Date desc
10 大 SaaS 应用
strings.coalesce(security_result.category_details, security_result.rule_name) = /saas/ nocase
strings.coalesce(principal.hostname, principal.asset.hostname, target.hostname, target.asset.hostname) in %ePHI_assets.Hostname
$Application = target.application
$Log_Type = metadata.log_type
match:
$Application, $Log_Type
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
前 10 项关键操作
(metadata.log_type = /AZURE_KEYVAULT_AUDIT|AKEYLESS_VAULT|GCP_CLOUDAUDIT/ or target.application = "kms.amazonaws.com")
strings.coalesce(principal.hostname, principal.asset.hostname, target.hostname, target.asset.hostname) in %ePHI_assets.Hostname
$Security_Event_Type = metadata.product_event_type
$Log_Type = strings.coalesce(metadata.log_type, target.application)
match:
$Security_Event_Type, $Log_Type
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
主机调查
此信息中心可全面了解主机活动和安全事件。关键 widget 可跟踪网络通信、身份验证更改、恶意软件、热门事件和罕见进程。它还会监控服务和预定任务的创建情况，以及潜在的安全威胁。
注意 ： 必须在过滤条件中指定主机名，图表才能正确填充。
10 大热门活动
事件随时间变化的趋势
恶意软件和入侵
网络通信出站地图
稀有流程
服务创建
网络通信
身份验证和更改
网络通信入站地图
创建计划任务
图表名称
查询示例
10 大热门活动
$Event_Type = metadata.event_type
$User = strings.coalesce(principal.user.userid, principal.user.user_display_name, principal.user.email_addresses)
match:
$Event_Type,$User
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
事件随时间变化的趋势
$Event_Type = metadata.event_type
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
match:
$Date, $Event_Type
outcome:
$Count = count(metadata.id)
order:
$Date asc
恶意软件和入侵
$Log_Type = metadata.log_type
$Category = security_result.category
($Category = "UNKNOWN_CATEGORY" or $Category = "SOFTWARE_MALICIOUS" or $Category = "SOFTWARE_SUSPICIOUS" or $Category = "SOFTWARE_PUA" or $Category = "NETWORK_MALICIOUS"or $Category = "NETWORK_SUSPICIOUS" or $Category = "NETWORK_CATEGORIZED_CONTENT" or $Category = "NETWORK_DENIAL_OF_SERVICE" or $Category = "NETWORK_RECON" or $Category = "NETWORK_COMMAND_AND_CONTROL" or $Category = "ACL_VIOLATION" or $Category = "AUTH_VIOLATION" or $Category = "EXPLOIT" or $Category = "DATA_EXFILTRATION" or $Category = "DATA_AT_REST" or $Category = "DATA_DESTRUCTION" or $Category = "TOR_EXIT_NODE" or $Category = "MAIL_SPAM" or $Category = "MAIL_PHISHING" or $Category = "MAIL_SPOOFING" or $Category = "POLICY_VIOLATION" or $Category = "SOCIAL_ENGINEERING" or $Category = "PHISHING")
$Hostname = strings.coalesce(principal.hostname,principal.asset.hostname,intermediary.hostname,target.hostname,target.asset.hostname)
$Hostname !=""
$Description = strings.coalesce(metadata.description,security_result.summary)
$Action = security_result.action
$File_Path = target.file.full_path
match:
$Hostname, $Log_Type, $Category, $Description, $Action,$File_Path
outcome:
$Count = count(metadata.id)
order:
$Count desc
网络通信出站地图
(metadata.event_type = "NETWORK_UNCATEGORIZED"
or metadata.event_type = "NETWORK_FLOW"
or metadata.event_type = "NETWORK_CONNECTION"
or metadata.event_type = "NETWORK_FTP"
or metadata.event_type = "NETWORK_DHCP"
or metadata.event_type = "NETWORK_DNS"
or metadata.event_type = "NETWORK_HTTP"
or metadata.event_type = "NETWORK_SMTP")
network.direction = "OUTBOUND"
$Hostname = strings.coalesce(principal.hostname, intermediary.hostname, observer.hostname, principal.asset.hostname, principal.asset.ip)
$Country = target.ip_geo_artifact.location.country_or_region
match:
$Country
outcome:
$Latitude = max(target.ip_geo_artifact.location.region_coordinates.latitude)
$Longitude = max(target.ip_geo_artifact.location.region_coordinates.longitude)
$Count = count(metadata.id)
稀有流程
(metadata.event_type = "PROCESS_LAUNCH"
or metadata.event_type = "PROCESS_INJECTION"
or metadata.event_type = "PROCESS_PRIVILEGE_ESCALATION"
or metadata.event_type = "PROCESS_TERMINATION"
or metadata.event_type = "PROCESS_OPEN"
or metadata.event_type = "PROCESS_MODULE_LOAD")
$Process_Name = strings.coalesce(if(principal.application != "", principal.application, ""), if(re.capture(target.process.file.full_path, `.*\\(\S+\.\w+)`) != "", re.capture(target.process.file.full_path, `.*\\(\S+\.\w+)`), ""))
$Process_Name != ""
$Severity = security_result.severity
$Action = security_result.action
$User = strings.coalesce(principal.user.userid, principal.user.user_display_name, principal.user.email_addresses, target.user.userid, target.user.user_display_name, target.user.email_addresses)
match:
$Process_Name,$User,$Severity,$Action
outcome:
$Count = count(metadata.id)
order:
$Count asc
服务创建
(metadata.event_type = "SERVICE_CREATION" or metadata.event_type = "SERVICE_UNSPECIFIED")
$Username = strings.coalesce(principal.user.userid, principal.user.user_display_name, principal.user.email_addresses)
$Hostname = strings.coalesce(principal.hostname,principal.asset.hostname,intermediary.hostname,target.hostname,target.asset.hostname)
$Application = target.application
$Path = target.process.file.full_path
match:
$Hostname, $Application, $Username, $Path
outcome:
$Count = count(metadata.id)
order:
$Count desc
网络通信
(metadata.event_type = "NETWORK_UNCATEGORIZED"
or metadata.event_type = "NETWORK_FLOW"
or metadata.event_type = "NETWORK_CONNECTION"
or metadata.event_type = "NETWORK_FTP"
or metadata.event_type = "NETWORK_DHCP"
or metadata.event_type = "NETWORK_DNS"
or metadata.event_type = "NETWORK_HTTP"
or metadata.event_type = "NETWORK_SMTP")
$Source_Port = principal.port
$Destination_Port = target.port
$Source_IP = principal.ip
$Destination_IP = target.ip
$Direction = network.direction
$Direction != "UNKNOWN_DIRECTION"
$Hostname = strings.coalesce(principal.hostname,principal.asset.hostname,intermediary.hostname,target.hostname,target.asset.hostname)
$Hostname != ""
$Bytes_Sent = network.sent_bytes
$Bytes_Received = network.received_bytes
match:
$Hostname, $Source_IP, $Source_Port, $Direction, $Destination_IP, $Destination_Port,$Bytes_Sent,$Bytes_Received
outcome:
$Count = count(metadata.id)
order:
$Count desc
身份验证和更改
$Event_Type = metadata.event_type
($Event_Type = "USER_LOGIN" or $Event_Type = "USER_LOGOUT" or $Event_Type = "USER_BADGE_IN" or $Event_Type= "USER_CHANGE_PASSWORD" or $Event_Type = "USER_CHANGE_PERMISSIONS" or $Event_Type = "USER_CREATION" or $Event_Type = "USER_DELETION" or $Event_Type = "USER_RESOURCE_CREATION" or $Event_Type = "USER_RESOURCE_DELETION" or $Event_Type= "USER_RESOURCE_UPDATE_CONTENT" or $Event_Type = "USER_RESOURCE_UPDATE_PERMISSIONS" or $Event_Type = "SERVICE_CREATION" or $Event_Type = "SERVICE_DELETION" or $Event_Type = "SERVICE_MODIFICATION" or $Event_Type = "SETTING_CREATION" or $Event_Type = "SETTING_DELETION" or $Event_Type = "SETTING_MODIFICATION" or $Event_Type = "DEVICE_CONFIG_UPDATE")
$Log_Type = metadata.log_type
$Security_Event_Type = metadata.product_event_type
$Description = strings.coalesce(metadata.description,security_result.description)
$Hostname = strings.coalesce(principal.hostname,principal.asset.hostname,intermediary.hostname,target.hostname,target.asset.hostname)
$Hostname !=""
$Action = security_result.action
match:
$Hostname, $Log_Type, $Event_Type,$Security_Event_Type, $Description, $Action
outcome:
$Count = count(metadata.id)
$Date = timestamp.get_timestamp(max(metadata.event_timestamp.seconds), "%F %T")
order:
$Count desc
网络通信入站地图
(metadata.event_type = "NETWORK_UNCATEGORIZED"
or metadata.event_type = "NETWORK_FLOW"
or metadata.event_type = "NETWORK_CONNECTION"
or metadata.event_type = "NETWORK_FTP"
or metadata.event_type = "NETWORK_DHCP"
or metadata.event_type = "NETWORK_DNS"
or metadata.event_type = "NETWORK_HTTP"
or metadata.event_type = "NETWORK_SMTP")
network.direction = "INBOUND"
$Country = principal.ip_geo_artifact.location.country_or_region
match:
$Country
outcome:
$Latitude = max(principal.ip_geo_artifact.location.region_coordinates.latitude)
$Longitude = max(principal.ip_geo_artifact.location.region_coordinates.longitude)
$Count = count(metadata.id)
创建计划任务
metadata.event_type = "SCHEDULED_TASK_CREATION"
$Username = strings.coalesce(principal.user.userid, principal.user.user_display_name, principal.user.email_addresses)
$Hostname = strings.coalesce(principal.hostname,principal.asset.hostname,intermediary.hostname,target.hostname,target.asset.hostname)
$Task_Name = target.resource.name
match:
$Hostname, $Task_Name, $Username
outcome:
$Count = count(metadata.id)
order:
$Count desc
IAM 安全运维
此信息中心是用于日常监控的简要概览。它侧重于实时异常情况、主动威胁和高风险事件，以便快速检测和响应突发事件。
注意 ： 您可以根据需要使用可用的过滤条件缩小结果范围。
最近删除的用户账号
特权账号登录失败和成功
修改过的唯一身份用户账号总数
用户账号登录次数最多的前 10 名
最近删除的角色
用户事件中被屏蔽的前 10 个来源 IP
首次通过新来源访问
用户访问次数最多的 10 个应用
用户生命周期 KPI
用户事件中被屏蔽次数最多的 10 位用户
密码随时间的变化
角色事件中被屏蔽的前 10 名用户
不可能旅行
已删除的唯一身份用户账号总数
创建的唯一身份用户账号总数
图表名称
查询示例
最近删除的用户账号
metadata.event_type = "USER_DELETION"
security_result.action = "ALLOW"
$Log_Type = metadata.log_type
$Initiator = strings.coalesce(principal.user.windows_sid, principal.user.userid, principal.user.email_addresses)
$User = strings.coalesce(target.user.userid, target.user.email_addresses)
$Date = timestamp.get_timestamp(metadata.event_timestamp.seconds, "%F %T ")
$IP_Address = principal.ip
match:
$Date, $Log_Type, $Initiator, $IP_Address, $User
order:
$Date desc
特权账号登录失败和成功
metadata.event_type = "USER_LOGIN"
strings.coalesce(principal.user.attribute.roles.name, principal.resource.name, target.user.attribute.roles.name, target.resource.name) = /admin/ nocase
if(security_result.action = "ALLOW", "Success", if(security_result.action = "BLOCK", "Failed", "Unknown")) != ""
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
$User = if(strings.coalesce(principal.user.attribute.roles.name, principal.resource.name) = /admin/ nocase, strings.coalesce(principal.user.windows_sid, principal.user.userid, principal.user.email_addresses),
if(strings.coalesce(target.user.attribute.roles.name, target.resource.name) = /admin/ nocase, strings.coalesce(target.user.windows_sid, target.user.userid, target.user.email_addresses), ""))
$Login_Status = if(security_result.action = "ALLOW", "Success", if(security_result.action = "BLOCK", "Failed", "Unknown"))
$Hostname = strings.coalesce(principal.asset.hostname, principal.hostname)
$Privilege_Type = principal.user.attribute.roles.name
$Privilege_Type != ""
$Source_IP = strings.coalesce(principal.asset.ip, principal.ip)
match:
$Date, $User, $Login_Status, $Privilege_Type, $Hostname, $Source_IP
outcome:
$Count = count(metadata.id)
order:
$Date desc
修改过的唯一身份用户账号总数
metadata.event_type = "USER_CHANGE_PERMISSIONS"
or metadata.event_type = "USER_CHANGE_PASSWORD"
or metadata.event_type = "USER_RESOURCE_UPDATE_PERMISSIONS"
security_result.action = "ALLOW"
outcome:
$Count = count_distinct(strings.coalesce(target.user.userid, target.user.email_addresses))
用户账号登录次数最多的前 10 名
metadata.event_type = "USER_LOGIN"
security_result.action = "ALLOW"
$Log_Type = metadata.log_type
$User = target.user.userid
match:
$Log_Type, $User
outcome:
$Count = count(target.user.userid)
order:
$Count desc
limit:
10
最近删除的角色
metadata.product_event_type = /\bDelete.?Role/ nocase
or
(security_result.category_details = /RoleManagement/ nocase
and metadata.product_event_type = /delete role definition/ nocase)
security_result.action = "ALLOW"
$Log_Type = metadata.log_type
$Initiator = strings.coalesce(principal.user.windows_sid, principal.user.userid, principal.user.email_addresses)
$Date = timestamp.get_timestamp(metadata.event_timestamp.seconds, "%F %T ")
$IP_Address = principal.ip
$Role = strings.coalesce(target.user.attribute.roles.name, target.resource.name)
match:
$Date, $Log_Type, $Initiator, $IP_Address, $Role
order:
$Date desc
用户事件中被屏蔽的前 10 个来源 IP
metadata.event_type = "USER_CREATION"
or metadata.event_type = "USER_DELETION"
or metadata.event_type = "USER_CHANGE_PERMISSIONS"
or metadata.event_type = "USER_CHANGE_PASSWORD"
or metadata.event_type = "USER_RESOURCE_UPDATE_PERMISSIONS"
security_result.action = "BLOCK"
$Event_Type = metadata.event_type
$IP_Address = principal.ip
match:
$Event_Type, $IP_Address
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
首次通过新来源访问
metadata.event_type = "USER_LOGIN"
security_result.action = "ALLOW"
$Source_IP = principal.ip
$User = target.user.userid
$Country = principal.location.country_or_region
$City = principal.location.city
$City != ""
$ASN = principal.ip_geo_artifact.network.asn
$ASN != ""
match:
$Source_IP, $User, $Country, $City, $ASN
outcome:
$Count = count(metadata.id)
$FirstTime_Access = earliest(metadata.event_timestamp)
order:
$FirstTime_Access desc
用户访问次数最多的 10 个应用
metadata.event_type = "USER_LOGIN"
security_result.action = "ALLOW"
$Log_Type = metadata.log_type
$Application = target.application
$Application != ""
match:
$Log_Type, $Application
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
用户生命周期 KPI
metadata.event_type = "USER_CREATION"
or metadata.event_type = "USER_DELETION"
or metadata.event_type = "USER_RESOURCE_DELETION"
or metadata.event_type = "RESOURCE_PERMISSIONS_CHANGE"
or metadata.event_type = "USER_CHANGE_PERMISSIONS"
or metadata.event_type = "USER_RESOURCE_UPDATE_PERMISSIONS"
$User_Action = if(metadata.event_type = "USER_CREATION", "Total Creation", if(metadata.event_type = "USER_DELETION" or metadata.event_type = "USER_RESOURCE_DELETION", "Total Deletion", if(metadata.event_type = "RESOURCE_PERMISSIONS_CHANGE" or metadata.event_type = "USER_CHANGE_PERMISSIONS" or metadata.event_type = "USER_RESOURCE_UPDATE_PERMISSIONS", "Total Modification")))
match:
$User_Action
outcome:
$Count = count(metadata.id)
order:
$Count asc
用户事件中被屏蔽次数最多的 10 位用户
metadata.event_type = "USER_CREATION"
or metadata.event_type = "USER_DELETION"
or metadata.event_type = "USER_CHANGE_PERMISSIONS"
or metadata.event_type = "USER_CHANGE_PASSWORD"
or metadata.event_type = "USER_RESOURCE_UPDATE_PERMISSIONS"
security_result.action = "BLOCK"
$Event_Type = metadata.event_type
$User = strings.coalesce(principal.user.windows_sid, principal.user.userid, principal.user.email_addresses)
match:
$Event_Type, $User
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
密码随时间的变化
metadata.event_type = "USER_CHANGE_PASSWORD"
security_result.action = "ALLOW"
$Log_Type = metadata.log_type
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
match:
$Log_Type, $Date
outcome:
$Count = count(metadata.id)
order:
$Date desc
角色事件中被屏蔽的前 10 名用户
(metadata.product_event_type = /Create.?Role/ nocase
or
(security_result.category_details = /RoleManagement/ nocase
and metadata.product_event_type = /add role definition/ nocase))
or
(metadata.product_event_type = /Update.?Role/ nocase
or
(security_result.category_details = /RoleManagement/ nocase
and metadata.product_event_type = /update role definition/ nocase))
or
(metadata.product_event_type = /\bDelete.?Role/ nocase
or
(security_result.category_details = /RoleManagement/ nocase
and metadata.product_event_type = /delete role definition/ nocase))
security_result.action = "BLOCK"
$User = strings.coalesce(principal.user.windows_sid, principal.user.userid, principal.user.email_addresses)
$Event = metadata.product_event_type
match:
$User, $Event
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
不可能旅行
$first_login.metadata.event_type = "USER_LOGIN"
$first_login.security_result.action = "ALLOW"
$first_login.principal.ip_geo_artifact.location.state != "" and $Country1 = $first_login.principal.ip_geo_artifact.location.state
$Time = timestamp.get_timestamp($first_login.metadata.event_timestamp.seconds, "%F %T ")
$User = strings.coalesce($first_login.target.user.userid, $first_login.target.user.email_addresses)
$User != ""
$Latitude1 = $first_login.principal.ip_geo_artifact.location.region_coordinates.latitude
$Longitude1 = $first_login.principal.ip_geo_artifact.location.region_coordinates.longitude
$second_login.metadata.event_type = "USER_LOGIN"
$second_login.security_result.action = "ALLOW"
$second_login.principal.ip_geo_artifact.location.state != "" and $Country2 = $second_login.principal.ip_geo_artifact.location.state
$Time2 = timestamp.get_timestamp($second_login.metadata.event_timestamp.seconds, "%F %T ")
$User = strings.coalesce($second_login.target.user.userid, $second_login.target.user.email_addresses)
$User != ""
$Latitude2 = $second_login.principal.ip_geo_artifact.location.region_coordinates.latitude
$Longitude2 = $second_login.principal.ip_geo_artifact.location.region_coordinates.longitude
$first_login.metadata.event_timestamp.seconds < $second_login.metadata.event_timestamp.seconds
($Latitude1 != $Latitude2)
($Longitude1 != $Longitude2)
match:
$User, $Time, $Country1, $Time2, $Country2 over 1h
outcome:
$distance_kilometers = math.ceil(max(math.geo_distance($Latitude1, $Longitude1, $Latitude2, $Longitude2)) /1000)
condition:
$first_login and $second_login and $distance_kilometers != 0
已删除的唯一身份用户账号总数
metadata.event_type = "USER_DELETION"
security_result.action = "ALLOW"
outcome:
$Count = count_distinct(strings.coalesce(target.user.userid, target.user.email_addresses))
创建的唯一身份用户账号总数
metadata.event_type = "USER_CREATION"
security_result.action = "ALLOW"
outcome:
$Count = count_distinct(strings.coalesce(target.user.userid, target.user.email_addresses))
IDS / IPS 事件概览
此信息中心可全面展示入侵检测和防御系统检测到的安全事件。
按类别划分的 IDS / IPS 事件
按事件数排序的前 10 个 IP 地址
按目的地划分的 IDS / IPS 事件
按来源划分的 IDS / IPS 事件
按规则和操作列出的热门 IDS / IPS 事件
IDS / IPS 事件（按严重程度）随时间的变化情况
10 大 IDS / IPS 高严重程度事件
按签名统计的 IDS / IPS 事件
图表名称
查询示例
按类别划分的 IDS / IPS 事件
$event_type = metadata.event_type
(($event_type = "SCAN_UNCATEGORIZED" or $event_type = "SCAN_NETWORK") or ($event_type >= 16000 and $event_type <= 16007))
$category = security_result.category
$category != "UNKNOWN_CATEGORY"
match:
$category
outcome:
$event_count = count(metadata.id)
order:
$event_count desc
按事件数排序的前 10 个 IP 地址
$event_type = metadata.event_type
(($event_type = "SCAN_UNCATEGORIZED" or $event_type = "SCAN_NETWORK" or $event_type = "SCAN_VULN_NETWORK") or ($event_type >= 16000 and $event_type <= 16007))
$source_ip = principal.ip
$rule_name = security_result.rule_name
$rule_name != ""
$date = timestamp.get_date(metadata.event_timestamp.seconds)
match:
$rule_name, $source_ip
outcome:
$event_count = count(metadata.id)
order:
$event_count desc
limit:
10
按目的地划分的 IDS / IPS 事件
$event_type = metadata.event_type
(($event_type = "SCAN_UNCATEGORIZED" or $event_type = "SCAN_NETWORK" or $event_type = "SCAN_VULN_NETWORK") or ($event_type >= 16000 and $event_type <= 16007))
$vendor = metadata.vendor_name
$destination_ip = target.ip
$action = security_result.action
$rule_name = security_result.rule_name
$rule_name != ""
$security_event_type = metadata.product_event_type
$security_event_type != ""
$security_event_type != /NetworkSecurityGroupFlowEvents|fileinfo|flow/ nocase
match:
$destination_ip, $rule_name, $vendor, $action
outcome:
$event_count = count(metadata.id)
order:
$event_count desc
按来源划分的 IDS / IPS 事件
$event_type = metadata.event_type
(($event_type = "SCAN_UNCATEGORIZED" or $event_type = "SCAN_NETWORK" or $event_type = "SCAN_VULN_NETWORK") or ($event_type >= 16000 and $event_type <= 16007))
$action = security_result.action
$action != "UNKNOWN_ACTION"
$hostname = principal.hostname
$rule_name = strings.coalesce(security_result.rule_name, metadata.description)
$rule_name != ""
$vendor = metadata.vendor_name
$security_event_type = metadata.product_event_type
$security_event_type != ""
$security_event_type != /NetworkSecurityGroupFlowEvents|fileinfo|flow/ nocase
match:
$hostname, $rule_name, $vendor, $action
outcome:
$event_count = count(metadata.id)
order:
$event_count desc
按规则和操作列出的热门 IDS / IPS 事件
$event_type = metadata.event_type
(($event_type = "SCAN_UNCATEGORIZED" or $event_type = "SCAN_NETWORK") or ($event_type >= 16000 and $event_type <= 16007))
$rule_name = security_result.rule_name
not $rule_name in %known_signatures
$rule_name != ""
$action = security_result.action
$action != "UNKNOWN_ACTION"
match:
$rule_name, $action
outcome:
$event_count = count(metadata.id)
order:
$event_count desc
IDS / IPS 事件（按严重程度）随时间的变化情况
$event_type = metadata.event_type
(($event_type = "SCAN_UNCATEGORIZED" or $event_type = "SCAN_NETWORK") or ($event_type >= 16000 and $event_type <= 16007))
$severity = security_result.severity
$severity != "UNKNOWN_SEVERITY"
$date = timestamp.get_date(metadata.event_timestamp.seconds)
match:
$severity, $date
outcome:
$event_count = count(metadata.id)
order:
$date asc
10 大 IDS / IPS 高严重程度事件
$event_type = metadata.event_type
(($event_type = "SCAN_UNCATEGORIZED" or $event_type = "SCAN_NETWORK") or ($event_type >= 16000 and $event_type <= 16007))
$action = security_result.action
$rule_name = strings.coalesce(security_result.rule_name, metadata.description)
$rule_name != ""
$severity = security_result.severity
$severity = "HIGH"
match:
$rule_name, $action
outcome:
$event_count = count(metadata.id)
order:
$event_count desc
limit:
10
按签名统计的 IDS / IPS 事件
$event_type = metadata.event_type
(($event_type = "SCAN_UNCATEGORIZED" or $event_type = "SCAN_NETWORK") or ($event_type >= 16000 and $event_type <= 16007))
$destination_ip = target.ip
$source_ip = principal.ip
$action = security_result.action
$rule_name = security_result.rule_name
$rule_name != ""
$date = timestamp.get_date(metadata.event_timestamp.seconds)
match:
$rule_name , $source_ip , $destination_ip , $action
outcome:
$event_count = count(metadata.id)
order:
$event_count desc
ISO27001 - 组织控制措施
此信息中心可根据 ISO 27001 标准，直观呈现组织的安全控制和合规性表现。它可帮助安全团队监控控制措施的实施情况、跟踪审核结果，并找出需要改进的方面。通过集中显示关键合规性指标，该信息中心有助于组织持续满足 ISO 27001 要求，并加强组织整体的信息安全管理。注意：此信息中心需要使用过滤条件。
按严重程度划分的数据泄露防护违规行为
前 10 大数据泄露防护规则
近期创建、修改和删除的角色
近期的权限变更
按原因划分的随时间变化的被屏蔽网络流量
用户事件随时间的变化趋势
访问次数最多的 10 个应用
按流量排序的前 10 个出站 IP
一段时间内的设备数
密码随时间的变化
图表名称
查询示例
按严重程度划分的数据泄露防护违规行为
strings.coalesce(metadata.product_event_type, security_result.rule_name, security_result.summary, metadata.description) = /Violation/ nocase
$Severity = security_result.severity
$Severity != "UNKNOWN_SEVERITY"
match:
$Severity
outcome:
$Count = count(metadata.id)
order:
$Count desc
前 10 大数据泄露防护规则
strings.coalesce(metadata.product_event_type, security_result.rule_name, security_result.summary, metadata.description) = /Violation/ nocase
$Violation = strings.coalesce(security_result.rule_name, metadata.product_event_type, security_result.summary, metadata.description)
match:
$Violation
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
近期创建、修改和删除的角色
metadata.product_event_type = /CreateRole|add role definition/ nocase
or metadata.product_event_type = /UpdateRole|update role(?: definition)?/ nocase
or metadata.product_event_type = /DeleteRole|delete role definition/ nocase
security_result.action = "ALLOW"
$Date = timestamp.get_timestamp(metadata.event_timestamp.seconds)
$Product_Event = metadata.product_event_type
$Source_IP = strings.coalesce(principal.asset.ip, principal.ip)
$Hostname = strings.coalesce(principal.asset.hostname, principal.hostname)
$Initiator = principal.user.userid
$Role = strings.coalesce(target.user.attribute.roles.name, target.resource.product_object_id, target.resource.name)
match:
$Date, $Product_Event, $Source_IP, $Hostname, $Initiator, $Role
order:
$Date desc
近期的权限变更
metadata.event_type = "RESOURCE_PERMISSIONS_CHANGE"
or metadata.event_type = "USER_CHANGE_PERMISSIONS"
or metadata.event_type = "USER_RESOURCE_UPDATE_PERMISSIONS"
security_result.action = "ALLOW"
$Date = timestamp.get_timestamp(metadata.event_timestamp.seconds)
$Log_Source = metadata.log_type
$Source_IP = strings.coalesce(principal.asset.ip, principal.ip)
$Hostname = strings.coalesce(principal.asset.hostname, principal.hostname)
$Initiator = principal.user.userid
$Description = metadata.description
match:
$Date, $Log_Source, $Source_IP, $Hostname, $Initiator, $Description
order:
$Date desc
按原因划分的随时间变化的被屏蔽网络流量
metadata.event_type = "NETWORK_UNCATEGORIZED"
or metadata.event_type = "NETWORK_FLOW"
or metadata.event_type = "NETWORK_CONNECTION"
or metadata.event_type = "NETWORK_FTP"
or metadata.event_type = "NETWORK_DHCP"
or metadata.event_type = "NETWORK_DNS"
or metadata.event_type = "NETWORK_HTTP"
or metadata.event_type = "NETWORK_SMTP"
security_result.action = "BLOCK"
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
$Reason = security_result.summary
match:
$Date, $Reason
outcome:
$Count = count(metadata.id)
order:
$Date desc
用户事件随时间的变化趋势
metadata.event_type = "USER_CREATION"
or metadata.event_type = "USER_DELETION"
or metadata.event_type = "USER_CHANGE_PERMISSIONS"
or metadata.event_type = "USER_CHANGE_PASSWORD"
or metadata.event_type = "USER_RESOURCE_UPDATE_PERMISSIONS"
security_result.action = "ALLOW"
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
$Event_Type = metadata.event_type
match:
$Date, $Event_Type
outcome:
$Count = count(metadata.id)
order:
$Date desc
访问次数最多的 10 个应用
$Log_Type = metadata.log_type
$Application = target.application
$Application != ""
match:
$Log_Type, $Application
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
按流量排序的前 10 个出站 IP
network.direction = "OUTBOUND"
$Log_Type = metadata.log_type
$Destination_IP = target.ip
match:
$Log_Type, $Destination_IP
outcome:
$Total_Bytes = sum(network.received_bytes + network.sent_bytes)/(1000*1000*1000)
order:
$Total_Bytes desc
limit:
10
一段时间内的设备数
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
$Device = group(principal.asset.hostname, principal.hostname, target.asset.hostname, target.hostname)
match:
$Date
outcome:
$Count = count_distinct($Device)
order:
$Date desc
密码随时间的变化
metadata.event_type = "USER_CHANGE_PASSWORD"
security_result.action = "ALLOW"
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
$Log_Type = metadata.log_type
match:
$Date, $Log_Type
outcome:
$Count = count(metadata.id)
order:
$Date desc
ISO27001 - 物理控制
此信息中心集中显示了有关实体安全类别合规性的数据，可让安全团队清晰了解控制措施的有效性。它会显示有关访问权限控制效力和可移动媒体事件的关键指标，这些指标对于快速识别漏洞和确定补救工作的优先级至关重要。借助该信息中心，您可以根据数据做出决策，以降低风险并持续改进组织在实体安全方面的状况，使其符合 ISO 27001 标准。
按严重程度划分的远程访问
近期可移动媒体事件
用户在一段时间内的刷卡情况
最近 10 次用户签到的徽章
10 大传感器位置
随时间变化的传感器位置
图表名称
查询示例
按严重程度划分的远程访问
metadata.event_type = "NETWORK_CONNECTION"
target.port = 22
or target.port = 3389
$Severity = security_result.severity
$Severity != "UNKNOWN_SEVERITY"
match:
$Severity
outcome:
$Count = count(metadata.id)
order:
$Count desc
近期可移动媒体事件
strings.coalesce(metadata.product_event_type, security_result.summary) = /\busb\b/ nocase
$Date = timestamp.get_timestamp(metadata.event_timestamp.seconds)
$USB_Event = strings.coalesce(metadata.product_event_type, security_result.summary)
$Category = strings.coalesce(security_result.category_details, security_result.detection_fields["Category"])
$Source_IP = strings.coalesce(principal.asset.ip, principal.ip)
$Hostname = strings.coalesce(principal.asset.hostname, principal.hostname)
$User = strings.coalesce(principal.user.userid, principal.user.user_display_name, principal.user.email_addresses, target.user.userid, target.user.user_display_name, target.user.email_addresses)
match:
$Date, $USB_Event, $User, $Hostname, $Source_IP, $Category
order:
$Date desc
用户在一段时间内的刷卡情况
metadata.event_type = "USER_BADGE_IN"
or metadata.event_type = "USER_RESOURCE_ACCESS"
or metadata.event_type = "USER_UNCATEGORIZED"
strings.coalesce(metadata.description, security_result.action_details, security_result.description, security_result.summary, additional.fields["plasectrxEvtypename"]) = /(?:access\sgranted|badge\sin)/ nocase
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
match:
$Date
outcome:
$Count = count(metadata.id)
order:
$Date desc
最近 10 次用户签到的徽章
metadata.event_type = "USER_BADGE_IN"
or metadata.event_type = "USER_RESOURCE_ACCESS"
or metadata.event_type = "USER_UNCATEGORIZED"
strings.coalesce(metadata.description, security_result.action_details, security_result.description, security_result.summary, additional.fields["plasectrxEvtypename"]) = /(?:access\sgranted|badge\sin)/ nocase
$User = strings.coalesce(principal.user.user_display_name, principal.user.email_addresses, additional.fields["person"], principal.user.userid)
$Location = strings.coalesce(security_result.rule_labels["Place"], additional.fields["site"], target.location.name, principal.resource.name)
$Date = timestamp.get_timestamp(metadata.event_timestamp.seconds)
match:
$Date, $User, $Location
order:
$Date desc
limit:
10
10 大传感器位置
metadata.event_type = "USER_BADGE_IN"
or metadata.event_type = "USER_RESOURCE_ACCESS"
or metadata.event_type = "USER_UNCATEGORIZED"
$Location = strings.coalesce(security_result.rule_labels["Place"], additional.fields["site"], target.location.name, principal.resource.name)
$Location != ""
match:
$Location
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
随时间变化的传感器位置
metadata.event_type = "USER_BADGE_IN"
or metadata.event_type = "USER_RESOURCE_ACCESS"
or metadata.event_type = "USER_UNCATEGORIZED"
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
$Location = strings.coalesce(security_result.rule_labels["Place"], additional.fields["site"], target.location.name, principal.resource.name)
$Location != ""
match:
$Date, $Location
outcome:
$Count = count(metadata.id)
order:
$Date desc
离地攻击活动
此信息中心可提供关键数据分析，帮助您了解攻击者可能滥用受信任的系统工具和进程的情况。此信息中心可跟踪并直观呈现与 rundll32、regsvr32、mshta.exe 等系统实用程序相关的活动，这些实用程序通常会被高级威胁利用来躲避检测。
可疑的 msiexec 执行
可疑的 mshta.exe 进程创建
可疑的 Regsvr32 执行
由 Rundll32.exe 发起的出站连接
可疑的 Rundll32 执行
可疑的 CertUtil 命令
可疑的 WMI 脚本
可疑的 Regsvr32 网络连接
图表名称
查询示例
可疑的 msiexec 执行
metadata.event_type = "PROCESS_UNCATEGORIZED"
or metadata.event_type = "PROCESS_LAUNCH"
or metadata.event_type = "PROCESS_INJECTION"
or metadata.event_type = "PROCESS_PRIVILEGE_ESCALATION"
or metadata.event_type = "PROCESS_TERMINATION"
or metadata.event_type = "PROCESS_OPEN"
or metadata.event_type = "PROCESS_MODULE_LOAD"
target.process.file.full_path = /msiexec/
target.process.command_line = /:\/\//
$Hostname = principal.hostname
$Parent_Process = principal.process.file.full_path
$Target_Process = target.process.file.full_path
$Command_Line = target.process.command_line
$Timestamp = timestamp.get_timestamp(metadata.event_timestamp.seconds)
match:
$Hostname, $Parent_Process, $Target_Process, $Command_Line, $Timestamp
order:
$Timestamp desc
limit:
50
可疑的 mshta.exe 进程创建
metadata.event_type = "PROCESS_UNCATEGORIZED"
or metadata.event_type = "PROCESS_LAUNCH"
or metadata.event_type = "PROCESS_INJECTION"
or metadata.event_type = "PROCESS_PRIVILEGE_ESCALATION"
or metadata.event_type = "PROCESS_TERMINATION"
or metadata.event_type = "PROCESS_OPEN"
or metadata.event_type = "PROCESS_MODULE_LOAD"
principal.process.file.full_path = /(cmd|cscript|powershell|pwsh|regsvr32|rundll32|wscript)\.exe/
target.process.file.full_path = /mshta.exe/
$Hostname = principal.hostname
$Parent_Process = principal.process.file.full_path
$Target_Process = target.process.file.full_path
$Command_Line = target.process.command_line
$timestamp = timestamp.get_timestamp(metadata.event_timestamp.seconds)
match:
$Hostname, $Parent_Process, $Target_Process, $Command_Line, $timestamp
order:
$timestamp desc
limit:
50
可疑的 Regsvr32 执行
metadata.event_type = "PROCESS_UNCATEGORIZED"
or metadata.event_type = "PROCESS_LAUNCH"
or metadata.event_type = "PROCESS_INJECTION"
or metadata.event_type = "PROCESS_PRIVILEGE_ESCALATION"
or metadata.event_type = "PROCESS_TERMINATION"
or metadata.event_type = "PROCESS_OPEN"
or metadata.event_type = "PROCESS_MODULE_LOAD"
target.process.command_line = /regsvr32/ nocase
target.process.command_line = /ProgramData|Temp\b|Users\\Public|Windows\\Temp|AppData\\Local\\Temp|AppData\\Roaming/ nocase
$Hostname = principal.hostname
$Parent_Process = principal.process.file.full_path
$Target_Process = target.process.file.full_path
$Command_Line = target.process.command_line
$timestamp = timestamp.get_timestamp(metadata.event_timestamp.seconds)
match:
$Hostname, $Parent_Process, $Target_Process, $Command_Line, $timestamp
order:
$timestamp desc
limit:
50
由 Rundll32.exe 发起的出站连接
metadata.event_type = "NETWORK_CONNECTION"
principal.process.file.full_path = /rundll32/ nocase
network.direction = "OUTBOUND"
target.ip != /^(10\b|127|192\.168|172\.(1[6-9]|2[0-9]|3[01]))/
principal.process.command_line != /PcaSvc\.dll|PcaPatchSdbTask/ nocase
$Hostname = principal.hostname
$Process_Name = principal.process.file.full_path
$Destination_IP = target.ip
$Command_Line = principal.process.command_line
$timestamp = timestamp.get_timestamp(metadata.event_timestamp.seconds)
match:
$Hostname, $Process_Name, $Destination_IP, $Command_Line, $timestamp
order:
$timestamp desc
limit:
50
可疑的 Rundll32 执行
metadata.event_type = "PROCESS_UNCATEGORIZED"
or metadata.event_type = "PROCESS_LAUNCH"
or metadata.event_type = "PROCESS_INJECTION"
or metadata.event_type = "PROCESS_PRIVILEGE_ESCALATION"
or metadata.event_type = "PROCESS_TERMINATION"
or metadata.event_type = "PROCESS_OPEN"
or metadata.event_type = "PROCESS_MODULE_LOAD"
principal.process.command_line != /Shell32\.dll|Control_RunDLL|\.cpl/ nocase
target.process.command_line = /rundll32.*(javascript|\.RegisterXLL|OpenURL|OpenURLA|FileProtocolHandler|(url|zipfldr|shell32|mshtml|advpack|ieadvpack|ieframe|shdocvw|syssetup|setupapi|pcwutl|dfshim|scrobj|shimgvw|comsvcs)\.dll|RouteTheCall|Control_RunDLL|ShellExec_RunDLL|PrintHTML|LaunchINFSection|RegisterOCX|SetupInfObjectInstallAction|InstallHinfSection|LaunchApplication|ShOpenVerbApplication|http|ImageView_Fullscreen|MiniDump)/ nocase
$Hostname = principal.hostname
$Parent_Process = strings.coalesce(principal.process.file.full_path, principal.file.full_path)
$Target_Process = strings.coalesce(target.process.file.full_path, target.file.full_path)
$Command_Line = target.process.command_line
$timestamp = timestamp.get_timestamp(metadata.event_timestamp.seconds)
match:
$Hostname, $Parent_Process, $Target_Process, $Command_Line, $timestamp
order:
$timestamp desc
limit:
50
可疑的 CertUtil 命令
target.process.command_line = /certutil.*(decode|encode|urlcache|verifyctl|encodehex|decodehex)/
$Hostname = principal.hostname
$Parent_Process = principal.process.file.full_path
$Target_Process = target.process.file.full_path
$Command_Line = target.process.command_line
$Timestamp = timestamp.get_timestamp(metadata.event_timestamp.seconds)
match:
$Hostname, $Parent_Process, $Target_Process, $Command_Line, $Timestamp
order:
$Timestamp desc
limit:
50
可疑的 WMI 脚本
target.process.command_line = /(jscript|vbscript)\.dll|format:/
target.process.file.full_path = /wmi.*\.exe/ nocase
$Hostname = principal.hostname
$Parent_Process = principal.process.file.full_path
$Target_Process = target.process.file.full_path
$Command_Line = target.process.command_line
$Timestamp = timestamp.get_timestamp(metadata.event_timestamp.seconds)
match:
$Hostname, $Parent_Process, $Target_Process, $Command_Line, $Timestamp
order:
$Timestamp
limit:
50
可疑的 Regsvr32 网络连接
metadata.event_type = "NETWORK_CONNECTION"
principal.process.file.full_path = /regsvr32/
target.ip != /^(10\b|127|169\.254|172\.16|224|100\.64|198\.(18|51\.100)|203\.0\.113|240|192\.(0\.2|0\.0\.(8|9|10|170|171)|0|31\.196|52\.193|168|88\.99|175\.48))/
$Hostname = principal.hostname
$Process_Name = principal.process.file.full_path
$Command_Line = principal.process.command_line
$Destination_IP = target.ip
$timestamp = timestamp.get_timestamp(metadata.event_timestamp.seconds)
match:
$Hostname, $Process_Name, $Destination_IP, $Command_Line, $timestamp
order:
$timestamp desc
limit:
50
带有 MITRE ATT&CK 标记的事件
此信息中心基于 MITRE ATT&CK 框架提供检测活动概览，跟踪检测情况并突出显示趋势，以识别新出现的威胁。它通过展示和映射策略、技术和流程 (TTP)，增强威胁检测和响应能力，并确保主动防御网络威胁，帮助组织和安全团队更好地了解其环境。
新策略和新技巧 - 过去 7 天
随时间变化的技巧趋势
10 大已识别的技术
策略随时间变化的趋势
按策略划分的供应商提醒总数
用户发现的策略
按主机名识别的技术
按主机名识别的策略
用户发现的技术
MITRE 事件的严重程度分布
按战术和技术划分的赛事
图表名称
查询示例
新策略和新技巧 - 过去 7 天
strings.coalesce(security_result.attack_details.tactics.id, security_result.detection_fields["Tactic ID"]) != ""
strings.coalesce(security_result.attack_details.tactics.name, security_result.detection_fields["Tactic"]) != ""
strings.coalesce(security_result.attack_details.techniques.id, security_result.detection_fields["Technique ID"]) != ""
strings.coalesce(security_result.attack_details.techniques.name, security_result.detection_fields["Technique"]) != ""
$Tactic = strings.concat(strings.coalesce(security_result.attack_details.tactics.id, security_result.detection_fields["Tactic ID"])," - ", strings.coalesce(security_result.attack_details.tactics.name, security_result.detection_fields["Tactic"]))
$Tactic != "-"
$Technique = strings.concat(strings.coalesce(security_result.attack_details.techniques.id, security_result.detection_fields["Technique ID"])," - ", strings.coalesce(security_result.attack_details.techniques.name, security_result.detection_fields["Technique"]))
$Technique != "-"
match:
$Tactic, $Technique
outcome:
$First_Seen = timestamp.get_timestamp(min(metadata.event_timestamp.seconds), "%F %T")
$Last_Seen = timestamp.get_timestamp(max(metadata.event_timestamp.seconds), "%F %T")
$Diff_First_Seen = timestamp.diff(timestamp.current_seconds(), min(metadata.event_timestamp.seconds), "DAY")
order:
$Diff_First_Seen asc
随时间变化的技巧趋势
strings.coalesce(security_result.attack_details.techniques.id, security_result.detection_fields["Technique ID"]) != ""
strings.coalesce(security_result.attack_details.techniques.name, security_result.detection_fields["Technique"]) != ""
$Technique = strings.concat(strings.coalesce(security_result.attack_details.techniques.id, security_result.detection_fields["Technique ID"])," - ", strings.coalesce(security_result.attack_details.techniques.name, security_result.detection_fields["Technique"]))
$Technique != "-"
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
match:
$Date, $Technique
outcome:
$Count = count(strings.coalesce(security_result.attack_details.techniques.name, security_result.detection_fields["Technique"]))
order:
$Date asc
10 大已识别的技术
strings.coalesce(security_result.attack_details.techniques.id, security_result.detection_fields["Technique ID"]) != ""
strings.coalesce(security_result.attack_details.techniques.name, security_result.detection_fields["Technique"]) != ""
$Technique = strings.concat(strings.coalesce(security_result.attack_details.techniques.id, security_result.detection_fields["Technique ID"])," - ", strings.coalesce(security_result.attack_details.techniques.name, security_result.detection_fields["Technique"]))
$Technique != "-"
match:
$Technique
outcome:
$Count = count(strings.concat(strings.coalesce(security_result.attack_details.techniques.id, security_result.detection_fields["Technique ID"])," - ", strings.coalesce(security_result.attack_details.techniques.name, security_result.detection_fields["Technique"])))
order:
$Count desc
limit:
10
10 大已识别的技术
strings.coalesce(security_result.attack_details.techniques.id, security_result.detection_fields["Technique ID"]) != ""
strings.coalesce(security_result.attack_details.techniques.name, security_result.detection_fields["Technique"]) != ""
$Technique = strings.concat(strings.coalesce(security_result.attack_details.techniques.id, security_result.detection_fields["Technique ID"])," - ", strings.coalesce(security_result.attack_details.techniques.name, security_result.detection_fields["Technique"]))
$Technique != "-"
match:
$Technique
outcome:
$Count = count(strings.concat(strings.coalesce(security_result.attack_details.techniques.id, security_result.detection_fields["Technique ID"])," - ", strings.coalesce(security_result.attack_details.techniques.name, security_result.detection_fields["Technique"])))
order:
$Count desc
limit:
10
策略随时间变化的趋势
strings.coalesce(security_result.attack_details.tactics.id, security_result.detection_fields["Tactic ID"]) != ""
strings.coalesce(security_result.attack_details.tactics.name, security_result.detection_fields["Tactic"]) != ""
$Tactic = strings.concat(strings.coalesce(security_result.attack_details.tactics.id, security_result.detection_fields["Tactic ID"])," - ", strings.coalesce(security_result.attack_details.tactics.name, security_result.detection_fields["Tactic"]))
$Tactic != "-"
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
match:
$Date, $Tactic
outcome:
$Count = count(strings.coalesce(security_result.attack_details.tactics.name, security_result.detection_fields["Tactic"]))
order:
$Date asc
策略随时间变化的趋势
strings.coalesce(security_result.attack_details.tactics.id, security_result.detection_fields["Tactic ID"]) != ""
strings.coalesce(security_result.attack_details.tactics.name, security_result.detection_fields["Tactic"]) != ""
$Tactic = strings.concat(strings.coalesce(security_result.attack_details.tactics.id, security_result.detection_fields["Tactic ID"])," - ", strings.coalesce(security_result.attack_details.tactics.name, security_result.detection_fields["Tactic"]))
$Tactic != "-"
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
match:
$Date, $Tactic
outcome:
$Count = count(strings.coalesce(security_result.attack_details.tactics.name, security_result.detection_fields["Tactic"]))
order:
$Date asc
按策略划分的供应商提醒总数
strings.coalesce(security_result.attack_details.tactics.id, security_result.detection_fields["Tactic ID"]) != ""
strings.coalesce(security_result.attack_details.tactics.name, security_result.detection_fields["Tactic"]) != ""
$Tactic = strings.concat(strings.coalesce(security_result.attack_details.tactics.id, security_result.detection_fields["Tactic ID"])," - ", strings.coalesce(security_result.attack_details.tactics.name, security_result.detection_fields["Tactic"]))
$Tactic != "-"
$Alert = strings.coalesce(security_result.rule_name, security_result.threat_name, security_result.summary, security_result.description)
match:
$Tactic, $Alert
outcome:
$Count = count(strings.concat(strings.coalesce(security_result.attack_details.tactics.id, security_result.detection_fields["Tactic ID"])," - ", strings.coalesce(security_result.attack_details.tactics.name, security_result.detection_fields["Tactic"])))
order:
$Tactic asc
用户发现的策略
strings.coalesce(security_result.attack_details.tactics.id, security_result.detection_fields["Tactic ID"]) != ""
strings.coalesce(security_result.attack_details.tactics.name, security_result.detection_fields["Tactic"]) != ""
$Tactic = strings.concat(strings.coalesce(security_result.attack_details.tactics.id, security_result.detection_fields["Tactic ID"])," - ", strings.coalesce(security_result.attack_details.tactics.name, security_result.detection_fields["Tactic"]))
$Tactic != "-"
$Username = strings.coalesce(principal.user.user_display_name, principal.user.userid)
$Username != ""
$Hostname = strings.coalesce(principal.hostname, principal.asset.hostname)
$Hostname != ""
match:
$Username, $Hostname, $Tactic
outcome:
$Count = count(strings.concat(strings.coalesce(security_result.attack_details.tactics.id, security_result.detection_fields["Tactic ID"])," - ", strings.coalesce(security_result.attack_details.tactics.name, security_result.detection_fields["Tactic"])))
order:
$Count desc
按主机名识别的技术
strings.coalesce(security_result.attack_details.techniques.id, security_result.detection_fields["Technique ID"]) != ""
strings.coalesce(security_result.attack_details.techniques.name, security_result.detection_fields["Technique"]) != ""
$Technique = strings.concat(strings.coalesce(security_result.attack_details.techniques.id, security_result.detection_fields["Technique ID"])," - ", strings.coalesce(security_result.attack_details.techniques.name, security_result.detection_fields["Technique"]))
$Technique != "-"
$Hostname = strings.coalesce(principal.hostname, principal.asset.hostname)
$Hostname != ""
$IP_Address = strings.coalesce(principal.ip, principal.asset.ip)
match:
$Hostname, $IP_Address, $Technique
outcome:
$Count = count(strings.concat(strings.coalesce(security_result.attack_details.techniques.id, security_result.detection_fields["Technique ID"])," - ", strings.coalesce(security_result.attack_details.techniques.name, security_result.detection_fields["Technique"])))
order:
$Count desc
按主机名识别的技术
strings.coalesce(security_result.attack_details.techniques.id, security_result.detection_fields["Technique ID"]) != ""
strings.coalesce(security_result.attack_details.techniques.name, security_result.detection_fields["Technique"]) != ""
$Technique = strings.concat(strings.coalesce(security_result.attack_details.techniques.id, security_result.detection_fields["Technique ID"])," - ", strings.coalesce(security_result.attack_details.techniques.name, security_result.detection_fields["Technique"]))
$Technique != "-"
$Hostname = strings.coalesce(principal.hostname, principal.asset.hostname)
$Hostname != ""
$IP_Address = strings.coalesce(principal.ip, principal.asset.ip)
match:
$Hostname, $IP_Address, $Technique
outcome:
$Count = count(strings.concat(strings.coalesce(security_result.attack_details.techniques.id, security_result.detection_fields["Technique ID"])," - ", strings.coalesce(security_result.attack_details.techniques.name, security_result.detection_fields["Technique"])))
order:
$Count desc
按主机名识别的策略
strings.coalesce(security_result.attack_details.tactics.id, security_result.detection_fields["Tactic ID"]) != ""
strings.coalesce(security_result.attack_details.tactics.name, security_result.detection_fields["Tactic"]) != ""
$Tactic = strings.concat(strings.coalesce(security_result.attack_details.tactics.id, security_result.detection_fields["Tactic ID"])," - ", strings.coalesce(security_result.attack_details.tactics.name, security_result.detection_fields["Tactic"]))
$Tactic != "-"
$Hostname = strings.coalesce(principal.hostname, principal.asset.hostname)
$Hostname != ""
$IP_Address = strings.coalesce(principal.ip, principal.asset.ip)
match:
$Hostname, $IP_Address, $Tactic
outcome:
$Count = count(strings.concat(strings.coalesce(security_result.attack_details.tactics.id, security_result.detection_fields["Tactic ID"])," - ", strings.coalesce(security_result.attack_details.tactics.name, security_result.detection_fields["Tactic"])))
order:
$Count desc
用户发现的技术
strings.coalesce(security_result.attack_details.techniques.id, security_result.detection_fields["Technique ID"]) != ""
strings.coalesce(security_result.attack_details.techniques.name, security_result.detection_fields["Technique"]) != ""
strings.coalesce(principal.user.user_display_name, principal.user.userid) != ""
strings.coalesce(principal.hostname, principal.asset.hostname) != ""
$Technique = strings.concat(strings.coalesce(security_result.attack_details.techniques.id, security_result.detection_fields["Technique ID"])," - ", strings.coalesce(security_result.attack_details.techniques.name, security_result.detection_fields["Technique"]))
$Technique != "-"
$Username = strings.coalesce(principal.user.user_display_name, principal.user.userid)
$Hostname = strings.coalesce(principal.hostname, principal.asset.hostname)
match:
$Username, $Hostname, $Technique
outcome:
$Count = count(strings.concat(strings.coalesce(security_result.attack_details.techniques.id, security_result.detection_fields["Technique ID"])," - ", strings.coalesce(security_result.attack_details.techniques.name, security_result.detection_fields["Technique"])))
order:
$Count desc
用户发现的技术
strings.coalesce(security_result.attack_details.techniques.id, security_result.detection_fields["Technique ID"]) != ""
strings.coalesce(security_result.attack_details.techniques.name, security_result.detection_fields["Technique"]) != ""
strings.coalesce(principal.user.user_display_name, principal.user.userid) != ""
strings.coalesce(principal.hostname, principal.asset.hostname) != ""
$Technique = strings.concat(strings.coalesce(security_result.attack_details.techniques.id, security_result.detection_fields["Technique ID"])," - ", strings.coalesce(security_result.attack_details.techniques.name, security_result.detection_fields["Technique"]))
$Technique != "-"
$Username = strings.coalesce(principal.user.user_display_name, principal.user.userid)
$Hostname = strings.coalesce(principal.hostname, principal.asset.hostname)
match:
$Username, $Hostname, $Technique
outcome:
$Count = count(strings.concat(strings.coalesce(security_result.attack_details.techniques.id, security_result.detection_fields["Technique ID"])," - ", strings.coalesce(security_result.attack_details.techniques.name, security_result.detection_fields["Technique"])))
order:
$Count desc
按策略划分的供应商提醒总数
strings.coalesce(security_result.attack_details.tactics.id, security_result.detection_fields["Tactic ID"]) != ""
strings.coalesce(security_result.attack_details.tactics.name, security_result.detection_fields["Tactic"]) != ""
$Tactic = strings.concat(strings.coalesce(security_result.attack_details.tactics.id, security_result.detection_fields["Tactic ID"])," - ", strings.coalesce(security_result.attack_details.tactics.name, security_result.detection_fields["Tactic"]))
$Tactic != "-"
$Alert = strings.coalesce(security_result.rule_name, security_result.threat_name, security_result.summary, security_result.description)
match:
$Tactic, $Alert
outcome:
$Count = count(strings.concat(strings.coalesce(security_result.attack_details.tactics.id, security_result.detection_fields["Tactic ID"])," - ", strings.coalesce(security_result.attack_details.tactics.name, security_result.detection_fields["Tactic"])))
order:
$Tactic asc
新策略和新技巧 - 过去 7 天
strings.coalesce(security_result.attack_details.tactics.id, security_result.detection_fields["Tactic ID"]) != ""
strings.coalesce(security_result.attack_details.tactics.name, security_result.detection_fields["Tactic"]) != ""
strings.coalesce(security_result.attack_details.techniques.id, security_result.detection_fields["Technique ID"]) != ""
strings.coalesce(security_result.attack_details.techniques.name, security_result.detection_fields["Technique"]) != ""
$Tactic = strings.concat(strings.coalesce(security_result.attack_details.tactics.id, security_result.detection_fields["Tactic ID"])," - ", strings.coalesce(security_result.attack_details.tactics.name, security_result.detection_fields["Tactic"]))
$Tactic != "-"
$Technique = strings.concat(strings.coalesce(security_result.attack_details.techniques.id, security_result.detection_fields["Technique ID"])," - ", strings.coalesce(security_result.attack_details.techniques.name, security_result.detection_fields["Technique"]))
$Technique != "-"
match:
$Tactic, $Technique
outcome:
$First_Seen = timestamp.get_timestamp(min(metadata.event_timestamp.seconds), "%F %T")
$Last_Seen = timestamp.get_timestamp(max(metadata.event_timestamp.seconds), "%F %T")
$First_Seen_Time = min(metadata.event_timestamp.seconds)
$Last_Seen_Time = max(metadata.event_timestamp.seconds)
$Diff_First_Seen = math.round(($Last_Seen_Time - $First_Seen_Time)/86400)
order:
$Diff_First_Seen asc
unselect:
$First_Seen_Time, $Last_Seen_Time
按主机名识别的策略
strings.coalesce(security_result.attack_details.tactics.id, security_result.detection_fields["Tactic ID"]) != ""
strings.coalesce(security_result.attack_details.tactics.name, security_result.detection_fields["Tactic"]) != ""
$Tactic = strings.concat(strings.coalesce(security_result.attack_details.tactics.id, security_result.detection_fields["Tactic ID"])," - ", strings.coalesce(security_result.attack_details.tactics.name, security_result.detection_fields["Tactic"]))
$Tactic != "-"
$Hostname = strings.coalesce(principal.hostname, principal.asset.hostname)
$Hostname != ""
$IP_Address = strings.coalesce(principal.ip, principal.asset.ip)
match:
$Hostname, $IP_Address, $Tactic
outcome:
$Count = count(strings.concat(strings.coalesce(security_result.attack_details.tactics.id, security_result.detection_fields["Tactic ID"])," - ", strings.coalesce(security_result.attack_details.tactics.name, security_result.detection_fields["Tactic"])))
order:
$Count desc
MITRE 事件的严重程度分布
strings.coalesce(security_result.attack_details.techniques.id, security_result.detection_fields["Technique ID"]) != ""
strings.coalesce(security_result.attack_details.techniques.name, security_result.detection_fields["Technique"]) != ""
$Severity = security_result.severity
match:
$Severity
outcome:
$Count = count(strings.concat(strings.coalesce(security_result.attack_details.techniques.id, security_result.detection_fields["Technique ID"])," - ", strings.coalesce(security_result.attack_details.techniques.name, security_result.detection_fields["Technique"])))
order:
$Count desc
随时间变化的技巧趋势
strings.coalesce(security_result.attack_details.techniques.id, security_result.detection_fields["Technique ID"]) != ""
strings.coalesce(security_result.attack_details.techniques.name, security_result.detection_fields["Technique"]) != ""
$Technique = strings.concat(strings.coalesce(security_result.attack_details.techniques.id, security_result.detection_fields["Technique ID"])," - ", strings.coalesce(security_result.attack_details.techniques.name, security_result.detection_fields["Technique"]))
$Technique != "-"
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
match:
$Date, $Technique
outcome:
$Count = count(strings.coalesce(security_result.attack_details.techniques.name, security_result.detection_fields["Technique"]))
order:
$Date asc
按战术和技术划分的赛事
strings.coalesce(security_result.attack_details.tactics.id, security_result.detection_fields["Tactic ID"]) != ""
strings.coalesce(security_result.attack_details.tactics.name, security_result.detection_fields["Tactic"]) != ""
strings.coalesce(security_result.attack_details.techniques.id, security_result.detection_fields["Technique ID"]) != ""
strings.coalesce(security_result.attack_details.techniques.name, security_result.detection_fields["Technique"]) != ""
$Tactic = strings.concat(strings.coalesce(security_result.attack_details.tactics.id, security_result.detection_fields["Tactic ID"])," - ", strings.coalesce(security_result.attack_details.tactics.name, security_result.detection_fields["Tactic"]))
$Tactic != "-"
$Technique = strings.concat(strings.coalesce(security_result.attack_details.techniques.id, security_result.detection_fields["Technique ID"])," - ", strings.coalesce(security_result.attack_details.techniques.name, security_result.detection_fields["Technique"]))
$Technique != "-"
match:
$Tactic, $Technique
outcome:
$Count = count(metadata.id)
order:
$Tactic asc
用户发现的策略
strings.coalesce(security_result.attack_details.tactics.id, security_result.detection_fields["Tactic ID"]) != ""
strings.coalesce(security_result.attack_details.tactics.name, security_result.detection_fields["Tactic"]) != ""
$Tactic = strings.concat(strings.coalesce(security_result.attack_details.tactics.id, security_result.detection_fields["Tactic ID"])," - ", strings.coalesce(security_result.attack_details.tactics.name, security_result.detection_fields["Tactic"]))
$Tactic != "-"
$Username = strings.coalesce(principal.user.user_display_name, principal.user.userid)
$Username != ""
$Hostname = strings.coalesce(principal.hostname, principal.asset.hostname)
$Hostname != ""
match:
$Username, $Hostname, $Tactic
outcome:
$Count = count(strings.concat(strings.coalesce(security_result.attack_details.tactics.id, security_result.detection_fields["Tactic ID"])," - ", strings.coalesce(security_result.attack_details.tactics.name, security_result.detection_fields["Tactic"])))
order:
$Count desc
Microsoft 365 - SharePoint 和 OneDrive
此信息中心可详细显示两个平台上的用户活动、数据访问权限和安全性事件。它可为组织提供宝贵的分析洞见，以跟踪文件操作、访问趋势和用户行为。此信息中心有助于识别未经授权的访问或异常活动，例如意外的登录位置或用户模式中的异常情况。
用户活动
共享政策的修改
访问次数最多的 10 个 SharePoint 网站
10 大活跃用户
排名前 10 位的特权账号活动
前 10 大文件操作
用户访问权限中的地理定位地图
前 10 大来源 IP 地址
一段时间内的活动趋势
一段时间内的文件下载次数
文件下载
图表名称
查询示例
用户活动
$Source_IP = strings.coalesce(principal.ip, principal.asset.ip)
$Security_Event_Type = metadata.product_event_type
$User = strings.coalesce(principal.user.userid,principal.user.user_display_name,principal.user.email_addresses)
$Application = strings.coalesce(principal.application, target.application, intermediary.application)
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
match:
$Date,$User,$Source_IP, $Application,$Security_Event_Type
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
共享政策的修改
metadata.product_event_type = "SharingPolicyChanged"
$Application = strings.coalesce(principal.application, target.application, intermediary.application)
$User = strings.coalesce(principal.user.userid, principal.user.user_display_name, principal.user.email_addresses)
$Role = principal.user.attribute.roles.name
$Policy = target.labels.key
$Action = target.labels.value
($Action = "True" or $Action = "False")
$Date = timestamp.get_timestamp(metadata.event_timestamp.seconds, "%F %T ")
match:
$Date, $User, $Role, $Policy, $Action, $Application
outcome:
$Count = count(metadata.id)
order:
$Count desc
访问次数最多的 10 个 SharePoint 网站
$Sites = strings.coalesce(target.url,network.http.referral_url,principal.url)
$User = strings.coalesce(principal.user.userid, principal.user.user_display_name, principal.user.email_addresses)
match:
$Sites, $User
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
10 大活跃用户
$User = strings.coalesce(principal.user.userid,principal.user.user_display_name,principal.user.email_addresses)
$Application = strings.coalesce(principal.application, target.application, intermediary.application)
match:
$User, $Application
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
排名前 10 位的特权账号活动
principal.user.attribute.roles.name = /Admin|DcAdmin|Administrator|Root/ nocase //It will be updated as per the client's environment.
$Role = principal.user.attribute.roles.name
$Security_Event_Type = metadata.product_event_type
$User = strings.coalesce(principal.user.userid, principal.user.user_display_name, principal.user.email_addresses)
$Resource = if(target.resource.name = "Unknown",target.url,target.resource.name)
$Application = strings.coalesce(principal.application, target.application, intermediary.application)
match:
$Role, $Security_Event_Type, $Application
outcome:
$Username = array_distinct($User)
$Count = count(metadata.id)
order:
$Count desc
limit:
10
前 10 大文件操作
metadata.product_event_type = /File/ nocase
$Security_Event_Type = metadata.product_event_type
$Action = security_result.action
match:
$Security_Event_Type, $Action
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
用户访问权限中的地理定位地图
$User = strings.coalesce(principal.user.userid, principal.user.user_display_name, principal.user.email_addresses)
$Country = strings.coalesce(principal.location.country_or_region, principal.ip_geo_artifact.location.country_or_region)
$Country != ""
match:
$Country
outcome:
$Count = count($User)
$Latitude = max(principal.ip_geo_artifact.location.region_latitude)
$Longitude = max(principal.ip_geo_artifact.location.region_longitude)
order:
$Count desc
前 10 大来源 IP 地址
$Source_IP = strings.coalesce(principal.ip, principal.asset.ip)
$User = strings.coalesce(principal.user.userid, principal.user.user_display_name, principal.user.email_addresses)
match:
$Source_IP, $User
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
一段时间内的活动趋势
$Application = strings.coalesce(principal.application, target.application, intermediary.application)
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
match:
$Application, $Date
outcome:
$Count = count(metadata.id)
order:
$Date asc
一段时间内的文件下载次数
metadata.product_event_type = "FileDownloaded"
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
$User = strings.coalesce(principal.user.userid, principal.user.user_display_name, principal.user.email_addresses)
match:
$Date, $User
outcome:
$Count = count(metadata.id)
order:
$Date asc
文件下载
metadata.product_event_type = "FileDownloaded"
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
$Downloaded_File = strings.coalesce(src.url,src.file.full_path)
$User = strings.coalesce(principal.user.userid, principal.user.user_display_name, principal.user.email_addresses)
$Role = principal.user.attribute.roles.name
match:
$Date, $User,$Role,$Downloaded_File
outcome:
$Count = count(metadata.id)
order:
$Count asc
Microsoft 365 提醒
此信息中心可提供安全事件和潜在威胁的概览，并跟踪与用户活动相关的严重提醒和趋势。
按提醒次数排名的前 10 位用户
10 大提醒
十大高严重程度提醒
近期提醒详情
提醒严重程度分布情况
随时间变化的提醒数
图表名称
查询示例
按提醒次数排名的前 10 位用户
metadata.log_type = "MICROSOFT_GRAPH_ALERT"
metadata.product_name = "Office 365 Security and Compliance"
security_result.summary = /threat(?:\s)?management/ nocase
target.user.userid != ""
$User = target.user.userid
match:
$User
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
10 大提醒
metadata.log_type = "MICROSOFT_GRAPH_ALERT"
metadata.product_name = "Office 365 Security and Compliance"
security_result.summary = /threat(?:\s)?management/ nocase
security_result.rule_name != ""
$Alert = security_result.rule_name
match:
$Alert
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
十大高严重程度提醒
metadata.log_type = "MICROSOFT_GRAPH_ALERT"
metadata.product_name = "Office 365 Security and Compliance"
security_result.severity = "HIGH"
security_result.summary = /threat(?:\s)?management/ nocase
security_result.rule_name != ""
$Alert = security_result.rule_name
match:
$Alert
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
近期提醒详情
metadata.log_type = "MICROSOFT_GRAPH_ALERT"
metadata.product_name = "Office 365 Security and Compliance"
security_result.summary = /threat(?:\s)?management/ nocase
$Alert = security_result.rule_name
$Description = security_result.description
$Severity = security_result.severity
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
match:
$Date, $Alert, $Description, $Severity
outcome:
$Count = count(metadata.id)
order:
$Date desc
limit:
50
提醒严重程度分布情况
metadata.log_type = "MICROSOFT_GRAPH_ALERT"
metadata.product_name = "Office 365 Security and Compliance"
security_result.summary = /threat(?:\s)?management/ nocase
$Severity = security_result.severity
match:
$Severity
outcome:
$Count = count(metadata.id)
order:
$Severity desc
随时间变化的提醒数
metadata.log_type = "MICROSOFT_GRAPH_ALERT"
metadata.product_name = "Office 365 Security and Compliance"
security_result.summary = /threat(?:\s)?management/ nocase
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
match:
$Date
outcome:
$Count = count(metadata.id)
order:
$Date asc
移动设备管理
此信息中心可提供有关合规性、威胁趋势、严重程度分布和用户活动的分析洞见，帮助安全团队监控组织移动设备，从而了解总体安全状况。它有助于做出明智的决策，以解决漏洞、强制执行安全政策并有效缓解新出现的威胁。
操作系统版本过时 / 存在安全漏洞的设备
前 10 个修改后的资源
操作系统发行版
十大设备威胁
设备位置信息排名前 10 的地点
不合规的设备随时间的变化
按登录失败次数排名前 10 的用户
设备近期受到的威胁（随时间变化）
已修补的设备随时间的变化
不同时间段的关键设备数
检测到的威胁随时间的变化趋势
设备严重程度分布
设备在不同时间段的加入/退出情况
一段时间内的事件
图表名称
查询示例
操作系统版本过时 / 存在安全漏洞的设备
(principal.asset.platform_software.platform_version = /Android|IOS|Windows|mac(?:os)?/ nocase
and not principal.asset.platform_software.platform_version = /Android(?:\s|\/)1[3-6]|IOS(?:\s|\/)1[5-8]|Windows(?:\s|\/)1[0-1]|mac(?:OS)?(?:\s|\/)1[3-5]/ nocase)
or (target.resource.attribute.labels["OS"] = /Android/ nocase
and not (target.resource.attribute.labels["Version"] = /1[3-6]/
or target.resource.attribute.labels["OSversion"] = /1[3-6]/))
or (target.resource.attribute.labels["OS"] = /IOS/ nocase
and not (target.resource.attribute.labels["Version"] = /1[5-8]/
or target.resource.attribute.labels["OSversion"] = /(15|16|17|18).*/))
or (target.resource.attribute.labels["OS"] = /Windows/ nocase
and not (target.resource.attribute.labels["Version"] = /10|11/
or target.resource.attribute.labels["OSversion"] = /10|11/))
or (target.resource.attribute.labels["OS"] = /mac(?:OS)?/ nocase
and not (target.resource.attribute.labels["Version"] = /1[3-5]/
or target.resource.attribute.labels["OSversion"] = /1[3-5]/))
$Device = strings.coalesce(principal.asset.hostname, principal.hostname)
$OS = strings.coalesce(principal.asset.platform_software.platform_version, target.resource.attribute.labels["OS"])
$Version = strings.coalesce(target.resource.attribute.labels["Version"], target.resource.attribute.labels["OSversion"])
match:
$Device, $OS, $Version
前 10 个修改后的资源
metadata.event_type = "USER_RESOURCE_UPDATE_CONTENT"
or metadata.event_type = "USER_RESOURCE_UPDATE_PERMISSIONS"
metadata.product_event_type = /Patch MobileApp|Patch ManagedDevice|Patch DeviceConfiguration|(Application|Profile)Modified/ nocase
$Resource_Name = principal.hostname
$Resource_Name != ""
match:
$Resource_Name
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
操作系统发行版
$Platform = principal.platform
match:
$Platform
outcome:
$Count = count(metadata.id)
order:
$Count desc
十大设备威胁
metadata.product_event_type = "THREAT_DETECTED"
or additional.fields["CompromisedStatus"] = /^Compromised/ nocase
or security_result.description = /Threat|Compromised/ nocase
$Threat_Event = strings.coalesce(metadata.product_event_type, security_result.category_details, security_result.description)
match:
$Threat_Event
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
设备位置信息排名前 10 的地点
$Country = principal.ip_geo_artifact.location.country_or_region
$Latitude = principal.ip_geo_artifact.location.region_coordinates.latitude
$Latitude != 0
$Longitude = principal.ip_geo_artifact.location.region_coordinates.longitude
$Longitude != 0
match:
$Country, $Latitude, $Longitude
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
不合规的设备随时间的变化
additional.fields["ComplianceState"] = /Not Compliant/ nocase
or target.resource.attribute.labels["Status"] = /NonCompliant/ nocase
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
match:
$Date
outcome:
$Count = count_distinct(principal.hostname)
order:
$Date desc
按登录失败次数排名前 10 的用户
(metadata.event_type = "USER_LOGIN"
or metadata.product_event_type = /user(?:\s|\S|)?login/ nocase
and security_result.action = "BLOCK" or target.resource.attribute.labels["Status"] = /Failure/ nocase)
or metadata.product_event_type = /user(?:\s|\S)?login.*(?:failed)?/ nocase
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
$User = principal.user.userid
$User != ""
match:
$User
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
设备近期受到的威胁（随时间变化）
metadata.product_event_type = "THREAT_DETECTED"
or additional.fields["CompromisedStatus"] = /^Compromised/ nocase
or security_result.description = /Threat|Compromised/ nocase
$Device = principal.hostname
$Device != ""
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
match:
$Date, $Device
outcome:
$Count = count(metadata.id)
order:
$Date desc
已修补的设备随时间的变化
metadata.event_type = "USER_RESOURCE_UPDATE_CONTENT"
or metadata.event_type = "USER_RESOURCE_UPDATE_PERMISSIONS"
metadata.product_event_type = /Patch MobileApp|Patch ManagedDevice|Patch DeviceConfiguration|(Application|Profile)Modified/ nocase
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
match:
$Date
outcome:
$Count = count(metadata.id)
order:
$Date desc
不同时间段的关键设备数
security_result.severity = "CRITICAL"
or security_result.severity = "HIGH"
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
match:
$Date
outcome:
$Count = count_distinct(principal.hostname)
order:
$Date desc
检测到的威胁随时间的变化趋势
metadata.product_event_type = "THREAT_DETECTED"
or additional.fields["CompromisedStatus"] = /^Compromised/ nocase
or security_result.description = /Threat|Compromised/ nocase
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
$Threat_Event = strings.coalesce(metadata.product_event_type, security_result.category_details, security_result.description)
match:
$Date, $Threat_Event
outcome:
$Count = count(metadata.id)
order:
$Date desc
设备严重程度分布
$Severity = security_result.severity
match:
$Severity
outcome:
$Count = count_distinct(principal.hostname)
order:
$Count desc
设备在不同时间段的加入/退出情况
metadata.event_type = "USER_RESOURCE_CREATION"
or metadata.product_event_type = /DEVICE_ENROLLMENT|DeviceEnrolled/ nocase
or metadata.event_type = "USER_RESOURCE_DELETION"
or metadata.product_event_type = /^(Deviceun(?:enrolled|enrollment)|BreakMDMConfirmed|Delete\s?(?:ManagedDevice|Device)(?:Requested)?|Retire\s?ManageDevice|DeviceWipeRequested)$/ nocase
$Enrollment = if(metadata.product_event_type = /DEVICE_ENROLLMENT|DeviceEnrolled/ nocase, "Onboard", if(metadata.product_event_type = /^(Deviceun(?:enrolled|enrollment)|BreakMDMConfirmed|Delete\s?(?:ManagedDevice|Device)(?:Requested)?|Retire\s?ManageDevice|DeviceWipeRequested)$/ nocase, "Offboard"))
$Enrollment != ""
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
match:
$Date, $Enrollment
outcome:
$Count = count_distinct(principal.hostname)
order:
$Date desc
一段时间内的事件
$Event_Type = metadata.event_type
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
match:
$Date, $Event_Type
outcome:
$Count = count(metadata.id)
order:
$Date desc
多重身份验证 (MFA) 监控
此信息中心可详细分析您组织中 MFA 的实施情况和效果。它可提供有关 MFA 使用趋势、失败提醒和注册状态的实时和历史数据分析。通过监控这些关键方面，该信息中心可帮助组织识别潜在的漏洞、跟踪身份验证性能，并确保符合安全协议，最终加强整体访问安全性和用户管理。
Okta MFA 绕过检测
MFA 失败率
按原因划分的被屏蔽的 MFA 尝试
MFA 尝试次数随时间的变化
按位置划分的 MFA 尝试次数
按 MFA 失败尝试次数排名的前 5 名用户
MFA 使用趋势
通过 MFA 访问的前 5 个应用
MFA 成功率
MFA 注册状态
MFA 失败提醒
图表名称
查询示例
Okta MFA 绕过检测
$event_type = metadata.event_type
$event_type = "USER_UNCATEGORIZED"
$vendor = metadata.vendor_name
$vendor = /Okta/ nocase
$security_event_type = metadata.product_event_type
$security_event_type = "user.mfa.attempt_bypass"
$User = principal.user.user_display_name
$Summary = security_result.summary
$Action = security_result.action
$Action != "UNKNOWN_ACTION"
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
match:
$User, $Action, $Date,$Summary, $security_event_type
outcome:
$Count = count(metadata.id)
MFA 失败率
$event_type = metadata.event_type
$event_type = "USER_LOGIN"
$product_name = metadata.product_name
$security_event_type = metadata.product_event_type
$requirement = additional.fields["AuthenticationRequirement"]
$result_value = security_result.detection_fields.value
(re.regex($product_name, "MULTI-FACTOR_AUTHENTICATION") or re.regex($security_event_type, `user.mfa`) or re.regex($requirement, `multiFactorAuthentication`) or re.regex($result_value, `MFA`))
$user = strings.coalesce(target.user.userid, principal.user.userid)
$user != ""
$email_id =strings.coalesce(target.user.email_addresses, principal.user.email_addresses)
$action = security_result.action
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
match:
$Date
outcome:
$total_attempts = count(metadata.id)
$failure_attempts = sum(if(any security_result.action = "BLOCK", 1, 0)) // Sums only failure MFA attempts
$failure_rate = (($failure_attempts / $total_attempts) * 100 )
order:
$Date asc
按原因划分的被屏蔽的 MFA 尝试
$product_name = metadata.product_name
$security_event_type = metadata.product_event_type
$requirement = additional.fields["AuthenticationRequirement"]
$result_value = security_result.detection_fields.value
(re.regex($product_name, "MULTI-FACTOR_AUTHENTICATION") or re.regex($security_event_type, `user.mfa`) nocase or re.regex($requirement, `multiFactorAuthentication`) nocase or re.regex($result_value, `MFA`) nocase)
$user = strings.coalesce(target.user.userid, principal.user.userid)
$user != ""
$action = security_result.action
$action = "BLOCK"
$Reason = security_result.summary
$Reason != ""
$Location = principal.location.country_or_region
match:
$Reason, $Location
outcome:
$Count = count(metadata.id)
order:
$Count desc
MFA 尝试次数随时间的变化
$event_type = metadata.event_type
$event_type = "USER_LOGIN"
$product_name = metadata.product_name
$security_event_type = metadata.product_event_type
$requirement = additional.fields["AuthenticationRequirement"]
$result_value = security_result.detection_fields.value
(re.regex($product_name, "MULTI-FACTOR_AUTHENTICATION") or re.regex($security_event_type, `user.mfa`) nocase or re.regex($requirement, `multiFactorAuthentication`) nocase or re.regex($result_value, `MFA`) nocase)
$user = strings.coalesce(target.user.userid, principal.user.userid)
$user != ""
$email_id = strings.coalesce(target.user.email_addresses, principal.user.email_addresses)
$action = security_result.action
$action != "UNKNOWN_ACTION"
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
$Location = principal.location.country_or_region
match:
$Date, $Location
outcome:
$Count = count(metadata.id)
order:
$Date asc
按位置划分的 MFA 尝试次数
$event_type = metadata.event_type
$event_type = "USER_LOGIN"
$product_name = metadata.product_name
$security_event_type = metadata.product_event_type
$requirement = additional.fields["AuthenticationRequirement"]
$result_value = security_result.detection_fields.value
(re.regex($product_name, "MULTI-FACTOR_AUTHENTICATION") or re.regex($security_event_type, `user.mfa`) or re.regex($requirement, `multiFactorAuthentication`) or re.regex($result_value, `MFA`))
$User = target.user.userid
$User != ""
$Action = security_result.action
$Action !="UNKNOWN_ACTION"
$Vendor = metadata.vendor_name
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
$Latitude = principal.location.region_coordinates.latitude
$Longitude = principal.location.region_coordinates.longitude
$Location = strings.coalesce(target.location.country_or_region, principal.location.country_or_region)
match:
$Vendor, $Date, $Location, $Latitude, $Longitude
outcome:
$Count = count(metadata.id)
按位置划分的 MFA 尝试次数
$event_type = metadata.event_type
$event_type = "USER_LOGIN"
$product_name = metadata.product_name
$security_event_type = metadata.product_event_type
$requirement = additional.fields["AuthenticationRequirement"]
$result_value = security_result.detection_fields.value
(re.regex($product_name, "MULTI-FACTOR_AUTHENTICATION") or re.regex($security_event_type, `user.mfa`) nocase or re.regex($requirement, `multiFactorAuthentication`) nocase or re.regex($result_value, `MFA`) nocase)
$User = target.user.userid
$User != ""
$Action = security_result.action
$Action !="UNKNOWN_ACTION"
$Vendor = metadata.vendor_name
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
$Latitude = principal.location.region_coordinates.latitude
$Longitude = principal.location.region_coordinates.longitude
$Location = strings.coalesce(target.location.country_or_region, principal.location.country_or_region)
match:
$Vendor, $Date, $Location, $Latitude, $Longitude
outcome:
$Count = count(metadata.id)
按 MFA 失败尝试次数排名的前 5 名用户
$event_type = metadata.event_type
$event_type = "USER_LOGIN"
$product_name = metadata.product_name
$security_event_type = metadata.product_event_type
$requirement = additional.fields["AuthenticationRequirement"]
$result_value = security_result.detection_fields.value
(re.regex($product_name, "MULTI-FACTOR_AUTHENTICATION") or re.regex($security_event_type, `user.mfa`) nocase or re.regex($requirement, `multiFactorAuthentication`) nocase or re.regex($result_value, `MFA`) nocase)
$User = strings.coalesce(target.user.userid, principal.user.userid)
$User != ""
$email_id = strings.coalesce(target.user.email_addresses,principal.user.email_addresses)
$Action = security_result.action
$Action = "BLOCK"
$date = timestamp.get_date(metadata.event_timestamp.seconds)
match:
$User, $Action
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:5
MFA 使用趋势
$event_type = metadata.event_type
$event_type = "USER_LOGIN"
$product_name = metadata.product_name
$security_event_type = metadata.product_event_type
$requirement = additional.fields["AuthenticationRequirement"]
$result_value = security_result.detection_fields.value
(re.regex($product_name, "MULTI-FACTOR_AUTHENTICATION") or re.regex($security_event_type, `user.mfa`) nocase or re.regex($requirement, `multiFactorAuthentication`) nocase or re.regex($result_value, `MFA`) nocase)
$user = strings.coalesce(target.user.userid, principal.user.userid)
$user != ""
$email_id = strings.coalesce(target.user.email_addresses, principal.user.email_addresses)
$action = security_result.action
$action != "UNKNOWN_ACTION"
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
match:
$event_type, $Date
outcome:
$Count = count($event_type)
order:
$Date asc
通过 MFA 访问的前 5 个应用
$event_type = metadata.event_type
$event_type = "USER_LOGIN"
$product_name = metadata.product_name
$security_event_type = metadata.product_event_type
$requirement = additional.fields["AuthenticationRequirement"]
$result_value = security_result.detection_fields.value
(re.regex($product_name, "MULTI-FACTOR_AUTHENTICATION") or re.regex($security_event_type, `user.mfa`) or re.regex($requirement, `multiFactorAuthentication`) or re.regex($result_value, `MFA`))
$user = strings.coalesce(target.user.userid, principal.user.userid)
$user != ""
$email_id = strings.coalesce(target.user.email_addresses, principal.user.email_addresses)
$Application = target.application
$Application != ""
match:
$Application
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit : 5
MFA 成功率
$event_type = metadata.event_type
$event_type = "USER_LOGIN"
$product_name = metadata.product_name
$security_event_type = metadata.product_event_type
$requirement = additional.fields["AuthenticationRequirement"]
$result_value = security_result.detection_fields.value
(re.regex($product_name, "MULTI-FACTOR_AUTHENTICATION") or re.regex($security_event_type, `user.mfa`) nocase or re.regex($requirement, `multiFactorAuthentication`) nocase or re.regex($result_value, `MFA`) nocase)
$user = strings.coalesce(target.user.userid,principal.user.userid)
$user !=""
$email_id =strings.coalesce(target.user.email_addresses,principal.user.email_addresses)
$action = security_result.action
$vendor = metadata.vendor_name
$date = timestamp.get_date(metadata.event_timestamp.seconds)
match:
$date
outcome:
$total_attempts = count(metadata.id)
$successful_attempts = sum(if(any security_result.action = "ALLOW", 1, 0)) // Sums only successful MFA attempts
$success_rate = (($successful_attempts / $total_attempts) * 100 )
order: $date asc
MFA 成功率
$event_type = metadata.event_type
$event_type = "USER_LOGIN"
$product_name = metadata.product_name
$security_event_type = metadata.product_event_type
$requirement = additional.fields["AuthenticationRequirement"]
$result_value = security_result.detection_fields.value
(re.regex($product_name, "MULTI-FACTOR_AUTHENTICATION") or re.regex($security_event_type, `user.mfa`) or re.regex($requirement, `multiFactorAuthentication`) or re.regex($result_value, `MFA`))
$user = strings.coalesce(target.user.userid,principal.user.userid)
$user !=""
$email_id =strings.coalesce(target.user.email_addresses,principal.user.email_addresses)
$action = security_result.action
$vendor = metadata.vendor_name
$date = timestamp.get_date(metadata.event_timestamp.seconds)
match:
$date
outcome:
$total_attempts = count(metadata.id)
$successful_attempts = sum(if(any security_result.action = "ALLOW", 1, 0)) // Sums only successful MFA attempts
$success_rate = (($successful_attempts / $total_attempts) * 100 )
order: $date asc
通过 MFA 访问的前 5 个应用
$event_type = metadata.event_type
$event_type = "USER_LOGIN"
$product_name = metadata.product_name
$security_event_type = metadata.product_event_type
$requirement = additional.fields["AuthenticationRequirement"]
$result_value = security_result.detection_fields.value
(re.regex($product_name, "MULTI-FACTOR_AUTHENTICATION") or re.regex($security_event_type, `user.mfa`) nocase or re.regex($requirement, `multiFactorAuthentication`) nocase or re.regex($result_value, `MFA`) nocase)
$user = strings.coalesce(target.user.userid, principal.user.userid)
$user != ""
$email_id = strings.coalesce(target.user.email_addresses, principal.user.email_addresses)
$Application = target.application
match:
$Application
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit : 5
按原因划分的被屏蔽的 MFA 尝试
$product_name = metadata.product_name
$security_event_type = metadata.product_event_type
$requirement = additional.fields["AuthenticationRequirement"]
$result_value = security_result.detection_fields.value
(re.regex($product_name, "MULTI-FACTOR_AUTHENTICATION") or re.regex($security_event_type, `user.mfa`) or re.regex($requirement, `multiFactorAuthentication`) or re.regex($result_value, `MFA`))
$user = strings.coalesce(target.user.userid, principal.user.userid)
$user != ""
$action = security_result.action
$action = "BLOCK"
$Reason = security_result.summary
$Reason != ""
$Location = principal.location.country_or_region
match:
$Reason, $Location
outcome:
$Count = count(metadata.id)
order:
$Count desc
MFA 注册状态
$event_type = metadata.event_type
$event_type = "USER_CREATION"
$security_event_type = metadata.product_event_type
$security_event_type = "enrollment"
$product_name = metadata.product_name
$requirement = additional.fields["AuthenticationRequirement"]
$result_value = security_result.detection_fields.value
(re.regex($product_name, "MULTI-FACTOR_AUTHENTICATION") or re.regex($requirement, `multiFactorAuthentication`) or re.regex($result_value, `MFA`))
$summary = security_result.summary
$summary != ""
$user = strings.coalesce(target.user.userid, principal.user.userid)
$user != ""
$email_id = strings.coalesce(target.user.email_addresses, principal.user.email_addresses)
$action = security_result.action
$vendor = metadata.vendor_name
$date = timestamp.get_date(metadata.event_timestamp.seconds)
match:
$summary
outcome:
$event_count = count(metadata.id)
order:
$event_count desc
MFA 失败率
$event_type = metadata.event_type
$event_type = "USER_LOGIN"
$product_name = metadata.product_name
$security_event_type = metadata.product_event_type
$requirement = additional.fields["AuthenticationRequirement"]
$result_value = security_result.detection_fields.value
(re.regex($product_name, "MULTI-FACTOR_AUTHENTICATION") or re.regex($security_event_type, `user.mfa`) nocase or re.regex($requirement, `multiFactorAuthentication`) nocase or re.regex($result_value, `MFA`) nocase)
$user = strings.coalesce(target.user.userid, principal.user.userid)
$user != ""
$email_id =strings.coalesce(target.user.email_addresses, principal.user.email_addresses)
$action = security_result.action
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
match:
$Date
outcome:
$total_attempts = count(metadata.id)
$failure_attempts = sum(if(any security_result.action = "BLOCK", 1, 0)) // Sums only failure MFA attempts
$failure_rate = (($failure_attempts / $total_attempts) * 100 )
order:
$Date asc
Okta MFA 绕过检测
$event_type = metadata.event_type
$event_type = "USER_UNCATEGORIZED"
$vendor = metadata.vendor_name
$vendor = /Okta/
$security_event_type = metadata.product_event_type
$security_event_type = "user.mfa.attempt_bypass"
$User = principal.user.user_display_name
$Summary = security_result.summary
$Action = security_result.action
$Action != "UNKNOWN_ACTION"
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
match:
$User, $Action, $Date,$Summary, $security_event_type
outcome:
$Count = count(metadata.id)
order:
$Count desc
按 MFA 失败尝试次数排名的前 5 名用户
$event_type = metadata.event_type
$event_type = "USER_LOGIN"
$product_name = metadata.product_name
$security_event_type = metadata.product_event_type
$requirement = additional.fields["AuthenticationRequirement"]
$result_value = security_result.detection_fields.value
(re.regex($product_name, "MULTI-FACTOR_AUTHENTICATION") or re.regex($security_event_type, `user.mfa`) or re.regex($requirement, `multiFactorAuthentication`) or re.regex($result_value, `MFA`))
$User = strings.coalesce(target.user.userid, principal.user.userid)
$User != ""
$email_id = strings.coalesce(target.user.email_addresses,principal.user.email_addresses)
$Action = security_result.action
$Action = "BLOCK"
$date = timestamp.get_date(metadata.event_timestamp.seconds)
match:
$User, $Action
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:5
MFA 尝试次数随时间的变化
$event_type = metadata.event_type
$event_type = "USER_LOGIN"
$product_name = metadata.product_name
$security_event_type = metadata.product_event_type
$requirement = additional.fields["AuthenticationRequirement"]
$result_value = security_result.detection_fields.value
(re.regex($product_name, "MULTI-FACTOR_AUTHENTICATION") or re.regex($security_event_type, `user.mfa`) or re.regex($requirement, `multiFactorAuthentication`) or re.regex($result_value, `MFA`))
$user = strings.coalesce(target.user.userid, principal.user.userid)
$user != ""
$email_id = strings.coalesce(target.user.email_addresses, principal.user.email_addresses)
$action = security_result.action
$action != "UNKNOWN_ACTION"
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
$Location = principal.location.country_or_region
match:
$Date, $Location
outcome:
$Count = count(metadata.id)
order:
$Date asc
MFA 失败提醒
$event_type = metadata.event_type
$event_type = "USER_LOGIN"
$product_name = metadata.product_name
$security_event_type = metadata.product_event_type
$requirement = additional.fields["AuthenticationRequirement"]
$result_value = security_result.detection_fields.value
(re.regex($product_name, "MULTI-FACTOR_AUTHENTICATION") or re.regex($security_event_type, `user.mfa`) or re.regex($requirement, `multiFactorAuthentication`) or re.regex($result_value, `MFA`))
$user = strings.coalesce(target.user.userid, principal.user.userid)
$user != ""
$email_id = strings.coalesce(target.user.email_addresses, principal.user.email_addresses)
$action = security_result.action
$action = "BLOCK"
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
match:
$Date
outcome:
$Count = count(metadata.id)
$Action = array_distinct($action)
order:
$Date asc
MFA 失败提醒
$event_type = metadata.event_type
$event_type = "USER_LOGIN"
$product_name = metadata.product_name
$security_event_type = metadata.product_event_type
$requirement = additional.fields["AuthenticationRequirement"]
$result_value = security_result.detection_fields.value
(re.regex($product_name, "MULTI-FACTOR_AUTHENTICATION") or re.regex($security_event_type, `user.mfa`) nocase or re.regex($requirement, `multiFactorAuthentication`) nocase or re.regex($result_value, `MFA`) nocase)
$user = strings.coalesce(target.user.userid, principal.user.userid)
$user != ""
$email_id = strings.coalesce(target.user.email_addresses, principal.user.email_addresses)
$action = security_result.action
$action = "BLOCK"
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
match:
$Date
outcome:
$Count = count(metadata.id)
$Action = array_distinct($action)
order:
$Date asc
MFA 注册状态
$event_type = metadata.event_type
$event_type = "USER_CREATION"
$security_event_type = metadata.product_event_type
$security_event_type = "enrollment"
$product_name = metadata.product_name
$requirement = additional.fields["AuthenticationRequirement"]
$result_value = security_result.detection_fields.value
(re.regex($product_name, "MULTI-FACTOR_AUTHENTICATION") or re.regex($requirement, `multiFactorAuthentication`) nocase or re.regex($result_value, `MFA`) nocase)
$summary = security_result.summary
$summary != ""
$user = strings.coalesce(target.user.userid, principal.user.userid)
$user != ""
$email_id = strings.coalesce(target.user.email_addresses, principal.user.email_addresses)
$action = security_result.action
$vendor = metadata.vendor_name
$date = timestamp.get_date(metadata.event_timestamp.seconds)
match:
$summary
outcome:
$event_count = count(metadata.id)
order:
$event_count desc
MFA 使用趋势
$event_type = metadata.event_type
$event_type = "USER_LOGIN"
$product_name = metadata.product_name
$security_event_type = metadata.product_event_type
$requirement = additional.fields["AuthenticationRequirement"]
$result_value = security_result.detection_fields.value
(re.regex($product_name, "MULTI-FACTOR_AUTHENTICATION") or re.regex($security_event_type, `user.mfa`) or re.regex($requirement, `multiFactorAuthentication`) or re.regex($result_value, `MFA`))
$user = strings.coalesce(target.user.userid, principal.user.userid)
$user != ""
$email_id = strings.coalesce(target.user.email_addresses, principal.user.email_addresses)
$action = security_result.action
$action != "UNKNOWN_ACTION"
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
match:
$event_type, $Date
outcome:
$Count = count($event_type)
order:
$Date asc
NIST 800-53 - 访问权限控制
此信息中心全面概述了符合 NIST 800-53 标准的访问权限控制活动。它会跟踪不同来源、政策和地理位置的访问趋势，以识别风险、简化监控并加强访问权限控制管理。此信息中心使用参考列表 nist_compliance_assets 将数据限定为 NIST 环境。
注意 ： 在创建所需的参考列表之前，此信息中心内的图表不会加载。
用户账号锁定
近期登录失败次数（过去 24 小时）
图表名称
查询示例
用户账号锁定
metadata.description = /locked out/ nocase
$Summary = metadata.description
$Log_Type = metadata.log_type
$Hostname = strings.coalesce(principal.hostname,principal.asset.hostname,target.hostname,target.asset.hostname)
$User = strings.coalesce(principal.user.userid, principal.user.user_display_name, principal.user.email_addresses,target.user.userid,target.user.user_display_name,target.user.email_addresses )
//If the user requires any inclusions for specific assets, these lines will need to be enabled in the query and update the NIST_Compliance_Assets reference list as needed.
//$Source_IP = strings.coalesce(principal.asset.ip, principal.ip)
//strings.coalesce($Hostname, $Source_IP) in %NIST_Compliance_Assets
match:
$Summary, $User, $Hostname, $Log_Type
outcome:
$Date = timestamp.get_timestamp(max(metadata.event_timestamp.seconds ), "%F %T")
$Count = count(metadata.id)
order:
$Count desc
近期登录失败次数（过去 24 小时）
metadata.event_type = "USER_LOGIN"
security_result.action = "BLOCK"
$Log_Type = metadata.log_type
$Source_IP = strings.coalesce(principal.ip, principal.asset.ip)
$Summary = strings.coalesce(security_result.summary, security_result.description, metadata.description, security_result.rule_name)
$Hostname = strings.coalesce(principal.hostname,principal.asset.hostname,target.hostname,target.asset.hostname)
$User = strings.coalesce(principal.user.userid, principal.user.user_display_name, principal.user.email_addresses,target.user.userid,target.user.user_display_name,target.user.email_addresses )
//If the user requires any inclusions for specific assets, these lines will need to be enabled in the query and update the NIST_Compliance_Assets reference list as needed.
//$Destination_IP = strings.coalesce(principal.asset.ip, principal.ip)
//strings.coalesce($Hostname, $Source_IP, $Destination_IP) in %NIST_Compliance_Assets
match:
$Summary, $User,$Hostname, $Source_IP, $Log_Type
outcome:
$Date = timestamp.get_timestamp(max(metadata.event_timestamp.seconds ), "%F %T")
$Count = count(metadata.id)
order:
$Count desc
NIST 800-53 - 审计与责任
此信息中心可全面了解日志管理情况，并符合 NIST 800-53 标准，让您能够有效地监控和管理审核日志，以确保安全性和合规性。
NIST 800-53 - 身份识别和身份验证
此信息中心可全面了解与 NIST 800-53 标准一致的身份和身份验证活动。它会跟踪密码更改、账号管理、权限更新和多重身份验证 (MFA) 活动等关键指标。此工具可帮助您强制执行身份和身份验证流程，确保敏感系统和数据受到保护。
MFA 成功率
权限随时间的变化
创建用户账号的前 10 名发起者
删除用户账号的前 10 大发起者
创建群组的前 10 名发起者
用户事件随时间的变化趋势
一段时间内的事件
近期角色修改
近期创建的群组
删除角色的前 10 名发起者
近期用户账号删除情况
删除群组的前 10 名发起者
MFA 失败率
近期的权限变更
最近删除的群组
修改角色的前 10 名发起者
最近创建的用户账号
最近删除的角色
创建角色的前 10 名发起者
近期用户账号修改
密码随时间的变化
修改群组的前 10 位发起者
近期创建的角色
MFA 注册状态
修改用户账号的前 10 位发起者
一段时间内的角色事件
近期群组修改
一段时间内的群组活动
图表名称
查询示例
MFA 成功率
metadata.product_name = "MULTI-FACTOR_AUTHENTICATION"
or metadata.product_event_type = /mfa(?:\S)?auth|auth(?:.*)?mfa/ nocase
$Log_Type = metadata.log_type
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
//If the user requires any inclusions for specific assets, these lines will need to be enabled in the query and update the NIST_Compliance_Assets reference list as needed.
//$Hostname = strings.coalesce(principal.asset.hostname, principal.hostname)
//$Source_IP = strings.coalesce(principal.asset.ip, principal.ip)
//strings.coalesce($Hostname, $Source_IP) in %NIST_Compliance_Assets
match:
$Date, $Log_Type
outcome:
$Count = count(metadata.id)
$Successful_Attempts = sum(if(security_result.action = "ALLOW", 1, 0))
$Success_Rate = (($Successful_Attempts / $Count) * 100)
order:
$Date desc
权限随时间的变化
metadata.event_type = "RESOURCE_PERMISSIONS_CHANGE"
or metadata.event_type = "USER_CHANGE_PERMISSIONS"
or metadata.event_type = "USER_RESOURCE_UPDATE_PERMISSIONS"
security_result.action = "ALLOW"
$Log_Type = metadata.log_type
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
//If the user requires any inclusions for specific assets, these lines will need to be enabled in the query and update the NIST_Compliance_Assets reference list as needed.
//$Hostname = strings.coalesce(principal.asset.hostname, principal.hostname)
//$Source_IP = strings.coalesce(principal.asset.ip, principal.ip)
//strings.coalesce($Hostname, $Source_IP) in %NIST_Compliance_Assets
match:
$Date, $Log_Type
outcome:
$Count = count(metadata.id)
order:
$Date desc
创建用户账号的前 10 名发起者
metadata.event_type = "USER_CREATION"
security_result.action = "ALLOW"
$Log_Source = metadata.log_type
$Initiator = principal.user.userid
//If the user requires any inclusions for specific assets, these lines will need to be enabled in the query and update the NIST_Compliance_Assets reference list as needed.
//$Source_IP = strings.coalesce(principal.asset.ip, principal.ip)
//$Hostname = strings.coalesce(principal.asset.hostname, principal.hostname)
//strings.coalesce($Hostname, $Source_IP) in %NIST_Compliance_Assets
match:
$Initiator, $Log_Source
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
删除用户账号的前 10 大发起者
metadata.event_type = "USER_DELETION"
security_result.action = "ALLOW"
$Log_Source = metadata.log_type
$Initiator = principal.user.userid
//If the user requires any inclusions for specific assets, these lines will need to be enabled in the query and update the NIST_Compliance_Assets reference list as needed.
//$Source_IP = strings.coalesce(principal.asset.ip, principal.ip)
//$Hostname = strings.coalesce(principal.asset.hostname, principal.hostname)
//strings.coalesce($Hostname, $Source_IP) in %NIST_Compliance_Assets
match:
$Initiator, $Log_Source
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
创建群组的前 10 名发起者
metadata.event_type = "GROUP_CREATION"
or metadata.product_event_type = /add group/ nocase
security_result.action = "ALLOW"
$Log_Source = metadata.log_type
$Initiator = principal.user.userid
//If the user requires any inclusions for specific assets, these lines will need to be enabled in the query and update the NIST_Compliance_Assets reference list as needed.
//$Source_IP = strings.coalesce(principal.asset.ip, principal.ip)
//$Hostname = strings.coalesce(principal.asset.hostname, principal.hostname)
//strings.coalesce($Hostname, $Source_IP) in %NIST_Compliance_Assets
match:
$Initiator, $Log_Source
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
用户事件随时间的变化趋势
metadata.event_type = "USER_CREATION"
or metadata.event_type = "USER_DELETION"
or metadata.event_type = "USER_CHANGE_PERMISSIONS"
or metadata.event_type = "USER_CHANGE_PASSWORD"
or metadata.event_type = "USER_RESOURCE_UPDATE_PERMISSIONS"
security_result.action = "ALLOW"
$Event_Type = metadata.event_type
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
//If the user requires any inclusions for specific assets, these lines will need to be enabled in the query and update the NIST_Compliance_Assets reference list as needed.
//$Hostname = strings.coalesce(principal.asset.hostname, principal.hostname)
//$Source_IP = strings.coalesce(principal.asset.ip, principal.ip)
//strings.coalesce($Hostname, $Source_IP) in %NIST_Compliance_Assets
match:
$Date, $Event_Type
outcome:
$Count = count(metadata.id)
order:
$Date desc
一段时间内的事件
metadata.event_type = "USER_CREATION"
or metadata.event_type = "USER_DELETION"
or metadata.event_type = "USER_CHANGE_PERMISSIONS"
or metadata.event_type = "USER_CHANGE_PASSWORD"
or metadata.event_type = "USER_RESOURCE_UPDATE_PERMISSIONS"
or metadata.event_type = "GROUP_CREATION"
or metadata.event_type = "GROUP_DELETION"
or metadata.event_type = "GROUP_MODIFICATION"
security_result.action = "ALLOW"
$Event_Type = metadata.event_type
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
//If the user requires any inclusions for specific assets, these lines will need to be enabled in the query and update the NIST_Compliance_Assets reference list as needed.
//$Hostname = strings.coalesce(principal.asset.hostname, principal.hostname)
//$Source_IP = strings.coalesce(principal.asset.ip, principal.ip)
//strings.coalesce($Hostname, $Source_IP) in %NIST_Compliance_Assets
match:
$Date, $Event_Type
outcome:
$Count = count(metadata.id)
order:
$Date desc
近期角色修改
metadata.product_event_type = /UpdateRole|update role(?: definition)?/ nocase
security_result.action = "ALLOW"
$Date = timestamp.get_timestamp(metadata.event_timestamp.seconds, "%F %T ")
$Log_Source = metadata.log_type
$Source_IP = strings.coalesce(principal.asset.ip, principal.ip)
$Hostname = strings.coalesce(principal.asset.hostname, principal.hostname)
$Initiator = principal.user.userid
$Role_Modified = strings.coalesce(target.user.attribute.roles.name, target.resource.product_object_id, target.resource.name)
//If the user requires any inclusions for specific assets, these lines will need to be enabled in the query and update the NIST_Compliance_Assets reference list as needed.
//strings.coalesce($Hostname, $Source_IP) in %NIST_Compliance_Assets
match:
$Date, $Log_Source, $Source_IP, $Hostname, $Initiator, $Role_Modified
order:
$Date desc
近期创建的群组
metadata.event_type = "GROUP_CREATION"
or metadata.product_event_type = /add group/ nocase
security_result.action = "ALLOW"
$Date = timestamp.get_timestamp(metadata.event_timestamp.seconds, "%F %T ")
$Log_Source = metadata.log_type
$Source_IP = strings.coalesce(principal.asset.ip, principal.ip)
$Hostname = strings.coalesce(principal.asset.hostname, principal.hostname)
$Product_Event = metadata.product_event_type
$Group_Name = target.group.group_display_name
//If the user requires any inclusions for specific assets, these lines will need to be enabled in the query and update the NIST_Compliance_Assets reference list as needed.
//strings.coalesce($Hostname, $Source_IP) in %NIST_Compliance_Assets
match:
$Date, $Log_Source, $Source_IP, $Hostname, $Product_Event, $Group_Name
order:
$Date desc
删除角色的前 10 名发起者
metadata.product_event_type = /DeleteRole|delete role definition/ nocase
security_result.action = "ALLOW"
$Log_Source = metadata.log_type
$Initiator = principal.user.userid
//If the user requires any inclusions for specific assets, these lines will need to be enabled in the query and update the NIST_Compliance_Assets reference list as needed.
//$Source_IP = strings.coalesce(principal.asset.ip, principal.ip)
//$Hostname = strings.coalesce(principal.asset.hostname, principal.hostname)
//strings.coalesce($Hostname, $Source_IP) in %NIST_Compliance_Assets
match:
$Initiator, $Log_Source
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
近期用户账号删除情况
metadata.event_type = "USER_DELETION"
security_result.action = "ALLOW"
$Date = timestamp.get_timestamp(metadata.event_timestamp.seconds, "%F %T ")
$Log_Source = metadata.log_type
$Source_IP = strings.coalesce(principal.asset.ip, principal.ip)
$Hostname = strings.coalesce(principal.asset.hostname, principal.hostname)
$Initiator = principal.user.userid
$User_Deleted = target.user.userid
//If the user requires any inclusions for specific assets, these lines will need to be enabled in the query and update the NIST_Compliance_Assets reference list as needed.
//strings.coalesce($Hostname, $Source_IP) in %NIST_Compliance_Assets
match:
$Date, $Log_Source, $Source_IP, $Hostname, $Initiator, $User_Deleted
order:
$Date desc
删除群组的前 10 名发起者
metadata.event_type = "GROUP_DELETION"
or metadata.product_event_type = /delete group/ nocase
security_result.action = "ALLOW"
$Log_Source = metadata.log_type
$Initiator = principal.user.userid
//If the user requires any inclusions for specific assets, these lines will need to be enabled in the query and update the NIST_Compliance_Assets reference list as needed.
//$Source_IP = strings.coalesce(principal.asset.ip, principal.ip)
//$Hostname = strings.coalesce(principal.asset.hostname, principal.hostname)
//strings.coalesce($Hostname, $Source_IP) in %NIST_Compliance_Assets
match:
$Initiator, $Log_Source
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
MFA 失败率
metadata.product_name = "MULTI-FACTOR_AUTHENTICATION"
or metadata.product_event_type = /mfa(?:\S)?auth|auth(?:.*)?mfa/ nocase
$Log_Type = metadata.log_type
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
//If the user requires any inclusions for specific assets, these lines will need to be enabled in the query and update the NIST_Compliance_Assets reference list as needed.
//$Hostname = strings.coalesce(principal.asset.hostname, principal.hostname)
//$Source_IP = strings.coalesce(principal.asset.ip, principal.ip)
//strings.coalesce($Hostname, $Source_IP) in %NIST_Compliance_Assets
match:
$Date, $Log_Type
outcome:
$Count = count(metadata.id)
$Failed_Attempts = sum(if(security_result.action = "BLOCK", 1, 0))
$Failure_Rate = (($Failed_Attempts / $Count) * 100 )
order:
$Date desc
近期的权限变更
metadata.event_type = "RESOURCE_PERMISSIONS_CHANGE"
or metadata.event_type = "USER_CHANGE_PERMISSIONS"
or metadata.event_type = "USER_RESOURCE_UPDATE_PERMISSIONS"
security_result.action = "ALLOW"
$Date = timestamp.get_timestamp(metadata.event_timestamp.seconds, "%F %T ")
$Log_Source = metadata.log_type
$Source_IP = strings.coalesce(principal.asset.ip, principal.ip)
$Hostname = strings.coalesce(principal.asset.hostname, principal.hostname)
$Initiator = principal.user.userid
$Description = metadata.description
//If the user requires any inclusions for specific assets, these lines will need to be enabled in the query and update the NIST_Compliance_Assets reference list as needed.
//strings.coalesce($Hostname, $Source_IP) in %NIST_Compliance_Assets
match:
$Date, $Log_Source, $Source_IP, $Hostname, $Initiator, $Description
order:
$Date desc
最近删除的群组
metadata.event_type = "GROUP_DELETION"
or metadata.product_event_type = /delete group/ nocase
security_result.action = "ALLOW"
$Date = timestamp.get_timestamp(metadata.event_timestamp.seconds, "%F %T ")
$Log_Source = metadata.log_type
$Source_IP = strings.coalesce(principal.asset.ip, principal.ip)
$Hostname = strings.coalesce(principal.asset.hostname, principal.hostname)
$Product_Event = metadata.product_event_type
$Group_Name = target.group.group_display_name
//If the user requires any inclusions for specific assets, these lines will need to be enabled in the query and update the NIST_Compliance_Assets reference list as needed.
//strings.coalesce($Hostname, $Source_IP) in %NIST_Compliance_Assets
match:
$Date, $Log_Source, $Source_IP, $Hostname, $Product_Event, $Group_Name
order:
$Date desc
修改角色的前 10 名发起者
metadata.product_event_type = /UpdateRole|update role(?: definition)?/ nocase
security_result.action = "ALLOW"
$Log_Source = metadata.log_type
$Initiator = principal.user.userid
//If the user requires any inclusions for specific assets, these lines will need to be enabled in the query and update the NIST_Compliance_Assets reference list as needed.
//$Source_IP = strings.coalesce(principal.asset.ip, principal.ip)
//$Hostname = strings.coalesce(principal.asset.hostname, principal.hostname)
//strings.coalesce($Hostname, $Source_IP) in %NIST_Compliance_Assets
match:
$Initiator, $Log_Source
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
最近创建的用户账号
metadata.event_type = "USER_CREATION"
security_result.action = "ALLOW"
$Date = timestamp.get_timestamp(metadata.event_timestamp.seconds, "%F %T ")
$Log_Source = metadata.log_type
$Source_IP = strings.coalesce(principal.asset.ip, principal.ip)
$Hostname = strings.coalesce(principal.asset.hostname, principal.hostname)
$Initiator = principal.user.userid
$User_Created = target.user.userid
//If the user requires any inclusions for specific assets, these lines will need to be enabled in the query and update the NIST_Compliance_Assets reference list as needed.
//strings.coalesce($Hostname, $Source_IP) in %NIST_Compliance_Assets
match:
$Date, $Log_Source, $Source_IP, $Hostname, $Initiator, $User_Created
order:
$Date desc
最近删除的角色
metadata.product_event_type = /DeleteRole|delete role definition/ nocase
security_result.action = "ALLOW"
$Date = timestamp.get_timestamp(metadata.event_timestamp.seconds, "%F %T ")
$Log_Source = metadata.log_type
$Source_IP = strings.coalesce(principal.asset.ip, principal.ip)
$Hostname = strings.coalesce(principal.asset.hostname, principal.hostname)
$Initiator = principal.user.userid
$Role_Deleted = strings.coalesce(target.user.attribute.roles.name, target.resource.product_object_id, target.resource.name)
//If the user requires any inclusions for specific assets, these lines will need to be enabled in the query and update the NIST_Compliance_Assets reference list as needed.
//strings.coalesce($Hostname, $source_IP) in %NIST_Compliance_Assets
match:
$Date, $Log_Source, $Source_IP, $Hostname, $Initiator, $Role_Deleted
order:
$Date desc
创建角色的前 10 名发起者
metadata.product_event_type = /CreateRole|add role definition/ nocase
security_result.action = "ALLOW"
$Log_Source = metadata.log_type
$Initiator = principal.user.userid
//If the user requires any inclusions for specific assets, these lines will need to be enabled in the query and update the NIST_Compliance_Assets reference list as needed.
//$Source_IP = strings.coalesce(principal.asset.ip, principal.ip)
//$Hostname = strings.coalesce(principal.asset.hostname, principal.hostname)
//strings.coalesce($Hostname, $Source_IP) in %NIST_Compliance_Assets
match:
$Initiator, $Log_Source
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
近期用户账号修改
metadata.event_type = "USER_CHANGE_PERMISSIONS"
or metadata.event_type = "USER_CHANGE_PASSWORD"
or metadata.event_type = "USER_RESOURCE_UPDATE_PERMISSIONS"
security_result.action = "ALLOW"
$Date = timestamp.get_timestamp(metadata.event_timestamp.seconds, "%F %T ")
$Log_Source = metadata.log_type
$Source_IP = strings.coalesce(principal.asset.ip, principal.ip)
$Hostname = strings.coalesce(principal.asset.hostname, principal.hostname)
$Initiator = principal.user.userid
$User_Modified = target.user.userid
$Event_Type = metadata.event_type
//If the user requires any inclusions for specific assets, these lines will need to be enabled in the query and update the NIST_Compliance_Assets reference list as needed.
//strings.coalesce($Hostname, $Source_IP) in %NIST_Compliance_Assets
match:
$Date, $Log_Source, $Source_IP, $Hostname, $Initiator, $Event_Type, $User_Modified
order:
$Date desc
密码随时间的变化
metadata.event_type = "USER_CHANGE_PASSWORD"
security_result.action = "ALLOW"
$Log_Type = metadata.log_type
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
//If the user requires any inclusions for specific assets, these lines will need to be enabled in the query and update the NIST_Compliance_Assets reference list as needed.
//$Hostname = strings.coalesce(principal.asset.hostname, principal.hostname)
//$Source_IP = strings.coalesce(principal.asset.ip, principal.ip)
//strings.coalesce($Hostname, $Source_IP) in %NIST_Compliance_Assets
match:
$Date, $Log_Type
outcome:
$Count = count(metadata.id)
order:
$Date desc
修改群组的前 10 位发起者
metadata.event_type = "GROUP_MODIFICATION"
and metadata.product_event_type = /(RemoveUserFrom|AddUserTo|Add member to |Remove member from )|(?:group)/ nocase
security_result.action = "ALLOW"
$Log_Source = metadata.log_type
$Initiator = principal.user.userid
//If the user requires any inclusions for specific assets, these lines will need to be enabled in the query and update the NIST_Compliance_Assets reference list as needed.
//$Source_IP = strings.coalesce(principal.asset.ip, principal.ip)
//$Hostname = strings.coalesce(principal.asset.hostname, principal.hostname)
//strings.coalesce($Hostname, $Source_IP) in %NIST_Compliance_Assets
match:
$Initiator, $Log_Source
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
近期创建的角色
metadata.product_event_type = /CreateRole|add role definition/ nocase
security_result.action = "ALLOW"
$Date = timestamp.get_timestamp(metadata.event_timestamp.seconds, "%F %T ")
$Log_Source = metadata.log_type
$Source_IP = strings.coalesce(principal.asset.ip, principal.ip)
$Hostname = strings.coalesce(principal.asset.hostname, principal.hostname)
$Initiator = principal.user.userid
$Role_Created = strings.coalesce(target.user.attribute.roles.name, target.resource.product_object_id, target.resource.name)
//If the user requires any inclusions for specific assets, these lines will need to be enabled in the query and update the NIST_Compliance_Assets reference list as needed.
//strings.coalesce($Hostname, $Source_IP) in %NIST_Compliance_Assets
match:
$Date, $Log_Source, $Source_IP, $Hostname, $Initiator, $Role_Created
order:
$Date desc
MFA 注册状态
metadata.product_name = "MULTI-FACTOR_AUTHENTICATION"
or strings.coalesce(additional.fields["AuthenticationRequirement"], security_result.detection_fields.value) = /mfa|multi(?:\s|\S)?factor(?:\s|\S)?authentication|/ nocase
metadata.product_event_type = "enrollment"
or target.resource_ancestors.resource_subtype = "AuthenticatorEnrollment"
$Result = security_result.summary
//If the user requires any inclusions for specific assets, these lines will need to be enabled in the query and update the NIST_Compliance_Assets reference list as needed.
//$Hostname = strings.coalesce(principal.asset.hostname, principal.hostname)
//$Source_IP = strings.coalesce(principal.asset.ip, principal.ip)
//strings.coalesce($Hostname, $Source_IP) in %NIST_Compliance_Assets
match:
$Result
outcome:
$Count = count(metadata.id)
order:
$Count desc
修改用户账号的前 10 位发起者
metadata.event_type = "USER_CHANGE_PERMISSIONS"
or metadata.event_type = "USER_CHANGE_PASSWORD"
or metadata.event_type = "USER_RESOURCE_UPDATE_PERMISSIONS"
security_result.action = "ALLOW"
$Log_Source = metadata.log_type
$Initiator = principal.user.userid
//If the user requires any inclusions for specific assets, these lines will need to be enabled in the query and update the NIST_Compliance_Assets reference list as needed.
//$Source_IP = strings.coalesce(principal.asset.ip, principal.ip)
//$Hostname = strings.coalesce(principal.asset.hostname, principal.hostname)
//strings.coalesce($Hostname, $Source_IP) in %NIST_Compliance_Assets
match:
$Initiator, $Log_Source
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
一段时间内的角色事件
metadata.product_event_type = /CreateRole|add role definition/ nocase
or metadata.product_event_type = /DeleteRole|delete role definition/ nocase
or metadata.product_event_type = /UpdateRole|update role(?: definition)?/ nocase
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
$Product_Event = metadata.product_event_type
//If the user requires any inclusions for specific assets, these lines will need to be enabled in the query and update the NIST_Compliance_Assets reference list as needed.
//$Hostname = strings.coalesce(principal.asset.hostname, principal.hostname)
//$Source_IP = strings.coalesce(principal.asset.ip, principal.ip)
//strings.coalesce($Hostname, $Source_IP) in %NIST_Compliance_Assets
match:
$Date, $Product_Event
outcome:
$Count = count(metadata.id)
order:
$Date desc
近期群组修改
metadata.event_type = "GROUP_MODIFICATION"
and metadata.product_event_type = /(RemoveUserFrom|AddUserTo|Add member to |Remove member from )|(?:group)/ nocase
security_result.action = "ALLOW"
$Date = timestamp.get_timestamp(metadata.event_timestamp.seconds, "%F %T ")
$Log_Source = metadata.log_type
$Source_IP = strings.coalesce(principal.asset.ip, principal.ip)
$Hostname = strings.coalesce(principal.asset.hostname, principal.hostname)
$Product_Event = metadata.product_event_type
$Group_Name = target.group.group_display_name
//If the user requires any inclusions for specific assets, these lines will need to be enabled in the query and update the NIST_Compliance_Assets reference list as needed.
//strings.coalesce($Hostname, $Source_IP) in %NIST_Compliance_Assets
match:
$Date, $Log_Source, $Source_IP, $Hostname, $Product_Event, $Group_Name
order:
$Date desc
一段时间内的群组活动
metadata.event_type = "GROUP_CREATION"
or metadata.event_type = "GROUP_DELETION"
or metadata.product_event_type = /add group/ nocase
or metadata.product_event_type = /delete group/ nocase
or (metadata.event_type = "GROUP_MODIFICATION"
and metadata.product_event_type = /(RemoveUserFrom|AddUserTo|Add member to |Remove member from )|(?:group)/ nocase)
$Event_Type = metadata.event_type
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
//If the user requires any inclusions for specific assets, these lines will need to be enabled in the query and update the NIST_Compliance_Assets reference list as needed.
//$Hostname = strings.coalesce(principal.asset.hostname, principal.hostname)
//$Source_IP = strings.coalesce(principal.asset.ip, principal.ip)
//strings.coalesce($Hostname, $Source_IP) in %NIST_Compliance_Assets
match:
$Date, $Event_Type
outcome:
$Count = count(metadata.id)
order:
$Date desc
此信息中心全面概述了媒体保护活动，符合 NIST 800-53 标准。它按操作和频率跟踪安全事件，突出显示关键趋势，例如频繁触发的规则、热门主机、IP 地址和用户。此工具可帮助您强制执行合规性要求，以保护敏感媒体资产。
按操作次数排名的前 10 名用户
按操作排序的前 10 个来源主机名
10 大供应商提醒位置
近期供应商提醒
按操作排序的前 10 个供应商提醒
按操作排序的前 10 个来源 IP
按操作统计的指定时间段内的事件
图表名称
查询示例
按操作次数排名的前 10 名用户
strings.coalesce(metadata.product_event_type, security_result.rule_name, security_result.summary) = /\busb|removable|drive\b/ nocase
$Action = security_result.action
$User = principal.user.userid
$User != ""
//If the user requires any inclusions for specific assets, these lines will need to be enabled in the query and update the NIST_Compliance_Assets reference list as needed.
//$Hostname = strings.coalesce(principal.asset.hostname, principal.hostname)
//$Source_IP = strings.coalesce(principal.asset.ip, principal.ip)
//strings.coalesce($Hostname, $Source_IP) in %NIST_Compliance_Assets
match:
$User, $Action
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
按操作排序的前 10 个来源主机名
strings.coalesce(metadata.product_event_type, security_result.rule_name, security_result.summary) = /\busb|removable|drive\b/ nocase
$Action = security_result.action
$Hostname = principal.hostname
$Hostname != ""
//If the user requires any inclusions for specific assets, these lines will need to be enabled in the query and update the NIST_Compliance_Assets reference list as needed.
//$Hostname = strings.coalesce(principal.asset.hostname, principal.hostname)
//$Source_IP = strings.coalesce(principal.asset.ip, principal.ip)
//strings.coalesce($Hostname, $Source_IP) in %NIST_Compliance_Assets
match:
$Hostname, $Action
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
10 大供应商提醒位置
strings.coalesce(metadata.product_event_type, security_result.rule_name, security_result.summary) = /\busb|removable|drive\b/ nocase
$Alert = strings.coalesce(metadata.product_event_type, security_result.rule_name, security_result.summary)
$Country = target.location.country_or_region
$Latitude = target.location.region_coordinates.latitude
$Longitude = target.location.region_coordinates.longitude
//If the user requires any inclusions for specific assets, these lines will need to be enabled in the query and update the NIST_Compliance_Assets reference list as needed.
//$Hostname = strings.coalesce(principal.asset.hostname, principal.hostname)
//$Source_IP = strings.coalesce(principal.asset.ip, principal.ip)
//strings.coalesce($Hostname, $Source_IP) in %NIST_Compliance_Assets
match:
$Alert, $Country, $Latitude, $Longitude
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
近期供应商提醒
strings.coalesce(metadata.product_event_type, security_result.rule_name, security_result.summary) = /\busb|drive\b/ nocase
$Vendor_Alert = strings.coalesce(metadata.product_event_type, security_result.rule_name, security_result.summary)
$User = strings.coalesce(principal.user.user_display_name, target.user.user_display_name)
$Source_IP = strings.coalesce(principal.asset.ip, principal.ip)
$File_Name = target.file.full_path
$Action = security_result.action
$Date = timestamp.get_timestamp(metadata.event_timestamp.seconds, "%F %T ")
//If the user requires any inclusions for specific assets, these lines will need to be enabled in the query and update the NIST_Compliance_Assets reference list as needed.
//$Hostname = strings.coalesce(principal.asset.hostname, principal.hostname)
//strings.coalesce($Hostname, $Source_IP) in %NIST_Compliance_Assets
match:
$Date, $Vendor_Alert, $Source_IP, $User, $File_Name, $Action
order:
$Date desc
按操作排序的前 10 个供应商提醒
strings.coalesce(metadata.product_event_type, security_result.rule_name, security_result.summary) = /\busb|removable|drive\b/ nocase
$Action = security_result.action
$Alerts = strings.coalesce(metadata.product_event_type, security_result.rule_name, security_result.summary)
//If the user requires any inclusions for specific assets, these lines will need to be enabled in the query and update the NIST_Compliance_Assets reference list as needed.
//$Hostname = strings.coalesce(principal.asset.hostname, principal.hostname)
//$Source_IP = strings.coalesce(principal.asset.ip, principal.ip)
//strings.coalesce($Hostname, $Source_IP) in %NIST_Compliance_Assets
match:
$Alerts, $Action
outcome:
$Count = count_distinct(metadata.id)
order:
$Count desc
limit:
10
按操作排序的前 10 个来源 IP
strings.coalesce(metadata.product_event_type, security_result.rule_name, security_result.summary) = /\busb|removable|drive\b/ nocase
$Action = security_result.action
$IP_Address = principal.ip
$IP_Address != ""
//If the user requires any inclusions for specific assets, these lines will need to be enabled in the query and update the NIST_Compliance_Assets reference list as needed.
//$Hostname = strings.coalesce(principal.asset.hostname, principal.hostname)
//$Source_IP = strings.coalesce(principal.asset.ip, principal.ip)
//strings.coalesce($Hostname, $Source_IP) in %NIST_Compliance_Assets
match:
$IP_Address, $Action
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
按操作统计的指定时间段内的事件
strings.coalesce(metadata.product_event_type, security_result.rule_name, security_result.summary) = /\busb|removable|drive\b/ nocase
$Action = security_result.action
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
//If the user requires any inclusions for specific assets, these lines will need to be enabled in the query and update the NIST_Compliance_Assets reference list as needed.
//$Hostname = strings.coalesce(principal.asset.hostname, principal.hostname)
//$Source_IP = strings.coalesce(principal.asset.ip, principal.ip)
//strings.coalesce($Hostname, $Source_IP) in %NIST_Compliance_Assets
match:
$Date, $Action
outcome:
$Count = count(metadata.id)
order:
$Date desc
NIST 800-53 - 系统和通信保护
此信息中心可提供有关系统和网络防御的深入分析，从而增强安全性和合规性。它会监控 EDR 传感器活动、IDS/IPS 事件、DDO 和网络流量异常情况，以检测潜在威胁，确保符合 NIST 安全标准。它使用参考列表 nist_compliance_assets 将数据限定在 NIST 环境中。
注意 ： 在创建所需的参考列表之前，此信息中心内的图表不会加载。
按类别划分的 IDS / IPS 事件
DDoS 活动
按操作划分的不同时间段的网络流量
按地理位置划分的入站被屏蔽流量
USB 事件
基于网络的恶意活动
EDR 供应商提醒
按日志类型划分的弱加密通信随时间的变化
按严重程度排序的前 10 个 IDS / IPS 供应商提醒
按日志类型划分的 EDR 事件中的前 10 大主机
按地理位置划分的出站被屏蔽流量
按方向划分的不同时间段的网络流量
图表名称
查询示例
按类别划分的 IDS / IPS 事件
metadata.event_type = "SCAN_UNCATEGORIZED"
or metadata.event_type = "SCAN_NETWORK"
or metadata.event_type = "NETWORK_UNCATEGORIZED"
or metadata.event_type = "NETWORK_FLOW"
or metadata.event_type = "NETWORK_CONNECTION"
or metadata.event_type = "NETWORK_FTP"
or metadata.event_type = "NETWORK_DHCP"
or metadata.event_type = "NETWORK_DNS"
or metadata.event_type = "NETWORK_HTTP"
or metadata.event_type = "NETWORK_SMTP"
$Category = security_result.category
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
//If the user requires any inclusions for specific assets, these lines will need to be enabled in the query and update the NIST_Compliance_Assets reference list as needed.
//$Hostname = strings.coalesce(principal.asset.hostname, principal.hostname, target.asset.hostname, target.hostname)
//$Source_IP = strings.coalesce(principal.asset.ip, principal.ip)
//$Destination_IP = strings.coalesce(target.asset.ip, target.ip)
//strings.coalesce($Hostname, $Destination_IP, $Source_IP) in %NIST_Compliance_Assets
match:
$Category
outcome:
$Count = count(metadata.id)
DDoS 活动
(metadata.log_type = /ddos/ nocase or (security_result.description = /ddos/ nocase or security_result.summary = /ddos/ nocase or metadata.description = /ddos/ nocase or security_result.rule_name = /ddos/ nocase or metadata.product_event_type = /ddos/ nocase))
$Summary = strings.coalesce(security_result.description, security_result.summary, metadata.description, security_result.rule_name, metadata.product_event_type)
$Action = security_result.action
$Log_Type = metadata.log_type
$Hostname = strings.coalesce(principal.hostname, principal.asset.hostname, target.asset.hostname, target.hostname)
$Source_IP = strings.coalesce(principal.asset.ip, principal.ip)
$Destination_IP = strings.coalesce(target.asset.ip, target.ip)
//If the user requires any inclusions for specific assets, these lines will need to be enabled in the query and update the NIST_Compliance_Assets reference list as needed.
//strings.coalesce($Hostname, $Source_IP, $Destination_IP) in %NIST_Compliance_Assets
match:
$Summary, $Hostname, $Source_IP, $Destination_IP, $Action, $Log_Type
outcome:
$Count = count(metadata.id)
$Date = timestamp.get_timestamp(max(metadata.event_timestamp.seconds), "%F %T")
order:
$Count desc
按操作划分的不同时间段的网络流量
metadata.event_type = "NETWORK_UNCATEGORIZED"
or metadata.event_type = "NETWORK_FLOW"
or metadata.event_type = "NETWORK_CONNECTION"
or metadata.event_type = "NETWORK_FTP"
or metadata.event_type = "NETWORK_DHCP"
or metadata.event_type = "NETWORK_DNS"
or metadata.event_type = "NETWORK_HTTP"
or metadata.event_type = "NETWORK_SMTP"
$Action = security_result.action
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
//If the user requires any inclusions for specific assets, these lines will need to be enabled in the query and update the NIST_Compliance_Assets reference list as needed.
//$Hostname = strings.coalesce(principal.asset.hostname, principal.hostname,target.hostname, target.asset.hostname)
//$Source_IP = strings.coalesce(principal.asset.ip, principal.ip)
//$Destination_IP = strings.coalesce(target.asset.ip, target.ip)
//strings.coalesce($Hostname, $Source_IP) in %NIST_Compliance_Assets
match:
$Date, $Action
outcome:
$Count = count(metadata.id)
按地理位置划分的入站被屏蔽流量
metadata.event_type = "NETWORK_UNCATEGORIZED"
or metadata.event_type = "NETWORK_FLOW"
or metadata.event_type = "NETWORK_CONNECTION"
or metadata.event_type = "NETWORK_FTP"
or metadata.event_type = "NETWORK_DHCP"
or metadata.event_type = "NETWORK_DNS"
or metadata.event_type = "NETWORK_HTTP"
or metadata.event_type = "NETWORK_SMTP"
security_result.action = "BLOCK"
network.direction = "INBOUND"
$Country = principal.location.country_or_region
$Country != ""
//If the user requires any inclusions for specific assets, these lines will need to be enabled in the query and update the NIST_Compliance_Assets reference list as needed.
//$Hostname = strings.coalesce(principal.asset.hostname, principal.hostname, target.asset.hostname, target.hostname)
//$Source_IP = strings.coalesce(principal.asset.ip, principal.ip)
//$Destination_IP = strings.coalesce(target.asset.ip, target.ip)
//strings.coalesce($Hostname, $Source_IP, $Destination_IP) in %NIST_Compliance_Assets
match:
$Country
outcome:
$Count = count(metadata.id)
$Latitude = max(principal.location.region_coordinates.latitude)
$Longitude = max(principal.location.region_coordinates.longitude)
order:
$Count desc
USB 事件
(metadata.product_event_type = /usb/ nocase or security_result.summary = /usb/ nocase )
$Log_Type = metadata.log_type
$USB_Event = strings.coalesce(metadata.product_event_type, security_result.summary)
$Category = security_result.category_details
$Source_IP = strings.coalesce(principal.ip, principal.asset.ip)
$Hostname = strings.coalesce(principal.asset.hostname, principal.hostname)
$User = strings.coalesce(principal.user.userid, principal.user.user_display_name, principal.user.email_addresses, target.user.userid, target.user.user_display_name, target.user.email_addresses)
//If the user requires any inclusions for specific assets, these lines will need to be enabled in the query and update the NIST_Compliance_Assets reference list as needed.
//strings.coalesce($Hostname, $Source_IP) in %NIST_Compliance_Assets
match:
$Log_Type, $USB_Event, $User, $Hostname, $Source_IP, $Category
outcome:
$Count = count(metadata.id)
$Date = timestamp.get_timestamp(max(metadata.event_timestamp.seconds), "%F %T")
order:
$Count desc
基于网络的恶意活动
metadata.event_type = "NETWORK_UNCATEGORIZED"
or metadata.event_type = "NETWORK_FLOW"
or metadata.event_type = "NETWORK_CONNECTION"
or metadata.event_type = "NETWORK_FTP"
or metadata.event_type = "NETWORK_DHCP"
or metadata.event_type = "NETWORK_DNS"
or metadata.event_type = "NETWORK_HTTP"
or metadata.event_type = "NETWORK_SMTP"
(security_result.category = "NETWORK_DENIAL_OF_SERVICE" or security_result.category = "NETWORK_MALICIOUS" or security_result.category = "NETWORK_SUSPICIOUS" or security_result.category = "SOFTWARE_MALICIOUS" or security_result.category = "SOFTWARE_SUSPICIOUS" or security_result.category = "NETWORK_RECON")
$Log_Type = metadata.log_type
$Category = security_result.category
$Summary = strings.coalesce(security_result.description, security_result.summary, metadata.description, security_result.rule_name, metadata.product_event_type)
$Hostname = strings.coalesce(principal.asset.hostname, principal.hostname, target.hostname, target.asset.hostname)
//If the user requires any inclusions for specific assets, these lines will need to be enabled in the query and update the NIST_Compliance_Assets reference list as needed.
//$Source_IP = strings.coalesce(principal.asset.ip, principal.ip)
//$Destination_IP = strings.coalesce(principal.asset.ip, principal.ip)
//strings.coalesce($Hostname, $Source_IP, $Destination_IP) in %NIST_Compliance_Assets
match:
$Summary, $Category, $Hostname, $Log_Type
outcome:
$Count = count(metadata.id)
$Date = timestamp.get_timestamp(max(metadata.event_timestamp.seconds), "%F %T")
order:
$Count desc
EDR 供应商提醒
$Log_Type = metadata.log_type
$Rule_Name = security_result.rule_name
$Severity = security_result.severity
$User = strings.coalesce(principal.user.user_display_name, principal.user.email_addresses, principal.user.userid, target.user.userid, target.user.user_display_name, target.user.email_addresses)
//If the user requires any inclusions for specific assets, these lines will need to be enabled in the query and update the NIST_Compliance_Assets reference list as needed.
//$Hostname = strings.coalesce(principal.asset.hostname, principal.hostname)
//$Source_IP = strings.coalesce(principal.asset.ip, principal.ip)
//strings.coalesce($Hostname, $Source_IP) in %NIST_Compliance_Assets
match:
$Rule_Name, $Severity, $User, $Log_Type
outcome:
$Count = count(metadata.id)
$Date = timestamp.get_timestamp(max(metadata.event_timestamp.seconds), "%F %T")
order:
$Count desc
按日志类型划分的弱加密通信随时间的变化
network.tls.cipher = /RSA|DES|RC4|SHA-1|3DES|MD5/ nocase
$Log_Type = metadata.log_type
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
//If the user requires any inclusions for specific assets, these lines will need to be enabled in the query and update the NIST_Compliance_Assets reference list as needed.
//$Hostname = strings.coalesce(principal.asset.hostname, principal.hostname, target.asset.hostname, target.hostname)
//$Source_IP = strings.coalesce(principal.asset.ip, principal.ip)
//$Destination_IP = strings.coalesce(target.asset.ip, target.ip)
//strings.coalesce($Hostname, $Source_IP, Destination_IP) in %NIST_Compliance_Assets
match:
$Date, $Log_Type
outcome:
$Count = count(metadata.id)
按严重程度排序的前 10 个 IDS / IPS 供应商提醒
metadata.event_type = "SCAN_UNCATEGORIZED"
or metadata.event_type = "SCAN_NETWORK"
or metadata.event_type = "NETWORK_UNCATEGORIZED"
or metadata.event_type = "NETWORK_FLOW"
or metadata.event_type = "NETWORK_CONNECTION"
or metadata.event_type = "NETWORK_FTP"
or metadata.event_type = "NETWORK_DHCP"
or metadata.event_type = "NETWORK_DNS"
or metadata.event_type = "NETWORK_HTTP"
or metadata.event_type = "NETWORK_SMTP"
(security_result.severity = "HIGH" or security_result.severity = "CRITICAL")
$Rule_Name = security_result.rule_name
$Rule_Name != ""
$Severity = security_result.severity
//If the user requires any inclusions for specific assets, these lines will need to be enabled in the query and update the NIST_Compliance_Assets reference list as needed.
//$Hostname = strings.coalesce(principal.asset.hostname, principal.hostname, target.asset.hostname, target.hostname)
//$Source_IP = strings.coalesce(principal.asset.ip, principal.ip)
//$Destination_IP = strings.coalesce(target.asset.ip, target.ip)
//strings.coalesce($Hostname, $Destination_IP, $Source_IP) in %NIST_Compliance_Assets
match:
$Rule_Name, $Severity
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
按日志类型划分的 EDR 事件中的前 10 大主机
$Hostname = strings.coalesce(principal.hostname, principal.asset.hostname)
$Hostname != ""
$Log_Type = metadata.log_type
//If the user requires any inclusions for specific assets, these lines will need to be enabled in the query and update the NIST_Compliance_Assets reference list as needed.
//$Source_IP = strings.coalesce(principal.asset.ip, principal.ip)
//strings.coalesce($Hostname, $Source_IP) in %NIST_Compliance_Assets
match:
$Hostname, $Log_Type
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
按地理位置划分的出站被屏蔽流量
metadata.event_type = "NETWORK_UNCATEGORIZED"
or metadata.event_type = "NETWORK_FLOW"
or metadata.event_type = "NETWORK_CONNECTION"
or metadata.event_type = "NETWORK_FTP"
or metadata.event_type = "NETWORK_DHCP"
or metadata.event_type = "NETWORK_DNS"
or metadata.event_type = "NETWORK_HTTP"
or metadata.event_type = "NETWORK_SMTP"
security_result.action = "BLOCK"
network.direction = "OUTBOUND"
$Country = principal.location.country_or_region
$Country != ""
//If the user requires any inclusions for specific assets, these lines will need to be enabled in the query and update the NIST_Compliance_Assets reference list as needed.
//$Hostname = strings.coalesce(principal.asset.hostname, principal.hostname, target.asset.hostname, target.hostname)
//$Source_IP = strings.coalesce(principal.asset.ip, principal.ip)
//$Destination_IP = strings.coalesce(target.asset.ip, target.ip)
//strings.coalesce($Hostname, $Source_IP, $Destination_IP) in %NIST_Compliance_Assets
match:
$Country
outcome:
$Count = count(metadata.id)
$Latitude = max(principal.location.region_coordinates.latitude)
$Longitude = max(principal.location.region_coordinates.longitude)
order:
$Count desc
按方向划分的不同时间段的网络流量
metadata.event_type = "NETWORK_UNCATEGORIZED"
or metadata.event_type = "NETWORK_FLOW"
or metadata.event_type = "NETWORK_CONNECTION"
or metadata.event_type = "NETWORK_FTP"
or metadata.event_type = "NETWORK_DHCP"
or metadata.event_type = "NETWORK_DNS"
or metadata.event_type = "NETWORK_HTTP"
or metadata.event_type = "NETWORK_SMTP"
//If the user requires any inclusions for specific assets, these lines will need to be enabled in the query and update the NIST_Compliance_Assets reference list as needed.
//$Hostname = strings.coalesce(principal.asset.hostname, principal.hostname, target.asset.hostname, target.hostname)
//$Source_IP = strings.coalesce(principal.asset.ip, principal.ip)
//$Destination_IP = strings.coalesce(target.asset.ip, target.ip)
//strings.coalesce($Hostname, $Source_IP, $Destination_IP) in %NIST_Compliance_Assets
$Direction = network.direction
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
match:
$Direction, $Date
outcome:
$Total_Volume = sum(network.sent_bytes) + sum(network.received_bytes)
$Total_Volume_GB = math.round($Total_Volume/ (1000 * 1000 * 1000), 2)
网络流量概览
此信息中心可按 IP 地址、协议、供应商、提醒和区域实时监控云端和本地网络流量，从而有效分析流量和潜在问题。
网络事件
供应商提醒中的前 10 个来源 IP
被屏蔽最多的前 10 位用户
按发送的字节数排名的前 10 个事件
按操作类型划分的供应商提醒随时间变化情况
按日志类型划分的指定时间段内的事件
按流量排序的前 10 个出站 IP
按日志类型统计的供应商提醒随时间的变化趋势
前 10 大来源 IP 地址
10 大供应商提醒
不同的目标 IP
弱 TLS 版本的使用情况随时间的变化
按流量排序的前 10 位用户
按发送的字节数排序的前 10 个应用
入站流量与出站流量随时间的变化
平均字节数
不同时间段的 IP 流量
流量来源位置（前 10 名）
按严重程度划分的事件
入站流量位置热图
按流量排序的前 10 项服务
按流量排序的前 10 个端口 - 出站
不同的来源 IP
不同日志类型的流量随时间的变化
发送的总字节数
标准差（字节）
出站流量位置热图
被屏蔽的来源 IP 到目标 IP 的前 10 名
按流量排序的前 10 个端口 - 入站
被屏蔽次数最多的 10 个国家/地区
前 10 大目标 IP 地址
网络协议随时间推移的分布情况
10 大可疑目标文件
供应商提醒中的前 10 位用户
前 10 个网址
允许的网络流量与遭拒的网络流量
按流量大小排序的前 10 个主机
按协议划分的目标端口
允许次数最多的 10 个连接
按操作划分的入站流量随时间变化情况
平均字节数
排名前 10 的禁播国家/地区
不同时间段的出站流量（按操作）
前 10 个事件类别
按流量排序的前 10 个入站 IP
前 10 名网络连接
被屏蔽的前 10 个来源 IP 地址
图表名称
查询示例
网络事件
$event.metadata.event_type = "NETWORK_FLOW"
or $event.metadata.event_type = "NETWORK_CONNECTION"
or $event.metadata.event_type = "NETWORK_FTP"
or $event.metadata.event_type = "NETWORK_DHCP"
or $event.metadata.event_type = "NETWORK_DNS"
or $event.metadata.event_type = "NETWORK_HTTP"
or $event.metadata.event_type = "NETWORK_SMTP"
outcome:
$Count = count($event.metadata.id)
供应商提醒中的前 10 个来源 IP
metadata.event_type = "NETWORK_UNCATEGORIZED"
or metadata.event_type = "NETWORK_FLOW"
or metadata.event_type = "NETWORK_CONNECTION"
or metadata.event_type = "NETWORK_FTP"
or metadata.event_type = "NETWORK_DHCP"
or metadata.event_type = "NETWORK_DNS"
or metadata.event_type = "NETWORK_HTTP"
or metadata.event_type = "NETWORK_SMTP"
security_result.rule_name != ""
$Source_IP = strings.coalesce(principal.ip, principal.asset.ip)
match:
$Source_IP
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
被屏蔽最多的前 10 位用户
metadata.event_type = "NETWORK_UNCATEGORIZED"
or metadata.event_type = "NETWORK_FLOW"
or metadata.event_type = "NETWORK_CONNECTION"
or metadata.event_type = "NETWORK_FTP"
or metadata.event_type = "NETWORK_DHCP"
or metadata.event_type = "NETWORK_DNS"
or metadata.event_type = "NETWORK_HTTP"
or metadata.event_type = "NETWORK_SMTP"
(security_result.action = "BLOCK" or security_result.action = "FAIL" or security_result.action_details = /fail|block/ nocase)
$User = strings.coalesce(principal.user.userid, principal.user.user_display_name, principal.user.email_addresses)
match:
$User
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
按发送的字节数排名的前 10 个事件
$Source_IP = principal.ip
$Event_Type = metadata.event_type
match:
$Event_Type, $Source_IP
outcome:
$Bytes_Sent = sum(network.sent_bytes) / (1000*1000*1000)
order:
$Bytes_Sent desc
limit:
10
按操作类型划分的供应商提醒随时间变化情况
metadata.event_type = "NETWORK_UNCATEGORIZED"
or metadata.event_type = "NETWORK_FLOW"
or metadata.event_type = "NETWORK_CONNECTION"
or metadata.event_type = "NETWORK_FTP"
or metadata.event_type = "NETWORK_DHCP"
or metadata.event_type = "NETWORK_DNS"
or metadata.event_type = "NETWORK_HTTP"
or metadata.event_type = "NETWORK_SMTP"
security_result.rule_name != ""
$Action = security_result.action
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
match:
$Date, $Action
outcome:
$Count = count(metadata.id)
order:
$Count desc
按日志类型划分的指定时间段内的事件
metadata.event_type = "NETWORK_UNCATEGORIZED"
or metadata.event_type = "NETWORK_FLOW"
or metadata.event_type = "NETWORK_CONNECTION"
or metadata.event_type = "NETWORK_FTP"
or metadata.event_type = "NETWORK_DHCP"
or metadata.event_type = "NETWORK_DNS"
or metadata.event_type = "NETWORK_HTTP"
or metadata.event_type = "NETWORK_SMTP"
$Log_type = metadata.log_type
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
match:
$Date, $Log_type
outcome:
$Count = count(metadata.id)
order:
$Date asc
按流量排序的前 10 个出站 IP
network.direction = "OUTBOUND"
$Log_Type = metadata.log_type
$Destination_IP = target.ip
match:
$Log_Type, $Destination_IP
outcome:
$Total_Bytes = sum(network.received_bytes + network.sent_bytes) / (1000*1000*1000)
order:
$Total_Bytes desc
limit:
10
按日志类型统计的供应商提醒随时间的变化趋势
metadata.event_type = "NETWORK_UNCATEGORIZED"
or metadata.event_type = "NETWORK_FLOW"
or metadata.event_type = "NETWORK_CONNECTION"
or metadata.event_type = "NETWORK_FTP"
or metadata.event_type = "NETWORK_DHCP"
or metadata.event_type = "NETWORK_DNS"
or metadata.event_type = "NETWORK_HTTP"
or metadata.event_type = "NETWORK_SMTP"
security_result.rule_name != ""
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
$Log_Type = metadata.log_type
match:
$Date , $Log_Type
outcome:
$Count = count(security_result.rule_name)
order:
$Date asc
前 10 大来源 IP 地址
$event.metadata.event_type = "NETWORK_FLOW"
or $event.metadata.event_type = "NETWORK_CONNECTION"
or $event.metadata.event_type = "NETWORK_FTP"
or $event.metadata.event_type = "NETWORK_DHCP"
or $event.metadata.event_type = "NETWORK_DNS"
or $event.metadata.event_type = "NETWORK_HTTP"
or $event.metadata.event_type = "NETWORK_SMTP"
$Event_Type = $event.metadata.event_type
$Source_IP = $event.principal.ip
$Source_IP != ""
match:
$Source_IP, $Event_Type
outcome:
$Count = count($event.metadata.id)
order:
$Count desc
limit:
10
10 大供应商提醒
metadata.event_type = "NETWORK_UNCATEGORIZED"
or metadata.event_type = "NETWORK_FLOW"
or metadata.event_type = "NETWORK_CONNECTION"
or metadata.event_type = "NETWORK_FTP"
or metadata.event_type = "NETWORK_DHCP"
or metadata.event_type = "NETWORK_DNS"
or metadata.event_type = "NETWORK_HTTP"
or metadata.event_type = "NETWORK_SMTP"
$Rule_Name = security_result.rule_name
match:
$Rule_Name
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
不同的目标 IP
$event.metadata.event_type = "NETWORK_FLOW"
or $event.metadata.event_type = "NETWORK_CONNECTION"
or $event.metadata.event_type = "NETWORK_FTP"
or $event.metadata.event_type = "NETWORK_DHCP"
or $event.metadata.event_type = "NETWORK_DNS"
or $event.metadata.event_type = "NETWORK_HTTP"
or $event.metadata.event_type = "NETWORK_SMTP"
outcome:
$Count = count_distinct($event.target.ip)
弱 TLS 版本的使用情况随时间的变化
network.tls.version != /1(\.|_)?(2|3)/ nocase
$Cipher_Version = network.tls.version
$Cipher_Version != ""
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
match:
$Cipher_Version, $Date
outcome:
$Count = count(metadata.id)
order:
$Date desc
按流量排序的前 10 位用户
$User = principal.user.userid
match:
$User
outcome:
$Total_Bytes = sum(network.sent_bytes + network.received_bytes) / (1000*1000*1000)
order:
$Total_Bytes desc
limit:
10
按发送的字节数排序的前 10 个应用
$Source_IP = principal.ip
$Application = target.application
match:
$Application, $Source_IP
outcome:
$Total_Bytes = sum(network.sent_bytes) / (1000*1000*1000)
order:
$Total_Bytes desc
limit:
10
入站流量与出站流量随时间的变化
metadata.event_type = "NETWORK_UNCATEGORIZED"
or metadata.event_type = "NETWORK_FLOW"
or metadata.event_type = "NETWORK_CONNECTION"
or metadata.event_type = "NETWORK_FTP"
or metadata.event_type = "NETWORK_DHCP"
or metadata.event_type = "NETWORK_DNS"
or metadata.event_type = "NETWORK_HTTP"
or metadata.event_type = "NETWORK_SMTP"
$Direction = network.direction
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
match:
$Direction, $Date
outcome:
$Total_Volume = sum(network.sent_bytes) + sum(network.received_bytes)
$Total_Volume_GB = $Total_Volume/ (1000 * 1000 * 1000)
order:
$Date desc
平均字节数
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
match:
$Date
outcome:
$Total_Bytes = sum(network.sent_bytes + network.received_bytes) / 2
$Mean_GB_Total = math.round($Total_Bytes / 1073741824, 2)
order:
$Date desc
不同时间段的 IP 流量
$IP_Address = principal.ip
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
match:
$IP_Address, $Date
outcome:
$Total_Bytes = sum(network.sent_bytes + network.received_bytes) / (1000*1000*1000)
order:
$Date desc
流量来源位置（前 10 名）
$Country = principal.location.country_or_region
$Country != ""
$Latitude = principal.location.region_coordinates.latitude
$Longitude = principal.location.region_coordinates.longitude
match:
$Country, $Latitude, $Longitude
outcome:
$Total_Bytes = sum(network.received_bytes + network.sent_bytes) / (1000*1000*1000)
order:
$Total_Bytes desc
limit:
10
按严重程度划分的事件
metadata.event_type = "NETWORK_UNCATEGORIZED"
or metadata.event_type = "NETWORK_FLOW"
or metadata.event_type = "NETWORK_CONNECTION"
or metadata.event_type = "NETWORK_FTP"
or metadata.event_type = "NETWORK_DHCP"
or metadata.event_type = "NETWORK_DNS"
or metadata.event_type = "NETWORK_HTTP"
or metadata.event_type = "NETWORK_SMTP"
$Severity = security_result.severity
match:
$Severity
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
入站流量位置热图
metadata.event_type = "NETWORK_UNCATEGORIZED"
or metadata.event_type = "NETWORK_FLOW"
or metadata.event_type = "NETWORK_CONNECTION"
or metadata.event_type = "NETWORK_FTP"
or metadata.event_type = "NETWORK_DHCP"
or metadata.event_type = "NETWORK_DNS"
or metadata.event_type = "NETWORK_HTTP"
or metadata.event_type = "NETWORK_SMTP"
network.direction = "INBOUND"
$Country = principal.ip_geo_artifact.location.country_or_region
match:
$Country
outcome:
$Count = count(metadata.id)
$Latitude = max(principal.ip_geo_artifact.location.region_coordinates.latitude)
$Longitude = max(principal.ip_geo_artifact.location.region_coordinates.longitude)
order:
$Count desc
按流量排序的前 10 项服务
target.port != 0
network.ip_protocol != "UNKNOWN_IP_PROTOCOL"
$Service = strings.concat(target.port, "")
$Protocol = network.ip_protocol
match:
$Service, $Protocol
outcome:
$Total_Bytes = sum(network.received_bytes + network.sent_bytes) / (1000*1000*1000)
order:
$Total_Bytes desc
limit:
10
按流量排序的前 10 个端口 - 出站
metadata.event_type = "NETWORK_UNCATEGORIZED"
or metadata.event_type = "NETWORK_FLOW"
or metadata.event_type = "NETWORK_CONNECTION"
or metadata.event_type = "NETWORK_FTP"
or metadata.event_type = "NETWORK_DHCP"
or metadata.event_type = "NETWORK_DNS"
or metadata.event_type = "NETWORK_HTTP"
or metadata.event_type = "NETWORK_SMTP"
network.direction = "OUTBOUND"
$Port = strings.concat(target.port, "")
match:
$Port
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
不同的来源 IP
$event.metadata.event_type = "NETWORK_FLOW"
or $event.metadata.event_type = "NETWORK_CONNECTION"
or $event.metadata.event_type = "NETWORK_FTP"
or $event.metadata.event_type = "NETWORK_DHCP"
or $event.metadata.event_type = "NETWORK_DNS"
or $event.metadata.event_type = "NETWORK_HTTP"
or $event.metadata.event_type = "NETWORK_SMTP"
outcome:
$Count = count_distinct($event.principal.ip)
不同日志类型的流量随时间的变化
$Log_Type = metadata.log_type
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
match:
$Date, $Log_Type
outcome:
$Total_Bytes = sum(network.sent_bytes + network.received_bytes) / (1000*1000*1000)
order:
$Date desc
发送的总字节数
outcome:
$Total_Bytes_Sent_GB = math.round(sum(network.sent_bytes) / (1000*1000*1000), 2)
标准差（字节）
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
match:
$Date
outcome:
$Stdev_Bytes = stddev(network.sent_bytes + network.received_bytes) / (1000*1000*1000)
order:
$Date desc
出站流量位置热图
metadata.event_type = "NETWORK_UNCATEGORIZED"
or metadata.event_type = "NETWORK_FLOW"
or metadata.event_type = "NETWORK_CONNECTION"
or metadata.event_type = "NETWORK_FTP"
or metadata.event_type = "NETWORK_DHCP"
or metadata.event_type = "NETWORK_DNS"
or metadata.event_type = "NETWORK_HTTP"
or metadata.event_type = "NETWORK_SMTP"
network.direction = "OUTBOUND"
$Country = target.ip_geo_artifact.location.country_or_region
match:
$Country
outcome:
$Count = count(metadata.id)
$Latitude = max(target.ip_geo_artifact.location.region_coordinates.latitude)
$Longitude = max(target.ip_geo_artifact.location.region_coordinates.longitude)
order:
$Count desc
被屏蔽的来源 IP 到目标 IP 的前 10 名
$event.metadata.event_type = "NETWORK_FLOW"
or $event.metadata.event_type = "NETWORK_CONNECTION"
or $event.metadata.event_type = "NETWORK_FTP"
or $event.metadata.event_type = "NETWORK_DHCP"
or $event.metadata.event_type = "NETWORK_DNS"
or $event.metadata.event_type = "NETWORK_HTTP"
or $event.metadata.event_type = "NETWORK_SMTP"
$Event_Type = $event.metadata.event_type
$Source_IP = $event.principal.ip
$Destination_IP = $event.target.ip
$Block = $event.security_result.action
$Block = "BLOCK"
match:
$Event_Type, $Source_IP, $Block, $Destination_IP
outcome:
$Count = count($event.metadata.id)
order:
$Count desc
limit:
10
按流量排序的前 10 个端口 - 入站
metadata.event_type = "NETWORK_UNCATEGORIZED"
or metadata.event_type = "NETWORK_FLOW"
or metadata.event_type = "NETWORK_CONNECTION"
or metadata.event_type = "NETWORK_FTP"
or metadata.event_type = "NETWORK_DHCP"
or metadata.event_type = "NETWORK_DNS"
or metadata.event_type = "NETWORK_HTTP"
or metadata.event_type = "NETWORK_SMTP"
network.direction = "INBOUND"
$Port = strings.concat(target.port, "")
match:
$Port
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
被屏蔽次数最多的 10 个国家/地区
metadata.event_type = "NETWORK_UNCATEGORIZED"
or metadata.event_type = "NETWORK_FLOW"
or metadata.event_type = "NETWORK_CONNECTION"
or metadata.event_type = "NETWORK_FTP"
or metadata.event_type = "NETWORK_DHCP"
or metadata.event_type = "NETWORK_DNS"
or metadata.event_type = "NETWORK_HTTP"
or metadata.event_type = "NETWORK_SMTP"
security_result.action = "BLOCK"
$Country = strings.coalesce(principal.location.country_or_region, principal.ip_geo_artifact.location.country_or_region)
match:
$Country
outcome:
$Count = count($Country)
order:
$Count desc
limit:
10
前 10 大目标 IP 地址
$event.metadata.event_type = "NETWORK_FLOW"
or $event.metadata.event_type = "NETWORK_CONNECTION"
or $event.metadata.event_type = "NETWORK_FTP"
or $event.metadata.event_type = "NETWORK_DHCP"
or $event.metadata.event_type = "NETWORK_DNS"
or $event.metadata.event_type = "NETWORK_HTTP"
or $event.metadata.event_type = "NETWORK_SMTP"
$Event_Type = $event.metadata.event_type
$Log_Type = $event.metadata.log_type
$Destination_IP = $event.target.ip
$Destination_IP != ""
match:
$Destination_IP, $Event_Type, $Log_Type
outcome:
$Count = count($event.metadata.id)
order:
$Count desc
limit:
10
网络协议随时间推移的分布情况
metadata.event_type = "NETWORK_UNCATEGORIZED"
or metadata.event_type = "NETWORK_FLOW"
or metadata.event_type = "NETWORK_CONNECTION"
or metadata.event_type = "NETWORK_FTP"
or metadata.event_type = "NETWORK_DHCP"
or metadata.event_type = "NETWORK_DNS"
or metadata.event_type = "NETWORK_HTTP"
or metadata.event_type = "NETWORK_SMTP"
$Protocol = network.application_protocol
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
match:
$Date, $Protocol
outcome:
$Count = count(metadata.id)
order:
$Date asc
10 大可疑目标文件
metadata.event_type = "NETWORK_UNCATEGORIZED"
or metadata.event_type = "NETWORK_FLOW"
or metadata.event_type = "NETWORK_CONNECTION"
or metadata.event_type = "NETWORK_FTP"
or metadata.event_type = "NETWORK_DHCP"
or metadata.event_type = "NETWORK_DNS"
or metadata.event_type = "NETWORK_HTTP"
or metadata.event_type = "NETWORK_SMTP"
$Files = target.file.full_path
$Files = /\.exe|\.scr|\.com|\.pif|\.dll|\.js|\.vbs|\.ps1|\.bat|\.cmd|\.wsf|\.hta|\.docm|\.xlsm|\.pptm|\.dotm|\.pdf|\.zip|\.rar|\.iso|\.img|\.lnk|\.url/ nocase
match:
$Files
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
供应商提醒中的前 10 位用户
metadata.event_type = "NETWORK_UNCATEGORIZED"
or metadata.event_type = "NETWORK_FLOW"
or metadata.event_type = "NETWORK_CONNECTION"
or metadata.event_type = "NETWORK_FTP"
or metadata.event_type = "NETWORK_DHCP"
or metadata.event_type = "NETWORK_DNS"
or metadata.event_type = "NETWORK_HTTP"
or metadata.event_type = "NETWORK_SMTP"
security_result.rule_name != ""
$Source_User = strings.coalesce(principal.user.userid, principal.user.user_display_name, principal.user.email_addresses)
match:
$Source_User
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
前 10 个网址
metadata.event_type = "NETWORK_UNCATEGORIZED"
or metadata.event_type = "NETWORK_FLOW"
or metadata.event_type = "NETWORK_CONNECTION"
or metadata.event_type = "NETWORK_FTP"
or metadata.event_type = "NETWORK_DHCP"
or metadata.event_type = "NETWORK_DNS"
or metadata.event_type = "NETWORK_HTTP"
or metadata.event_type = "NETWORK_SMTP"
$URL = target.url
match:
$URL
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
允许的网络流量与遭拒的网络流量
metadata.event_type = "NETWORK_UNCATEGORIZED"
or metadata.event_type = "NETWORK_FLOW"
or metadata.event_type = "NETWORK_CONNECTION"
or metadata.event_type = "NETWORK_FTP"
or metadata.event_type = "NETWORK_DHCP"
or metadata.event_type = "NETWORK_DNS"
or metadata.event_type = "NETWORK_HTTP"
or metadata.event_type = "NETWORK_SMTP"
$Action = security_result.action
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
match:
$Action, $Date
outcome:
$Count = count(metadata.id)
order:
$Date asc
按流量大小排序的前 10 个主机
$Hostname = principal.hostname
match:
$Hostname
outcome:
$Total_Bytes = sum(network.sent_bytes + network.received_bytes) / (1000*1000*1000)
order:
$Total_Bytes desc
limit:
10
按协议划分的目标端口
metadata.event_type = "NETWORK_UNCATEGORIZED"
or metadata.event_type = "NETWORK_FLOW"
or metadata.event_type = "NETWORK_CONNECTION"
or metadata.event_type = "NETWORK_FTP"
or metadata.event_type = "NETWORK_DHCP"
or metadata.event_type = "NETWORK_DNS"
or metadata.event_type = "NETWORK_HTTP"
or metadata.event_type = "NETWORK_SMTP"
$Port = strings.concat(target.port, "")
$Protocol = network.application_protocol
match:
$Port, $Protocol
outcome:
$Count = count(metadata.id)
order:
$Count desc
允许次数最多的 10 个连接
$event.metadata.event_type = "NETWORK_FLOW"
or $event.metadata.event_type = "NETWORK_CONNECTION"
or $event.metadata.event_type = "NETWORK_FTP"
or $event.metadata.event_type = "NETWORK_DHCP"
or $event.metadata.event_type = "NETWORK_DNS"
or $event.metadata.event_type = "NETWORK_HTTP"
or $event.metadata.event_type = "NETWORK_SMTP"
$Event_Type = $event.metadata.event_type
$Hostname = $event.principal.hostname
$Asset_Type = $event.principal.asset.type
$OS_Version = $event.target.asset.platform_software.platform_version
$Source_IP = $event.principal.ip
$Mac_Add = $event.principal.mac
$Nat_IP = $event.principal.nat_ip
$Destination_IP = $event.target.ip
$Destination_IP != ""
$Connection = $event.security_result.action
$Connection = "ALLOW"
match:
$Event_Type, $Hostname, $OS_Version, $Source_IP, $Mac_Add, $Nat_IP, $Connection, $Destination_IP
outcome:
$Count = count($event.metadata.id)
order:
$Count desc
limit:
10
按操作划分的入站流量随时间变化情况
metadata.event_type = "NETWORK_UNCATEGORIZED"
or metadata.event_type = "NETWORK_FLOW"
or metadata.event_type = "NETWORK_CONNECTION"
or metadata.event_type = "NETWORK_FTP"
or metadata.event_type = "NETWORK_DHCP"
or metadata.event_type = "NETWORK_DNS"
or metadata.event_type = "NETWORK_HTTP"
or metadata.event_type = "NETWORK_SMTP"
network.direction = "INBOUND"
$Action = security_result.action
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
match:
$Action, $Date
outcome:
$Count = count(metadata.id)
order:
$Date asc
平均字节数
outcome:
$Average_Bytes = sum(network.sent_bytes + network.received_bytes) / 2
$Average_Bytes_GB = math.round($Average_Bytes / (1000*1000*1000), 2)
排名前 10 的禁播国家/地区
$event.metadata.event_type = "NETWORK_FLOW"
or $event.metadata.event_type = "NETWORK_CONNECTION"
or $event.metadata.event_type = "NETWORK_FTP"
or $event.metadata.event_type = "NETWORK_DHCP"
or $event.metadata.event_type = "NETWORK_DNS"
or $event.metadata.event_type = "NETWORK_HTTP"
or $event.metadata.event_type = "NETWORK_SMTP"
$event.security_result.action = "BLOCK"
$Countries = $event.principal.location.country_or_region
$Latitude = $event.principal.location.region_coordinates.latitude
$Longitude = $event.principal.location.region_coordinates.longitude
match:
$Countries, $Latitude, $Longitude
outcome:
$Count = count_distinct($Countries)
limit:
10
不同时间段的出站流量（按操作）
metadata.event_type = "NETWORK_UNCATEGORIZED"
or metadata.event_type = "NETWORK_FLOW"
or metadata.event_type = "NETWORK_CONNECTION"
or metadata.event_type = "NETWORK_FTP"
or metadata.event_type = "NETWORK_DHCP"
or metadata.event_type = "NETWORK_DNS"
or metadata.event_type = "NETWORK_HTTP"
or metadata.event_type = "NETWORK_SMTP"
network.direction = "OUTBOUND"
$Action = security_result.action
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
match:
$Action, $Date
outcome:
$Count = count(metadata.id)
order:
$Date asc
前 10 个事件类别
metadata.event_type = "NETWORK_UNCATEGORIZED"
or metadata.event_type = "NETWORK_FLOW"
or metadata.event_type = "NETWORK_CONNECTION"
or metadata.event_type = "NETWORK_FTP"
or metadata.event_type = "NETWORK_DHCP"
or metadata.event_type = "NETWORK_DNS"
or metadata.event_type = "NETWORK_HTTP"
or metadata.event_type = "NETWORK_SMTP"
$Category = security_result.category
match:
$Category
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
按流量排序的前 10 个入站 IP
network.direction = "INBOUND"
$Log_Type = metadata.log_type
$Source_IP = principal.ip
match:
$Log_Type, $Source_IP
outcome:
$Total_Bytes = sum(network.received_bytes + network.sent_bytes) / (1000*1000*1000)
order:
$Total_Bytes desc
limit:
10
前 10 名网络连接
$event.metadata.event_type = "NETWORK_FLOW"
or $event.metadata.event_type = "NETWORK_CONNECTION"
or $event.metadata.event_type = "NETWORK_FTP"
or $event.metadata.event_type = "NETWORK_DHCP"
or $event.metadata.event_type = "NETWORK_DNS"
or $event.metadata.event_type = "NETWORK_HTTP"
or $event.metadata.event_type = "NETWORK_SMTP"
$Source_Port = $event.principal.port
$Destination_Port = $event.target.port
$Source_IP = $event.principal.ip
$Destination_IP = $event.target.ip
$OS = $event.target.asset.platform_software.platform_version
$Direction = $event.network.direction
$Hostname = $event.principal.hostname
$Direction != "UNKNOWN_DIRECTION"
$OS != ""
$Hostname != ""
match:
$Hostname, $OS, $Source_IP, $Source_Port, $Direction, $Destination_IP, $Destination_Port
outcome:
$Time = timestamp.get_timestamp(max($event.metadata.event_timestamp.seconds))
order:
$Time desc
limit:
10
被屏蔽的前 10 个来源 IP 地址
$event.metadata.event_type = "NETWORK_FLOW"
or $event.metadata.event_type = "NETWORK_CONNECTION"
or $event.metadata.event_type = "NETWORK_FTP"
or $event.metadata.event_type = "NETWORK_DHCP"
or $event.metadata.event_type = "NETWORK_DNS"
or $event.metadata.event_type = "NETWORK_HTTP"
or $event.metadata.event_type = "NETWORK_SMTP"
$Event_Type = $event.metadata.event_type
$Source_IP = $event.principal.ip
$Source_IP != ""
$Destination_IP = $event.target.ip
$Log_Type = $event.metadata.log_type
$Block = $event.security_result.action
$Block = "BLOCK"
match:
$Source_IP, $Block, $Destination_IP, $Log_Type
outcome:
$Count = count($event.metadata.id)
order:
$Count desc
limit:
10
OT 安全
此信息中心可让您深入了解 OT 环境中的安全性，从而跟踪和评估安全事件。它会识别趋势、关键资产、用户和服务，同时监控网络和地理位置活动。这样一来，您就可以确定威胁的优先级、优化响应策略，并增强 OT 系统的安全性。
按日志类型列出的前 10 个非 OT 协议
使用明文协议的前 10 大资产
前 10 个 CVE
OT Sniffer 随时间的变化情况
外部网络定位的前 10 个实体
按资产划分的供应商随时间变化的提醒
明文协议分布
按用户列出的前 10 个供应商提醒
发起外部网络的前 10 大实体
按严重程度排序的前 10 个供应商提醒
应用协议随时间的变化
新的 OT 资产
供应商随时间变化的提醒
新 OT 资产总数
10 大来源资产
按操作划分的供应商提醒
OT 资产总数
按日志类型划分的供应商随时间变化的提醒
按类别划分的前 10 个供应商提醒
图表名称
查询示例
按日志类型列出的前 10 个非 OT 协议
network.application_protocol != "COAP"
network.application_protocol != "DNP3"
network.application_protocol != "MODBUS"
network.application_protocol != "MQTT"
network.application_protocol != "SNMP"
$Log_Type = metadata.log_type
$Protocol = network.application_protocol
match:
$Protocol, $Log_Type
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
使用明文协议的前 10 大资产
network.application_protocol = "MODBUS"
or network.application_protocol = "DNP3"
or network.application_protocol = "CIP"
or network.application_protocol = "IEC104"
or network.application_protocol = "SNMP"
or network.application_protocol = "COTP"
or network.application_protocol = "GOOSE"
or network.application_protocol = "SV"
or network.application_protocol = "DEVICE_NET"
or network.application_protocol = "PTP"
or network.application_protocol = "HTTP"
or network.application_protocol = "RLOGIN"
or network.application_protocol = "FINGER"
or network.application_protocol = "SMTP"
$Protocol = network.application_protocol
$Asset = strings.coalesce(target.asset.hostname, target.asset.ip, target.asset.mac, target.hostname)
$Asset != ""
match:
$Asset, $Protocol
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
前 10 个 CVE
$CVE = principal.asset.vulnerabilities.cve_id
$CVE != ""
$Asset = principal.asset.hostname
match:
$CVE, $Asset
outcome:
$Count = count(principal.asset.vulnerabilities.cve_id)
order:
$Count desc
limit:
10
OT Sniffer 随时间的变化情况
$Log_Type = metadata.log_type
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
match:
$Date, $Log_Type
outcome:
$Count = count(observer.hostname)
order:
$Date desc
外部网络定位的前 10 个实体
principal.ip != /^10\..|^172\.(1[6-9]|2\d|3[0-1])\..*|^192\.168\../
principal.ip != ""
$Entity = group(target.asset.hostname, target.asset.ip, target.asset.mac, target.user.userid)
$Entity != ""
match:
$Entity
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
按资产划分的供应商随时间变化的提醒
(metadata.log_type = /CLAROTY_CTD|CLAROTY_EMC/ nocase
and security_result.threat_id != "")
or (metadata.log_type = /NOZOMI_GUARDIAN/ nocase
and additional.fields["IsSecurity"] = "true")
or (metadata.log_type = /TENABLE_OT/ nocase
and security_result.category_details = /NetworkThreats/ nocase)
metadata.product_event_type != "Event"
metadata.product_event_type != "HealthCheck"
metadata.product_event_type != "Insight"
$Device = strings.coalesce(target.asset.hostname, target.asset.ip, target.asset.mac, target.hostname)
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
$Vendor_Alert = metadata.product_event_type
match:
$Date, $Device
outcome:
$Count = count($Vendor_Alert)
order:
$Count desc
明文协议分布
network.application_protocol = "MODBUS"
or network.application_protocol = "DNP3"
or network.application_protocol = "CIP"
or network.application_protocol = "IEC104"
or network.application_protocol = "SNMP"
or network.application_protocol = "COTP"
or network.application_protocol = "GOOSE"
or network.application_protocol = "SV"
or network.application_protocol = "DEVICE_NET"
or network.application_protocol = "PTP"
or network.application_protocol = "HTTP"
or network.application_protocol = "RLOGIN"
or network.application_protocol = "FINGER"
or network.application_protocol = "SMTP"
$Protocol = network.application_protocol
match:
$Protocol
outcome:
$Count = count(metadata.id)
order:
$Count desc
按用户列出的前 10 个供应商提醒
(metadata.log_type = /CLAROTY_CTD|CLAROTY_EMC/ nocase
and security_result.threat_id != "")
or (metadata.log_type = /NOZOMI_GUARDIAN/ nocase
and additional.fields["IsSecurity"] = "true")
or (metadata.log_type = /TENABLE_OT/ nocase
and security_result.category_details = /NetworkThreats/ nocase)
metadata.product_event_type != "Event"
metadata.product_event_type != "HealthCheck"
metadata.product_event_type != "Insight"
$Event = metadata.product_event_type
$User = principal.user.user_display_name
match:
$User, $Event
outcome:
$Count = count(if((metadata.log_type = /claroty/ nocase and security_result.threat_id != "") or (metadata.log_type = /nozomi/ nocase and additional.fields["IsSecurity"] = "true") or (metadata.log_type = /TENABLE_OT/ nocase and security_result.category_details = /NetworkThreats/ nocase), 1, 0))
order:
$Count desc
limit:
10
发起外部网络的前 10 大实体
target.ip != /^10\..|^172\.(1[6-9]|2\d|3[0-1])\..*|^192\.168\../
$Entity = group(principal.asset.hostname, principal.asset.ip, principal.asset.mac, principal.user.windows_sid, principal.user.userid)
$Entity != ""
match:
$Entity
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
按严重程度排序的前 10 个供应商提醒
(metadata.log_type = /CLAROTY_CTD|CLAROTY_EMC/ nocase
and security_result.threat_id != "")
or (metadata.log_type = /NOZOMI_GUARDIAN/ nocase
and additional.fields["IsSecurity"] = "true")
or (metadata.log_type = /TENABLE_OT/ nocase
and security_result.category_details = /NetworkThreats/ nocase)
metadata.product_event_type != "Event"
metadata.product_event_type != "HealthCheck"
metadata.product_event_type != "Insight"
$Vendor_Alert = metadata.product_event_type
$Severity = security_result.severity
match:
$Severity, $Vendor_Alert
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
应用协议随时间的变化
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
$Application_Protocol = network.application_protocol
match:
$Application_Protocol, $Date
outcome:
$Count = count(metadata.id)
order:
$Count desc
新的 OT 资产
metadata.product_event_type = /New Asset|SIGN:DHCP-OPERATION/ nocase
$Hostname = strings.coalesce(target.asset.hostname, target.asset.ip, target.asset.mac, target.hostname)
$Hostname != ""
match:
$Hostname
供应商随时间变化的提醒
(metadata.log_type = /CLAROTY_CTD|CLAROTY_EMC/ nocase
and security_result.threat_id != "")
or (metadata.log_type = /NOZOMI_GUARDIAN/ nocase
and additional.fields["IsSecurity"] = "true")
or (metadata.log_type = /TENABLE_OT/ nocase
and security_result.category_details = /NetworkThreats/ nocase)
metadata.product_event_type != "Event"
metadata.product_event_type != "HealthCheck"
metadata.product_event_type != "Insight"
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
$Vendor_Alert = metadata.product_event_type
match:
$Date, $Vendor_Alert
outcome:
$Count = count(if((metadata.log_type = /claroty/ nocase and security_result.threat_id != "") or (metadata.log_type = /nozomi/ nocase and additional.fields["IsSecurity"] = "true") or (metadata.log_type = /TENABLE_OT/ nocase and security_result.category_details = /NetworkThreats/ nocase), 1, 0))
order:
$Count desc
新 OT 资产总数
metadata.product_event_type = /New Asset|SIGN:DHCP-OPERATION/ nocase
strings.coalesce(target.asset.hostname, target.asset.ip, target.asset.mac, target.hostname) != ""
outcome:
$Count = count_distinct(strings.coalesce(target.asset.hostname, target.asset.ip, target.asset.mac, target.hostname))
10 大来源资产
$Hostname = strings.coalesce(principal.asset.hostname, principal.asset.ip, principal.asset.mac, principal.hostname)
$Hostname != ""
match:
$Hostname
outcome:
$Count = count_distinct(strings.coalesce(target.asset.ip, target.ip))
order:
$Count desc
limit:
10
按操作划分的供应商提醒
(metadata.log_type = /CLAROTY_CTD|CLAROTY_EMC/ nocase
and security_result.threat_id != "")
or (metadata.log_type = /NOZOMI_GUARDIAN/ nocase
and additional.fields["IsSecurity"] = "true")
or (metadata.log_type = /TENABLE_OT/ nocase
and security_result.category_details = /NetworkThreats/ nocase)
metadata.product_event_type != "Event"
metadata.product_event_type != "HealthCheck"
metadata.product_event_type != "Insight"
security_result.action_details = "Succeeded"
or security_result.action_details = "Failed"
$Action = security_result.action_details
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
match:
$Date, $Action
outcome:
$Count = count(if((metadata.log_type = /claroty/ nocase and security_result.threat_id != "") or (metadata.log_type = /nozomi/ nocase and additional.fields["IsSecurity"] = "true") or (metadata.log_type = /TENABLE_OT/ nocase and security_result.category_details = /NetworkThreats/ nocase), 1, 0))
order:
$Date desc
OT 资产总数
outcome:
$Count = count_distinct(strings.coalesce(target.asset.hostname, target.asset.ip, target.asset.mac, target.hostname))
按日志类型划分的供应商随时间变化的提醒
(metadata.log_type = /CLAROTY_CTD|CLAROTY_EMC/ nocase
and security_result.threat_id != "")
or (metadata.log_type = /NOZOMI_GUARDIAN/ nocase
and additional.fields["IsSecurity"] = "true")
or (metadata.log_type = /TENABLE_OT/ nocase
and security_result.category_details = /NetworkThreats/ nocase)
metadata.product_event_type != "Event"
metadata.product_event_type != "HealthCheck"
metadata.product_event_type != "Insight"
$Log_Type = metadata.log_type
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
$Vendor_Alert = metadata.product_event_type
match:
$Date, $Vendor_Alert, $Log_Type
outcome:
$Count = count(if((metadata.log_type = /claroty/ nocase and security_result.threat_id != "") or (metadata.log_type = /nozomi/ nocase and additional.fields["IsSecurity"] = "true") or (metadata.log_type = /TENABLE_OT/ nocase and security_result.category_details = /NetworkThreats/ nocase), 1, 0))
order:
$Date desc
按类别划分的前 10 个供应商提醒
(metadata.log_type = /CLAROTY_CTD|CLAROTY_EMC/ nocase
and security_result.threat_id != "")
or (metadata.log_type = /NOZOMI_GUARDIAN/ nocase
and additional.fields["IsSecurity"] = "true")
or (metadata.log_type = /TENABLE_OT/ nocase
and security_result.category_details = /NetworkThreats/ nocase)
metadata.product_event_type != "Event"
metadata.product_event_type != "HealthCheck"
metadata.product_event_type != "Insight"
$Event = metadata.product_event_type
$Category = security_result.category_details
match:
$Category, $Event
outcome:
$Count = count(if((metadata.log_type = /claroty/ nocase and security_result.threat_id != "") or (metadata.log_type = /nozomi/ nocase and additional.fields["IsSecurity"] = "true") or (metadata.log_type = /TENABLE_OT/ nocase and security_result.category_details = /NetworkThreats/ nocase), 1, 0))
order:
$Count desc
limit:
10
PCI - 反恶意软件
此信息中心可显示支付卡行业 (PCI) 资产和检测到的有效威胁。它使用参考列表 pci_assets 将数据限定在 PCI 环境内。
注意：在创建所需的参考列表之前，此信息中心内的图表不会加载。
按类型划分的已屏蔽事件
按用户划分的允许的事件
按操作划分的活动摘要
事件总数
按严重程度划分的 EDR 提醒总数
10 大活动类型
EDR 提醒总数
按策略划分的 EDR 提醒
EDR 提醒总数随时间变化情况
按严重程度划分的事件
其他活动
各类事件的总数随时间的变化情况
按 IP 地址划分的允许的事件
按日志类型划分的事件操作
按 IP 地址划分的已屏蔽事件
按用户屏蔽的活动
隔离的事件
按位置划分的前 10 个端点
已屏蔽的活动
一段时间内的事件总数
按类型划分的允许事件
允许的事件
图表名称
查询示例
按类型划分的已屏蔽事件
$event.metadata.log_type = /_AV|EDR|BEYONDTRUST_ENDPOINT|BITDEFENDER|CISCO_AMP|CISCO_SECURE_WORKLOAD|CS_DETECTS|CS_IDP|CYBERARK_EPM|CYNET_360_AUTOXDR|ENDPOINT_PROTECTOR_DLP|FIREEYE_HX|HALCYON|IBM_SECURITY_VERIFY|JAMF_PRO|JAMF_PROTECT|JAMF_TELEMETRY|KOLIDE|LOOKOUT_MOBILE_ENDPOINT_SECURITY|MACOS|MACOS_ENDPOINT_SECURITY|MICROSOFT_DEFENDER_ENDPOINT|MICROSOFT_DEFENDER_ENDPOINT_IOS|MICROSOFT_DEFENDER_IDENTITY|MICROSOFT_GRAPH_ALERT|MICROSOFT_IAS|MICROSOFT_SCEP|MOBILEIRON|OPENPATH|PASSWORDSTATE|SAVIYNT_EIP|SENTINEL_DV|SENTINELONE_ALERT|SEP|SEQRITE_ENDPOINT|SOPHOS_CENTRAL|SPYCLOUD|TRENDMICRO_APEX_CENTRAL|TRENDMICRO_APEX_ONE|TRENDMICRO_DEEP_SECURITY|TRENDMICRO_STELLAR|TRENDMICRO_VISION_ONE|VENAFI_ZTPKI|WINDOWS_DEFENDER_ATP|WINEVTLOG|WINEVTLOG_XML/
strings.coalesce($event.principal.asset.hostname, $event.principal.hostname) in %PCI_Assets
$event.security_result.action = "BLOCK"
$Event_Type = $event.metadata.event_type
match:
$Event_Type
outcome:
$Count = count($event.security_result.action)
order:
$Count desc
按用户划分的允许的事件
$event.metadata.log_type = /_AV|EDR|BEYONDTRUST_ENDPOINT|BITDEFENDER|CISCO_AMP|CISCO_SECURE_WORKLOAD|CS_DETECTS|CS_IDP|CYBERARK_EPM|CYNET_360_AUTOXDR|ENDPOINT_PROTECTOR_DLP|FIREEYE_HX|HALCYON|IBM_SECURITY_VERIFY|JAMF_PRO|JAMF_PROTECT|JAMF_TELEMETRY|KOLIDE|LOOKOUT_MOBILE_ENDPOINT_SECURITY|MACOS|MACOS_ENDPOINT_SECURITY|MICROSOFT_DEFENDER_ENDPOINT|MICROSOFT_DEFENDER_ENDPOINT_IOS|MICROSOFT_DEFENDER_IDENTITY|MICROSOFT_GRAPH_ALERT|MICROSOFT_IAS|MICROSOFT_SCEP|MOBILEIRON|OPENPATH|PASSWORDSTATE|SAVIYNT_EIP|SENTINEL_DV|SENTINELONE_ALERT|SEP|SEQRITE_ENDPOINT|SOPHOS_CENTRAL|SPYCLOUD|TRENDMICRO_APEX_CENTRAL|TRENDMICRO_APEX_ONE|TRENDMICRO_DEEP_SECURITY|TRENDMICRO_STELLAR|TRENDMICRO_VISION_ONE|VENAFI_ZTPKI|WINDOWS_DEFENDER_ATP|WINEVTLOG|WINEVTLOG_XML/
strings.coalesce($event.principal.asset.hostname, $event.principal.hostname) in %PCI_Assets
$event.security_result.action = "ALLOW"
$Event_Type = $event.metadata.event_type
$User = strings.coalesce($event.principal.user.user_display_name, $event.principal.user.userid)
match:
$User, $Event_Type
outcome:
$Count = count($event.security_result.action)
order:
$Count desc
limit:
50
按操作划分的活动摘要
$event.metadata.log_type = /_AV|EDR|BEYONDTRUST_ENDPOINT|BITDEFENDER|CISCO_AMP|CISCO_SECURE_WORKLOAD|CS_DETECTS|CS_IDP|CYBERARK_EPM|CYNET_360_AUTOXDR|ENDPOINT_PROTECTOR_DLP|FIREEYE_HX|HALCYON|IBM_SECURITY_VERIFY|JAMF_PRO|JAMF_PROTECT|JAMF_TELEMETRY|KOLIDE|LOOKOUT_MOBILE_ENDPOINT_SECURITY|MACOS|MACOS_ENDPOINT_SECURITY|MICROSOFT_DEFENDER_ENDPOINT|MICROSOFT_DEFENDER_ENDPOINT_IOS|MICROSOFT_DEFENDER_IDENTITY|MICROSOFT_GRAPH_ALERT|MICROSOFT_IAS|MICROSOFT_SCEP|MOBILEIRON|OPENPATH|PASSWORDSTATE|SAVIYNT_EIP|SENTINEL_DV|SENTINELONE_ALERT|SEP|SEQRITE_ENDPOINT|SOPHOS_CENTRAL|SPYCLOUD|TRENDMICRO_APEX_CENTRAL|TRENDMICRO_APEX_ONE|TRENDMICRO_DEEP_SECURITY|TRENDMICRO_STELLAR|TRENDMICRO_VISION_ONE|VENAFI_ZTPKI|WINDOWS_DEFENDER_ATP|WINEVTLOG|WINEVTLOG_XML/ nocase
strings.coalesce($event.principal.asset.hostname, $event.principal.hostname) in %PCI_Assets
$Action = $event.security_result.action
match:
$Action
outcome:
$Count = count($event.security_result.action)
order:
$Count desc
事件总数
$event.metadata.log_type = /_AV|EDR|BEYONDTRUST_ENDPOINT|BITDEFENDER|CISCO_AMP|CISCO_SECURE_WORKLOAD|CS_DETECTS|CS_IDP|CYBERARK_EPM|CYNET_360_AUTOXDR|ENDPOINT_PROTECTOR_DLP|FIREEYE_HX|HALCYON|IBM_SECURITY_VERIFY|JAMF_PRO|JAMF_PROTECT|JAMF_TELEMETRY|KOLIDE|LOOKOUT_MOBILE_ENDPOINT_SECURITY|MACOS|MACOS_ENDPOINT_SECURITY|MICROSOFT_DEFENDER_ENDPOINT|MICROSOFT_DEFENDER_ENDPOINT_IOS|MICROSOFT_DEFENDER_IDENTITY|MICROSOFT_GRAPH_ALERT|MICROSOFT_IAS|MICROSOFT_SCEP|MOBILEIRON|OPENPATH|PASSWORDSTATE|SAVIYNT_EIP|SENTINEL_DV|SENTINELONE_ALERT|SEP|SEQRITE_ENDPOINT|SOPHOS_CENTRAL|SPYCLOUD|TRENDMICRO_APEX_CENTRAL|TRENDMICRO_APEX_ONE|TRENDMICRO_DEEP_SECURITY|TRENDMICRO_STELLAR|TRENDMICRO_VISION_ONE|VENAFI_ZTPKI|WINDOWS_DEFENDER_ATP|WINEVTLOG|WINEVTLOG_XML/ nocase
strings.coalesce($event.principal.asset.hostname, $event.principal.hostname) in %PCI_Assets
outcome:
$Count = count($event.security_result.action)
按严重程度划分的 EDR 提醒总数
$event.metadata.log_type = /EDR|CS_DETECTS|FIREEYE_HX|MICROSOFT_DEFENDER_ENDPOINT|MICROSOFT_DEFENDER_IDENTITY|SENTINEL_DV/
strings.coalesce($event.principal.asset.hostname, $event.principal.hostname) in %PCI_Assets
$Log_Type = $event.metadata.log_type
$Severity = $event.security_result.severity
$Rule_Name = strings.coalesce($event.security_result.rule_name, $event.security_result.description)
$Rule_Name != ""
$Description = $event.metadata.description
match:
$Rule_Name, $Description, $Log_Type, $Severity
outcome:
$Count = count($event.security_result.rule_name)
order:
$Severity desc
limit:
50
10 大活动类型
$event.metadata.log_type = /_AV|EDR|BEYONDTRUST_ENDPOINT|BITDEFENDER|CISCO_AMP|CISCO_SECURE_WORKLOAD|CS_DETECTS|CS_IDP|CYBERARK_EPM|CYNET_360_AUTOXDR|ENDPOINT_PROTECTOR_DLP|FIREEYE_HX|HALCYON|IBM_SECURITY_VERIFY|JAMF_PRO|JAMF_PROTECT|JAMF_TELEMETRY|KOLIDE|LOOKOUT_MOBILE_ENDPOINT_SECURITY|MACOS|MACOS_ENDPOINT_SECURITY|MICROSOFT_DEFENDER_ENDPOINT|MICROSOFT_DEFENDER_ENDPOINT_IOS|MICROSOFT_DEFENDER_IDENTITY|MICROSOFT_GRAPH_ALERT|MICROSOFT_IAS|MICROSOFT_SCEP|MOBILEIRON|OPENPATH|PASSWORDSTATE|SAVIYNT_EIP|SENTINEL_DV|SENTINELONE_ALERT|SEP|SEQRITE_ENDPOINT|SOPHOS_CENTRAL|SPYCLOUD|TRENDMICRO_APEX_CENTRAL|TRENDMICRO_APEX_ONE|TRENDMICRO_DEEP_SECURITY|TRENDMICRO_STELLAR|TRENDMICRO_VISION_ONE|VENAFI_ZTPKI|WINDOWS_DEFENDER_ATP|WINEVTLOG|WINEVTLOG_XML/ nocase
strings.coalesce($event.principal.asset.hostname, $event.principal.hostname) in %PCI_Assets
$Event_Type = $event.metadata.event_type
match:
$Event_Type
outcome:
$Count = count($event.security_result.action)
order:
$Count desc
limit:
10
EDR 提醒总数
$event.metadata.log_type = /EDR|CS_DETECTS|FIREEYE_HX|MICROSOFT_DEFENDER_ENDPOINT|MICROSOFT_DEFENDER_IDENTITY|SENTINEL_DV/ nocase
strings.coalesce($event.principal.asset.hostname, $event.principal.hostname) in %PCI_Assets
outcome:
$Count = count($event.security_result.rule_name)
按策略划分的 EDR 提醒
$event.metadata.log_type = /EDR|CS_DETECTS|FIREEYE_HX|MICROSOFT_DEFENDER_ENDPOINT|MICROSOFT_DEFENDER_IDENTITY|SENTINEL_DV/
strings.coalesce($event.principal.asset.hostname, $event.principal.hostname) in %PCI_Assets
$Log_Type = $event.metadata.log_type
$Tactic_ID = strings.coalesce($event.security_result.attack_details.tactics.id, $event.security_result.detection_fields["Tactic ID"])
$Tactic_ID != ""
$Tactic_Name = strings.coalesce($event.security_result.attack_details.tactics.name, $event.security_result.detection_fields["Tactic"])
$Tactic_Name != ""
$Severity = $event.security_result.severity
match:
$Tactic_ID, $Tactic_Name, $Severity
outcome:
$Count = count($event.security_result.rule_name)
order:
$Severity desc
limit:
50
EDR 提醒总数随时间变化情况
$event.metadata.log_type = /EDR|CS_DETECTS|FIREEYE_HX|MICROSOFT_DEFENDER_ENDPOINT|MICROSOFT_DEFENDER_IDENTITY|SENTINEL_DV/
strings.coalesce($event.principal.asset.hostname, $event.principal.hostname) in %PCI_Assets
$Log_Type = $event.metadata.log_type
$Date = timestamp.get_date($event.metadata.event_timestamp.seconds)
match:
$Log_Type, $Date
outcome:
$Count = count($event.security_result.rule_name)
order:
$Date asc
按严重程度划分的事件
$event.metadata.log_type = /_AV|EDR|BEYONDTRUST_ENDPOINT|BITDEFENDER|CISCO_AMP|CISCO_SECURE_WORKLOAD|CS_DETECTS|CS_IDP|CYBERARK_EPM|CYNET_360_AUTOXDR|ENDPOINT_PROTECTOR_DLP|FIREEYE_HX|HALCYON|IBM_SECURITY_VERIFY|JAMF_PRO|JAMF_PROTECT|JAMF_TELEMETRY|KOLIDE|LOOKOUT_MOBILE_ENDPOINT_SECURITY|MACOS|MACOS_ENDPOINT_SECURITY|MICROSOFT_DEFENDER_ENDPOINT|MICROSOFT_DEFENDER_ENDPOINT_IOS|MICROSOFT_DEFENDER_IDENTITY|MICROSOFT_GRAPH_ALERT|MICROSOFT_IAS|MICROSOFT_SCEP|MOBILEIRON|OPENPATH|PASSWORDSTATE|SAVIYNT_EIP|SENTINEL_DV|SENTINELONE_ALERT|SEP|SEQRITE_ENDPOINT|SOPHOS_CENTRAL|SPYCLOUD|TRENDMICRO_APEX_CENTRAL|TRENDMICRO_APEX_ONE|TRENDMICRO_DEEP_SECURITY|TRENDMICRO_STELLAR|TRENDMICRO_VISION_ONE|VENAFI_ZTPKI|WINDOWS_DEFENDER_ATP|WINEVTLOG|WINEVTLOG_XML/ nocase
strings.coalesce($event.principal.asset.hostname, $event.principal.hostname) in %PCI_Assets
$Event_Type = $event.metadata.event_type
$Log_Type = $event.metadata.log_type
$Severity = $event.security_result.severity
match:
$Event_Type, $Log_Type, $Severity
outcome:
$Count = count($event.security_result.action)
order:
$Severity desc
limit:
50
其他活动
$event.metadata.log_type = /_AV|EDR|BEYONDTRUST_ENDPOINT|BITDEFENDER|CISCO_AMP|CISCO_SECURE_WORKLOAD|CS_DETECTS|CS_IDP|CYBERARK_EPM|CYNET_360_AUTOXDR|ENDPOINT_PROTECTOR_DLP|FIREEYE_HX|HALCYON|IBM_SECURITY_VERIFY|JAMF_PRO|JAMF_PROTECT|JAMF_TELEMETRY|KOLIDE|LOOKOUT_MOBILE_ENDPOINT_SECURITY|MACOS|MACOS_ENDPOINT_SECURITY|MICROSOFT_DEFENDER_ENDPOINT|MICROSOFT_DEFENDER_ENDPOINT_IOS|MICROSOFT_DEFENDER_IDENTITY|MICROSOFT_GRAPH_ALERT|MICROSOFT_IAS|MICROSOFT_SCEP|MOBILEIRON|OPENPATH|PASSWORDSTATE|SAVIYNT_EIP|SENTINEL_DV|SENTINELONE_ALERT|SEP|SEQRITE_ENDPOINT|SOPHOS_CENTRAL|SPYCLOUD|TRENDMICRO_APEX_CENTRAL|TRENDMICRO_APEX_ONE|TRENDMICRO_DEEP_SECURITY|TRENDMICRO_STELLAR|TRENDMICRO_VISION_ONE|VENAFI_ZTPKI|WINDOWS_DEFENDER_ATP|WINEVTLOG|WINEVTLOG_XML/ nocase
strings.coalesce($event.principal.asset.hostname, $event.principal.hostname) in %PCI_Assets
outcome:
$Count = sum(if($event.security_result.action = "UNKNOWN_ACTION", 1, 0) + if($event.security_result.action = "FAIL", 1, 0) + if($event.security_result.action = "CHALLENGE", 1, 0))
各类事件的总数随时间的变化情况
$event.metadata.log_type = /_AV|EDR|BEYONDTRUST_ENDPOINT|BITDEFENDER|CISCO_AMP|CISCO_SECURE_WORKLOAD|CS_DETECTS|CS_IDP|CYBERARK_EPM|CYNET_360_AUTOXDR|ENDPOINT_PROTECTOR_DLP|FIREEYE_HX|HALCYON|IBM_SECURITY_VERIFY|JAMF_PRO|JAMF_PROTECT|JAMF_TELEMETRY|KOLIDE|LOOKOUT_MOBILE_ENDPOINT_SECURITY|MACOS|MACOS_ENDPOINT_SECURITY|MICROSOFT_DEFENDER_ENDPOINT|MICROSOFT_DEFENDER_ENDPOINT_IOS|MICROSOFT_DEFENDER_IDENTITY|MICROSOFT_GRAPH_ALERT|MICROSOFT_IAS|MICROSOFT_SCEP|MOBILEIRON|OPENPATH|PASSWORDSTATE|SAVIYNT_EIP|SENTINEL_DV|SENTINELONE_ALERT|SEP|SEQRITE_ENDPOINT|SOPHOS_CENTRAL|SPYCLOUD|TRENDMICRO_APEX_CENTRAL|TRENDMICRO_APEX_ONE|TRENDMICRO_DEEP_SECURITY|TRENDMICRO_STELLAR|TRENDMICRO_VISION_ONE|VENAFI_ZTPKI|WINDOWS_DEFENDER_ATP|WINEVTLOG|WINEVTLOG_XML/ nocase
strings.coalesce($event.principal.asset.hostname, $event.principal.hostname) in %PCI_Assets
$Event_Type = $event.metadata.event_type
$Date = timestamp.get_date($event.metadata.event_timestamp.seconds)
match:
$Event_Type, $Date
outcome:
$Count = count($event.security_result.action)
order:
$Date asc
按 IP 地址划分的允许的事件
$event.metadata.log_type = /_AV|EDR|BEYONDTRUST_ENDPOINT|BITDEFENDER|CISCO_AMP|CISCO_SECURE_WORKLOAD|CS_DETECTS|CS_IDP|CYBERARK_EPM|CYNET_360_AUTOXDR|ENDPOINT_PROTECTOR_DLP|FIREEYE_HX|HALCYON|IBM_SECURITY_VERIFY|JAMF_PRO|JAMF_PROTECT|JAMF_TELEMETRY|KOLIDE|LOOKOUT_MOBILE_ENDPOINT_SECURITY|MACOS|MACOS_ENDPOINT_SECURITY|MICROSOFT_DEFENDER_ENDPOINT|MICROSOFT_DEFENDER_ENDPOINT_IOS|MICROSOFT_DEFENDER_IDENTITY|MICROSOFT_GRAPH_ALERT|MICROSOFT_IAS|MICROSOFT_SCEP|MOBILEIRON|OPENPATH|PASSWORDSTATE|SAVIYNT_EIP|SENTINEL_DV|SENTINELONE_ALERT|SEP|SEQRITE_ENDPOINT|SOPHOS_CENTRAL|SPYCLOUD|TRENDMICRO_APEX_CENTRAL|TRENDMICRO_APEX_ONE|TRENDMICRO_DEEP_SECURITY|TRENDMICRO_STELLAR|TRENDMICRO_VISION_ONE|VENAFI_ZTPKI|WINDOWS_DEFENDER_ATP|WINEVTLOG|WINEVTLOG_XML/
strings.coalesce($event.principal.asset.hostname, $event.principal.hostname) in %PCI_Assets
$event.security_result.action = "ALLOW"
$Event_Type = $event.metadata.event_type
$IP = $event.principal.ip
match:
$IP, $Event_Type
outcome:
$Count = count($event.security_result.action)
order:
$Count desc
limit:
50
按日志类型划分的事件操作
$event.metadata.log_type = /_AV|EDR|BEYONDTRUST_ENDPOINT|BITDEFENDER|CISCO_AMP|CISCO_SECURE_WORKLOAD|CS_DETECTS|CS_IDP|CYBERARK_EPM|CYNET_360_AUTOXDR|ENDPOINT_PROTECTOR_DLP|FIREEYE_HX|HALCYON|IBM_SECURITY_VERIFY|JAMF_PRO|JAMF_PROTECT|JAMF_TELEMETRY|KOLIDE|LOOKOUT_MOBILE_ENDPOINT_SECURITY|MACOS|MACOS_ENDPOINT_SECURITY|MICROSOFT_DEFENDER_ENDPOINT|MICROSOFT_DEFENDER_ENDPOINT_IOS|MICROSOFT_DEFENDER_IDENTITY|MICROSOFT_GRAPH_ALERT|MICROSOFT_IAS|MICROSOFT_SCEP|MOBILEIRON|OPENPATH|PASSWORDSTATE|SAVIYNT_EIP|SENTINEL_DV|SENTINELONE_ALERT|SEP|SEQRITE_ENDPOINT|SOPHOS_CENTRAL|SPYCLOUD|TRENDMICRO_APEX_CENTRAL|TRENDMICRO_APEX_ONE|TRENDMICRO_DEEP_SECURITY|TRENDMICRO_STELLAR|TRENDMICRO_VISION_ONE|VENAFI_ZTPKI|WINDOWS_DEFENDER_ATP|WINEVTLOG|WINEVTLOG_XML/ nocase
strings.coalesce($event.principal.asset.hostname, $event.principal.hostname) in %PCI_Assets
$Log_Type = $event.metadata.log_type
$Action = $event.security_result.action
match:
$Action, $Log_Type
outcome:
$Count = count($event.security_result.action)
order:
$Count desc
limit:
10
按 IP 地址划分的已屏蔽事件
$event.metadata.log_type = /_AV|EDR|BEYONDTRUST_ENDPOINT|BITDEFENDER|CISCO_AMP|CISCO_SECURE_WORKLOAD|CS_DETECTS|CS_IDP|CYBERARK_EPM|CYNET_360_AUTOXDR|ENDPOINT_PROTECTOR_DLP|FIREEYE_HX|HALCYON|IBM_SECURITY_VERIFY|JAMF_PRO|JAMF_PROTECT|JAMF_TELEMETRY|KOLIDE|LOOKOUT_MOBILE_ENDPOINT_SECURITY|MACOS|MACOS_ENDPOINT_SECURITY|MICROSOFT_DEFENDER_ENDPOINT|MICROSOFT_DEFENDER_ENDPOINT_IOS|MICROSOFT_DEFENDER_IDENTITY|MICROSOFT_GRAPH_ALERT|MICROSOFT_IAS|MICROSOFT_SCEP|MOBILEIRON|OPENPATH|PASSWORDSTATE|SAVIYNT_EIP|SENTINEL_DV|SENTINELONE_ALERT|SEP|SEQRITE_ENDPOINT|SOPHOS_CENTRAL|SPYCLOUD|TRENDMICRO_APEX_CENTRAL|TRENDMICRO_APEX_ONE|TRENDMICRO_DEEP_SECURITY|TRENDMICRO_STELLAR|TRENDMICRO_VISION_ONE|VENAFI_ZTPKI|WINDOWS_DEFENDER_ATP|WINEVTLOG|WINEVTLOG_XML/
strings.coalesce($event.principal.asset.hostname, $event.principal.hostname) in %PCI_Assets
$event.security_result.action = "BLOCK"
$Event_Type = $event.metadata.event_type
$IP = $event.principal.ip
match:
$IP, $Event_Type
outcome:
$Count = count($event.security_result.action)
order:
$Count desc
limit:
50
按用户屏蔽的活动
$event.metadata.log_type = /_AV|EDR|BEYONDTRUST_ENDPOINT|BITDEFENDER|CISCO_AMP|CISCO_SECURE_WORKLOAD|CS_DETECTS|CS_IDP|CYBERARK_EPM|CYNET_360_AUTOXDR|ENDPOINT_PROTECTOR_DLP|FIREEYE_HX|HALCYON|IBM_SECURITY_VERIFY|JAMF_PRO|JAMF_PROTECT|JAMF_TELEMETRY|KOLIDE|LOOKOUT_MOBILE_ENDPOINT_SECURITY|MACOS|MACOS_ENDPOINT_SECURITY|MICROSOFT_DEFENDER_ENDPOINT|MICROSOFT_DEFENDER_ENDPOINT_IOS|MICROSOFT_DEFENDER_IDENTITY|MICROSOFT_GRAPH_ALERT|MICROSOFT_IAS|MICROSOFT_SCEP|MOBILEIRON|OPENPATH|PASSWORDSTATE|SAVIYNT_EIP|SENTINEL_DV|SENTINELONE_ALERT|SEP|SEQRITE_ENDPOINT|SOPHOS_CENTRAL|SPYCLOUD|TRENDMICRO_APEX_CENTRAL|TRENDMICRO_APEX_ONE|TRENDMICRO_DEEP_SECURITY|TRENDMICRO_STELLAR|TRENDMICRO_VISION_ONE|VENAFI_ZTPKI|WINDOWS_DEFENDER_ATP|WINEVTLOG|WINEVTLOG_XML/
strings.coalesce($event.principal.asset.hostname, $event.principal.hostname) in %PCI_Assets
$event.security_result.action = "BLOCK"
$Event_Type = $event.metadata.event_type
$User = strings.coalesce($event.principal.user.user_display_name, $event.principal.user.userid)
match:
$User, $Event_Type
outcome:
$Count = count($event.security_result.action)
order:
$Count desc
limit:
50
隔离的事件
$event.metadata.log_type = /_AV|EDR|BEYONDTRUST_ENDPOINT|BITDEFENDER|CISCO_AMP|CISCO_SECURE_WORKLOAD|CS_DETECTS|CS_IDP|CYBERARK_EPM|CYNET_360_AUTOXDR|ENDPOINT_PROTECTOR_DLP|FIREEYE_HX|HALCYON|IBM_SECURITY_VERIFY|JAMF_PRO|JAMF_PROTECT|JAMF_TELEMETRY|KOLIDE|LOOKOUT_MOBILE_ENDPOINT_SECURITY|MACOS|MACOS_ENDPOINT_SECURITY|MICROSOFT_DEFENDER_ENDPOINT|MICROSOFT_DEFENDER_ENDPOINT_IOS|MICROSOFT_DEFENDER_IDENTITY|MICROSOFT_GRAPH_ALERT|MICROSOFT_IAS|MICROSOFT_SCEP|MOBILEIRON|OPENPATH|PASSWORDSTATE|SAVIYNT_EIP|SENTINEL_DV|SENTINELONE_ALERT|SEP|SEQRITE_ENDPOINT|SOPHOS_CENTRAL|SPYCLOUD|TRENDMICRO_APEX_CENTRAL|TRENDMICRO_APEX_ONE|TRENDMICRO_DEEP_SECURITY|TRENDMICRO_STELLAR|TRENDMICRO_VISION_ONE|VENAFI_ZTPKI|WINDOWS_DEFENDER_ATP|WINEVTLOG|WINEVTLOG_XML/ nocase
strings.coalesce($event.principal.asset.hostname, $event.principal.hostname) in %PCI_Assets
$event.security_result.action = "QUARANTINE"
outcome:
$Count = count($event.security_result.action)
按位置划分的前 10 个端点
$event.metadata.log_type = /_AV|EDR|BEYONDTRUST_ENDPOINT|BITDEFENDER|CISCO_AMP|CISCO_SECURE_WORKLOAD|CS_DETECTS|CS_IDP|CYBERARK_EPM|CYNET_360_AUTOXDR|ENDPOINT_PROTECTOR_DLP|FIREEYE_HX|HALCYON|IBM_SECURITY_VERIFY|JAMF_PRO|JAMF_PROTECT|JAMF_TELEMETRY|KOLIDE|LOOKOUT_MOBILE_ENDPOINT_SECURITY|MACOS|MACOS_ENDPOINT_SECURITY|MICROSOFT_DEFENDER_ENDPOINT|MICROSOFT_DEFENDER_ENDPOINT_IOS|MICROSOFT_DEFENDER_IDENTITY|MICROSOFT_GRAPH_ALERT|MICROSOFT_IAS|MICROSOFT_SCEP|MOBILEIRON|OPENPATH|PASSWORDSTATE|SAVIYNT_EIP|SENTINEL_DV|SENTINELONE_ALERT|SEP|SEQRITE_ENDPOINT|SOPHOS_CENTRAL|SPYCLOUD|TRENDMICRO_APEX_CENTRAL|TRENDMICRO_APEX_ONE|TRENDMICRO_DEEP_SECURITY|TRENDMICRO_STELLAR|TRENDMICRO_VISION_ONE|VENAFI_ZTPKI|WINDOWS_DEFENDER_ATP|WINEVTLOG|WINEVTLOG_XML/ nocase
strings.coalesce($event.principal.asset.hostname, $event.principal.hostname) in %PCI_Assets
$Countries = $event.principal.location.country_or_region
$Countries != ""
$Latitude = $event.principal.location.region_coordinates.latitude
$Longitude = $event.principal.location.region_coordinates.longitude
$Hostname = $event.target.asset.hostname
match:
$Countries, $Latitude, $Longitude, $Hostname
outcome:
$Count = count($event.principal.location.country_or_region)
limit:
10
已屏蔽的活动
$event.metadata.log_type = /_AV|EDR|BEYONDTRUST_ENDPOINT|BITDEFENDER|CISCO_AMP|CISCO_SECURE_WORKLOAD|CS_DETECTS|CS_IDP|CYBERARK_EPM|CYNET_360_AUTOXDR|ENDPOINT_PROTECTOR_DLP|FIREEYE_HX|HALCYON|IBM_SECURITY_VERIFY|JAMF_PRO|JAMF_PROTECT|JAMF_TELEMETRY|KOLIDE|LOOKOUT_MOBILE_ENDPOINT_SECURITY|MACOS|MACOS_ENDPOINT_SECURITY|MICROSOFT_DEFENDER_ENDPOINT|MICROSOFT_DEFENDER_ENDPOINT_IOS|MICROSOFT_DEFENDER_IDENTITY|MICROSOFT_GRAPH_ALERT|MICROSOFT_IAS|MICROSOFT_SCEP|MOBILEIRON|OPENPATH|PASSWORDSTATE|SAVIYNT_EIP|SENTINEL_DV|SENTINELONE_ALERT|SEP|SEQRITE_ENDPOINT|SOPHOS_CENTRAL|SPYCLOUD|TRENDMICRO_APEX_CENTRAL|TRENDMICRO_APEX_ONE|TRENDMICRO_DEEP_SECURITY|TRENDMICRO_STELLAR|TRENDMICRO_VISION_ONE|VENAFI_ZTPKI|WINDOWS_DEFENDER_ATP|WINEVTLOG|WINEVTLOG_XML/
strings.coalesce($event.principal.asset.hostname, $event.principal.hostname) in %PCI_Assets
$event.security_result.action = "BLOCK"
outcome:
$Count = count($event.security_result.action)
一段时间内的事件总数
$event.metadata.log_type = /_AV|EDR|BEYONDTRUST_ENDPOINT|BITDEFENDER|CISCO_AMP|CISCO_SECURE_WORKLOAD|CS_DETECTS|CS_IDP|CYBERARK_EPM|CYNET_360_AUTOXDR|ENDPOINT_PROTECTOR_DLP|FIREEYE_HX|HALCYON|IBM_SECURITY_VERIFY|JAMF_PRO|JAMF_PROTECT|JAMF_TELEMETRY|KOLIDE|LOOKOUT_MOBILE_ENDPOINT_SECURITY|MACOS|MACOS_ENDPOINT_SECURITY|MICROSOFT_DEFENDER_ENDPOINT|MICROSOFT_DEFENDER_ENDPOINT_IOS|MICROSOFT_DEFENDER_IDENTITY|MICROSOFT_GRAPH_ALERT|MICROSOFT_IAS|MICROSOFT_SCEP|MOBILEIRON|OPENPATH|PASSWORDSTATE|SAVIYNT_EIP|SENTINEL_DV|SENTINELONE_ALERT|SEP|SEQRITE_ENDPOINT|SOPHOS_CENTRAL|SPYCLOUD|TRENDMICRO_APEX_CENTRAL|TRENDMICRO_APEX_ONE|TRENDMICRO_DEEP_SECURITY|TRENDMICRO_STELLAR|TRENDMICRO_VISION_ONE|VENAFI_ZTPKI|WINDOWS_DEFENDER_ATP|WINEVTLOG|WINEVTLOG_XML/ nocase
strings.coalesce($event.principal.asset.hostname, $event.principal.hostname) in %PCI_Assets
$Log_Type = $event.metadata.log_type
$Date = timestamp.get_date($event.metadata.event_timestamp.seconds)
match:
$Log_Type, $Date
outcome:
$Count = count($event.security_result.action)
order:
$Date asc
按类型划分的允许事件
$event.metadata.log_type = /_AV|EDR|BEYONDTRUST_ENDPOINT|BITDEFENDER|CISCO_AMP|CISCO_SECURE_WORKLOAD|CS_DETECTS|CS_IDP|CYBERARK_EPM|CYNET_360_AUTOXDR|ENDPOINT_PROTECTOR_DLP|FIREEYE_HX|HALCYON|IBM_SECURITY_VERIFY|JAMF_PRO|JAMF_PROTECT|JAMF_TELEMETRY|KOLIDE|LOOKOUT_MOBILE_ENDPOINT_SECURITY|MACOS|MACOS_ENDPOINT_SECURITY|MICROSOFT_DEFENDER_ENDPOINT|MICROSOFT_DEFENDER_ENDPOINT_IOS|MICROSOFT_DEFENDER_IDENTITY|MICROSOFT_GRAPH_ALERT|MICROSOFT_IAS|MICROSOFT_SCEP|MOBILEIRON|OPENPATH|PASSWORDSTATE|SAVIYNT_EIP|SENTINEL_DV|SENTINELONE_ALERT|SEP|SEQRITE_ENDPOINT|SOPHOS_CENTRAL|SPYCLOUD|TRENDMICRO_APEX_CENTRAL|TRENDMICRO_APEX_ONE|TRENDMICRO_DEEP_SECURITY|TRENDMICRO_STELLAR|TRENDMICRO_VISION_ONE|VENAFI_ZTPKI|WINDOWS_DEFENDER_ATP|WINEVTLOG|WINEVTLOG_XML/
strings.coalesce($event.principal.asset.hostname, $event.principal.hostname) in %PCI_Assets
$event.security_result.action = "ALLOW"
or $event.security_result.action = "ALLOW_WITH_MODIFICATION"
$Event_Type = $event.metadata.event_type
match:
$Event_Type
outcome:
$Count = count($event.security_result.action)
order:
$Count desc
允许的事件
$event.metadata.log_type = /_AV|EDR|BEYONDTRUST_ENDPOINT|BITDEFENDER|CISCO_AMP|CISCO_SECURE_WORKLOAD|CS_DETECTS|CS_IDP|CYBERARK_EPM|CYNET_360_AUTOXDR|ENDPOINT_PROTECTOR_DLP|FIREEYE_HX|HALCYON|IBM_SECURITY_VERIFY|JAMF_PRO|JAMF_PROTECT|JAMF_TELEMETRY|KOLIDE|LOOKOUT_MOBILE_ENDPOINT_SECURITY|MACOS|MACOS_ENDPOINT_SECURITY|MICROSOFT_DEFENDER_ENDPOINT|MICROSOFT_DEFENDER_ENDPOINT_IOS|MICROSOFT_DEFENDER_IDENTITY|MICROSOFT_GRAPH_ALERT|MICROSOFT_IAS|MICROSOFT_SCEP|MOBILEIRON|OPENPATH|PASSWORDSTATE|SAVIYNT_EIP|SENTINEL_DV|SENTINELONE_ALERT|SEP|SEQRITE_ENDPOINT|SOPHOS_CENTRAL|SPYCLOUD|TRENDMICRO_APEX_CENTRAL|TRENDMICRO_APEX_ONE|TRENDMICRO_DEEP_SECURITY|TRENDMICRO_STELLAR|TRENDMICRO_VISION_ONE|VENAFI_ZTPKI|WINDOWS_DEFENDER_ATP|WINEVTLOG|WINEVTLOG_XML/
strings.coalesce($event.principal.asset.hostname, $event.principal.hostname) in %PCI_Assets
$event.security_result.action = "ALLOW"
or $event.security_result.action = "ALLOW_WITH_MODIFICATION"
outcome:
$Count = count($event.security_result.action)
PCI - 数据加密
此信息中心简要介绍了 PCI 资产的加密实践。此信息中心可增强加密密钥使用情况的可视性，让您深入了解密钥管理服务 (KMS) 活动、Azure 密钥保管库日志和 Akeyless 保管库日志。它使用参考列表 pci_network_ranges 将数据限定在 PCI 环境中。
注意 ： 在创建所需的参考列表之前，此信息中心内的图表不会加载。
密钥轮替时间距今超过 30 天
密钥解密失败
密钥删除
加密强度较弱 / 未加密的通信
按端口划分的弱加密/ 未加密通信
密钥已轮替
密钥已启用
密钥解密成功
新密钥
弱加密 / 未加密通信随时间的变化
密钥停用时间超过 30 天
弱加密/ 未加密通信前 10 名用户
前 10 项关键操作
弱加密 / 未加密通信前 10 名主机
图表名称
查询示例
密钥轮替时间距今超过 30 天
$log_type = metadata.log_type
$app = target.application
($log_type = /AZURE_KEYVAULT_AUDIT|AKEYLESS_VAULT/ or $app = "kms.amazonaws.com")
principal.ip in cidr %PCI_Network_Ranges
$IP = principal.ip
$security_event_type = metadata.product_event_type
($security_event_type = "RotateKeyOnDemand" or $security_event_type = "RotateKey" or $security_event_type = "KeyRotate" or $security_event_type = /KeyRotationPolicy/ nocase or $security_event_type = "KeyRotateIfDue")
$difference = timestamp.diff(timestamp.current_seconds(), metadata.ingested_timestamp.seconds, "DAY")
$difference > 30
$label = principal.user.attribute.labels.key
$value = principal.user.attribute.labels.value
$user = strings.coalesce(principal.user.userid,principal.user.user_display_name,principal.user.email_addresses)
$key = target.resource.name
$target_key = target.resource.attribute.labels.key
$target_key = "Recipient Account Id"
$account_Id = target.resource.attribute.labels.value
$date = timestamp.get_date(metadata.ingested_timestamp.seconds)
match:
$date, $account_Id, $user, $IP, $key, $label, $value
outcome:
$age = max($difference)
order:
$age desc
密钥解密失败
$log_type = metadata.log_type
$app = target.application
($log_type = /AZURE_KEYVAULT_AUDIT|AKEYLESS_VAULT/ or $app = "kms.amazonaws.com")
principal.ip in cidr %PCI_Network_Ranges
$IP = principal.ip
$security_event_type = metadata.product_event_type
($security_event_type = "Decrypt" or $security_event_type = "KeyDecrypt")
$summary = security_result.summary
$description = metadata.description
$result_type = additional.fields["resultType"]
(re.regex($summary, `Fail`) nocase or re.regex($result_type, `Fail`) nocase)
$message = strings.coalesce(security_result.summary, metadata.description)
$key = target.resource.name
$label = principal.user.attribute.labels.key
$label = "principalId"
$value = principal.user.attribute.labels.value
$role = principal.user.role_name
$user = strings.coalesce(principal.user.userid,principal.user.user_display_name,principal.user.email_addresses)
match:
$user, $IP, $key, $role, $message, $label, $value
outcome:
$event_count = count(metadata.id)
order:
$event_count desc
密钥删除
$log_type = metadata.log_type
$app = target.application
($log_type = /AZURE_KEYVAULT_AUDIT|AKEYLESS_VAULT/ or $app = "kms.amazonaws.com")
principal.ip in cidr %PCI_Network_Ranges
$IP = principal.ip
$security_event_type = metadata.product_event_type
($security_event_type = "KeyDelete" or $security_event_type = "ScheduleKeyDeletion" or $security_event_type = "Delete")
$label = principal.user.attribute.labels.key
$user = strings.coalesce(principal.user.attribute.labels.value, principal.user.userid, principal.user.user_display_name,principal.user.email_addresses)
$key = target.resource.name
$date = timestamp.get_date(metadata.event_timestamp.seconds)
match:
$user, $IP, $key, $label, $date
outcome:
$event_count = count(metadata.id)
order:
$date, $event_count desc
加密强度较弱 / 未加密的通信
$log_type = metadata.log_type
$app = target.application
($log_type = /AZURE_KEYVAULT_AUDIT|AKEYLESS_VAULT/ or $app = "kms.amazonaws.com")
principal.ip in cidr %PCI_Network_Ranges
$IP = principal.ip
$target_key = target.resource.attribute.labels.key
($target_key = "keyProperties_type" or $target_key = "requestParameters.keySpec")
$target_value = target.resource.attribute.labels.value
$target_value != /RSA|AES_256/ nocase
outcome:
$event_count = count_distinct(metadata.id)
按端口划分的弱加密/ 未加密通信
$IP = principal.ip
principal.ip in cidr %PCI_Network_Ranges
$event_type = metadata.event_type
($event_type >= 16000 and $event_type <= 16007)
$port = strings.concat(target.port, "")
$port = /(80|69|23|21|110|143|161|79|88)/
$direction = network.direction
match:
$port, $direction, $event_type
outcome:
$event_count = count(metadata.id)
order:
$event_count desc
limit:
10
密钥已轮替
principal.ip in cidr %PCI_Network_Ranges
($log_type = /AZURE_KEYVAULT_AUDIT|AKEYLESS_VAULT/ or $app = "kms.amazonaws.com")
$log_type = metadata.log_type
$app = target.application
$IP = principal.ip
$security_event_type = metadata.product_event_type
($security_event_type = "RotateKeyOnDemand" or $security_event_type = "RotateKey" or $security_event_type = "KeyRotate" or $security_event_type = /KeyRotationPolicy/ nocase or $security_event_type = "KeyRotateIfDue")
$label = principal.user.attribute.labels.key
$value = principal.user.attribute.labels.value
$user = strings.coalesce(principal.user.userid, principal.user.user_display_name, principal.user.email_addresses)
$key = target.resource.name
match:
$user, $IP, $key, $label, $value
outcome:
$event_count = count(metadata.id)
order:
$event_count desc
密钥已启用
$log_type = metadata.log_type
$app = target.application
($log_type = /AZURE_KEYVAULT_AUDIT|AKEYLESS_VAULT/ or $app = "kms.amazonaws.com")
principal.ip in cidr %PCI_Network_Ranges
$IP = principal.ip
$security_event_type = metadata.product_event_type
($security_event_type = "EnableKey" or $security_event_type = "KeyEnable")
outcome:
$event_count = count(metadata.id)
密钥解密成功
$log_type = metadata.log_type
$app = target.application
($log_type = /AZURE_KEYVAULT_AUDIT|AKEYLESS_VAULT/ or $app = "kms.amazonaws.com")
principal.ip in cidr %PCI_Network_Ranges
$IP = principal.ip
$security_event_type = metadata.product_event_type
($security_event_type = "Decrypt" or $security_event_type = "KeyDecrypt")
$summary = security_result.summary
$description = metadata.description
$result_type = additional.fields["resultType"]
(re.regex($summary, `Success`) nocase or re.regex($result_type, `Success`) nocase)
$message = strings.coalesce(security_result.summary, metadata.description)
$key = target.resource.name
$label = principal.user.attribute.labels.key
$value = principal.user.attribute.labels.value
$role = principal.user.role_name
$user = strings.coalesce(principal.user.userid,principal.user.user_display_name,principal.user.email_addresses)
match:
$user, $IP, $key, $role, $message, $label, $value
outcome:
$event_count = count(metadata.id)
order:
$event_count desc
limit:
50
新密钥
$log_type = metadata.log_type
$app = target.application
($log_type = /AZURE_KEYVAULT_AUDIT|AKEYLESS_VAULT/ or $app = "kms.amazonaws.com")
principal.ip in cidr %PCI_Network_Ranges
$IP = principal.ip
$security_event_type = metadata.product_event_type
($security_event_type = "CreateKey" or $security_event_type = "KeyCreate")
outcome:
$event_count = count(metadata.id)
弱加密 / 未加密通信随时间的变化
$log_type = metadata.log_type
$app = target.application
($log_type = /AZURE_KEYVAULT_AUDIT|AKEYLESS_VAULT/ or $app = "kms.amazonaws.com")
principal.ip in cidr %PCI_Network_Ranges
$IP = principal.ip
$target_key = target.resource.attribute.labels.key
($target_key = "keyProperties_type" or $target_key = "requestParameters.keySpec")
$target_value = target.resource.attribute.labels.value
$target_value != /RSA|AES_256/ nocase
$date = timestamp.get_date(metadata.event_timestamp.seconds)
match:
$date
outcome:
$event_count = count(metadata.id)
order:
$date asc
密钥停用时间超过 30 天
$log_type = metadata.log_type
$app = target.application
($log_type = /AZURE_KEYVAULT_AUDIT|AKEYLESS_VAULT/ or $app = "kms.amazonaws.com")
principal.ip in cidr %PCI_Network_Ranges
$IP = principal.ip
$security_event_type = metadata.product_event_type
($security_event_type = "DisableKey" or $security_event_type = "Disable")
$difference = timestamp.diff(timestamp.current_seconds(), metadata.ingested_timestamp.seconds, "DAY")
$difference > 30
$account_id = target.resource.attribute.labels.value
$user = strings.coalesce(principal.user.userid, principal.user.user_display_name, principal.user.email_addresses)
$key = target.resource.name
match:
$account_id, $user, $IP, $key
outcome:
$age = max($difference)
order:
$age desc
弱加密/ 未加密通信前 10 名用户
$log_type = metadata.log_type
$app = target.application
($log_type = /AZURE_KEYVAULT_AUDIT|AKEYLESS_VAULT/ or $app = "kms.amazonaws.com")
principal.ip in cidr %PCI_Network_Ranges
$IP = principal.ip
$target_key = target.resource.attribute.labels.key
($target_key = "keyProperties_type" or $target_key = "requestParameters.keySpec")
$target_value = target.resource.attribute.labels.value
$target_value != /RSA|AES_256/ nocase
$user = strings.coalesce(principal.user.attribute.labels.value, principal.user.userid, principal.user.user_display_name,principal.user.email_addresses)
match:
$user
outcome:
$event_count = count(metadata.id)
order:
$event_count desc
limit :
10
前 10 项关键操作
$log_type = metadata.log_type
$app = target.application
($log_type = /AZURE_KEYVAULT_AUDIT|AKEYLESS_VAULT/ or $app = "kms.amazonaws.com")
principal.ip in cidr %PCI_Network_Ranges
$IP = principal.ip
$security_event_type = metadata.product_event_type
match:
$security_event_type
outcome:
$event_count = count(metadata.id)
order:
$event_count desc
limit:
10
弱加密 / 未加密通信前 10 名主机
$log_type = metadata.log_type
$app = target.application
($log_type = /AZURE_KEYVAULT_AUDIT|AKEYLESS_VAULT/ or $app = "kms.amazonaws.com")
principal.ip in cidr %PCI_Network_Ranges
$IP = principal.ip
$target_key = target.resource.attribute.labels.key
($target_key = "keyProperties_type" or $target_key = "requestParameters.keySpec")
$target_value = target.resource.attribute.labels.value
$target_value != /RSA|AES_256/
$hostname = strings.coalesce(principal.hostname, principal.asset.hostname)
$hostname != ""
match:
$hostname
outcome:
$event_count = count(metadata.id)
order:
$event_count desc
limit:
10
PCI - EDR 提醒概览
此信息中心可详细显示资产、事件和有效威胁检测等关键元素。它使用参考列表 pci_assets 将数据限定在 PCI 环境中。
注意 ： 在创建所需的参考列表之前，此信息中心内的图表不会加载。
EDR 传感器数量
10 大技巧
基于 EDR 提醒的严重程度
EDR 提醒总数随时间变化情况
基于 EDR 提醒的前 10 名用户
10 大策略
前 10 个 EDR 提醒
根据 EDR 提醒得出的前 10 名主机
有效 EDR 传感器
EDR 提醒总数
图表名称
查询示例
EDR 传感器数量
$event.metadata.log_type = /EDR|CS_DETECTS|FIREEYE_HX|MICROSOFT_DEFENDER_ENDPOINT|MICROSOFT_DEFENDER_IDENTITY|SENTINEL_DV/ nocase
strings.coalesce($event.principal.asset.hostname, $event.principal.hostname) in %PCI_Assets
outcome:
$Count = count_distinct($event.principal.asset.hostname)
10 大技巧
$event.metadata.log_type = /EDR|CS_DETECTS|FIREEYE_HX|MICROSOFT_DEFENDER_ENDPOINT|MICROSOFT_DEFENDER_IDENTITY|SENTINEL_DV/ nocase
strings.coalesce($event.principal.asset.hostname, $event.principal.hostname) in %PCI_Assets
$Technique_ID = strings.coalesce($event.security_result.attack_details.techniques.id, $event.security_result.detection_fields["Technique ID"])
$Technique_Name = strings.coalesce($event.security_result.attack_details.techniques.name, $event.security_result.detection_fields["Technique"])
$Technique_ID != ""
$Technique_Name != ""
match:
$Technique_Name
outcome:
$Count = count($event.security_result.summary)
order:
$Count desc
limit:
107
基于 EDR 提醒的严重程度
$event.metadata.log_type = /EDR|CS_DETECTS|FIREEYE_HX|MICROSOFT_DEFENDER_ENDPOINT|MICROSOFT_DEFENDER_IDENTITY|SENTINEL_DV/ nocase
strings.coalesce($event.principal.asset.hostname, $event.principal.hostname) in %PCI_Assets
$event.security_result.summary != ""
$Severity = $event.security_result.severity
match:
$Severity
outcome:
$Count = count($event.security_result.summary)
order:
$Severity asc
limit:
10
EDR 提醒总数随时间变化情况
$event.metadata.log_type = /EDR|CS_DETECTS|FIREEYE_HX|MICROSOFT_DEFENDER_ENDPOINT|MICROSOFT_DEFENDER_IDENTITY|SENTINEL_DV/ nocase
strings.coalesce($event.principal.asset.hostname, $event.principal.hostname) in %PCI_Assets
$Log_Type = $event.metadata.log_type
$Date = timestamp.get_date($event.metadata.event_timestamp.seconds)
match:
$Date, $Log_Type
outcome:
$Count = count($event.security_result.summary)
order:
$Date asc
基于 EDR 提醒的前 10 名用户
$event.metadata.log_type = /EDR|CS_DETECTS|FIREEYE_HX|MICROSOFT_DEFENDER_ENDPOINT|MICROSOFT_DEFENDER_IDENTITY|SENTINEL_DV/ nocase
strings.coalesce($event.principal.asset.hostname, $event.principal.hostname) in %PCI_Assets
$User = $event.principal.user.user_display_name
$User != ""
match:
$User
outcome:
$Count = count($event.security_result.summary)
order:
$Count desc
limit:
10
10 大策略
$event.metadata.log_type = /EDR|CS_DETECTS|FIREEYE_HX|MICROSOFT_DEFENDER_ENDPOINT|MICROSOFT_DEFENDER_IDENTITY|SENTINEL_DV/ nocase
strings.coalesce($event.principal.asset.hostname, $event.principal.hostname) in %PCI_Assets
$Tactic_ID = strings.coalesce($event.security_result.attack_details.tactics.id, $event.security_result.detection_fields["Tactic ID"])
$Tactic_Name = strings.coalesce($event.security_result.attack_details.tactics.name, $event.security_result.detection_fields["Tactic"])
$Tactic_ID != ""
$Tactic_Name != ""
match:
$Tactic_Name
outcome:
$Count = count($event.security_result.summary)
order:
$Count desc
limit:
10
前 10 个 EDR 提醒
$event.metadata.log_type = /EDR|CS_DETECTS|FIREEYE_HX|MICROSOFT_DEFENDER_ENDPOINT|MICROSOFT_DEFENDER_IDENTITY|SENTINEL_DV/ nocase
strings.coalesce($event.principal.asset.hostname, $event.principal.hostname) in %PCI_Assets
$Log_Type = $event.metadata.log_type
$Detection = $event.security_result.summary
$Detection != ""
match:
$Detection, $Log_Type
outcome:
$Count = count($event.security_result.summary)
order:
$Count desc
limit:
10
根据 EDR 提醒得出的前 10 名主机
$event.metadata.log_type = /EDR|CS_DETECTS|FIREEYE_HX|MICROSOFT_DEFENDER_ENDPOINT|MICROSOFT_DEFENDER_IDENTITY|SENTINEL_DV/ nocase
strings.coalesce($event.principal.asset.hostname, $event.principal.hostname) in %PCI_Assets
$Hostname = strings.coalesce($event.principal.asset.hostname, $event.principal.hostname)
$Hostname != ""
match:
$Hostname
outcome:
$Count = count($event.security_result.summary)
order:
$Count desc
limit:
10
有效 EDR 传感器
$event.metadata.log_type = /EDR|CS_DETECTS|FIREEYE_HX|MICROSOFT_DEFENDER_ENDPOINT|MICROSOFT_DEFENDER_IDENTITY|SENTINEL_DV/ nocase
strings.coalesce($event.principal.asset.hostname, $event.principal.hostname) in %PCI_Assets
$EDR_Asset = strings.coalesce($event.principal.asset.hostname, $event.principal.hostname)
match:
$EDR_Asset
limit:
50
EDR 提醒总数
$event.metadata.log_type = /EDR|CS_DETECTS|FIREEYE_HX|MICROSOFT_DEFENDER_ENDPOINT|MICROSOFT_DEFENDER_IDENTITY|SENTINEL_DV/ nocase
strings.coalesce($event.principal.asset.hostname, $event.principal.hostname) in %PCI_Assets
outcome:
$Count = count($event.security_result.summary)
PCI - 身份和访问权限
此信息中心可提供访问权限管理和身份相关活动的详细实时概览，以支持 PCI-DSS 合规性。它会整合关键指标和数据洞见，包括用户访问权限、密码更改和身份验证事件。它使用参考列表 pci_assets 将数据限定在 PCI 环境中。
注意 ： 在创建所需的参考列表之前，此信息中心内的图表不会加载。
密码永不过期的账号
用户账号权限变更
已创建用户账号
用户账号已删除
尝试更改密码次数最多的 10 位用户
密码随时间的变化
图表名称
查询示例
密码永不过期的账号
$event_type = metadata.event_type
$event_type >= 15000 and $event_type <= 15014
(principal.hostname in %PCI_Assets or principal.asset.hostname in %PCI_Assets or target.hostname in %PCI_Assets or target.asset.hostname in %PCI_Assets)
$hostname = strings.coalesce(principal.hostname,principal.asset.hostname,target.hostname,target.asset.hostname)
$vendor = metadata.vendor_name
$security_event_type = metadata.product_event_type
$key = principal.user.attribute.labels.key
$value = principal.user.attribute.labels.value
($key = /Password Never Expires/ nocase and $value = /true/ nocase)
$user = strings.coalesce(principal.user.userid,principal.user.user_display_name,principal.user.email_addresses)
$action = security_result.action
match:
$user, $hostname, $vendor, $action, $security_event_type
outcome:
$event_count = count_distinct(metadata.id)
order:
$event_count desc
用户账号权限变更
$event_type = metadata.event_type
$event_type = "USER_CHANGE_PERMISSIONS"
(principal.hostname in %PCI_Assets or principal.asset.hostname in %PCI_Assets or target.hostname in %PCI_Assets or target.asset.hostname in %PCI_Assets)
$hostname = strings.coalesce(principal.hostname,principal.asset.hostname,target.hostname,target.asset.hostname)
$vendor = metadata.vendor_name
$user = strings.coalesce(principal.user.userid,principal.user.user_display_name,principal.user.email_addresses)
$action = security_result.action
match:
$user, $hostname, $vendor, $action
outcome:
$event_count = count(metadata.id)
order:
$event_count desc
已创建用户账号
$event_type = metadata.event_type
$event_type = "USER_CREATION"
(principal.hostname in %PCI_Assets or principal.asset.hostname in %PCI_Assets or target.hostname in %PCI_Assets or target.asset.hostname in %PCI_Assets)
outcome:
$event_count = count(metadata.id)
已创建用户账号
$event_type = metadata.event_type
$event_type = "USER_CREATION"
(principal.hostname in %PCI_Assets or principal.asset.hostname in %PCI_Assets or target.hostname in %PCI_Assets or target.asset.hostname in %PCI_Assets)
$hostname = strings.coalesce(principal.hostname,principal.asset.hostname,target.hostname,target.asset.hostname)
$vendor = metadata.vendor_name
$user = strings.coalesce(principal.user.userid,principal.user.user_display_name,principal.user.email_addresses)
$action = security_result.action
match:
$user, $hostname, $vendor, $action
outcome:
$event_count = count(metadata.id)
order:
$event_count desc
用户账号已删除
$event_type = metadata.event_type
$event_type = "USER_DELETION"
(principal.hostname in %PCI_Assets or principal.asset.hostname in %PCI_Assets or target.hostname in %PCI_Assets or target.asset.hostname in %PCI_Assets)
$hostname = strings.coalesce(principal.hostname,principal.asset.hostname,target.hostname,target.asset.hostname)
$vendor = metadata.vendor_name
$user = strings.coalesce(principal.user.userid,principal.user.user_display_name,principal.user.email_addresses)
$action = security_result.action
match:
$user, $hostname, $vendor, $action
outcome:
$event_count = count(metadata.id)
order:
$event_count desc
尝试更改密码次数最多的 10 位用户
$event_type = metadata.event_type
$event_type = "USER_CHANGE_PASSWORD"
(principal.hostname in %PCI_Assets or principal.asset.hostname in %PCI_Assets or target.hostname in %PCI_Assets or target.asset.hostname in %PCI_Assets)
$hostname = strings.coalesce(principal.hostname,principal.asset.hostname,target.hostname,target.asset.hostname)
$vendor = metadata.vendor_name
$user = strings.coalesce(principal.user.userid,principal.user.user_display_name,principal.user.email_addresses)
$action = security_result.action
match:
$user, $hostname, $vendor, $action
outcome:
$event_count = count(metadata.id)
order:
$event_count desc
limit:
10
用户账号已删除
$event_type = metadata.event_type
$event_type = "USER_DELETION"
(principal.hostname in %PCI_Assets or principal.asset.hostname in %PCI_Assets or target.hostname in %PCI_Assets or target.asset.hostname in %PCI_Assets)
outcome:
$event_count = count(metadata.id)
用户账号权限变更
$event_type = metadata.event_type
$event_type = "USER_CHANGE_PERMISSIONS"
(principal.hostname in %PCI_Assets or principal.asset.hostname in %PCI_Assets or target.hostname in %PCI_Assets or target.asset.hostname in %PCI_Assets)
outcome:
$event_count = count(metadata.id)
密码随时间的变化
$event_type = metadata.event_type
$event_type = "USER_CHANGE_PASSWORD"
(principal.hostname in %PCI_Assets or principal.asset.hostname in %PCI_Assets or target.hostname in %PCI_Assets or target.asset.hostname in %PCI_Assets)
$hostname = strings.coalesce(principal.hostname,principal.asset.hostname,target.hostname,target.asset.hostname)
$date = timestamp.get_date(metadata.event_timestamp.seconds)
match:
$date
outcome:
$event_count = count(metadata.id)
order:
$date asc
PCI - 监控和测试
此信息中心可监控和跟踪对 PCI 环境中支付卡持卡人数据的访问。它利用参考列表 pci_assets 和 default_users 来确定数据范围。
注意 ： 在创建所需的参考列表之前，此信息中心内的图表不会加载。
按事件类型统计的指定时间段内的事件
按来源划分的热门资源访问情况
审核日志访问权限
对系统的管理员访问权限
按操作次数排名的前 10 名用户
不活跃用户（过去 7 天）
日志清除检测（Windows 事件）
审核政策变更
失败的事件
按来源 IP 地址划分的失败事件总数
按事件类型划分的事件总数
图表名称
查询示例
按事件类型统计的指定时间段内的事件
(metadata.event_type = "USER_UNCATEGORIZED"
or metadata.event_type = "USER_LOGIN"
or metadata.event_type = "USER_LOGOUT"
or metadata.event_type = "USER_CREATION"
or metadata.event_type = "USER_CHANGE_PASSWORD"
or metadata.event_type = "USER_CHANGE_PERMISSIONS"
or metadata.event_type = "USER_BADGE_IN"
or metadata.event_type = "USER_DELETION"
or metadata.event_type = "USER_RESOURCE_CREATION"
or metadata.event_type = "USER_RESOURCE_UPDATE_CONTENT"
or metadata.event_type = "USER_RESOURCE_UPDATE_PERMISSIONS"
or metadata.event_type = "USER_COMMUNICATION"
or metadata.event_type = "USER_RESOURCE_ACCESS"
or metadata.event_type = "USER_RESOURCE_DELETION")
(principal.hostname in %PCI_Assets or principal.asset.hostname in %PCI_Assets or target.hostname in %PCI_Assets or target.asset.hostname in %PCI_Assets)
$Event_Type = metadata.event_type
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
match:
$Date, $Event_Type
outcome:
$Count = count(metadata.id)
order:
$Date asc
按来源划分的热门资源访问情况
(metadata.event_type = "USER_UNCATEGORIZED"
or metadata.event_type = "USER_LOGIN"
or metadata.event_type = "USER_LOGOUT"
or metadata.event_type = "USER_CREATION"
or metadata.event_type = "USER_CHANGE_PASSWORD"
or metadata.event_type = "USER_CHANGE_PERMISSIONS"
or metadata.event_type = "USER_BADGE_IN"
or metadata.event_type = "USER_DELETION"
or metadata.event_type = "USER_RESOURCE_CREATION"
or metadata.event_type = "USER_RESOURCE_UPDATE_CONTENT"
or metadata.event_type = "USER_RESOURCE_UPDATE_PERMISSIONS"
or metadata.event_type = "USER_COMMUNICATION"
or metadata.event_type = "USER_RESOURCE_ACCESS"
or metadata.event_type = "USER_RESOURCE_DELETION")
(principal.hostname in %PCI_Assets or principal.asset.hostname in %PCI_Assets or target.hostname in %PCI_Assets or target.asset.hostname in %PCI_Assets)
$Source_IP = strings.coalesce(principal.ip, principal.asset.ip)
$Hostname = strings.coalesce(principal.hostname, principal.asset.hostname, target.hostname, target.asset.hostname)
$Vendor = metadata.vendor_name
$Action = security_result.action
$Source_User = strings.coalesce(principal.user.userid, principal.user.user_display_name, principal.user.email_addresses)
$Destination_User = strings.coalesce(target.user.userid, target.user.user_display_name, target.user.email_addresses)
match:
$Source_IP, $Hostname, $Source_User, $Destination_User, $Vendor, $Action
outcome:
$Count = count(metadata.id)
$Date = timestamp.get_timestamp(max(metadata.event_timestamp.seconds), "%F %T")
order:
$Count desc
审核日志访问权限
(metadata.event_type = "SYSTEM_AUDIT_LOG_UNCATEGORIZED" or metadata.event_type = "SYSTEM_AUDIT_LOG_WIPE")
(principal.hostname in %PCI_Assets or principal.asset.hostname in %PCI_Assets or target.hostname in %PCI_Assets or target.asset.hostname in %PCI_Assets)
$Vendor = metadata.vendor_name
$Source_User = strings.coalesce(principal.user.userid, principal.user.user_display_name, principal.user.email_addresses)
$Destination_User = strings.coalesce(target.user.userid, target.user.user_display_name, target.user.email_addresses)
match:
$Source_User, $Destination_User, $Vendor
outcome:
$Count = count(metadata.id)
$Date = timestamp.get_timestamp(max(metadata.event_timestamp.seconds ), "%F %T")
order:
$Count desc
对系统的管理员访问权限
(principal.hostname in %PCI_Assets or principal.asset.hostname in %PCI_Assets or target.hostname in %PCI_Assets or target.asset.hostname in %PCI_Assets)
$Event_Type = metadata.event_type
$Hostname = strings.coalesce(principal.hostname, principal.asset.hostname, target.hostname, target.asset.hostname)
$Vendor = metadata.vendor_name
$User = strings.coalesce(principal.user.userid, principal.user.user_display_name, principal.user.email_addresses, target.user.userid, target.user.user_display_name, target.user.email_addresses)
$User in %Default_Users
match:
$User, $Hostname, $Vendor, $Event_Type
outcome:
$Count = count(metadata.id)
$Date = timestamp.get_timestamp(max(metadata.event_timestamp.seconds ), "%F %T")
order:
$Count desc
按操作次数排名的前 10 名用户
(metadata.event_type = "USER_UNCATEGORIZED"
or metadata.event_type = "USER_LOGIN"
or metadata.event_type = "USER_LOGOUT"
or metadata.event_type = "USER_CREATION"
or metadata.event_type = "USER_CHANGE_PASSWORD"
or metadata.event_type = "USER_CHANGE_PERMISSIONS"
or metadata.event_type = "USER_BADGE_IN"
or metadata.event_type = "USER_DELETION"
or metadata.event_type = "USER_RESOURCE_CREATION"
or metadata.event_type = "USER_RESOURCE_UPDATE_CONTENT"
or metadata.event_type = "USER_RESOURCE_UPDATE_PERMISSIONS"
or metadata.event_type = "USER_COMMUNICATION"
or metadata.event_type = "USER_RESOURCE_ACCESS"
or metadata.event_type = "USER_RESOURCE_DELETION")
(principal.hostname in %PCI_Assets or principal.asset.hostname in %PCI_Assets or target.hostname in %PCI_Assets or target.asset.hostname in %PCI_Assets)
$User = strings.coalesce(principal.user.userid, principal.user.user_display_name, principal.user.email_addresses, target.user.userid, target.user.user_display_name, target.user.email_addresses)
$Action = security_result.action
match:
$User, $Action
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
不活跃用户（过去 7 天）
(metadata.event_type = "USER_UNCATEGORIZED"
or metadata.event_type = "USER_LOGIN"
or metadata.event_type = "USER_LOGOUT"
or metadata.event_type = "USER_CREATION"
or metadata.event_type = "USER_CHANGE_PASSWORD"
or metadata.event_type = "USER_CHANGE_PERMISSIONS"
or metadata.event_type = "USER_BADGE_IN"
or metadata.event_type = "USER_DELETION"
or metadata.event_type = "USER_RESOURCE_CREATION"
or metadata.event_type = "USER_RESOURCE_UPDATE_CONTENT"
or metadata.event_type = "USER_RESOURCE_UPDATE_PERMISSIONS"
or metadata.event_type = "USER_COMMUNICATION"
or metadata.event_type = "USER_RESOURCE_ACCESS"
or metadata.event_type = "USER_RESOURCE_DELETION")
(principal.hostname in %PCI_Assets or principal.asset.hostname in %PCI_Assets or target.hostname in %PCI_Assets or target.asset.hostname in %PCI_Assets)
principal.user.last_login_time.seconds > 0
$Event_Type = metadata.event_type
$User = strings.coalesce(principal.user.userid, principal.user.user_display_name, principal.user.email_addresses, target.user.userid, target.user.user_display_name, target.user.email_addresses)
$Time_Difference = cast.as_int((metadata.event_timestamp.seconds-principal.user.last_login_time.seconds)/86400)
match:
$User, $Time_Difference
outcome:
$Logtime = timestamp.get_timestamp(max(metadata.event_timestamp.seconds), "%F %T")
$Lastime = timestamp.get_timestamp(max(principal.user.last_login_time.seconds), "%F %T")
order:
$Time_Difference desc
日志清除检测（Windows 事件）
metadata.log_type = "WINEVTLOG"
(metadata.product_event_type = "1102" or metadata.product_event_type = "104" or metadata.event_type = "SYSTEM_AUDIT_LOG_WIPE")
(principal.hostname in %PCI_Assets or principal.asset.hostname in %PCI_Assets or target.hostname in %PCI_Assets or target.asset.hostname in %PCI_Assets)
$Event_Type = metadata.event_type
$Security_Event_Type = metadata.product_event_type
$Hostname = strings.coalesce(principal.hostname,principal.asset.hostname,target.hostname,target.asset.hostname)
$Summary = strings.coalesce(metadata.description, security_result.summary, security_result.description)
match:
$Hostname, $Event_Type, $Security_Event_Type, $Summary
outcome:
$Count = count(metadata.id)
$Date = timestamp.get_timestamp(max(metadata.event_timestamp.seconds ), "%F %T")
order:
$Count desc
审核政策变更
metadata.event_type = "SYSTEM_AUDIT_LOG_UNCATEGORIZED" or metadata.event_type = "STATUS_UPDATE"
(security_result.category_details = /AuditPolicyChanges/ nocase or strings.coalesce(metadata.description, security_result.description, security_result.summary, metadata.product_event_type) = /policy change/ nocase)
(principal.hostname in %PCI_Assets or principal.asset.hostname in %PCI_Assets or target.hostname in %PCI_Assets or target.asset.hostname in %PCI_Assets)
$Security_Event_Type = metadata.product_event_type
$Policy_Change = strings.coalesce(metadata.description, security_result.description, security_result.summary, security_result.category_details)
$Source_User = strings.coalesce(principal.user.userid, principal.user.user_display_name, principal.user.email_addresses)
$Destination_User = strings.coalesce(target.user.userid, target.user.user_display_name, target.user.email_addresses)
match:
$Source_User, $Destination_User, $Security_Event_Type, $Policy_Change
outcome:
$Count = count(metadata.id)
$Date = timestamp.get_timestamp(max(metadata.event_timestamp.seconds ), "%F %T")
order:
$Count desc
审核政策变更
(metadata.event_type = "SYSTEM_AUDIT_LOG_UNCATEGORIZED" or metadata.event_type = "STATUS_UPDATE")
(security_result.category_details = /AuditPolicyChanges/ nocase or strings.coalesce(metadata.description, security_result.description, security_result.summary, metadata.product_event_type) = /policy change/ nocase)
(principal.hostname in %PCI_Assets or principal.asset.hostname in %PCI_Assets or target.hostname in %PCI_Assets or target.asset.hostname in %PCI_Assets)
outcome:
$Count = count(metadata.id)
失败的事件
(metadata.event_type = "USER_UNCATEGORIZED"
or metadata.event_type = "USER_LOGIN"
or metadata.event_type = "USER_LOGOUT"
or metadata.event_type = "USER_CREATION"
or metadata.event_type = "USER_CHANGE_PASSWORD"
or metadata.event_type = "USER_CHANGE_PERMISSIONS"
or metadata.event_type = "USER_BADGE_IN"
or metadata.event_type = "USER_DELETION"
or metadata.event_type = "USER_RESOURCE_CREATION"
or metadata.event_type = "USER_RESOURCE_UPDATE_CONTENT"
or metadata.event_type = "USER_RESOURCE_UPDATE_PERMISSIONS"
or metadata.event_type = "USER_COMMUNICATION"
or metadata.event_type = "USER_RESOURCE_ACCESS"
or metadata.event_type = "USER_RESOURCE_DELETION")
security_result.action = "BLOCK"
(principal.hostname in %PCI_Assets or principal.asset.hostname in %PCI_Assets or target.hostname in %PCI_Assets or target.asset.hostname in %PCI_Assets)
outcome:
$Count = count(metadata.id)
按来源 IP 地址划分的失败事件总数
(metadata.event_type = "USER_UNCATEGORIZED"
or metadata.event_type = "USER_LOGIN"
or metadata.event_type = "USER_LOGOUT"
or metadata.event_type = "USER_CREATION"
or metadata.event_type = "USER_CHANGE_PASSWORD"
or metadata.event_type = "USER_CHANGE_PERMISSIONS"
or metadata.event_type = "USER_BADGE_IN"
or metadata.event_type = "USER_DELETION"
or metadata.event_type = "USER_RESOURCE_CREATION"
or metadata.event_type = "USER_RESOURCE_UPDATE_CONTENT"
or metadata.event_type = "USER_RESOURCE_UPDATE_PERMISSIONS"
or metadata.event_type = "USER_COMMUNICATION"
or metadata.event_type = "USER_RESOURCE_ACCESS"
or metadata.event_type = "USER_RESOURCE_DELETION")
security_result.action = "BLOCK"
(principal.hostname in %PCI_Assets or principal.asset.hostname in %PCI_Assets or target.hostname in %PCI_Assets or target.asset.hostname in %PCI_Assets)
$Hostname = strings.coalesce(principal.hostname, principal.asset.hostname, target.hostname, target.asset.hostname)
$Vendor = metadata.vendor_name
$Source_IP = strings.coalesce(principal.ip, principal.asset.ip)
$Source_User = strings.coalesce(principal.user.userid, principal.user.user_display_name, principal.user.email_addresses)
$Destination_User = strings.coalesce(target.user.userid, target.user.user_display_name, target.user.email_addresses)
match:
$Source_IP, $Source_User, $Destination_User, $Hostname, $Vendor, metadata.event_type
outcome:
$Count = count(metadata.id)
$Date = timestamp.get_timestamp(max(metadata.event_timestamp.seconds ), "%F %T")
order:
$Count desc
按事件类型划分的事件总数
(metadata.event_type = "USER_UNCATEGORIZED"
or metadata.event_type = "USER_LOGIN"
or metadata.event_type = "USER_LOGOUT"
or metadata.event_type = "USER_CREATION"
or metadata.event_type = "USER_CHANGE_PASSWORD"
or metadata.event_type = "USER_CHANGE_PERMISSIONS"
or metadata.event_type = "USER_BADGE_IN"
or metadata.event_type = "USER_DELETION"
or metadata.event_type = "USER_RESOURCE_CREATION"
or metadata.event_type = "USER_RESOURCE_UPDATE_CONTENT"
or metadata.event_type = "USER_RESOURCE_UPDATE_PERMISSIONS"
or metadata.event_type = "USER_COMMUNICATION"
or metadata.event_type = "USER_RESOURCE_ACCESS"
or metadata.event_type = "USER_RESOURCE_DELETION")
(principal.hostname in %PCI_Assets or principal.asset.hostname in %PCI_Assets or target.hostname in %PCI_Assets or target.asset.hostname in %PCI_Assets)
$Event_Type = metadata.event_type
$Vendor = metadata.vendor_name
$Action = security_result.action
match:
$Event_Type, $Vendor, $Action
outcome:
$Count = count(metadata.id)
order:
$Count desc
PCI - 网络
此信息中心可提供有关特定接口（来源或目的地）网络性能的数据分析、热门网络活动的实时可见性，以及流量趋势和分析。它使用参考列表 pci_network_ranges 将数据限定在 PCI 环境中。
注意 ： 在创建所需的参考列表之前，此信息中心内的图表不会加载。
流量总数
按位置划分的前 10 大目的地流量
按前 10 个目标平台划分的流量
触发次数最多的 10 条网络规则
按前 10 个目标端口划分的流量
10 大网络活动
港口活动摘要
按前 10 大协议划分的流量
随时间变化的网络数据处理量（发送的字节数）
随时间变化的网络数据处理量（接收的字节数）
不同时间段的网络流量
按前 10 个来源端口划分的流量
网络资产数量
不同时间段的协议流量
按操作划分的不同时间段的流量
按前 10 大来源划分的流量
图表名称
查询示例
流量总数
$event.metadata.log_type = /ROUTER|SWITCH|DHCP|PROXY|NETWORK|VPN|FIREWALL|_FLOW|VPC|WIRELESS|IPS|IDS|ARUBA_EDGECONNECT_SDWAN|ARUBA_SWITCH|CISCO_APIC|CISCO_CALL_MANAGER|CISCO_DNAC|CISCO_ESTREAMER|CISCO_IOS|CISCO_PRIME|EFFICIENTIP_DDI|EXTREME_SWITCH|FORTINET_FORTIDDOS|FORTINET_FORTIMANAGER|ARUBA_CENTRAL|JUNIPER_JUNOS|JUNIPER_MIST|JUNIPER_SDWAN|NAGIOS|ARBOR_EDGE_DEFENSE|MICROSOFT_NPS|STEELHEAD|SHRUBBERY_TACACS|TRENDMICRO_DDI|VMWARE_NSX|WINDOWS_NET_POLICY_SERVER|ZYWALL|IMPERVA_FLEXPROTECT|PAN_IOT|NOZOMI_GUARDIAN|SURICATA_EVE|UMBRELLA_DNS|WINDOWS_SYSMON|COHESITY|RUBRIK|CISCO_MERAKI|CLAROTY_EMC|CLAROTY_CTD|HONEYD|AIRWATCH|IMPERVA_SECURESPHERE|SECURELINK|WALLIX_BASTION|CHECKPOINT_HARMONY|UNIFI_AP|DIGI_MODEMS|DESYNOVA_CONTIDO|CLOUDGENIX_SDWAN|JUNIPER_MX|SAP_WEBDISP|ADVA_FSP|HP_PROCURVE|VYOS|RSA_SECURID|HCNET_ACCOUNT_ADAPTER|INFOBLOX|VITALQIP|ASSET_STATIC_IP|BLUECAT_DDI|TWINGATE|SYMANTEC_VIP_AUTHHUB|ZSCALER_DECEPTION|BROCADE_SERVERIRON|KEMP_LOADBALANCER|A10_LOAD_BALANCER|AWS_ELB|F5_BIGIP_LTM|RADWARE_ALTEON|CITRIX_NETSCALER|AKAMAI_CLOUD_MONITOR|CISCO_ACE|GCP_LOADBALANCING|KERIOCONTROL|EXTRAHOP|NETFILTER_IPTABLES|CISCO_UMBRELLA_AUDIT|F5_AFM|NUTANIX_PRISM|SANGFOR_NGAF|VERCEL_WAF|PEPLINK_FW|NETDOCUMENTS|PAN_PANORAMA|PFSENSE|AZION|FIREEYE_PX|OPNSENSE|CISCO_FWSM|FORTINET_FORTIWEB|BARRACUDA_WAF|SYMANTEC_WSS|MENLO_SECURITY|DIGITALARTS_IFILTER|WEBMARSHAL|UMBRELLA_IP|AWS_SECURITY_HUB|EXTRAHOP|GUARDDUTY|MICROSOFT_ATA|ORCA|OSSEC|SURICATA_EVE|VMWARE_TANZU/ nocase
$event.principal.ip in cidr %PCI_Network_Ranges
or $event.principal.asset.ip in cidr %PCI_Network_Ranges
outcome:
$Count = count($event.network.direction)
按位置划分的前 10 大目的地流量
$event.metadata.log_type = /ROUTER|SWITCH|DHCP|PROXY|NETWORK|VPN|FIREWALL|_FLOW|VPC|WIRELESS|IPS|IDS|ARUBA_EDGECONNECT_SDWAN|ARUBA_SWITCH|CISCO_APIC|CISCO_CALL_MANAGER|CISCO_DNAC|CISCO_ESTREAMER|CISCO_IOS|CISCO_PRIME|EFFICIENTIP_DDI|EXTREME_SWITCH|FORTINET_FORTIDDOS|FORTINET_FORTIMANAGER|ARUBA_CENTRAL|JUNIPER_JUNOS|JUNIPER_MIST|JUNIPER_SDWAN|NAGIOS|ARBOR_EDGE_DEFENSE|MICROSOFT_NPS|STEELHEAD|SHRUBBERY_TACACS|TRENDMICRO_DDI|VMWARE_NSX|WINDOWS_NET_POLICY_SERVER|ZYWALL|IMPERVA_FLEXPROTECT|PAN_IOT|NOZOMI_GUARDIAN|SURICATA_EVE|UMBRELLA_DNS|WINDOWS_SYSMON|COHESITY|RUBRIK|CISCO_MERAKI|CLAROTY_EMC|CLAROTY_CTD|HONEYD|AIRWATCH|IMPERVA_SECURESPHERE|SECURELINK|WALLIX_BASTION|CHECKPOINT_HARMONY|UNIFI_AP|DIGI_MODEMS|DESYNOVA_CONTIDO|CLOUDGENIX_SDWAN|JUNIPER_MX|SAP_WEBDISP|ADVA_FSP|HP_PROCURVE|VYOS|RSA_SECURID|HCNET_ACCOUNT_ADAPTER|INFOBLOX|VITALQIP|ASSET_STATIC_IP|BLUECAT_DDI|TWINGATE|SYMANTEC_VIP_AUTHHUB|ZSCALER_DECEPTION|BROCADE_SERVERIRON|KEMP_LOADBALANCER|A10_LOAD_BALANCER|AWS_ELB|F5_BIGIP_LTM|RADWARE_ALTEON|CITRIX_NETSCALER|AKAMAI_CLOUD_MONITOR|CISCO_ACE|GCP_LOADBALANCING|KERIOCONTROL|EXTRAHOP|NETFILTER_IPTABLES|CISCO_UMBRELLA_AUDIT|F5_AFM|NUTANIX_PRISM|SANGFOR_NGAF|VERCEL_WAF|PEPLINK_FW|NETDOCUMENTS|PAN_PANORAMA|PFSENSE|AZION|FIREEYE_PX|OPNSENSE|CISCO_FWSM|FORTINET_FORTIWEB|BARRACUDA_WAF|SYMANTEC_WSS|MENLO_SECURITY|DIGITALARTS_IFILTER|WEBMARSHAL|UMBRELLA_IP|AWS_SECURITY_HUB|EXTRAHOP|GUARDDUTY|MICROSOFT_ATA|ORCA|OSSEC|SURICATA_EVE|VMWARE_TANZU/ nocase
$event.principal.ip in cidr %PCI_Network_Ranges
or $event.principal.asset.ip in cidr %PCI_Network_Ranges
$event.target.ip != ""
$Countries = $event.target.location.country_or_region
$Latitude = $event.target.location.region_coordinates.latitude
$Longitude = $event.target.location.region_coordinates.longitude
$Countries != ""
match:
$Countries, $Latitude, $Longitude
outcome:
$Count = count($event.target.ip)
limit:
10
按前 10 个目标平台划分的流量
$event.metadata.log_type = /ROUTER|SWITCH|DHCP|PROXY|NETWORK|VPN|FIREWALL|_FLOW|VPC|WIRELESS|IPS|IDS|ARUBA_EDGECONNECT_SDWAN|ARUBA_SWITCH|CISCO_APIC|CISCO_CALL_MANAGER|CISCO_DNAC|CISCO_ESTREAMER|CISCO_IOS|CISCO_PRIME|EFFICIENTIP_DDI|EXTREME_SWITCH|FORTINET_FORTIDDOS|FORTINET_FORTIMANAGER|ARUBA_CENTRAL|JUNIPER_JUNOS|JUNIPER_MIST|JUNIPER_SDWAN|NAGIOS|ARBOR_EDGE_DEFENSE|MICROSOFT_NPS|STEELHEAD|SHRUBBERY_TACACS|TRENDMICRO_DDI|VMWARE_NSX|WINDOWS_NET_POLICY_SERVER|ZYWALL|IMPERVA_FLEXPROTECT|PAN_IOT|NOZOMI_GUARDIAN|SURICATA_EVE|UMBRELLA_DNS|WINDOWS_SYSMON|COHESITY|RUBRIK|CISCO_MERAKI|CLAROTY_EMC|CLAROTY_CTD|HONEYD|AIRWATCH|IMPERVA_SECURESPHERE|SECURELINK|WALLIX_BASTION|CHECKPOINT_HARMONY|UNIFI_AP|DIGI_MODEMS|DESYNOVA_CONTIDO|CLOUDGENIX_SDWAN|JUNIPER_MX|SAP_WEBDISP|ADVA_FSP|HP_PROCURVE|VYOS|RSA_SECURID|HCNET_ACCOUNT_ADAPTER|INFOBLOX|VITALQIP|ASSET_STATIC_IP|BLUECAT_DDI|TWINGATE|SYMANTEC_VIP_AUTHHUB|ZSCALER_DECEPTION|BROCADE_SERVERIRON|KEMP_LOADBALANCER|A10_LOAD_BALANCER|AWS_ELB|F5_BIGIP_LTM|RADWARE_ALTEON|CITRIX_NETSCALER|AKAMAI_CLOUD_MONITOR|CISCO_ACE|GCP_LOADBALANCING|KERIOCONTROL|EXTRAHOP|NETFILTER_IPTABLES|CISCO_UMBRELLA_AUDIT|F5_AFM|NUTANIX_PRISM|SANGFOR_NGAF|VERCEL_WAF|PEPLINK_FW|NETDOCUMENTS|PAN_PANORAMA|PFSENSE|AZION|FIREEYE_PX|OPNSENSE|CISCO_FWSM|FORTINET_FORTIWEB|BARRACUDA_WAF|SYMANTEC_WSS|MENLO_SECURITY|DIGITALARTS_IFILTER|WEBMARSHAL|UMBRELLA_IP|AWS_SECURITY_HUB|EXTRAHOP|GUARDDUTY|MICROSOFT_ATA|ORCA|OSSEC|SURICATA_EVE|VMWARE_TANZU/ nocase
$event.principal.ip in cidr %PCI_Network_Ranges
or $event.principal.asset.ip in cidr %PCI_Network_Ranges
$IP_Address = $event.target.ip
match:
$IP_Address
outcome:
$Count = count($event.metadata.id)
order:
$Count desc
limit:
10
触发次数最多的 10 条网络规则
$event.metadata.log_type = /ROUTER|SWITCH|DHCP|PROXY|NETWORK|VPN|FIREWALL|_FLOW|VPC|WIRELESS|IPS|IDS|ARUBA_EDGECONNECT_SDWAN|ARUBA_SWITCH|CISCO_APIC|CISCO_CALL_MANAGER|CISCO_DNAC|CISCO_ESTREAMER|CISCO_IOS|CISCO_PRIME|EFFICIENTIP_DDI|EXTREME_SWITCH|FORTINET_FORTIDDOS|FORTINET_FORTIMANAGER|ARUBA_CENTRAL|JUNIPER_JUNOS|JUNIPER_MIST|JUNIPER_SDWAN|NAGIOS|ARBOR_EDGE_DEFENSE|MICROSOFT_NPS|STEELHEAD|SHRUBBERY_TACACS|TRENDMICRO_DDI|VMWARE_NSX|WINDOWS_NET_POLICY_SERVER|ZYWALL|IMPERVA_FLEXPROTECT|PAN_IOT|NOZOMI_GUARDIAN|SURICATA_EVE|UMBRELLA_DNS|WINDOWS_SYSMON|COHESITY|RUBRIK|CISCO_MERAKI|CLAROTY_EMC|CLAROTY_CTD|HONEYD|AIRWATCH|IMPERVA_SECURESPHERE|SECURELINK|WALLIX_BASTION|CHECKPOINT_HARMONY|UNIFI_AP|DIGI_MODEMS|DESYNOVA_CONTIDO|CLOUDGENIX_SDWAN|JUNIPER_MX|SAP_WEBDISP|ADVA_FSP|HP_PROCURVE|VYOS|RSA_SECURID|HCNET_ACCOUNT_ADAPTER|INFOBLOX|VITALQIP|ASSET_STATIC_IP|BLUECAT_DDI|TWINGATE|SYMANTEC_VIP_AUTHHUB|ZSCALER_DECEPTION|BROCADE_SERVERIRON|KEMP_LOADBALANCER|A10_LOAD_BALANCER|AWS_ELB|F5_BIGIP_LTM|RADWARE_ALTEON|CITRIX_NETSCALER|AKAMAI_CLOUD_MONITOR|CISCO_ACE|GCP_LOADBALANCING|KERIOCONTROL|EXTRAHOP|NETFILTER_IPTABLES|CISCO_UMBRELLA_AUDIT|F5_AFM|NUTANIX_PRISM|SANGFOR_NGAF|VERCEL_WAF|PEPLINK_FW|NETDOCUMENTS|PAN_PANORAMA|PFSENSE|AZION|FIREEYE_PX|OPNSENSE|CISCO_FWSM|FORTINET_FORTIWEB|BARRACUDA_WAF|SYMANTEC_WSS|MENLO_SECURITY|DIGITALARTS_IFILTER|WEBMARSHAL|UMBRELLA_IP|AWS_SECURITY_HUB|EXTRAHOP|GUARDDUTY|MICROSOFT_ATA|ORCA|OSSEC|SURICATA_EVE|VMWARE_TANZU/ nocase
$event.principal.ip in cidr %PCI_Network_Ranges
or $event.principal.asset.ip in cidr %PCI_Network_Ranges
$event.metadata.event_type = "NETWORK_UNCATEGORIZED"
or $event.metadata.event_type = "NETWORK_FLOW"
or $event.metadata.event_type = "NETWORK_CONNECTION"
or $event.metadata.event_type = "NETWORK_FTP"
or $event.metadata.event_type = "NETWORK_DHCP"
or $event.metadata.event_type = "NETWORK_DNS"
or $event.metadata.event_type = "NETWORK_HTTP"
or $event.metadata.event_type = "NETWORK_SMTP"
or $event.metadata.event_type = "SCAN_NETWORK"
$Log_Type = $event.metadata.log_type
$Event_Type = $event.metadata.event_type
$Product_Network_Event = $event.security_result.rule_name
$Direction = $event.network.direction
$Product_Network_Event != ""
match:
$Event_Type, $Log_Type, $Direction, $Product_Network_Event
outcome:
$Count = count_distinct($event.metadata.id)
order:
$Count desc
limit:
10
按前 10 个目标端口划分的流量
$event.metadata.log_type = /ROUTER|SWITCH|DHCP|PROXY|NETWORK|VPN|FIREWALL|_FLOW|VPC|WIRELESS|IPS|IDS|ARUBA_EDGECONNECT_SDWAN|ARUBA_SWITCH|CISCO_APIC|CISCO_CALL_MANAGER|CISCO_DNAC|CISCO_ESTREAMER|CISCO_IOS|CISCO_PRIME|EFFICIENTIP_DDI|EXTREME_SWITCH|FORTINET_FORTIDDOS|FORTINET_FORTIMANAGER|ARUBA_CENTRAL|JUNIPER_JUNOS|JUNIPER_MIST|JUNIPER_SDWAN|NAGIOS|ARBOR_EDGE_DEFENSE|MICROSOFT_NPS|STEELHEAD|SHRUBBERY_TACACS|TRENDMICRO_DDI|VMWARE_NSX|WINDOWS_NET_POLICY_SERVER|ZYWALL|IMPERVA_FLEXPROTECT|PAN_IOT|NOZOMI_GUARDIAN|SURICATA_EVE|UMBRELLA_DNS|WINDOWS_SYSMON|COHESITY|RUBRIK|CISCO_MERAKI|CLAROTY_EMC|CLAROTY_CTD|HONEYD|AIRWATCH|IMPERVA_SECURESPHERE|SECURELINK|WALLIX_BASTION|CHECKPOINT_HARMONY|UNIFI_AP|DIGI_MODEMS|DESYNOVA_CONTIDO|CLOUDGENIX_SDWAN|JUNIPER_MX|SAP_WEBDISP|ADVA_FSP|HP_PROCURVE|VYOS|RSA_SECURID|HCNET_ACCOUNT_ADAPTER|INFOBLOX|VITALQIP|ASSET_STATIC_IP|BLUECAT_DDI|TWINGATE|SYMANTEC_VIP_AUTHHUB|ZSCALER_DECEPTION|BROCADE_SERVERIRON|KEMP_LOADBALANCER|A10_LOAD_BALANCER|AWS_ELB|F5_BIGIP_LTM|RADWARE_ALTEON|CITRIX_NETSCALER|AKAMAI_CLOUD_MONITOR|CISCO_ACE|GCP_LOADBALANCING|KERIOCONTROL|EXTRAHOP|NETFILTER_IPTABLES|CISCO_UMBRELLA_AUDIT|F5_AFM|NUTANIX_PRISM|SANGFOR_NGAF|VERCEL_WAF|PEPLINK_FW|NETDOCUMENTS|PAN_PANORAMA|PFSENSE|AZION|FIREEYE_PX|OPNSENSE|CISCO_FWSM|FORTINET_FORTIWEB|BARRACUDA_WAF|SYMANTEC_WSS|MENLO_SECURITY|DIGITALARTS_IFILTER|WEBMARSHAL|UMBRELLA_IP|AWS_SECURITY_HUB|EXTRAHOP|GUARDDUTY|MICROSOFT_ATA|ORCA|OSSEC|SURICATA_EVE|VMWARE_TANZU/ nocase
$event.principal.ip in cidr %PCI_Network_Ranges
or $event.principal.asset.ip in cidr %PCI_Network_Ranges
$Ports = strings.concat($event.target.port, " ")
match:
$Ports
outcome:
$Count = count($event.metadata.id)
order:
$Count desc
limit:
10
10 大网络活动
$event.metadata.log_type = /ROUTER|SWITCH|DHCP|PROXY|NETWORK|VPN|FIREWALL|_FLOW|VPC|WIRELESS|IPS|IDS|ARUBA_EDGECONNECT_SDWAN|ARUBA_SWITCH|CISCO_APIC|CISCO_CALL_MANAGER|CISCO_DNAC|CISCO_ESTREAMER|CISCO_IOS|CISCO_PRIME|EFFICIENTIP_DDI|EXTREME_SWITCH|FORTINET_FORTIDDOS|FORTINET_FORTIMANAGER|ARUBA_CENTRAL|JUNIPER_JUNOS|JUNIPER_MIST|JUNIPER_SDWAN|NAGIOS|ARBOR_EDGE_DEFENSE|MICROSOFT_NPS|STEELHEAD|SHRUBBERY_TACACS|TRENDMICRO_DDI|VMWARE_NSX|WINDOWS_NET_POLICY_SERVER|ZYWALL|IMPERVA_FLEXPROTECT|PAN_IOT|NOZOMI_GUARDIAN|SURICATA_EVE|UMBRELLA_DNS|WINDOWS_SYSMON|COHESITY|RUBRIK|CISCO_MERAKI|CLAROTY_EMC|CLAROTY_CTD|HONEYD|AIRWATCH|IMPERVA_SECURESPHERE|SECURELINK|WALLIX_BASTION|CHECKPOINT_HARMONY|UNIFI_AP|DIGI_MODEMS|DESYNOVA_CONTIDO|CLOUDGENIX_SDWAN|JUNIPER_MX|SAP_WEBDISP|ADVA_FSP|HP_PROCURVE|VYOS|RSA_SECURID|HCNET_ACCOUNT_ADAPTER|INFOBLOX|VITALQIP|ASSET_STATIC_IP|BLUECAT_DDI|TWINGATE|SYMANTEC_VIP_AUTHHUB|ZSCALER_DECEPTION|BROCADE_SERVERIRON|KEMP_LOADBALANCER|A10_LOAD_BALANCER|AWS_ELB|F5_BIGIP_LTM|RADWARE_ALTEON|CITRIX_NETSCALER|AKAMAI_CLOUD_MONITOR|CISCO_ACE|GCP_LOADBALANCING|KERIOCONTROL|EXTRAHOP|NETFILTER_IPTABLES|CISCO_UMBRELLA_AUDIT|F5_AFM|NUTANIX_PRISM|SANGFOR_NGAF|VERCEL_WAF|PEPLINK_FW|NETDOCUMENTS|PAN_PANORAMA|PFSENSE|AZION|FIREEYE_PX|OPNSENSE|CISCO_FWSM|FORTINET_FORTIWEB|BARRACUDA_WAF|SYMANTEC_WSS|MENLO_SECURITY|DIGITALARTS_IFILTER|WEBMARSHAL|UMBRELLA_IP|AWS_SECURITY_HUB|EXTRAHOP|GUARDDUTY|MICROSOFT_ATA|ORCA|OSSEC|SURICATA_EVE|VMWARE_TANZU/ nocase
$event.principal.ip in cidr %PCI_Network_Ranges
or $event.principal.asset.ip in cidr %PCI_Network_Ranges
$Log_Type = $event.metadata.log_type
$Event_Type = $event.metadata.event_type
$Security_Action = $event.security_result.action
match:
$Event_Type, $Log_Type, $Security_Action
outcome:
$Count = count($event.metadata.event_type)
order:
$Count desc
limit:
10
港口活动摘要
$event.metadata.log_type = /ROUTER|SWITCH|DHCP|PROXY|NETWORK|VPN|FIREWALL|_FLOW|VPC|WIRELESS|IPS|IDS|ARUBA_EDGECONNECT_SDWAN|ARUBA_SWITCH|CISCO_APIC|CISCO_CALL_MANAGER|CISCO_DNAC|CISCO_ESTREAMER|CISCO_IOS|CISCO_PRIME|EFFICIENTIP_DDI|EXTREME_SWITCH|FORTINET_FORTIDDOS|FORTINET_FORTIMANAGER|ARUBA_CENTRAL|JUNIPER_JUNOS|JUNIPER_MIST|JUNIPER_SDWAN|NAGIOS|ARBOR_EDGE_DEFENSE|MICROSOFT_NPS|STEELHEAD|SHRUBBERY_TACACS|TRENDMICRO_DDI|VMWARE_NSX|WINDOWS_NET_POLICY_SERVER|ZYWALL|IMPERVA_FLEXPROTECT|PAN_IOT|NOZOMI_GUARDIAN|SURICATA_EVE|UMBRELLA_DNS|WINDOWS_SYSMON|COHESITY|RUBRIK|CISCO_MERAKI|CLAROTY_EMC|CLAROTY_CTD|HONEYD|AIRWATCH|IMPERVA_SECURESPHERE|SECURELINK|WALLIX_BASTION|CHECKPOINT_HARMONY|UNIFI_AP|DIGI_MODEMS|DESYNOVA_CONTIDO|CLOUDGENIX_SDWAN|JUNIPER_MX|SAP_WEBDISP|ADVA_FSP|HP_PROCURVE|VYOS|RSA_SECURID|HCNET_ACCOUNT_ADAPTER|INFOBLOX|VITALQIP|ASSET_STATIC_IP|BLUECAT_DDI|TWINGATE|SYMANTEC_VIP_AUTHHUB|ZSCALER_DECEPTION|BROCADE_SERVERIRON|KEMP_LOADBALANCER|A10_LOAD_BALANCER|AWS_ELB|F5_BIGIP_LTM|RADWARE_ALTEON|CITRIX_NETSCALER|AKAMAI_CLOUD_MONITOR|CISCO_ACE|GCP_LOADBALANCING|KERIOCONTROL|EXTRAHOP|NETFILTER_IPTABLES|CISCO_UMBRELLA_AUDIT|F5_AFM|NUTANIX_PRISM|SANGFOR_NGAF|VERCEL_WAF|PEPLINK_FW|NETDOCUMENTS|PAN_PANORAMA|PFSENSE|AZION|FIREEYE_PX|OPNSENSE|CISCO_FWSM|FORTINET_FORTIWEB|BARRACUDA_WAF|SYMANTEC_WSS|MENLO_SECURITY|DIGITALARTS_IFILTER|WEBMARSHAL|UMBRELLA_IP|AWS_SECURITY_HUB|EXTRAHOP|GUARDDUTY|MICROSOFT_ATA|ORCA|OSSEC|SURICATA_EVE|VMWARE_TANZU/ nocase
$event.principal.ip in cidr %PCI_Network_Ranges
or $event.principal.asset.ip in cidr %PCI_Network_Ranges
$Source_Port = $event.principal.port
$Target_Port = $event.target.port
$Direction = $event.network.direction
$Event_Type = $event.metadata.event_type
match:
$Source_Port, $Direction, $Target_Port, $Event_Type
outcome:
$Count = count($event.metadata.id)
order:
$Count desc
limit:
50
按前 10 大协议划分的流量
$event.metadata.log_type = /ROUTER|SWITCH|DHCP|PROXY|NETWORK|VPN|FIREWALL|_FLOW|VPC|WIRELESS|IPS|IDS|ARUBA_EDGECONNECT_SDWAN|ARUBA_SWITCH|CISCO_APIC|CISCO_CALL_MANAGER|CISCO_DNAC|CISCO_ESTREAMER|CISCO_IOS|CISCO_PRIME|EFFICIENTIP_DDI|EXTREME_SWITCH|FORTINET_FORTIDDOS|FORTINET_FORTIMANAGER|ARUBA_CENTRAL|JUNIPER_JUNOS|JUNIPER_MIST|JUNIPER_SDWAN|NAGIOS|ARBOR_EDGE_DEFENSE|MICROSOFT_NPS|STEELHEAD|SHRUBBERY_TACACS|TRENDMICRO_DDI|VMWARE_NSX|WINDOWS_NET_POLICY_SERVER|ZYWALL|IMPERVA_FLEXPROTECT|PAN_IOT|NOZOMI_GUARDIAN|SURICATA_EVE|UMBRELLA_DNS|WINDOWS_SYSMON|COHESITY|RUBRIK|CISCO_MERAKI|CLAROTY_EMC|CLAROTY_CTD|HONEYD|AIRWATCH|IMPERVA_SECURESPHERE|SECURELINK|WALLIX_BASTION|CHECKPOINT_HARMONY|UNIFI_AP|DIGI_MODEMS|DESYNOVA_CONTIDO|CLOUDGENIX_SDWAN|JUNIPER_MX|SAP_WEBDISP|ADVA_FSP|HP_PROCURVE|VYOS|RSA_SECURID|HCNET_ACCOUNT_ADAPTER|INFOBLOX|VITALQIP|ASSET_STATIC_IP|BLUECAT_DDI|TWINGATE|SYMANTEC_VIP_AUTHHUB|ZSCALER_DECEPTION|BROCADE_SERVERIRON|KEMP_LOADBALANCER|A10_LOAD_BALANCER|AWS_ELB|F5_BIGIP_LTM|RADWARE_ALTEON|CITRIX_NETSCALER|AKAMAI_CLOUD_MONITOR|CISCO_ACE|GCP_LOADBALANCING|KERIOCONTROL|EXTRAHOP|NETFILTER_IPTABLES|CISCO_UMBRELLA_AUDIT|F5_AFM|NUTANIX_PRISM|SANGFOR_NGAF|VERCEL_WAF|PEPLINK_FW|NETDOCUMENTS|PAN_PANORAMA|PFSENSE|AZION|FIREEYE_PX|OPNSENSE|CISCO_FWSM|FORTINET_FORTIWEB|BARRACUDA_WAF|SYMANTEC_WSS|MENLO_SECURITY|DIGITALARTS_IFILTER|WEBMARSHAL|UMBRELLA_IP|AWS_SECURITY_HUB|EXTRAHOP|GUARDDUTY|MICROSOFT_ATA|ORCA|OSSEC|SURICATA_EVE|VMWARE_TANZU/ nocase
$event.principal.ip in cidr %PCI_Network_Ranges
or $event.principal.asset.ip in cidr %PCI_Network_Ranges
$Log_Type = $event.metadata.log_type
$Protocol = $event.network.ip_protocol
$Direction = $event.network.direction
match:
$Protocol, $Direction
outcome:
$Count = count($event.metadata.id)
order:
$Count desc
limit:
10
随时间变化的网络数据处理量（发送的字节数）
$event.metadata.log_type = /ROUTER|SWITCH|DHCP|PROXY|NETWORK|VPN|FIREWALL|_FLOW|VPC|WIRELESS|IPS|IDS|ARUBA_EDGECONNECT_SDWAN|ARUBA_SWITCH|CISCO_APIC|CISCO_CALL_MANAGER|CISCO_DNAC|CISCO_ESTREAMER|CISCO_IOS|CISCO_PRIME|EFFICIENTIP_DDI|EXTREME_SWITCH|FORTINET_FORTIDDOS|FORTINET_FORTIMANAGER|ARUBA_CENTRAL|JUNIPER_JUNOS|JUNIPER_MIST|JUNIPER_SDWAN|NAGIOS|ARBOR_EDGE_DEFENSE|MICROSOFT_NPS|STEELHEAD|SHRUBBERY_TACACS|TRENDMICRO_DDI|VMWARE_NSX|WINDOWS_NET_POLICY_SERVER|ZYWALL|IMPERVA_FLEXPROTECT|PAN_IOT|NOZOMI_GUARDIAN|SURICATA_EVE|UMBRELLA_DNS|WINDOWS_SYSMON|COHESITY|RUBRIK|CISCO_MERAKI|CLAROTY_EMC|CLAROTY_CTD|HONEYD|AIRWATCH|IMPERVA_SECURESPHERE|SECURELINK|WALLIX_BASTION|CHECKPOINT_HARMONY|UNIFI_AP|DIGI_MODEMS|DESYNOVA_CONTIDO|CLOUDGENIX_SDWAN|JUNIPER_MX|SAP_WEBDISP|ADVA_FSP|HP_PROCURVE|VYOS|RSA_SECURID|HCNET_ACCOUNT_ADAPTER|INFOBLOX|VITALQIP|ASSET_STATIC_IP|BLUECAT_DDI|TWINGATE|SYMANTEC_VIP_AUTHHUB|ZSCALER_DECEPTION|BROCADE_SERVERIRON|KEMP_LOADBALANCER|A10_LOAD_BALANCER|AWS_ELB|F5_BIGIP_LTM|RADWARE_ALTEON|CITRIX_NETSCALER|AKAMAI_CLOUD_MONITOR|CISCO_ACE|GCP_LOADBALANCING|KERIOCONTROL|EXTRAHOP|NETFILTER_IPTABLES|CISCO_UMBRELLA_AUDIT|F5_AFM|NUTANIX_PRISM|SANGFOR_NGAF|VERCEL_WAF|PEPLINK_FW|NETDOCUMENTS|PAN_PANORAMA|PFSENSE|AZION|FIREEYE_PX|OPNSENSE|CISCO_FWSM|FORTINET_FORTIWEB|BARRACUDA_WAF|SYMANTEC_WSS|MENLO_SECURITY|DIGITALARTS_IFILTER|WEBMARSHAL|UMBRELLA_IP|AWS_SECURITY_HUB|EXTRAHOP|GUARDDUTY|MICROSOFT_ATA|ORCA|OSSEC|SURICATA_EVE|VMWARE_TANZU/ nocase
$event.principal.ip in cidr %PCI_Network_Ranges
or $event.principal.asset.ip in cidr %PCI_Network_Ranges
$Log_Type = $event.metadata.log_type
$Date = timestamp.get_date($event.metadata.event_timestamp.seconds)
match:
$Date, $Log_Type
outcome:
$Total_Bytes = sum($event.network.sent_bytes)
$GB = math.ceil($Total_Bytes / 1073741824)
order:
$Date asc
limit:
50
随时间变化的网络数据处理量（接收的字节数）
$event.metadata.log_type = /ROUTER|SWITCH|DHCP|PROXY|NETWORK|VPN|FIREWALL|_FLOW|VPC|WIRELESS|IPS|IDS|ARUBA_EDGECONNECT_SDWAN|ARUBA_SWITCH|CISCO_APIC|CISCO_CALL_MANAGER|CISCO_DNAC|CISCO_ESTREAMER|CISCO_IOS|CISCO_PRIME|EFFICIENTIP_DDI|EXTREME_SWITCH|FORTINET_FORTIDDOS|FORTINET_FORTIMANAGER|ARUBA_CENTRAL|JUNIPER_JUNOS|JUNIPER_MIST|JUNIPER_SDWAN|NAGIOS|ARBOR_EDGE_DEFENSE|MICROSOFT_NPS|STEELHEAD|SHRUBBERY_TACACS|TRENDMICRO_DDI|VMWARE_NSX|WINDOWS_NET_POLICY_SERVER|ZYWALL|IMPERVA_FLEXPROTECT|PAN_IOT|NOZOMI_GUARDIAN|SURICATA_EVE|UMBRELLA_DNS|WINDOWS_SYSMON|COHESITY|RUBRIK|CISCO_MERAKI|CLAROTY_EMC|CLAROTY_CTD|HONEYD|AIRWATCH|IMPERVA_SECURESPHERE|SECURELINK|WALLIX_BASTION|CHECKPOINT_HARMONY|UNIFI_AP|DIGI_MODEMS|DESYNOVA_CONTIDO|CLOUDGENIX_SDWAN|JUNIPER_MX|SAP_WEBDISP|ADVA_FSP|HP_PROCURVE|VYOS|RSA_SECURID|HCNET_ACCOUNT_ADAPTER|INFOBLOX|VITALQIP|ASSET_STATIC_IP|BLUECAT_DDI|TWINGATE|SYMANTEC_VIP_AUTHHUB|ZSCALER_DECEPTION|BROCADE_SERVERIRON|KEMP_LOADBALANCER|A10_LOAD_BALANCER|AWS_ELB|F5_BIGIP_LTM|RADWARE_ALTEON|CITRIX_NETSCALER|AKAMAI_CLOUD_MONITOR|CISCO_ACE|GCP_LOADBALANCING|KERIOCONTROL|EXTRAHOP|NETFILTER_IPTABLES|CISCO_UMBRELLA_AUDIT|F5_AFM|NUTANIX_PRISM|SANGFOR_NGAF|VERCEL_WAF|PEPLINK_FW|NETDOCUMENTS|PAN_PANORAMA|PFSENSE|AZION|FIREEYE_PX|OPNSENSE|CISCO_FWSM|FORTINET_FORTIWEB|BARRACUDA_WAF|SYMANTEC_WSS|MENLO_SECURITY|DIGITALARTS_IFILTER|WEBMARSHAL|UMBRELLA_IP|AWS_SECURITY_HUB|EXTRAHOP|GUARDDUTY|MICROSOFT_ATA|ORCA|OSSEC|SURICATA_EVE|VMWARE_TANZU/ nocase
$event.principal.ip in cidr %PCI_Network_Ranges
or $event.principal.asset.ip in cidr %PCI_Network_Ranges
$Log_Type = $event.metadata.log_type
$Date = timestamp.get_date($event.metadata.event_timestamp.seconds)
match:
$Date, $Log_Type
outcome:
$Total_Bytes = sum($event.network.received_bytes)
$GB = math.ceil($Total_Bytes / 1073741824)
order:
$Date asc
limit:
50
不同时间段的网络流量
$event.metadata.log_type = /ROUTER|SWITCH|DHCP|PROXY|NETWORK|VPN|FIREWALL|_FLOW|VPC|WIRELESS|IPS|IDS|ARUBA_EDGECONNECT_SDWAN|ARUBA_SWITCH|CISCO_APIC|CISCO_CALL_MANAGER|CISCO_DNAC|CISCO_ESTREAMER|CISCO_IOS|CISCO_PRIME|EFFICIENTIP_DDI|EXTREME_SWITCH|FORTINET_FORTIDDOS|FORTINET_FORTIMANAGER|ARUBA_CENTRAL|JUNIPER_JUNOS|JUNIPER_MIST|JUNIPER_SDWAN|NAGIOS|ARBOR_EDGE_DEFENSE|MICROSOFT_NPS|STEELHEAD|SHRUBBERY_TACACS|TRENDMICRO_DDI|VMWARE_NSX|WINDOWS_NET_POLICY_SERVER|ZYWALL|IMPERVA_FLEXPROTECT|PAN_IOT|NOZOMI_GUARDIAN|SURICATA_EVE|UMBRELLA_DNS|WINDOWS_SYSMON|COHESITY|RUBRIK|CISCO_MERAKI|CLAROTY_EMC|CLAROTY_CTD|HONEYD|AIRWATCH|IMPERVA_SECURESPHERE|SECURELINK|WALLIX_BASTION|CHECKPOINT_HARMONY|UNIFI_AP|DIGI_MODEMS|DESYNOVA_CONTIDO|CLOUDGENIX_SDWAN|JUNIPER_MX|SAP_WEBDISP|ADVA_FSP|HP_PROCURVE|VYOS|RSA_SECURID|HCNET_ACCOUNT_ADAPTER|INFOBLOX|VITALQIP|ASSET_STATIC_IP|BLUECAT_DDI|TWINGATE|SYMANTEC_VIP_AUTHHUB|ZSCALER_DECEPTION|BROCADE_SERVERIRON|KEMP_LOADBALANCER|A10_LOAD_BALANCER|AWS_ELB|F5_BIGIP_LTM|RADWARE_ALTEON|CITRIX_NETSCALER|AKAMAI_CLOUD_MONITOR|CISCO_ACE|GCP_LOADBALANCING|KERIOCONTROL|EXTRAHOP|NETFILTER_IPTABLES|CISCO_UMBRELLA_AUDIT|F5_AFM|NUTANIX_PRISM|SANGFOR_NGAF|VERCEL_WAF|PEPLINK_FW|NETDOCUMENTS|PAN_PANORAMA|PFSENSE|AZION|FIREEYE_PX|OPNSENSE|CISCO_FWSM|FORTINET_FORTIWEB|BARRACUDA_WAF|SYMANTEC_WSS|MENLO_SECURITY|DIGITALARTS_IFILTER|WEBMARSHAL|UMBRELLA_IP|AWS_SECURITY_HUB|EXTRAHOP|GUARDDUTY|MICROSOFT_ATA|ORCA|OSSEC|SURICATA_EVE|VMWARE_TANZU/ nocase
$event.principal.ip in cidr %PCI_Network_Ranges
or $event.principal.asset.ip in cidr %PCI_Network_Ranges
$Direction = $event.network.direction
$Date = timestamp.get_date($event.metadata.event_timestamp.seconds)
match:
$Date, $Direction
outcome:
$Count = count($event.metadata.id)
order:
$Date asc
按前 10 个来源端口划分的流量
$event.metadata.log_type = /ROUTER|SWITCH|DHCP|PROXY|NETWORK|VPN|FIREWALL|_FLOW|VPC|WIRELESS|IPS|IDS|ARUBA_EDGECONNECT_SDWAN|ARUBA_SWITCH|CISCO_APIC|CISCO_CALL_MANAGER|CISCO_DNAC|CISCO_ESTREAMER|CISCO_IOS|CISCO_PRIME|EFFICIENTIP_DDI|EXTREME_SWITCH|FORTINET_FORTIDDOS|FORTINET_FORTIMANAGER|ARUBA_CENTRAL|JUNIPER_JUNOS|JUNIPER_MIST|JUNIPER_SDWAN|NAGIOS|ARBOR_EDGE_DEFENSE|MICROSOFT_NPS|STEELHEAD|SHRUBBERY_TACACS|TRENDMICRO_DDI|VMWARE_NSX|WINDOWS_NET_POLICY_SERVER|ZYWALL|IMPERVA_FLEXPROTECT|PAN_IOT|NOZOMI_GUARDIAN|SURICATA_EVE|UMBRELLA_DNS|WINDOWS_SYSMON|COHESITY|RUBRIK|CISCO_MERAKI|CLAROTY_EMC|CLAROTY_CTD|HONEYD|AIRWATCH|IMPERVA_SECURESPHERE|SECURELINK|WALLIX_BASTION|CHECKPOINT_HARMONY|UNIFI_AP|DIGI_MODEMS|DESYNOVA_CONTIDO|CLOUDGENIX_SDWAN|JUNIPER_MX|SAP_WEBDISP|ADVA_FSP|HP_PROCURVE|VYOS|RSA_SECURID|HCNET_ACCOUNT_ADAPTER|INFOBLOX|VITALQIP|ASSET_STATIC_IP|BLUECAT_DDI|TWINGATE|SYMANTEC_VIP_AUTHHUB|ZSCALER_DECEPTION|BROCADE_SERVERIRON|KEMP_LOADBALANCER|A10_LOAD_BALANCER|AWS_ELB|F5_BIGIP_LTM|RADWARE_ALTEON|CITRIX_NETSCALER|AKAMAI_CLOUD_MONITOR|CISCO_ACE|GCP_LOADBALANCING|KERIOCONTROL|EXTRAHOP|NETFILTER_IPTABLES|CISCO_UMBRELLA_AUDIT|F5_AFM|NUTANIX_PRISM|SANGFOR_NGAF|VERCEL_WAF|PEPLINK_FW|NETDOCUMENTS|PAN_PANORAMA|PFSENSE|AZION|FIREEYE_PX|OPNSENSE|CISCO_FWSM|FORTINET_FORTIWEB|BARRACUDA_WAF|SYMANTEC_WSS|MENLO_SECURITY|DIGITALARTS_IFILTER|WEBMARSHAL|UMBRELLA_IP|AWS_SECURITY_HUB|EXTRAHOP|GUARDDUTY|MICROSOFT_ATA|ORCA|OSSEC|SURICATA_EVE|VMWARE_TANZU/ nocase
$event.principal.ip in cidr %PCI_Network_Ranges
or $event.principal.asset.ip in cidr %PCI_Network_Ranges
$Ports = strings.concat($event.principal.port, " ")
match:
$Ports
outcome:
$Count = count($event.metadata.id)
order:
$Count desc
limit:
10
网络资产数量
$event.metadata.log_type = /ROUTER|SWITCH|DHCP|PROXY|NETWORK|VPN|FIREWALL|_FLOW|VPC|WIRELESS|IPS|IDS|ARUBA_EDGECONNECT_SDWAN|ARUBA_SWITCH|CISCO_APIC|CISCO_CALL_MANAGER|CISCO_DNAC|CISCO_ESTREAMER|CISCO_IOS|CISCO_PRIME|EFFICIENTIP_DDI|EXTREME_SWITCH|FORTINET_FORTIDDOS|FORTINET_FORTIMANAGER|ARUBA_CENTRAL|JUNIPER_JUNOS|JUNIPER_MIST|JUNIPER_SDWAN|NAGIOS|ARBOR_EDGE_DEFENSE|MICROSOFT_NPS|STEELHEAD|SHRUBBERY_TACACS|TRENDMICRO_DDI|VMWARE_NSX|WINDOWS_NET_POLICY_SERVER|ZYWALL|IMPERVA_FLEXPROTECT|PAN_IOT|NOZOMI_GUARDIAN|SURICATA_EVE|UMBRELLA_DNS|WINDOWS_SYSMON|COHESITY|RUBRIK|CISCO_MERAKI|CLAROTY_EMC|CLAROTY_CTD|HONEYD|AIRWATCH|IMPERVA_SECURESPHERE|SECURELINK|WALLIX_BASTION|CHECKPOINT_HARMONY|UNIFI_AP|DIGI_MODEMS|DESYNOVA_CONTIDO|CLOUDGENIX_SDWAN|JUNIPER_MX|SAP_WEBDISP|ADVA_FSP|HP_PROCURVE|VYOS|RSA_SECURID|HCNET_ACCOUNT_ADAPTER|INFOBLOX|VITALQIP|ASSET_STATIC_IP|BLUECAT_DDI|TWINGATE|SYMANTEC_VIP_AUTHHUB|ZSCALER_DECEPTION|BROCADE_SERVERIRON|KEMP_LOADBALANCER|A10_LOAD_BALANCER|AWS_ELB|F5_BIGIP_LTM|RADWARE_ALTEON|CITRIX_NETSCALER|AKAMAI_CLOUD_MONITOR|CISCO_ACE|GCP_LOADBALANCING|KERIOCONTROL|EXTRAHOP|NETFILTER_IPTABLES|CISCO_UMBRELLA_AUDIT|F5_AFM|NUTANIX_PRISM|SANGFOR_NGAF|VERCEL_WAF|PEPLINK_FW|NETDOCUMENTS|PAN_PANORAMA|PFSENSE|AZION|FIREEYE_PX|OPNSENSE|CISCO_FWSM|FORTINET_FORTIWEB|BARRACUDA_WAF|SYMANTEC_WSS|MENLO_SECURITY|DIGITALARTS_IFILTER|WEBMARSHAL|UMBRELLA_IP|AWS_SECURITY_HUB|EXTRAHOP|GUARDDUTY|MICROSOFT_ATA|ORCA|OSSEC|SURICATA_EVE|VMWARE_TANZU/ nocase
$event.principal.ip in cidr %PCI_Network_Ranges
or $event.principal.asset.ip in cidr %PCI_Network_Ranges
$Network_Asset = strings.coalesce($event.principal.ip, $event.principal.asset.ip)
outcome:
$Count = count_distinct(strings.coalesce($event.principal.ip, $event.principal.asset.ip))
不同时间段的协议流量
$event.metadata.log_type = /ROUTER|SWITCH|DHCP|PROXY|NETWORK|VPN|FIREWALL|_FLOW|VPC|WIRELESS|IPS|IDS|ARUBA_EDGECONNECT_SDWAN|ARUBA_SWITCH|CISCO_APIC|CISCO_CALL_MANAGER|CISCO_DNAC|CISCO_ESTREAMER|CISCO_IOS|CISCO_PRIME|EFFICIENTIP_DDI|EXTREME_SWITCH|FORTINET_FORTIDDOS|FORTINET_FORTIMANAGER|ARUBA_CENTRAL|JUNIPER_JUNOS|JUNIPER_MIST|JUNIPER_SDWAN|NAGIOS|ARBOR_EDGE_DEFENSE|MICROSOFT_NPS|STEELHEAD|SHRUBBERY_TACACS|TRENDMICRO_DDI|VMWARE_NSX|WINDOWS_NET_POLICY_SERVER|ZYWALL|IMPERVA_FLEXPROTECT|PAN_IOT|NOZOMI_GUARDIAN|SURICATA_EVE|UMBRELLA_DNS|WINDOWS_SYSMON|COHESITY|RUBRIK|CISCO_MERAKI|CLAROTY_EMC|CLAROTY_CTD|HONEYD|AIRWATCH|IMPERVA_SECURESPHERE|SECURELINK|WALLIX_BASTION|CHECKPOINT_HARMONY|UNIFI_AP|DIGI_MODEMS|DESYNOVA_CONTIDO|CLOUDGENIX_SDWAN|JUNIPER_MX|SAP_WEBDISP|ADVA_FSP|HP_PROCURVE|VYOS|RSA_SECURID|HCNET_ACCOUNT_ADAPTER|INFOBLOX|VITALQIP|ASSET_STATIC_IP|BLUECAT_DDI|TWINGATE|SYMANTEC_VIP_AUTHHUB|ZSCALER_DECEPTION|BROCADE_SERVERIRON|KEMP_LOADBALANCER|A10_LOAD_BALANCER|AWS_ELB|F5_BIGIP_LTM|RADWARE_ALTEON|CITRIX_NETSCALER|AKAMAI_CLOUD_MONITOR|CISCO_ACE|GCP_LOADBALANCING|KERIOCONTROL|EXTRAHOP|NETFILTER_IPTABLES|CISCO_UMBRELLA_AUDIT|F5_AFM|NUTANIX_PRISM|SANGFOR_NGAF|VERCEL_WAF|PEPLINK_FW|NETDOCUMENTS|PAN_PANORAMA|PFSENSE|AZION|FIREEYE_PX|OPNSENSE|CISCO_FWSM|FORTINET_FORTIWEB|BARRACUDA_WAF|SYMANTEC_WSS|MENLO_SECURITY|DIGITALARTS_IFILTER|WEBMARSHAL|UMBRELLA_IP|AWS_SECURITY_HUB|EXTRAHOP|GUARDDUTY|MICROSOFT_ATA|ORCA|OSSEC|SURICATA_EVE|VMWARE_TANZU/ nocase
$event.principal.ip in cidr %PCI_Network_Ranges
or $event.principal.asset.ip in cidr %PCI_Network_Ranges
$Protocol = $event.network.ip_protocol
$Date = timestamp.get_date($event.metadata.event_timestamp.seconds)
match:
$Date, $Protocol
outcome:
$Count = count_distinct($event.metadata.id)
order:
$Date asc
按操作划分的不同时间段的流量
$event.metadata.log_type = /ROUTER|SWITCH|DHCP|PROXY|NETWORK|VPN|FIREWALL|_FLOW|VPC|WIRELESS|IPS|IDS|ARUBA_EDGECONNECT_SDWAN|ARUBA_SWITCH|CISCO_APIC|CISCO_CALL_MANAGER|CISCO_DNAC|CISCO_ESTREAMER|CISCO_IOS|CISCO_PRIME|EFFICIENTIP_DDI|EXTREME_SWITCH|FORTINET_FORTIDDOS|FORTINET_FORTIMANAGER|ARUBA_CENTRAL|JUNIPER_JUNOS|JUNIPER_MIST|JUNIPER_SDWAN|NAGIOS|ARBOR_EDGE_DEFENSE|MICROSOFT_NPS|STEELHEAD|SHRUBBERY_TACACS|TRENDMICRO_DDI|VMWARE_NSX|WINDOWS_NET_POLICY_SERVER|ZYWALL|IMPERVA_FLEXPROTECT|PAN_IOT|NOZOMI_GUARDIAN|SURICATA_EVE|UMBRELLA_DNS|WINDOWS_SYSMON|COHESITY|RUBRIK|CISCO_MERAKI|CLAROTY_EMC|CLAROTY_CTD|HONEYD|AIRWATCH|IMPERVA_SECURESPHERE|SECURELINK|WALLIX_BASTION|CHECKPOINT_HARMONY|UNIFI_AP|DIGI_MODEMS|DESYNOVA_CONTIDO|CLOUDGENIX_SDWAN|JUNIPER_MX|SAP_WEBDISP|ADVA_FSP|HP_PROCURVE|VYOS|RSA_SECURID|HCNET_ACCOUNT_ADAPTER|INFOBLOX|VITALQIP|ASSET_STATIC_IP|BLUECAT_DDI|TWINGATE|SYMANTEC_VIP_AUTHHUB|ZSCALER_DECEPTION|BROCADE_SERVERIRON|KEMP_LOADBALANCER|A10_LOAD_BALANCER|AWS_ELB|F5_BIGIP_LTM|RADWARE_ALTEON|CITRIX_NETSCALER|AKAMAI_CLOUD_MONITOR|CISCO_ACE|GCP_LOADBALANCING|KERIOCONTROL|EXTRAHOP|NETFILTER_IPTABLES|CISCO_UMBRELLA_AUDIT|F5_AFM|NUTANIX_PRISM|SANGFOR_NGAF|VERCEL_WAF|PEPLINK_FW|NETDOCUMENTS|PAN_PANORAMA|PFSENSE|AZION|FIREEYE_PX|OPNSENSE|CISCO_FWSM|FORTINET_FORTIWEB|BARRACUDA_WAF|SYMANTEC_WSS|MENLO_SECURITY|DIGITALARTS_IFILTER|WEBMARSHAL|UMBRELLA_IP|AWS_SECURITY_HUB|EXTRAHOP|GUARDDUTY|MICROSOFT_ATA|ORCA|OSSEC|SURICATA_EVE|VMWARE_TANZU/ nocase
$event.principal.ip in cidr %PCI_Network_Ranges
or $event.principal.asset.ip in cidr %PCI_Network_Ranges
$Date = timestamp.get_date($event.metadata.event_timestamp.seconds)
$Security_Result = $event.security_result.action
match:
$Date, $Security_Result
outcome:
$Count = count($event.security_result.action)
order:
$Date asc
按前 10 大来源划分的流量
$event.metadata.log_type = /ROUTER|SWITCH|DHCP|PROXY|NETWORK|VPN|FIREWALL|_FLOW|VPC|WIRELESS|IPS|IDS|ARUBA_EDGECONNECT_SDWAN|ARUBA_SWITCH|CISCO_APIC|CISCO_CALL_MANAGER|CISCO_DNAC|CISCO_ESTREAMER|CISCO_IOS|CISCO_PRIME|EFFICIENTIP_DDI|EXTREME_SWITCH|FORTINET_FORTIDDOS|FORTINET_FORTIMANAGER|ARUBA_CENTRAL|JUNIPER_JUNOS|JUNIPER_MIST|JUNIPER_SDWAN|NAGIOS|ARBOR_EDGE_DEFENSE|MICROSOFT_NPS|STEELHEAD|SHRUBBERY_TACACS|TRENDMICRO_DDI|VMWARE_NSX|WINDOWS_NET_POLICY_SERVER|ZYWALL|IMPERVA_FLEXPROTECT|PAN_IOT|NOZOMI_GUARDIAN|SURICATA_EVE|UMBRELLA_DNS|WINDOWS_SYSMON|COHESITY|RUBRIK|CISCO_MERAKI|CLAROTY_EMC|CLAROTY_CTD|HONEYD|AIRWATCH|IMPERVA_SECURESPHERE|SECURELINK|WALLIX_BASTION|CHECKPOINT_HARMONY|UNIFI_AP|DIGI_MODEMS|DESYNOVA_CONTIDO|CLOUDGENIX_SDWAN|JUNIPER_MX|SAP_WEBDISP|ADVA_FSP|HP_PROCURVE|VYOS|RSA_SECURID|HCNET_ACCOUNT_ADAPTER|INFOBLOX|VITALQIP|ASSET_STATIC_IP|BLUECAT_DDI|TWINGATE|SYMANTEC_VIP_AUTHHUB|ZSCALER_DECEPTION|BROCADE_SERVERIRON|KEMP_LOADBALANCER|A10_LOAD_BALANCER|AWS_ELB|F5_BIGIP_LTM|RADWARE_ALTEON|CITRIX_NETSCALER|AKAMAI_CLOUD_MONITOR|CISCO_ACE|GCP_LOADBALANCING|KERIOCONTROL|EXTRAHOP|NETFILTER_IPTABLES|CISCO_UMBRELLA_AUDIT|F5_AFM|NUTANIX_PRISM|SANGFOR_NGAF|VERCEL_WAF|PEPLINK_FW|NETDOCUMENTS|PAN_PANORAMA|PFSENSE|AZION|FIREEYE_PX|OPNSENSE|CISCO_FWSM|FORTINET_FORTIWEB|BARRACUDA_WAF|SYMANTEC_WSS|MENLO_SECURITY|DIGITALARTS_IFILTER|WEBMARSHAL|UMBRELLA_IP|AWS_SECURITY_HUB|EXTRAHOP|GUARDDUTY|MICROSOFT_ATA|ORCA|OSSEC|SURICATA_EVE|VMWARE_TANZU/ nocase
$event.principal.ip in cidr %PCI_Network_Ranges
or $event.principal.asset.ip in cidr %PCI_Network_Ranges
$IP_Address = $event.principal.ip
match:
$IP_Address
outcome:
$Count = count_distinct($event.metadata.id)
order:
$Count desc
limit:
10
PCI - 补丁管理
此信息中心可全面展示补丁管理生命周期，帮助组织有效监控和管理系统更新。它使用参考列表 patch_updates 和 pci_assets 将数据限定在 PCI 环境中。
注意 ： 在创建所需的参考列表之前，此信息中心内的图表不会加载。
按主机列出的 10 大成功安装
随时间变化的安装失败次数
有可用更新的系统
随时间变化的取消安装次数
失败的下载随时间的变化
成功下载次数随时间的变化
启动的下载随时间的变化
已安装最新更新
随时间变化的成功安装次数
按主机列出的前 10 个失败的安装
图表名称
查询示例
按主机列出的 10 大成功安装
strings.coalesce($event.principal.asset.hostname, $event.principal.hostname) in %PCI_Assets
$event.metadata.product_event_type = "19"
$Date = timestamp.get_date($event.metadata.event_timestamp.seconds)
$Hostname = strings.coalesce($event.principal.asset.hostname, $event.principal.hostname)
match:
$Date, $Hostname
outcome:
$Count = count($event.metadata.id)
order:
$Date desc
limit:
10
随时间变化的安装失败次数
strings.coalesce($event.principal.asset.hostname, $event.principal.hostname) in %PCI_Assets
$event.metadata.product_event_type = "20"
$Date = timestamp.get_date($event.metadata.event_timestamp.seconds)
$Event = $event.metadata.product_event_type
match:
$Event, $Date
outcome:
$Count = count($event.metadata.id)
order:
$Date asc
有可用更新的系统
strings.coalesce($event.principal.asset.hostname, $event.principal.hostname) in %PCI_Assets
$event.metadata.product_event_type = "40"
$Date = timestamp.get_date($event.metadata.event_timestamp.seconds)
$Hostname = strings.coalesce($event.principal.asset.hostname, $event.principal.hostname)
match:
$Hostname, $Date
outcome:
$Count = count($event.metadata.id)
order:
$Date asc
limit:
10
随时间变化的取消安装次数
strings.coalesce($event.principal.asset.hostname, $event.principal.hostname) in %PCI_Assets
$event.metadata.product_event_type = "21"
$Date = timestamp.get_date($event.metadata.event_timestamp.seconds)
$Hostname = strings.coalesce($event.principal.asset.hostname, $event.principal.hostname)
match:
$Hostname, $Date
outcome:
$Count = count($event.metadata.id)
order:
$Date asc
失败的下载随时间的变化
strings.coalesce($event.principal.asset.hostname, $event.principal.hostname) in %PCI_Assets
$event.metadata.product_event_type = "31"
$Date = timestamp.get_date($event.metadata.event_timestamp.seconds)
$Hostname = strings.coalesce($event.principal.asset.hostname, $event.principal.hostname)
match:
$Hostname, $Date
outcome:
$Count = count($event.metadata.id)
order:
$Date asc
成功下载次数随时间的变化
strings.coalesce($event.principal.asset.hostname, $event.principal.hostname) in %PCI_Assets
$event.metadata.product_event_type = "16"
$Date = timestamp.get_date($event.metadata.event_timestamp.seconds)
$Hostname = strings.coalesce($event.principal.asset.hostname, $event.principal.hostname)
match:
$Hostname, $Date
outcome:
$Count = count($event.metadata.id)
order:
$Date asc
启动的下载随时间的变化
strings.coalesce($event.principal.asset.hostname, $event.principal.hostname) in %PCI_Assets
$event.metadata.product_event_type = "41"
$Date = timestamp.get_date($event.metadata.event_timestamp.seconds)
$Hostname = strings.coalesce($event.principal.asset.hostname, $event.principal.hostname)
match:
$Hostname, $Date
outcome:
$Count = count($event.metadata.id)
order:
$Date asc
已安装最新更新
strings.coalesce($event.principal.asset.hostname, $event.principal.hostname) in %PCI_Assets
$event.metadata.description in regex %Patch_Updates
$event.metadata.product_event_type = "19"
$Hostname = strings.coalesce($event.principal.asset.hostname, $event.principal.hostname)
$Hostname != ""
$Update = $event.metadata.description
match:
$Hostname, $Update
limit:
50
随时间变化的成功安装次数
strings.coalesce($event.principal.asset.hostname, $event.principal.hostname) in %PCI_Assets
$event.metadata.product_event_type = "19"
$Event = $event.metadata.product_event_type
$Date = timestamp.get_date($event.metadata.event_timestamp.seconds)
match:
$Event, $Date
outcome:
$Count = count($event.metadata.id)
order:
$Date asc
按主机列出的前 10 个失败的安装
strings.coalesce($event.principal.asset.hostname, $event.principal.hostname) in %PCI_Assets
$event.metadata.product_event_type = "20"
$Date = timestamp.get_date($event.metadata.event_timestamp.seconds)
$Hostname = strings.coalesce($event.principal.asset.hostname, $event.principal.hostname)
match:
$Date, $Hostname
outcome:
$Count = count($event.metadata.id)
order:
$Date desc
limit:
10
PCI - 安全配置
此信息中心可实时监控安全配置实践。它会跟踪关键指标、突出显示风险，并帮助您维护关键配置。它使用参考列表 pci_assets 和 default_users 将数据限定在 PCI 环境中。
注意 ： 在创建所需的参考列表之前，此信息中心内的图表不会加载。
登录失败次数
政策变更总数
默认账号随时间推移的使用情况
10 大默认用户名
一段时间内登录尝试失败的次数
用户进行的政策变更
前 10 个主机的登录失败尝试次数
用户登录失败尝试次数
按主机名的默认账号使用情况
默认用户名身份验证总次数
按日志来源划分的政策变更
政策随时间的变化
默认用户名身份验证摘要
图表名称
查询示例
登录失败次数
$event_type = metadata.event_type
$event_type = "USER_LOGIN"
(principal.hostname in %PCI_Assets or principal.asset.hostname in %PCI_Assets or target.hostname in %PCI_Assets or target.asset.hostname in %PCI_Assets)
$action = security_result.action
$action = "BLOCK"
outcome:
$event_count = count(metadata.id)
order:
$event_count desc
政策变更总数
$event_type = metadata.event_type
($event_type = "SYSTEM_AUDIT_LOG_UNCATEGORIZED" or $event_type = "STATUS_UPDATE")
(principal.hostname in %PCI_Assets or principal.asset.hostname in %PCI_Assets or target.hostname in %PCI_Assets or target.asset.hostname in %PCI_Assets)
$policy_change = strings.coalesce(security_result.description,metadata.product_event_type,security_result.about.registry.registry_key)
$policy_change = /policy change/ nocase
outcome:
$event_count = count(metadata.id)
默认账号随时间推移的使用情况
$date = timestamp.get_date(metadata.event_timestamp.seconds)
(principal.hostname in %PCI_Assets or principal.asset.hostname in %PCI_Assets or target.hostname in %PCI_Assets or target.asset.hostname in %PCI_Assets)
$user = strings.coalesce(principal.user.userid,principal.user.user_display_name,principal.user.email_addresses)
$user in %Default_Users
match:
$date, $user
outcome:
$event_count = count(metadata.id)
order:
$date asc
10 大默认用户名
(principal.hostname in %PCI_Assets or principal.asset.hostname in %PCI_Assets or target.hostname in %PCI_Assets or target.asset.hostname in %PCI_Assets)
$user = strings.coalesce(principal.user.userid,principal.user.user_display_name,principal.user.email_addresses)
$user in %Default_Users
$event_type = metadata.event_type
match:
$user
outcome:
$event_types = array_distinct(metadata.event_type)
$event_count = count(metadata.id)
order:
$event_count desc
limit:
10
一段时间内登录尝试失败的次数
$date = timestamp.get_date(metadata.event_timestamp.seconds)
$event_type = metadata.event_type
$event_type = "USER_LOGIN"
(principal.hostname in %PCI_Assets or principal.asset.hostname in %PCI_Assets or target.hostname in %PCI_Assets or target.asset.hostname in %PCI_Assets)
$action = security_result.action
$action = "BLOCK"
match:
$date,$action
outcome:
$event_count = count(metadata.id)
order:
$date asc
用户进行的政策变更
$event_type = metadata.event_type
($event_type = "SYSTEM_AUDIT_LOG_UNCATEGORIZED" or $event_type = "STATUS_UPDATE")
(principal.hostname in %PCI_Assets or principal.asset.hostname in %PCI_Assets or target.hostname in %PCI_Assets or target.asset.hostname in %PCI_Assets)
$policy_change = strings.coalesce(security_result.description,metadata.product_event_type,security_result.about.registry.registry_key)
$policy_change = /policy change/ nocase
$user = strings.coalesce(principal.user.userid,principal.user.user_display_name,principal.user.email_addresses)
match:
$user
outcome:
$event_count = count(metadata.id)
order:
$event_count desc
前 10 个主机的登录失败尝试次数
$event_type = metadata.event_type
$event_type = "USER_LOGIN"
(principal.hostname in %PCI_Assets or principal.asset.hostname in %PCI_Assets or target.hostname in %PCI_Assets or target.asset.hostname in %PCI_Assets)
$hostname = strings.coalesce(principal.hostname,principal.asset.hostname,target.hostname,target.asset.hostname)
$hostname != ""
$action = security_result.action
$action = "BLOCK"
match:
$hostname
outcome:
$event_count = count(metadata.id)
order:
$event_count desc
limit:
10
用户登录失败尝试次数
$vendor = metadata.vendor_name
$event_type = metadata.event_type
$event_type = "USER_LOGIN"
(principal.hostname in %PCI_Assets or principal.asset.hostname in %PCI_Assets or target.hostname in %PCI_Assets or target.asset.hostname in %PCI_Assets)
$hostname = strings.coalesce(principal.hostname,principal.asset.hostname,target.hostname,target.asset.hostname)
$action = security_result.action
$action = "BLOCK"
$user = strings.coalesce(principal.user.userid,principal.user.user_display_name,principal.user.email_addresses)
$user != ""
match:
$user, $hostname, $vendor
outcome:
$event_count = count(metadata.id)
order:
$event_count desc
按主机名的默认账号使用情况
(principal.hostname in %PCI_Assets or principal.asset.hostname in %PCI_Assets or target.hostname in %PCI_Assets or target.asset.hostname in %PCI_Assets)
$hostname = strings.coalesce(principal.hostname, principal.asset.hostname,target.hostname,target.asset.hostname)
$user = strings.coalesce(principal.user.userid,principal.user.user_display_name,principal.user.email_addresses)
$user in %Default_Users
match:
$hostname
outcome:
$event_count = count(metadata.id)
order:
$event_count desc
默认用户名身份验证总次数
$event_type = metadata.event_type
$event_type = "USER_LOGIN"
(principal.hostname in %PCI_Assets or principal.asset.hostname in %PCI_Assets or target.hostname in %PCI_Assets or target.asset.hostname in %PCI_Assets)
$user = strings.coalesce(principal.user.userid,principal.user.user_display_name,principal.user.email_addresses)
$user in %Default_Users
outcome:
$event_count = count(metadata.id)
按日志来源划分的政策变更
$event_type = metadata.event_type
($event_type = "SYSTEM_AUDIT_LOG_UNCATEGORIZED" or $event_type = "STATUS_UPDATE")
(principal.hostname in %PCI_Assets or principal.asset.hostname in %PCI_Assets or target.hostname in %PCI_Assets or target.asset.hostname in %PCI_Assets)
$policy_change = strings.coalesce(security_result.description,metadata.product_event_type,security_result.about.registry.registry_key)
$policy_change = /policy change/ nocase
$log_source = metadata.log_type
match:
$log_source
outcome:
$event_count = count(metadata.id)
order:
$event_count desc
政策随时间的变化
$event_type = metadata.event_type
($event_type = "SYSTEM_AUDIT_LOG_UNCATEGORIZED" or $event_type = "STATUS_UPDATE")
(principal.hostname in %PCI_Assets or principal.asset.hostname in %PCI_Assets or target.hostname in %PCI_Assets or target.asset.hostname in %PCI_Assets)
$policy_change = strings.coalesce(security_result.description,metadata.product_event_type,security_result.about.registry.registry_key)
$policy_change = /policy change/ nocase
$date = timestamp.get_date(metadata.event_timestamp.seconds)
match:
$date, $policy_change
outcome:
$event_count = count(metadata.id)
order:
$event_count desc
默认用户名身份验证摘要
$event_type = metadata.event_type
$event_type = "USER_LOGIN"
$log_type = metadata.log_type
(principal.hostname in %PCI_Assets or principal.asset.hostname in %PCI_Assets or target.hostname in %PCI_Assets or target.asset.hostname in %PCI_Assets)
$hostname = strings.coalesce(principal.hostname, principal.asset.hostname,target.hostname,target.asset.hostname)
$action = security_result.action
$user = strings.coalesce(principal.user.userid,principal.user.user_display_name,principal.user.email_addresses)
$user in %Default_Users
match:
$user, $hostname, $log_type, $action
outcome:
$event_count = count(metadata.id)
order:
$event_count desc
PCI - 漏洞管理
此信息中心可实时监控和跟踪漏洞。它可为更广泛的合规性工作提供支持，帮助识别、评估和管理风险，从而维护安全的付款环境，同时简化报告流程。它使用参考列表 pci_assets 和 pci_network_ranges 将数据限定在 PCI 环境中。
注意 ： 在创建所需的参考列表之前，此信息中心内的图表不会加载。
按年龄划分的漏洞
十大易受攻击的主机
十大常见漏洞
新漏洞
总漏洞数
易受攻击的系统
漏洞（按严重程度划分）
易受攻击的系统（百分比）
每个系统的漏洞数
图表名称
查询示例
按年龄划分的漏洞
$event_type = metadata.event_type
($event_type = "SCAN_VULN_HOST" or $event_type = "SCAN_VULN_NETWORK")
(principal.hostname in %PCI_Assets) or (principal.asset.hostname in %PCI_Assets) or (principal.ip in cidr %PCI_Network_Ranges) or (principal.asset.ip in cidr %PCI_Network_Ranges)
$vulnerability = extensions.vulns.vulnerabilities.description
$First_Found = timestamp.get_date(extensions.vulns.vulnerabilities.first_found.seconds)
$date = timestamp.get_date(metadata.event_timestamp.seconds)
$Time_difference = timestamp.diff(metadata.event_timestamp.seconds, extensions.vulns.vulnerabilities.first_found.seconds, "DAY")
match:
$Time_difference,$vulnerability
outcome:
$Range = if(max($Time_difference) <= 30, "0-30Days", if(max($Time_difference) <= 60, "31-60Days", if(max($Time_difference) <= 90, "61-90Days", ">90Days")))
$event_count = count(metadata.id)
order:
$Time_difference desc
十大易受攻击的主机
$event_type = metadata.event_type
($event_type = "SCAN_VULN_HOST" or $event_type = "SCAN_VULN_NETWORK")
$asset = strings.coalesce(principal.hostname,principal.asset.hostname,principal.ip,principal.asset.ip)
(principal.hostname in %PCI_Assets) or (principal.asset.hostname in %PCI_Assets) or (principal.ip in cidr %PCI_Network_Ranges) or (principal.asset.ip in cidr %PCI_Network_Ranges)
$platform = principal.platform
match:
$asset, $platform
outcome:
$event_count = count(metadata.id)
order:
$event_count desc
limit:
10
十大常见漏洞
$event_type = metadata.event_type
($event_type = "SCAN_VULN_HOST" or $event_type = "SCAN_VULN_NETWORK")
(principal.hostname in %PCI_Assets) or (principal.asset.hostname in %PCI_Assets) or (principal.ip in cidr %PCI_Network_Ranges) or (principal.asset.ip in cidr %PCI_Network_Ranges)
$vulnerability = extensions.vulns.vulnerabilities.description
$platform = principal.platform
match:
$vulnerability,$platform
outcome:
$event_count = count(metadata.id)
order:
$event_count desc
limit:
10
新漏洞
$event_type = metadata.event_type
($event_type = "SCAN_VULN_HOST" or $event_type = "SCAN_VULN_NETWORK")
(principal.hostname in %PCI_Assets) or (principal.asset.hostname in %PCI_Assets) or (principal.ip in cidr %PCI_Network_Ranges) or (principal.asset.ip in cidr %PCI_Network_Ranges)
$date = timestamp.get_date(metadata.event_timestamp.seconds)
$First_Found = timestamp.get_date(extensions.vulns.vulnerabilities.first_found.seconds)
$vulnerability = extensions.vulns.vulnerabilities.description
$severity = extensions.vulns.vulnerabilities.severity
$Time_difference = timestamp.diff(metadata.event_timestamp.seconds, extensions.vulns.vulnerabilities.first_found.seconds, "DAY")
$Time_difference < 30
match:
$vulnerability, $severity
outcome:
$event_count = count(metadata.id)
$age = max($Time_difference)
order:
$severity desc
总漏洞数
$event_type = metadata.event_type
($event_type = "SCAN_VULN_HOST" or $event_type = "SCAN_VULN_NETWORK")
(principal.hostname in %PCI_Assets) or (principal.asset.hostname in %PCI_Assets) or (principal.ip in cidr %PCI_Network_Ranges) or (principal.asset.ip in cidr %PCI_Network_Ranges)
outcome:
$event_count = count(metadata.id)
易受攻击的系统
$event_type = metadata.event_type
($event_type = "SCAN_VULN_HOST" or $event_type = "SCAN_VULN_NETWORK")
(principal.hostname in %PCI_Assets) or (principal.asset.hostname in %PCI_Assets) or (principal.ip in cidr %PCI_Network_Ranges) or (principal.asset.ip in cidr %PCI_Network_Ranges)
$asset = strings.coalesce(principal.hostname,principal.asset.hostname,principal.ip,principal.asset.ip)
outcome:
$event_count = count_distinct($asset)
漏洞（按严重程度划分）
$event_type = metadata.event_type
($event_type = "SCAN_VULN_HOST" or $event_type = "SCAN_VULN_NETWORK")
(principal.hostname in %PCI_Assets) or (principal.asset.hostname in %PCI_Assets) or (principal.ip in cidr %PCI_Network_Ranges) or (principal.asset.ip in cidr %PCI_Network_Ranges)
$severity = extensions.vulns.vulnerabilities.severity
match:
$severity
outcome:
$event_count = count(metadata.id)
order:
$severity desc
易受攻击的系统（百分比）
$event_type = metadata.event_type
($event_type = "SCAN_VULN_HOST" or $event_type = "SCAN_VULN_NETWORK")
(principal.hostname in %PCI_Assets) or (principal.asset.hostname in %PCI_Assets) or (principal.ip in cidr %PCI_Network_Ranges) or (principal.asset.ip in cidr %PCI_Network_Ranges)
$platform = principal.platform
match:
$platform
outcome:
$event_count = count($platform)
每个系统的漏洞数
$event_type = metadata.event_type
($event_type = "SCAN_VULN_HOST" or $event_type = "SCAN_VULN_NETWORK")
$asset = strings.coalesce(principal.hostname,principal.asset.hostname,principal.ip,principal.asset.ip)
(principal.hostname in %PCI_Assets) or (principal.asset.hostname in %PCI_Assets) or (principal.ip in cidr %PCI_Network_Ranges) or (principal.asset.ip in cidr %PCI_Network_Ranges)
$platform = principal.platform
match:
$asset
outcome:
$operating_system = array_distinct($platform)
$event_count = count(metadata.id)
order:
$event_count desc
密码更改监控信息中心
此信息中心会跟踪和记录密码更改，并提供密码更改事件的全面视图，包括密码更改的日期和时间。它可直观呈现趋势，识别可疑 IP 地址、用户和位置等风险，并帮助检测和应对潜在的安全事件，例如未经授权的密码更改。
按用户数统计的前 10 个来源 IP 地址
前 10 名密码重置
按日志类型划分的指定时间段内的事件
按操作划分的事件
来源地理位置热图
按操作次数排名的前 10 名用户
10 大活动说明
用户最近更改密码（24 小时内）
按严重程度划分的事件
图表名称
查询示例
按用户数统计的前 10 个来源 IP 地址
metadata.event_type = "USER_CHANGE_PASSWORD"
$Source_IP = strings.coalesce(principal.ip, principal.asset.ip)
$Source_IP != ""
$User = strings.coalesce(principal.user.userid, principal.user.user_display_name, principal.user.email_addresses,target.user.userid,target.user.user_display_name,target.user.email_addresses )
match :
$Source_IP,$User
outcome :
$Count = count(metadata.id)
order :
$Count desc
limit:10
前 10 名密码重置
metadata.event_type = "USER_CHANGE_PASSWORD"
$Log_Type = metadata.log_type
$Password_Event_Type = metadata.product_event_type
$Description = metadata.description
($Password_Event_Type = /Reset/ nocase OR $Description = /Reset/ nocase)
$User = strings.coalesce(principal.user.userid, principal.user.user_display_name, principal.user.email_addresses,target.user.userid,target.user.user_display_name,target.user.email_addresses )
match :
$User
outcome :
$Count = count(metadata.id)
order :
$Count desc
limit: 10
按日志类型划分的指定时间段内的事件
metadata.event_type = "USER_CHANGE_PASSWORD"
$Log_Type = metadata.log_type
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
match :
$Date,$Log_Type
outcome :
$Count = count(metadata.id)
按操作划分的事件
metadata.event_type = "USER_CHANGE_PASSWORD"
$Action = security_result.action
match :
$Action
outcome :
$Count = count(metadata.id)
来源地理位置热图
metadata.event_type = "USER_CHANGE_PASSWORD"
$Country = principal.ip_geo_artifact.location.country_or_region
match :
$Country
outcome :
$Count = count(metadata.id)
$Latitude = max(principal.ip_geo_artifact.location.region_coordinates.latitude)
$Longitude = max(principal.ip_geo_artifact.location.region_coordinates.longitude)
order :
$Count desc
按操作次数排名的前 10 名用户
metadata.event_type = "USER_CHANGE_PASSWORD"
$User = strings.coalesce(principal.user.userid, principal.user.user_display_name, principal.user.email_addresses,target.user.userid,target.user.user_display_name,target.user.email_addresses )
$Action = security_result.action
match :
$User,$Action
outcome :
$Count = count(metadata.id)
order :
$Count desc
limit :
10
10 大活动说明
metadata.event_type = "USER_CHANGE_PASSWORD"
$Description = strings.coalesce(metadata.description,security_result.description,metadata.product_event_type)
match :
$Description
outcome :
$Count = count(metadata.id)
order :
$Count desc
limit :
10
用户最近更改密码（24 小时内）
metadata.event_type = "USER_CHANGE_PASSWORD"
$Log_Type = metadata.log_type
$Password_Event_Type = metadata.product_event_type
$User = strings.coalesce(principal.user.userid, principal.user.user_display_name, principal.user.email_addresses,target.user.userid,target.user.user_display_name,target.user.email_addresses )
$Hostname = strings.coalesce(principal.hostname,principal.asset.hostname)
$Source_IP = strings.coalesce(principal.ip, principal.asset.ip)
match :
$User,$Hostname,$Source_IP,$Password_Event_Type,$Log_Type
outcome :
$Date = timestamp.get_timestamp(max(metadata.event_timestamp.seconds ), "%F %T")
$Count = count(metadata.id)
order :
$Count desc
按严重程度划分的事件
metadata.event_type = "USER_CHANGE_PASSWORD"
$Severity = security_result.severity
match :
$Severity
outcome :
$Count = count(metadata.id)
网络钓鱼监控
此信息中心可提供有关钓鱼式攻击威胁、电子邮件安全和攻击趋势的分析洞见。它可让安全团队了解网络钓鱼企图，从而使团队能够监控恶意电子邮件活动、识别可疑发件人和目标用户，并标记潜在的有害指标。
注意 ： 应用基于特定日志类型的过滤条件，以便在信息中心内显示相关结果。
供应商提醒中的前 10 位用户
访问次数最多的 10 个钓鱼式攻击网址
十大钓鱼邮件主题
按操作划分的活动
按日志类型划分的指定时间段内的事件
检测到的钓鱼式攻击事件总数
排名前 10 的关联网域
按操作类型划分的供应商提醒随时间变化情况
近期钓鱼式攻击事件
10 大供应商提醒
前 10 大威胁名称
按操作统计的指定时间段内的事件
十大钓鱼式攻击电子邮件发件人
钓鱼式攻击文件详情
按文件类型划分的事件数
按日志类型划分的供应商随时间变化的提醒
前 10 个钓鱼式攻击网址
十大最容易成为网络钓鱼电子邮件攻击目标的群体
来源地理位置概览
按严重程度划分的事件
图表名称
查询示例
供应商提醒中的前 10 位用户
(security_result.category = "MAIL_PHISHING" or re.regex(security_result.threat_name,`Phish`) nocase or re.regex(security_result.category_details,`Phish`)nocase)
security_result.threat_name != "NOT_PHISHING"
security_result.rule_name != ""
$User = strings.coalesce(network.email.from, principal.user.userid, principal.user.user_display_name, principal.user.email_addresses, target.user.userid, target.user.user_display_name, target.user.email_addresses)
match:
$User
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
访问次数最多的 10 个钓鱼式攻击网址
(security_result.category = "MAIL_PHISHING" or re.regex(security_result.threat_name,`Phish`) nocase or re.regex(security_result.category_details,`Phish`) nocase)
security_result.threat_name!= "NOT_PHISHING"
metadata.product_event_type = /permit/ nocase
$URL = strings.coalesce (target.url, principal.process.file.embedded_urls, security_result.about.url, network.http.referral_url, principal.url)
$URL != ""
$User = strings.coalesce(network.email.from, principal.user.userid, principal.user.user_display_name, principal.user.email_addresses, target.user.userid, target.user.user_display_name, target.user.email_addresses)
$Action = security_result.action
match:
$URL, $Action
outcome:
$User_List = array_distinct($User)
$Count = count($URL)
order:
$URL desc
//limit:
//10
十大钓鱼邮件主题
(security_result.category = "MAIL_PHISHING" or re.regex(security_result.threat_name,`Phish`) nocase or re.regex(security_result.category_details,`Phish`) nocase)
security_result.threat_name!= "NOT_PHISHING"
$Subject = network.email.subject
$Action = security_result.action
match:
$Subject, $Action
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
按操作划分的活动
(security_result.category = "MAIL_PHISHING" or re.regex(security_result.threat_name,`Phish`) nocase or re.regex(security_result.category_details,`Phish`) nocase)
security_result.threat_name != "NOT_PHISHING"
$Action = security_result.action
match:
$Action
outcome:
$Count = count(metadata.id)
order:
$Action desc
按日志类型划分的指定时间段内的事件
(security_result.category = "MAIL_PHISHING" or re.regex(security_result.threat_name,`Phish`) nocase or re.regex(security_result.category_details,`Phish`)nocase)
security_result.threat_name!= "NOT_PHISHING"
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
$Log_Type = metadata.log_type
match:
$Date, $Log_Type
outcome:
$Count = count(metadata.id)
order:
$Date asc
检测到的钓鱼式攻击事件总数
(security_result.category = "MAIL_PHISHING" or re.regex(security_result.threat_name,`Phish`) nocase or re.regex(security_result.category_details,`Phish`) nocase)
security_result.threat_name != "NOT_PHISHING"
outcome:
$Count = count(metadata.id)
排名前 10 的关联网域
(security_result.category = "MAIL_PHISHING" or re.regex(security_result.threat_name,`Phish`) nocase or re.regex(security_result.category_details,`Phish`) nocase)
security_result.threat_name!= "NOT_PHISHING"
$Domain = strings.coalesce(principal.administrative_domain, target.administrative_domain, about.administrative_domain)
$Action = security_result.action
match:
$Domain, $Action
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
按操作类型划分的供应商提醒随时间变化情况
(security_result.category = "MAIL_PHISHING" or re.regex(security_result.threat_name,`Phish`) nocase or re.regex(security_result.category_details,`Phish`)nocase)
security_result.threat_name != "NOT_PHISHING"
security_result.rule_name != ""
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
$Action = security_result.action
match:
$Date, $Action
outcome:
$Count = count(metadata.id)
order:
$Date asc
近期钓鱼式攻击事件
(security_result.category = "MAIL_PHISHING" or re.regex(security_result.threat_name,`Phish`) nocase or re.regex(security_result.category_details,`Phish`)nocase)
security_result.threat_name!= "NOT_PHISHING"
$Security_Event_Type = metadata.product_event_type
$Summary = strings.coalesce(security_result.summary, metadata.description, security_result.description)
$Sender = strings.coalesce(network.email.from, principal.user.email_addresses)
$Subject = network.email.subject
match:
$Security_Event_Type, $Summary, $Subject, $Sender
outcome:
$Count = count(metadata.id)
$Receiver_Count = count_distinct(strings.coalesce(network.email.to, network.email.reply_to, target.user.email_addresses))
$Date = timestamp.get_timestamp(max(metadata.event_timestamp.seconds), "%F %T")
order:
$Count desc
10 大供应商提醒
(security_result.category = "MAIL_PHISHING" or re.regex(security_result.threat_name,`Phish`) nocase or re.regex(security_result.category_details,`Phish`)nocase)
security_result.threat_name != "NOT_PHISHING"
security_result.rule_name != ""
$Rule_Name = security_result.rule_name
match:
$Rule_Name
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
前 10 大威胁名称
(security_result.category = "MAIL_PHISHING" or re.regex(security_result.threat_name,`Phish`) nocase or re.regex(security_result.category_details,`Phish`) nocase)
security_result.threat_name!= "NOT_PHISHING"
$Threat_Name = strings.coalesce(security_result.threat_name,security_result.category_details)
$Log_Type = metadata.log_type
match:
$Threat_Name, $Log_Type
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
按操作统计的指定时间段内的事件
(security_result.category = "MAIL_PHISHING" or re.regex(security_result.threat_name,`Phish`) nocase or re.regex(security_result.category_details,`Phish`) nocase)
security_result.threat_name != "NOT_PHISHING"
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
$Action = security_result.action
match:
$Date, $Action
outcome:
$Count = count(metadata.id)
order:
$Action asc
十大钓鱼式攻击电子邮件发件人
(security_result.category = "MAIL_PHISHING" or re.regex(security_result.threat_name,`Phish`) nocase or re.regex(security_result.category_details,`Phish`) nocase)
security_result.threat_name != "NOT_PHISHING"
$Sender = strings.coalesce(network.email.from,principal.user.email_addresses)
$Action = security_result.action
match:
$Sender, $Action
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
钓鱼式攻击文件详情
(security_result.category = "MAIL_PHISHING" or re.regex(security_result.threat_name,`Phish`) nocase or re.regex(security_result.category_details,`Phish`) nocase)
security_result.threat_name!= "NOT_PHISHING"
strings.coalesce(target.file.full_path, about.file.full_path, target.file.names) != ""
$File_Path = strings.coalesce(target.file.full_path, about.file.full_path, target.file.names)
$File_Type = strings.coalesce(about.file.mime_type, target.file.mime_type)
$Action = security_result.action
$Receiver = strings.coalesce(network.email.to, network.email.reply_to,target.user.email_addresses)
$Sender = strings.coalesce(network.email.from,principal.user.email_addresses)
$File_Hash = strings.coalesce(about.file.md5, about.file.sha256, security_result.about.file.sha256)
match:
$File_Path, $File_Type, $File_Hash, $Sender, $Receiver, $Action
outcome:
$Count = count(metadata.id)
$Date = timestamp.get_timestamp(max(metadata.event_timestamp.seconds), "%F %T")
order:
$Count desc
按文件类型划分的事件数
(security_result.category = "MAIL_PHISHING" or re.regex(security_result.threat_name,`Phish`) nocase or re.regex(security_result.category_details,`Phish`) nocase)
security_result.threat_name!= "NOT_PHISHING"
$File_Type = strings.coalesce(about.file.mime_type, target.file.mime_type)
match:
$File_Type
outcome:
$Count = count(metadata.id)
order:
$File_Type desc
按日志类型划分的供应商随时间变化的提醒
(security_result.category = "MAIL_PHISHING" or re.regex(security_result.threat_name,`Phish`) nocase or re.regex(security_result.category_details,`Phish`)nocase)
security_result.threat_name != "NOT_PHISHING"
security_result.rule_name != ""
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
$Log_Type = metadata.log_type
match:
$Date, $Log_Type
outcome:
$Count = count(metadata.id)
order:
$Date asc
前 10 个钓鱼式攻击网址
(security_result.category = "MAIL_PHISHING" or re.regex(security_result.threat_name,`Phish`) nocase or re.regex(security_result.category_details,`Phish`) nocase)
security_result.threat_name!= "NOT_PHISHING"
$URL = strings.coalesce(target.url, security_result.about.url, network.http.referral_url, principal.process.file.embedded_urls, principal.url)
$URL != ""
match:
$URL
outcome:
$Threat_Names = array_distinct(strings.coalesce(security_result.threat_name,security_result.category_details))
$Categories = array_distinct(security_result.category)
$Count = count($URL)
order:
$Count desc
limit:
10
十大最容易成为网络钓鱼电子邮件攻击目标的群体
(security_result.category = "MAIL_PHISHING" or re.regex(security_result.threat_name,`Phish`) nocase or re.regex(security_result.category_details,`Phish`) nocase)
security_result.threat_name!= "NOT_PHISHING"
$Receiver = strings.coalesce(network.email.to, network.email.reply_to, target.user.email_addresses)
$Action = security_result.action
match:
$Receiver, $Action
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
来源地理位置概览
(security_result.category = "MAIL_PHISHING" or re.regex(security_result.threat_name,`Phish`) nocase or re.regex(security_result.category_details,`Phish`) nocase)
security_result.threat_name != "NOT_PHISHING"
$Country = principal.ip_geo_artifact.location.country_or_region
$Country != ""
match:
$Country
outcome:
$Count = count(metadata.id)
$Latitude = max(principal.ip_geo_artifact.location.region_coordinates.latitude)
$Longitude = max(principal.ip_geo_artifact.location.region_coordinates.longitude)
order:
$Count desc
按严重程度划分的事件
(security_result.category = "MAIL_PHISHING" or re.regex(security_result.threat_name,`Phish`) nocase or re.regex(security_result.category_details,`Phish`) nocase)
security_result.threat_name != "NOT_PHISHING"
$Severity = security_result.severity
match:
$Severity
outcome:
$Count = count(metadata.id)
order:
$Severity desc
端口扫描检测
此信息中心可提供有关端口扫描活动和其他相关网络侦察技术的深入分析，这些技术可能表明网络基础设施中存在潜在威胁或恶意活动。通过跟踪和直观呈现此类行为，您可以检测、调查和缓解任何未经授权或可疑的网络访问尝试。
按日志类型划分的指定时间段内的事件
最近尝试连接到标准端口失败
严重程度分布
用户随时间推移的端口扫描事件
前 10 大目标 IP 地址
近期端口扫描事件
排名前 10 的来源国家/地区
前 10 个目标内部子网
最近尝试连接到非标准端口失败
10 大目标端口
排名前 10 的端口扫描来源
前 10 大来源 IP
端口/IP 比
协议分发
按主机名统计的端口扫描事件随时间的变化趋势
图表名称
查询示例
按日志类型划分的指定时间段内的事件
metadata.event_type = "SCAN_NETWORK"
or strings.coalesce(security_result.threat_name, security_result.rule_name, security_result.description, security_result.summary, metadata.product_event_type, metadata.description) = /port(?:\s|\_)?scan(?:ning|ner)?/ nocase
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
$Log_Type = metadata.log_type
match:
$Date, $Log_Type
outcome:
$Count = count(metadata.id)
order:
$Date desc
最近尝试连接到标准端口失败
metadata.event_type = "NETWORK_UNCATEGORIZED"
or metadata.event_type = "NETWORK_FLOW"
or metadata.event_type = "NETWORK_CONNECTION"
or metadata.event_type = "NETWORK_FTP"
or metadata.event_type = "NETWORK_DHCP"
or metadata.event_type = "NETWORK_DNS"
or metadata.event_type = "NETWORK_HTTP"
or metadata.event_type = "NETWORK_SMTP"
security_result.action = "BLOCK"
target.port > 19
target.port < 1025
$Date = timestamp.get_timestamp(metadata.event_timestamp.seconds, "%F %T ")
$Principal_IP = principal.ip
$Target_IP = target.ip
$Protocol = network.ip_protocol
$Port = target.port
match:
$Date, $Principal_IP, $Protocol, $Port, $Target_IP
order:
$Date desc
严重程度分布
metadata.event_type = "SCAN_NETWORK"
or strings.coalesce(security_result.threat_name, security_result.rule_name, security_result.description, security_result.summary, metadata.product_event_type, metadata.description) = /port(?:\s|\_)?scan(?:ning|ner)?/ nocase
$Severity = security_result.severity
match:
$Severity
outcome:
$Count = count(metadata.id)
order:
$Count desc
用户随时间推移的端口扫描事件
metadata.event_type = "SCAN_NETWORK"
or strings.coalesce(security_result.threat_name, security_result.rule_name, security_result.description, security_result.summary, metadata.product_event_type, metadata.description) = /port(?:\s|\_)?scan(?:ning|ner)?/ nocase
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
$User = group(principal.user.userid, principal.user.email_addresses, target.user.userid, target.user.email_addresses)
match:
$Date, $User
outcome:
$Count = count(metadata.id)
order:
$Date desc
前 10 大目标 IP 地址
metadata.event_type = "SCAN_NETWORK"
or strings.coalesce(security_result.threat_name, security_result.rule_name, security_result.description, security_result.summary, metadata.product_event_type, metadata.description) = /port(?:\s|\_)?scan(?:ning|ner)?/ nocase
$IP_Address = target.ip
$Log_Type = metadata.log_type
match:
$IP_Address, $Log_Type
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
近期端口扫描事件
metadata.event_type = "SCAN_NETWORK"
or strings.coalesce(security_result.threat_name, security_result.rule_name, security_result.description, security_result.summary, metadata.product_event_type, metadata.description) = /port(?:\s|\_)?scan(?:ning|ner)?/ nocase
principal.ip != ""
target.ip != ""
$Date = timestamp.get_timestamp(metadata.event_timestamp.seconds, "%F %T ")
$Description = strings.coalesce(security_result.threat_name, security_result.rule_name, security_result.description, security_result.summary, metadata.product_event_type, metadata.description)
$Source_IP = principal.ip
$Target_IP = target.ip
match:
$Date, $Source_IP, $Description, $Target_IP
outcome:
$Port = array_distinct(target.port)
order:
$Date desc
排名前 10 的来源国家/地区
metadata.event_type = "SCAN_NETWORK"
or strings.coalesce(security_result.threat_name, security_result.rule_name, security_result.description, security_result.summary, metadata.product_event_type, metadata.description) = /port(?:\s|\_)?scan(?:ning|ner)?/ nocase
$Country = principal.location.country_or_region
$Country != ""
match:
$Country
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
前 10 个目标内部子网
metadata.event_type = "SCAN_NETWORK"
or strings.coalesce(security_result.threat_name, security_result.rule_name, security_result.description, security_result.summary, metadata.product_event_type, metadata.description) = /port(?:\s|\_)?scan(?:ning|ner)?/ nocase
net.ip_in_range_cidr(target.ip, "10.0.0.0/8")
or net.ip_in_range_cidr(target.ip, "172.16.0.0/12")
or net.ip_in_range_cidr(target.ip, "192.168.0.0/16")
or net.ip_in_range_cidr(target.ip, "fc00::/7")
$IP_Range = if(net.ip_in_range_cidr(target.ip, "192.168.0.0/16"), strings.concat(re.capture(target.ip, /^\d+\.\d+\.\d+\./), "0/16"),
if(net.ip_in_range_cidr(target.ip, "172.16.0.0/12"), strings.concat(re.capture(target.ip, /^\d+\.\d+\./), "0.0/12"),
if(net.ip_in_range_cidr(target.ip, "10.0.0.0/8"), strings.concat(re.capture(target.ip, /^\d+\./), "0.0.0/8"),
if(net.ip_in_range_cidr(target.ip, "fc00::/7"), strings.concat(re.capture(target.ip, /^(?:[0-9A-Fa-f]{1,4}:){3}[0-9A-Fa-f]{1,4}/), "/64"), "Unknown IP address range"))))
match:
$IP_Range
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
最近尝试连接到非标准端口失败
metadata.event_type = "NETWORK_UNCATEGORIZED"
or metadata.event_type = "NETWORK_FLOW"
or metadata.event_type = "NETWORK_CONNECTION"
security_result.action = "BLOCK"
target.port < 19
or target.port > 1025
$Date = timestamp.get_timestamp(metadata.event_timestamp.seconds, "%F %T ")
$Principal_IP = principal.ip
$Target_IP = target.ip
$Protocol = network.ip_protocol
$Port = target.port
match:
$Date, $Principal_IP, $Protocol, $Port, $Target_IP
order:
$Date desc
10 大目标端口
metadata.event_type = "SCAN_NETWORK"
or strings.coalesce(security_result.threat_name, security_result.rule_name, security_result.description, security_result.summary, metadata.product_event_type, metadata.description) = /port(?:\s|\_)?scan(?:ning|ner)?/ nocase
$Port = strings.concat(target.port, " ")
$Log_Type = metadata.log_type
match:
$Port, $Log_Type
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
排名前 10 的端口扫描来源
metadata.event_type = "SCAN_NETWORK"
or strings.coalesce(security_result.threat_name, security_result.rule_name, security_result.description, security_result.summary, metadata.product_event_type, metadata.description) = /port(?:\s|\_)?scan(?:ning|ner)?/ nocase
$Country = principal.location.country_or_region
$Latitude = principal.location.region_coordinates.latitude
$Latitude != 0
$Longitude = principal.location.region_coordinates.longitude
$Longitude != 0
match:
$Country, $Latitude, $Longitude
outcome:
$Count = count(metadata.id)
order:
$Count desc
前 10 大来源 IP
metadata.event_type = "SCAN_NETWORK"
or strings.coalesce(security_result.threat_name, security_result.rule_name, security_result.description, security_result.summary, metadata.product_event_type, metadata.description) = /port(?:\s|\_)?scan(?:ning|ner)?/ nocase
$IP_Address = principal.ip
$Log_Type = metadata.log_type
match:
$IP_Address, $Log_Type
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
端口/IP 比
metadata.event_type = "SCAN_NETWORK"
or strings.coalesce(security_result.threat_name, security_result.rule_name, security_result.description, security_result.summary, metadata.product_event_type, metadata.description) = /port(?:\s|\_)?scan(?:ning|ner)?/ nocase
$Port = target.port
$Source_IP = principal.ip
outcome:
$Ratio = math.round(count_distinct(target.port) / count_distinct(principal.ip), 2)
协议分发
metadata.event_type = "SCAN_NETWORK"
or strings.coalesce(security_result.threat_name, security_result.rule_name, security_result.description, security_result.summary, metadata.product_event_type, metadata.description) = /port(?:\s|\_)?scan(?:ning|ner)?/ nocase
$Protocol = network.ip_protocol
match:
$Protocol
outcome:
$Count = count(metadata.id)
order:
$Count desc
按主机名统计的端口扫描事件随时间的变化趋势
metadata.event_type = "SCAN_NETWORK"
or strings.coalesce(security_result.threat_name, security_result.rule_name, security_result.description, security_result.summary, metadata.product_event_type, metadata.description) = /port(?:\s|\_)?scan(?:ning|ner)?/ nocase
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
$Hostname = group(principal.hostname, target.hostname)
match:
$Date, $Hostname
outcome:
$Count = count(metadata.id)
order:
$Date desc
端口和协议概览
此信息中心可提供有关网络端口活动和协议使用情况的实时和历史数据分析。它可识别有效和无效端口、潜在漏洞，并有助于优化网络安全和性能，同时确保政策合规性。
新端口活动 - 入站
允许的端口流量与被屏蔽的端口流量
按流量排序的前 10 个端口 - 出站
协议分发
常见禁止端口上的流量
按流量排序的前 10 个端口 - 入站
图表名称
查询示例
新端口活动 - 入站
$event_type = metadata.event_type
$event_type >= 16000 and $event_type <= 16007
$Direction = network.direction
$Direction = "INBOUND"
$policy = security_result.rule_name
$port = strings.concat(target.port, "")
$port != /(40202|40203|40462|41611|41612|41620|41629|41674|41684|41685|41694|41703|41712|41721|41730|41747|43448|44924|44925|45071|52818|53025|54736|443|57903|58254|62977|80|88)/
$source_ip = principal.ip
$location = principal.ip_geo_artifact.location.country_or_region
$action = security_result.action
$action != "BLOCK"
match:
$port, $action
outcome:
$Source_IP = array_distinct($source_ip)
$event_count = count(metadata.id)
order:
$event_count desc
允许的端口流量与被屏蔽的端口流量
$event_type = metadata.event_type
$event_type >= 16000 and $event_type <= 16007
$action = security_result.action
$action != "UNKNOWN_ACTION"
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
match:
$action, $Date
outcome:
$Event_Count = count(metadata.id)
order:
$Date asc
按流量排序的前 10 个端口 - 出站
$event_type = metadata.event_type
$event_type >= 16000 and $event_type <= 16007
$Logtype = metadata.log_type
$Direction = network.direction
$Direction = "OUTBOUND"
$Port = target.port
match:
$Port
outcome:
$event_count = count(metadata.id)
$logtype = array_distinct($Logtype)
order:
$event_count desc
limit:
10
协议分发
$event_type = metadata.event_type
$event_type >= 16000 and $event_type <= 16007
$Protocol = network.ip_protocol
$Protocol != "UNKNOWN_IP_PROTOCOL"
match:
$Protocol
outcome:
$Event_Count = count(metadata.id)
协议分发
$event_type = metadata.event_type
$event_type >= 16000 and $event_type <= 16007
$Protocol = network.ip_protocol
$Protocol != "UNKNOWN_IP_PROTOCOL"
match:
$Protocol
outcome:
$Event_Count = count(metadata.id)
常见禁止端口上的流量
$event_type = metadata.event_type
$event_type >= 16000 and $event_type <= 16007
$policy = security_result.rule_name
$port = strings.concat(target.port, "")
$port != /(443|53|8080|8081|34622|34756|35406|35466|35546|36602|37276|38976|41394|41672|41926|45432|46354|47416|48678|51664|51824|52086|52818|54052|54958|55276|55890|57488|57666|58546|58914|59388|60388|61000|64450|64482|64498|64598|64674|64707|64735|64739|64740|64795|64828|64880|64905|64945|64962|65004|65019|65050|65094|65114|65169|65202|65223|65264|65287|65323|65346|65378|65392|65456|8728|3389|6379|5555|2222|5060|3128|8888|27017|8088|1080)/
match:
$port
outcome:
$event_count = count(metadata.id)
order:
$event_count desc
limit:
20
按流量排序的前 10 个端口 - 入站
$event_type = metadata.event_type
$event_type >= 16000 and $event_type <= 16007
$Direction = network.direction
$Direction = "INBOUND"
$Port = target.port
$Logtype = metadata.log_type
match:
$Port
outcome:
$event_count = count(metadata.id)
$logtype = array_distinct($Logtype)
order:
$event_count desc
limit:
10
常见禁止端口上的流量
$event_type = metadata.event_type
$event_type >= 16000 and $event_type <= 16007
$policy = security_result.rule_name
$port = strings.concat(target.port, "")
$port != /(443|53|8080|8081|34622|34756|35406|35466|35546|36602|37276|38976|41394|41672|41926|45432|46354|47416|48678|51664|51824|52086|52818|54052|54958|55276|55890|57488|57666|58546|58914|59388|60388|61000|64450|64482|64498|64598|64674|64707|64735|64739|64740|64795|64828|64880|64905|64945|64962|65004|65019|65050|65094|65114|65169|65202|65223|65264|65287|65323|65346|65378|65392|65456|8728|3389|6379|5555|2222|5060|3128|8888|27017|8088|1080)/
match:
$port
outcome:
$event_count = count(metadata.id)
order:
$event_count desc
limit:
20
按流量排序的前 10 个端口 - 出站
$event_type = metadata.event_type
$event_type >= 16000 and $event_type <= 16007
$Logtype = metadata.log_type
$Direction = network.direction
$Direction = "OUTBOUND"
$Port = target.port
match:
$Port
outcome:
$event_count = count(metadata.id)
$logtype = array_distinct($Logtype)
order:
$event_count desc
limit:
10
允许的端口流量与被屏蔽的端口流量
$event_type = metadata.event_type
$event_type >= 16000 and $event_type <= 16007
$action = security_result.action
$action != "UNKNOWN_ACTION"
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
match:
$action, $Date
outcome:
$Event_Count = count(metadata.id)
order:
$Date asc
按流量排序的前 10 个端口 - 入站
$event_type = metadata.event_type
$event_type >= 16000 and $event_type <= 16007
$Direction = network.direction
$Direction = "INBOUND"
$Port = target.port
$Logtype = metadata.log_type
match:
$Port
outcome:
$event_count = count(metadata.id)
$logtype = array_distinct($Logtype)
order:
$event_count desc
limit:
10
新端口活动 - 入站
$event_type = metadata.event_type
$event_type >= 16000 and $event_type <= 16007
$Direction = network.direction
$Direction = "INBOUND"
$policy = security_result.rule_name
$port = strings.concat(target.port, "")
$port != /(40202|40203|40462|41611|41612|41620|41629|41674|41684|41685|41694|41703|41712|41721|41730|41747|43448|44924|44925|45071|52818|53025|54736|443|57903|58254|62977|80|88)/
$source_ip = principal.ip
$location = principal.ip_geo_artifact.location.country_or_region
$action = security_result.action
$action != "BLOCK"
match:
$port, $action
outcome:
$Source_IP = array_distinct($source_ip)
$event_count = count(metadata.id)
order:
$event_count desc
PowerShell
此信息中心旨在分析和监控组织内的 PowerShell 活动。它可帮助您深入了解命令执行、用户互动和潜在的安全风险。通过汇总和直观呈现这些数据，信息中心有助于识别潜在问题、跟踪威胁并提升整体安全性。
按进程事件类型列出的 PowerShell 执行情况
最不常见的文件路径
最不常见的主机
最不常用的命令行
前 10 位用户
按安全性结果操作划分的 PowerShell 事件
最不常见的用户
PowerShell 出站网络连接
PowerShell 活动摘要
10 大命令行
PowerShell 事件（按严重程度）
字符变量混淆
10 大热门主持人
通过 PowerShell 下载文件
包含 PowerShell 的前 10 大事件类型
前 10 大文件路径
图表名称
查询示例
按进程事件类型列出的 PowerShell 执行情况
$event.metadata.event_type = "PROCESS_UNCATEGORIZED"
or $event.metadata.event_type = "PROCESS_LAUNCH"
or $event.metadata.event_type = "PROCESS_INJECTION"
or $event.metadata.event_type = "PROCESS_PRIVILEGE_ESCALATION"
or $event.metadata.event_type = "PROCESS_TERMINATION"
or $event.metadata.event_type = "PROCESS_OPEN"
or $event.metadata.event_type = "PROCESS_MODULE_LOAD"
$Command_Line = group($event.principal.process.command_line, $event.target.process.command_line)
$Command_Line = /(?:pwsh|powershell(?:_ise)?)\.exe/ nocase
$Event_Type = $event.metadata.event_type
$Date = timestamp.get_date($event.metadata.event_timestamp.seconds)
match:
$Event_Type, $Date
outcome:
$Count = count($event.metadata.id)
order:
$Count desc
limit:
10
最不常见的文件路径
$event.principal.process.file.full_path = /(?:pwsh|powershell(?:_ise)?)\.exe/ nocase
$Full_Path = group($event.principal.process.file.full_path, $event.target.process.file.full_path)
$Full_Path != ""
match:
$Full_Path
outcome:
$Count = count($event.metadata.id)
order:
$Count asc
limit:
100
最不常见的主机
$Command_Line = group($event.principal.process.command_line, $event.target.process.command_line)
$Command_Line = /(?:pwsh|powershell(?:_ise)?)\.exe/ nocase
$Hostname = $event.principal.hostname
match:
$Hostname
outcome:
$Count = count($event.metadata.id)
order:
$Count asc
limit:
100
最不常用的命令行
$Command_Line = group($event.principal.process.command_line, $event.target.process.command_line)
$Command_Line = /(?:pwsh|powershell(?:_ise)?)\.exe/ nocase
match:
$Command_Line
outcome:
$Count = count($event.metadata.id)
order:
$Count asc
limit:
10
最不常用的命令行
$Command_Line = group($event.principal.process.command_line, $event.target.process.command_line)
$Command_Line = /(?:pwsh|powershell(?:_ise)?)\.exe/ nocase
match:
$Command_Line
outcome:
$Count = count($event.metadata.id)
order:
$Count asc
limit:
10
前 10 位用户
$event.principal.user.userid != /\$$/
$Command_Line = group($event.principal.process.command_line, $event.target.process.command_line)
$Command_Line = /(?:pwsh|powershell(?:_ise)?)\.exe/ nocase
$User = $event.principal.user.userid
$User != ""
match:
$User
outcome:
$Count = count($event.metadata.id)
order:
$Count desc
limit:
10
PowerShell Events by Security Result Action
$Powershell = group($event.principal.process.command_line, $event.target.process.command_line)
$Powershell = /(?:pwsh|powershell(?:_ise)?)\.exe/ nocase
$Action = $event.security_result.action
match:
$Action
outcome:
$Count = count($event.security_result.action)
order:
$Count desc
PowerShell Events by Security Result Action
$Powershell = group($event.principal.process.command_line, $event.target.process.command_line)
$Powershell = /(?:pwsh|powershell(?:_ise)?)\.exe/ nocase
$Action = $event.security_result.action
match:
$Action
outcome:
$Count = count($event.security_result.action)
order:
$Count desc
Least Common Users
$event.principal.user.userid != /\$$/
$Command_Line = group($event.principal.process.command_line, $event.target.process.command_line)
$Command_Line = /(?:pwsh|powershell(?:_ise)?)\.exe/ nocase
$User = $event.principal.user.userid
match:
$User
outcome:
$Count = count($event.metadata.id)
order:
$Count asc
limit:
100
PowerShell 出站网络连接
$event.metadata.event_type = "NETWORK_CONNECTION"
$event.network.direction = "OUTBOUND"
$Command_Line = group($event.principal.process.command_line, $event.target.process.command_line)
$Command_Line = /(?:pwsh|powershell(?:_ise)?)\.exe/ nocase
$Destination_IP = $event.target.ip
$Source_IP = $event.principal.ip
$Direction = $event.network.direction
match:
$Source_IP, $Direction, $Destination_IP, $Command_Line
outcome:
$Count = count($event.metadata.id)
order:
$Count desc
limit:
50
PowerShell 出站网络连接
$event.metadata.event_type = "NETWORK_CONNECTION"
$event.network.direction = "OUTBOUND"
$Command_Line = group($event.principal.process.command_line, $event.target.process.command_line)
$Command_Line = /(?:pwsh|powershell(?:_ise)?)\.exe/ nocase
$Destination_IP = $event.target.ip
$Source_IP = $event.principal.ip
$Direction = $event.network.direction
match:
$Source_IP, $Direction, $Destination_IP, $Command_Line
outcome:
$Count = count($event.metadata.id)
order:
$Count desc
limit:
50
PowerShell 活动摘要
$Command_Line = group($event.principal.process.command_line, $event.target.process.command_line)
$Command_Line = /(?:pwsh|powershell(?:_ise)?)\.exe/ nocase
$Event_Type = $event.metadata.event_type
$Log_Type = $event.metadata.log_type
$Direction = $event.network.direction
match:
$Event_Type, $Log_Type, $Direction, $Command_Line
outcome:
$Count = count($event.metadata.id)
order:
$Count desc
limit:
50
10 大命令行
$Command_Line = group($event.principal.process.command_line, $event.target.process.command_line)
$Command_Line = /(?:pwsh|powershell(?:_ise)?)\.exe/ nocase
match:
$Command_Line
outcome:
$Count = count($event.metadata.id)
order:
$Count desc
limit:
10
PowerShell 事件（按严重程度）
$Powershell = group($event.principal.process.command_line, $event.target.process.command_line)
$Powershell = /(?:pwsh|powershell(?:_ise)?)\.exe/ nocase
$Severity = $event.security_result.severity
match:
$Severity
outcome:
$Count = count($event.security_result.severity)
order:
$Count desc
按进程事件类型列出的 PowerShell 执行情况
$event.metadata.event_type = "PROCESS_UNCATEGORIZED"
or $event.metadata.event_type = "PROCESS_LAUNCH"
or $event.metadata.event_type = "PROCESS_INJECTION"
or $event.metadata.event_type = "PROCESS_PRIVILEGE_ESCALATION"
or $event.metadata.event_type = "PROCESS_TERMINATION"
or $event.metadata.event_type = "PROCESS_OPEN"
or $event.metadata.event_type = "PROCESS_MODULE_LOAD"
$Command_Line = group($event.principal.process.command_line, $event.target.process.command_line)
$Command_Line = /(?:pwsh|powershell(?:_ise)?)\.exe/ nocase
$Event_Type = $event.metadata.event_type
match:
$Event_Type
outcome:
$Count = count($event.metadata.id)
order:
$Count desc
字符变量混淆
$Command_Line = group($event.principal.process.command_line, $event.target.process.command_line)
$Command_Line = /(?:powershell(?:\.exe)?).*\[char(?:\]|\[)/ nocase
or $Command_Line = /(?:powershell(?:\.exe)?).*(?:iex|invoke-expression)/ nocase
or $Command_Line = /(?:powershell(?:\.exe)?).*(?:tochararray)/ nocase
$Registry_Value = $event.target.registry.registry_value_data
match:
$Command_Line, $Registry_Value
outcome:
$Count = count($event.metadata.id)
limit:
50
Top 10 Hosts
$Command_Line = group($event.principal.process.command_line, $event.target.process.command_line)
$Command_Line = /(?:pwsh|powershell(?:_ise)?)\.exe/ nocase
$Hostname = $event.principal.hostname
$Hostname != ""
match:
$Hostname
outcome:
$Count = count($event.metadata.id)
order:
$Count desc
limit:
10
Top 10 Users
$event.principal.user.userid != /\$$/
$Command_Line = group($event.principal.process.command_line, $event.target.process.command_line)
$Command_Line = /(?:pwsh|powershell(?:_ise)?)\.exe/ nocase
$User = $event.principal.user.userid
match:
$User
outcome:
$Count = count($event.metadata.id)
order:
$Count desc
limit:
10
File Downloads via PowerShell
$Command_Line = group($event.principal.process.command_line, $event.target.process.command_line)
$Command_Line = /(?:powershell(?:\.exe)?).*?(?:Invoke\-(?:WebRequest|RestMethod)|Start\-BitsTransfer)/ nocase
or $Command_Line = /(?:powershell(?:\.exe)?).*?(?:system\.net\.(?:http\.httpclient|webclient).*?(?:downloadfile|writeallbytes))/ nocase
match:
$Command_Line
outcome:
$Count = count($event.metadata.id)
limit:
50
Top 10 Event Types Containing PowerShell
$Command_Line = group($event.principal.process.command_line, $event.target.process.command_line)
$Command_Line = /(?:pwsh|powershell(?:_ise)?)\.exe/ nocase
$Event_Type = $event.metadata.event_type
match:
$Event_Type
outcome:
$Count = count($event.metadata.id)
order:
$Count desc
limit:
10
Powershell Activity Summary
$Command_Line = group($event.principal.process.command_line, $event.target.process.command_line)
$Command_Line = /(?:pwsh|powershell(?:_ise)?)\.exe/ nocase
$Event_Type = $event.metadata.event_type
$Log_Type = $event.metadata.log_type
$Direction = $event.network.direction
match:
$Event_Type, $Log_Type, $Direction, $Command_Line
outcome:
$Count = count($event.metadata.id)
order:
$Count desc
limit:
50
Top 10 Command Lines
$Command_Line = group($event.principal.process.command_line, $event.target.process.command_line)
$Command_Line = /(?:pwsh|powershell(?:_ise)?)\.exe/ nocase
match:
$Command_Line
outcome:
$Count = count($event.metadata.id)
order:
$Count desc
limit:
10
Least Common Users
$event.principal.user.userid != /\$$/
$Command_Line = group($event.principal.process.command_line, $event.target.process.command_line)
$Command_Line = /(?:pwsh|powershell(?:_ise)?)\.exe/ nocase
$User = $event.principal.user.userid
match:
$User
outcome:
$Count = count($event.metadata.id)
order:
$Count asc
limit:
100
Top 10 Hosts
$Command_Line = group($event.principal.process.command_line, $event.target.process.command_line)
$Command_Line = /(?:pwsh|powershell(?:_ise)?)\.exe/ nocase
$Hostname = $event.principal.hostname
match:
$Hostname
outcome:
$Count = count($event.metadata.id)
order:
$Count desc
limit:
10
Top 10 Event Types Containing PowerShell
$Command_Line = group($event.principal.process.command_line, $event.target.process.command_line)
$Command_Line = /(?:pwsh|powershell(?:_ise)?)\.exe/ nocase
$Event_Type = $event.metadata.event_type
match:
$Event_Type
outcome:
$Count = count($event.metadata.id)
order:
$Count desc
limit:
10
Least Common File Paths
$event.principal.process.file.full_path = /(?:pwsh|powershell(?:_ise)?)\.exe/ nocase
$Full_Path = group($event.principal.process.file.full_path, $event.target.process.file.full_path)
$Full_Path != ""
match:
$Full_Path
outcome:
$Count = count($event.metadata.id)
order:
$Count asc
limit:
100
Powershell Execution by Process Event Type
$event.metadata.event_type = "PROCESS_UNCATEGORIZED"
or $event.metadata.event_type = "PROCESS_LAUNCH"
or $event.metadata.event_type = "PROCESS_INJECTION"
or $event.metadata.event_type = "PROCESS_PRIVILEGE_ESCALATION"
or $event.metadata.event_type = "PROCESS_TERMINATION"
or $event.metadata.event_type = "PROCESS_OPEN"
or $event.metadata.event_type = "PROCESS_MODULE_LOAD"
$Command_Line = group($event.principal.process.command_line, $event.target.process.command_line)
$Command_Line = /(?:pwsh|powershell(?:_ise)?)\.exe/ nocase
$Event_Type = $event.metadata.event_type
$Date = timestamp.get_date($event.metadata.event_timestamp.seconds)
match:
$Event_Type, $Date
outcome:
$Count = count($event.metadata.id)
order:
$Count desc
limit:
10
Top 10 File Paths
$event.principal.process.file.full_path = /(?:pwsh|powershell(?:_ise)?)\.exe/ nocase
$Full_Path = group($event.principal.process.file.full_path, $event.target.process.file.full_path)
$Full_Path != ""
match:
$Full_Path
outcome:
$Count = count($event.metadata.id)
order:
$Count desc
limit:
10
Char Variable Obfuscation
$Command_Line = group($event.principal.process.command_line, $event.target.process.command_line)
$Command_Line = /(?:powershell(?:\.exe)?).*\[char(?:\]|\[)/ nocase
or $Command_Line = /(?:powershell(?:\.exe)?).*(?:iex|invoke-expression)/ nocase
or $Command_Line = /(?:powershell(?:\.exe)?).*(?:tochararray)/ nocase
$Registry_Value = $event.target.registry.registry_value_data
match:
$Command_Line, $Registry_Value
outcome:
$Count = count($event.metadata.id)
limit:
50
通过 PowerShell 下载文件
$Command_Line = group($event.principal.process.command_line, $event.target.process.command_line)
$Command_Line = /(?:powershell(?:\.exe)?).*?(?:Invoke\-(?:WebRequest|RestMethod)|Start\-BitsTransfer)/ nocase
or $Command_Line = /(?:powershell(?:\.exe)?).*?(?:system\.net\.(?:http\.httpclient|webclient).*?(?:downloadfile|writeallbytes))/ nocase
match:
$Command_Line
outcome:
$Count = count($event.metadata.id)
limit:
50
按进程事件类型列出的 PowerShell 执行情况
$event.metadata.event_type = "PROCESS_UNCATEGORIZED"
or $event.metadata.event_type = "PROCESS_LAUNCH"
or $event.metadata.event_type = "PROCESS_INJECTION"
or $event.metadata.event_type = "PROCESS_PRIVILEGE_ESCALATION"
or $event.metadata.event_type = "PROCESS_TERMINATION"
or $event.metadata.event_type = "PROCESS_OPEN"
or $event.metadata.event_type = "PROCESS_MODULE_LOAD"
$Command_Line = group($event.principal.process.command_line, $event.target.process.command_line)
$Command_Line = /(?:pwsh|powershell(?:_ise)?)\.exe/ nocase
$Event_Type = $event.metadata.event_type
match:
$Event_Type
outcome:
$Count = count($event.metadata.id)
order:
$Count desc
PowerShell 事件（按严重程度）
$Powershell = group($event.principal.process.command_line, $event.target.process.command_line)
$Powershell = /(?:pwsh|powershell(?:_ise)?)\.exe/ nocase
$Severity = $event.security_result.severity
match:
$Severity
outcome:
$Count = count($event.security_result.severity)
order:
$Count desc
前 10 大文件路径
$event.principal.process.file.full_path = /(?:pwsh|powershell(?:_ise)?)\.exe/ nocase
$Full_Path = group($event.principal.process.file.full_path, $event.target.process.file.full_path)
$Full_Path != ""
match:
$Full_Path
outcome:
$Count = count($event.metadata.id)
order:
$Count desc
limit:
10
最不常见的主机
$Command_Line = group($event.principal.process.command_line, $event.target.process.command_line)
$Command_Line = /(?:pwsh|powershell(?:_ise)?)\.exe/ nocase
$Hostname = $event.principal.hostname
match:
$Hostname
outcome:
$Count = count($event.metadata.id)
order:
$Count asc
limit:
100
特权访问管理
此信息中心可跟踪特权访问活动，识别用户、主机名和 IP 地址等来源，同时突出显示关键资产。它可帮助安全团队监控访问趋势和管理风险，确保只有获得授权的个人才能访问敏感系统和数据。
10 大管理员
10 大热门资产
一段时间内的事件
前 10 大用户账号
事件类型分布情况
前 10 个目标主机名
前 10 大来源 IP
前 10 个来源用户名
图表名称
查询示例
10 大管理员
principal.user.attribute.roles.type = "ADMINISTRATOR"
$Admin = principal.user.userid
match:
$Admin
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
10 大热门资产
$Asset = target.asset.hostname
$Asset != ""
match:
$Asset
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
一段时间内的事件
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
match:
$Date
outcome:
$Count = count(metadata.id)
order:
$Date desc
前 10 大用户账号
$Account = target.user.userid
$Account != ""
match:
$Account
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
事件类型分布情况
$Event_Type = metadata.event_type
match:
$Event_Type
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
50
前 10 个目标主机名
$Hostname = target.hostname
$Hostname != ""
match:
$Hostname
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
前 10 大来源 IP
$Source_IP = principal.ip
$Source_IP != ""
match:
$Source_IP
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
前 10 个来源用户名
$Username = principal.user.userid
$Username != ""
match:
$Username
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
流程事件摘要
此信息中心通过收集和直观呈现各种进程发生情况、主机、用户和事件的数据，让您全面了解网络活动。该信息中心会突出显示关键指标、图表和异常情况，以便您深入了解事件频率和流程效果。它有助于主动监控系统健康状况、通过异常行为检测潜在的安全威胁，以及确定需要提高效率的方面。
PowerShell 事件总数
前 10 个父进程
前 10 位用户
命令 shell 事件总数
不同用户总数
被屏蔽的事件总数
前 10 大 PowerShell 事件
前 10 个哈希值
处理事件
按用户数统计的前 10 大 shell 命令
一段时间内的流程事件
10 大主机名
一段时间内的进程终止事件
进程事件总数
10 大热门主持人
不同主机总数
不同主机名总数
活动类型分布情况
近期进程事件
前 10 大命令 shell 事件
图表名称
查询示例
PowerShell 事件总数
$event.metadata.event_type = "PROCESS_UNCATEGORIZED"
or $event.metadata.event_type = "PROCESS_LAUNCH"
or $event.metadata.event_type = "PROCESS_INJECTION"
or $event.metadata.event_type = "PROCESS_PRIVILEGE_ESCALATION"
or $event.metadata.event_type = "PROCESS_TERMINATION"
or $event.metadata.event_type = "PROCESS_OPEN"
or $event.metadata.event_type = "PROCESS_MODULE_LOAD"
$Powershell = group($event.principal.process.command_line, $event.target.process.command_line)
$Powershell = /(?:pwsh|powershell(?:_ise)?)\.exe/ nocase
outcome:
$Count = count($Powershell)
前 10 个父进程
metadata.event_type = "PROCESS_UNCATEGORIZED"
or metadata.event_type = "PROCESS_LAUNCH"
or metadata.event_type = "PROCESS_INJECTION"
or metadata.event_type = "PROCESS_PRIVILEGE_ESCALATION"
or metadata.event_type = "PROCESS_TERMINATION"
or metadata.event_type = "PROCESS_OPEN"
or metadata.event_type = "PROCESS_MODULE_LOAD"
$Event_Type = metadata.event_type
$Parent_Process = re.capture(principal.process.file.full_path, `\w+.exe$`)
$Parent_Process != ""
match:
$Parent_Process, $Event_Type
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
前 10 位用户
$event.metadata.event_type = "PROCESS_UNCATEGORIZED"
or $event.metadata.event_type = "PROCESS_LAUNCH"
or $event.metadata.event_type = "PROCESS_INJECTION"
or $event.metadata.event_type = "PROCESS_PRIVILEGE_ESCALATION"
or $event.metadata.event_type = "PROCESS_TERMINATION"
or $event.metadata.event_type = "PROCESS_OPEN"
or $event.metadata.event_type = "PROCESS_MODULE_LOAD"
$Event_Type = $event.metadata.event_type
$User = strings.concat($event.principal.user.userid, " ")
match:
$User, $Event_Type
outcome:
$Count = count($event.metadata.id)
order:
$Count desc
limit:
10
命令 shell 事件总数
metadata.event_type = "PROCESS_UNCATEGORIZED"
or metadata.event_type = "PROCESS_LAUNCH"
or metadata.event_type = "PROCESS_INJECTION"
or metadata.event_type = "PROCESS_PRIVILEGE_ESCALATION"
or metadata.event_type = "PROCESS_TERMINATION"
or metadata.event_type = "PROCESS_OPEN"
or metadata.event_type = "PROCESS_MODULE_LOAD"
$Command_Shell = principal.process.command_line
$Command_Shell = /(?:cmd|shell)\.exe/ nocase or $Command_Shell = /\/(bash|sh|zsh)/ nocase
outcome:
$Count = count($Command_Shell)
不同用户总数
$event.metadata.event_type = "PROCESS_UNCATEGORIZED"
or $event.metadata.event_type = "PROCESS_LAUNCH"
or $event.metadata.event_type = "PROCESS_INJECTION"
or $event.metadata.event_type = "PROCESS_PRIVILEGE_ESCALATION"
or $event.metadata.event_type = "PROCESS_TERMINATION"
or $event.metadata.event_type = "PROCESS_OPEN"
or $event.metadata.event_type = "PROCESS_MODULE_LOAD"
outcome:
$Count = count_distinct($event.principal.user.userid)
被屏蔽的事件总数
$event.metadata.event_type = "PROCESS_UNCATEGORIZED"
or $event.metadata.event_type = "PROCESS_LAUNCH"
or $event.metadata.event_type = "PROCESS_INJECTION"
or $event.metadata.event_type = "PROCESS_PRIVILEGE_ESCALATION"
or $event.metadata.event_type = "PROCESS_TERMINATION"
or $event.metadata.event_type = "PROCESS_OPEN"
or $event.metadata.event_type = "PROCESS_MODULE_LOAD"
$event.security_result.action = "BLOCK"
outcome:
$Count = count($event.metadata.id)
PowerShell 事件总数
metadata.event_type = "PROCESS_UNCATEGORIZED"
or metadata.event_type = "PROCESS_LAUNCH"
or metadata.event_type = "PROCESS_INJECTION"
or metadata.event_type = "PROCESS_PRIVILEGE_ESCALATION"
or metadata.event_type = "PROCESS_TERMINATION"
or metadata.event_type = "PROCESS_OPEN"
or metadata.event_type = "PROCESS_MODULE_LOAD"
$Powershell = group(principal.process.command_line, target.process.command_line)
$Powershell = /(?:pwsh|powershell(?:_ise)?)\.exe/ nocase
outcome:
$Count = count($Powershell)
前 10 大 PowerShell 事件
$event.metadata.event_type = "PROCESS_UNCATEGORIZED"
or $event.metadata.event_type = "PROCESS_LAUNCH"
or $event.metadata.event_type = "PROCESS_INJECTION"
or $event.metadata.event_type = "PROCESS_PRIVILEGE_ESCALATION"
or $event.metadata.event_type = "PROCESS_TERMINATION"
or $event.metadata.event_type = "PROCESS_OPEN"
or $event.metadata.event_type = "PROCESS_MODULE_LOAD"
$Powershell = group($event.principal.process.command_line, $event.target.process.command_line)
$Powershell = /(?:pwsh|powershell(?:_ise)?)\.exe/ nocase
match:
$Powershell
outcome:
$Count = count($event.metadata.id)
order:
$Count desc
limit:
10
前 10 个哈希值
metadata.event_type = "PROCESS_UNCATEGORIZED"
or metadata.event_type = "PROCESS_LAUNCH"
or metadata.event_type = "PROCESS_INJECTION"
or metadata.event_type = "PROCESS_PRIVILEGE_ESCALATION"
or metadata.event_type = "PROCESS_TERMINATION"
or metadata.event_type = "PROCESS_OPEN"
or metadata.event_type = "PROCESS_MODULE_LOAD"
$Event_Type = metadata.event_type
$Hash = group(principal.process.file.md5, principal.process.file.sha1, principal.process.file.sha256, target.process.file.md5, target.process.file.sha1, target.process.file.sha256)
$Hash != ""
match:
$Hash, $Event_Type
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
处理事件
$event.metadata.event_type = "PROCESS_UNCATEGORIZED"
or $event.metadata.event_type = "PROCESS_LAUNCH"
or $event.metadata.event_type = "PROCESS_INJECTION"
or $event.metadata.event_type = "PROCESS_PRIVILEGE_ESCALATION"
or $event.metadata.event_type = "PROCESS_TERMINATION"
or $event.metadata.event_type = "PROCESS_OPEN"
or $event.metadata.event_type = "PROCESS_MODULE_LOAD"
$Hostname = $event.principal.hostname
$User = $event.principal.user.userid
$Parent_Process = $event.principal.process.file.full_path
$Parent_Command_Line = $event.principal.process.command_line
$Target_Process = $event.target.process.file.full_path
$Target_Command_Line = $event.target.process.command_line
match:
$Hostname, $User, $Parent_Process, $Parent_Command_Line, $Target_Process, $Target_Command_Line
outcome:
$Time = timestamp.get_timestamp(max($event.metadata.event_timestamp.seconds))
order:
$Time desc
limit:
50
按用户数统计的前 10 大 shell 命令
metadata.event_type = "PROCESS_UNCATEGORIZED"
or metadata.event_type = "PROCESS_LAUNCH"
or metadata.event_type = "PROCESS_INJECTION"
or metadata.event_type = "PROCESS_PRIVILEGE_ESCALATION"
or metadata.event_type = "PROCESS_TERMINATION"
or metadata.event_type = "PROCESS_OPEN"
or metadata.event_type = "PROCESS_MODULE_LOAD"
$Shell = principal.process.command_line
$Shell = /(?:pwsh|powershell(?:_ise)?)\.exe/ nocase
or $Shell = /(?:cmd|shell)\.exe/ nocase
or $Shell = /\/(bash|sh|zsh)/ nocase
$User = principal.user.userid
match:
$Shell, $User
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
一段时间内的流程事件
metadata.event_type = "PROCESS_UNCATEGORIZED"
or metadata.event_type = "PROCESS_LAUNCH"
or metadata.event_type = "PROCESS_INJECTION"
or metadata.event_type = "PROCESS_PRIVILEGE_ESCALATION"
or metadata.event_type = "PROCESS_TERMINATION"
or metadata.event_type = "PROCESS_OPEN"
or metadata.event_type = "PROCESS_MODULE_LOAD"
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
match:
$Date
outcome:
$Count = count(metadata.id)
order:
$Date desc
10 大主机名
metadata.event_type = "PROCESS_UNCATEGORIZED"
or metadata.event_type = "PROCESS_LAUNCH"
or metadata.event_type = "PROCESS_INJECTION"
or metadata.event_type = "PROCESS_PRIVILEGE_ESCALATION"
or metadata.event_type = "PROCESS_TERMINATION"
or metadata.event_type = "PROCESS_OPEN"
or metadata.event_type = "PROCESS_MODULE_LOAD"
$Event_Type = metadata.event_type
$Hostname = principal.hostname
match:
$Hostname, $Event_Type
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
前 10 位用户
metadata.event_type = "PROCESS_UNCATEGORIZED"
or metadata.event_type = "PROCESS_LAUNCH"
or metadata.event_type = "PROCESS_INJECTION"
or metadata.event_type = "PROCESS_PRIVILEGE_ESCALATION"
or metadata.event_type = "PROCESS_TERMINATION"
or metadata.event_type = "PROCESS_OPEN"
or metadata.event_type = "PROCESS_MODULE_LOAD"
$Event_Type = metadata.event_type
$User = strings.concat(principal.user.userid, " ")
match:
$User, $Event_Type
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
一段时间内的进程终止事件
metadata.event_type = "PROCESS_TERMINATION"
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
match:
$Date
outcome:
$Count = count(metadata.id)
order:
$Date desc
被屏蔽的事件总数
metadata.event_type = "PROCESS_UNCATEGORIZED"
or metadata.event_type = "PROCESS_LAUNCH"
or metadata.event_type = "PROCESS_INJECTION"
or metadata.event_type = "PROCESS_PRIVILEGE_ESCALATION"
or metadata.event_type = "PROCESS_TERMINATION"
or metadata.event_type = "PROCESS_OPEN"
or metadata.event_type = "PROCESS_MODULE_LOAD"
security_result.action = "BLOCK"
outcome:
$Count = count(metadata.id)
不同用户总数
metadata.event_type = "PROCESS_UNCATEGORIZED"
or metadata.event_type = "PROCESS_LAUNCH"
or metadata.event_type = "PROCESS_INJECTION"
or metadata.event_type = "PROCESS_PRIVILEGE_ESCALATION"
or metadata.event_type = "PROCESS_TERMINATION"
or metadata.event_type = "PROCESS_OPEN"
or metadata.event_type = "PROCESS_MODULE_LOAD"
outcome:
$Count = count_distinct(principal.user.userid)
进程事件总数
metadata.event_type = "PROCESS_UNCATEGORIZED"
or metadata.event_type = "PROCESS_LAUNCH"
or metadata.event_type = "PROCESS_INJECTION"
or metadata.event_type = "PROCESS_PRIVILEGE_ESCALATION"
or metadata.event_type = "PROCESS_TERMINATION"
or metadata.event_type = "PROCESS_OPEN"
or metadata.event_type = "PROCESS_MODULE_LOAD"
outcome:
$Count = count(metadata.id)
10 大热门主持人
$event.metadata.event_type = "PROCESS_UNCATEGORIZED"
or $event.metadata.event_type = "PROCESS_LAUNCH"
or $event.metadata.event_type = "PROCESS_INJECTION"
or $event.metadata.event_type = "PROCESS_PRIVILEGE_ESCALATION"
or $event.metadata.event_type = "PROCESS_TERMINATION"
or $event.metadata.event_type = "PROCESS_OPEN"
or $event.metadata.event_type = "PROCESS_MODULE_LOAD"
$Event_Type = $event.metadata.event_type
$Hostname = $event.principal.hostname
match:
$Hostname, $Event_Type
outcome:
$Count = count($event.metadata.id)
order:
$Count desc
limit:
10
进程事件总数
$event.metadata.event_type = "PROCESS_UNCATEGORIZED"
or $event.metadata.event_type = "PROCESS_LAUNCH"
or $event.metadata.event_type = "PROCESS_INJECTION"
or $event.metadata.event_type = "PROCESS_PRIVILEGE_ESCALATION"
or $event.metadata.event_type = "PROCESS_TERMINATION"
or $event.metadata.event_type = "PROCESS_OPEN"
or $event.metadata.event_type = "PROCESS_MODULE_LOAD"
outcome:
$Count = count($event.metadata.id)
不同主机总数
$event.metadata.event_type = "PROCESS_UNCATEGORIZED"
or $event.metadata.event_type = "PROCESS_LAUNCH"
or $event.metadata.event_type = "PROCESS_INJECTION"
or $event.metadata.event_type = "PROCESS_PRIVILEGE_ESCALATION"
or $event.metadata.event_type = "PROCESS_TERMINATION"
or $event.metadata.event_type = "PROCESS_OPEN"
or $event.metadata.event_type = "PROCESS_MODULE_LOAD"
outcome:
$Count = count_distinct($event.principal.hostname)
不同主机名总数
metadata.event_type = "PROCESS_UNCATEGORIZED"
or metadata.event_type = "PROCESS_LAUNCH"
or metadata.event_type = "PROCESS_INJECTION"
or metadata.event_type = "PROCESS_PRIVILEGE_ESCALATION"
or metadata.event_type = "PROCESS_TERMINATION"
or metadata.event_type = "PROCESS_OPEN"
or metadata.event_type = "PROCESS_MODULE_LOAD"
outcome:
$Count = count_distinct(principal.hostname)
命令 shell 事件总数
$event.metadata.event_type = "PROCESS_UNCATEGORIZED"
or $event.metadata.event_type = "PROCESS_LAUNCH"
or $event.metadata.event_type = "PROCESS_INJECTION"
or $event.metadata.event_type = "PROCESS_PRIVILEGE_ESCALATION"
or $event.metadata.event_type = "PROCESS_TERMINATION"
or $event.metadata.event_type = "PROCESS_OPEN"
or $event.metadata.event_type = "PROCESS_MODULE_LOAD"
$Command_Shell = $event.principal.process.command_line
$Command_Shell = /(?:cmd|shell)\.exe/ nocase or $Command_Shell = /\/(bash|sh|zsh)/ nocase
outcome:
$Count = count($Command_Shell)
活动类型分布情况
metadata.event_type = "PROCESS_UNCATEGORIZED"
or metadata.event_type = "PROCESS_LAUNCH"
or metadata.event_type = "PROCESS_INJECTION"
or metadata.event_type = "PROCESS_PRIVILEGE_ESCALATION"
or metadata.event_type = "PROCESS_TERMINATION"
or metadata.event_type = "PROCESS_OPEN"
or metadata.event_type = "PROCESS_MODULE_LOAD"
$Event_Type = metadata.event_type
match:
$Event_Type
outcome:
$Count = count(metadata.id)
order:
$Count desc
近期进程事件
metadata.event_type = "PROCESS_UNCATEGORIZED"
or metadata.event_type = "PROCESS_LAUNCH"
or metadata.event_type = "PROCESS_INJECTION"
or metadata.event_type = "PROCESS_PRIVILEGE_ESCALATION"
or metadata.event_type = "PROCESS_TERMINATION"
or metadata.event_type = "PROCESS_OPEN"
or metadata.event_type = "PROCESS_MODULE_LOAD"
$Hostname = principal.hostname
$User = principal.user.userid
$Parent_Process = principal.process.file.full_path
$Parent_Command_Line = principal.process.command_line
$Target_Process = target.process.file.full_path
$Target_Command_Line = target.process.command_line
match:
$Hostname, $User, $Parent_Process, $Parent_Command_Line, $Target_Process, $Target_Command_Line
outcome:
$Time = timestamp.get_timestamp(max(metadata.event_timestamp.seconds), "%F %T")
order:
$Time desc
前 10 大命令 shell 事件
$event.metadata.event_type = "PROCESS_UNCATEGORIZED"
or $event.metadata.event_type = "PROCESS_LAUNCH"
or $event.metadata.event_type = "PROCESS_INJECTION"
or $event.metadata.event_type = "PROCESS_PRIVILEGE_ESCALATION"
or $event.metadata.event_type = "PROCESS_TERMINATION"
or $event.metadata.event_type = "PROCESS_OPEN"
or $event.metadata.event_type = "PROCESS_MODULE_LOAD"
$Command_Shell = $event.principal.process.command_line
$Command_Shell = /(?:cmd|shell)\.exe/ nocase or $Command_Shell = /\/(bash|sh|zsh)/ nocase
match:
$Command_Shell
outcome:
$Count = count($event.metadata.id)
order:
$Count desc
limit:
10
勒索软件聚光灯监控
此信息中心可全面展示各种安全工具和数据源检测到的与勒索软件相关的活动。它会突出显示最近发生的事件、受影响的设备和检测来源，帮助安全团队快速识别勒索软件威胁并做出响应。
按网址/附件列出的近期勒索软件电子邮件事件
近期勒索软件虚拟机事件
近期勒索软件 DLP 事件
近期的端点勒索软件事件
排名前 10 的勒索软件日志源
按产品统计的勒索软件事件随时间的变化趋势
近期勒索软件 NDR 事件
按主机名统计的近期勒索软件事件
图表名称
查询示例
按网址/附件列出的近期勒索软件电子邮件事件
security_result.summary = /ransom/ nocase
$Subject = network.email.subject
$Sender = network.email.from
$Receiver = network.email.to
$Log_Type = metadata.log_type
$Attachments = strings.coalesce(about.file.full_path, security_result.detection_fields["attachmentNames"])
$Summary = security_result.summary
$Url = target.url
$Action = security_result.action
$Severity = security_result.severity
match:
$Sender, $Receiver, $Subject, $Summary, $Url , $Attachments, $Action, $Severity, $Log_Type
outcome:
$Date = timestamp.get_timestamp(max(metadata.event_timestamp.seconds), "%F %T")
$Count = count(metadata.id)
order:
$Count desc
近期勒索软件虚拟机事件
extensions.vulns.vulnerabilities.description = /ransom/ nocase
$Log_Type = metadata.log_type
$Summary = extensions.vulns.vulnerabilities.description
$Hostname = strings.coalesce(principal.hostname, principal.asset.hostname, target.hostname, target.asset.hostname)
match:
$Summary, $Hostname, $Log_Type
outcome:
$Date = timestamp.get_timestamp(max(metadata.event_timestamp.seconds), "%F %T")
$Count = count(metadata.id)
order:
$Count desc
近期勒索软件 DLP 事件
(security_result.rule_name = /ransom/ nocase or security_result.category_details = /ransom/ nocase or security_result.threat_name = /ransom/ nocase or security_result.summary = /ransom/ nocase
or security_result.description = /ransom/ nocase or metadata.description = /ransom/ nocase or metadata.product_event_type = /ransom/ nocase)
$Log_Type = metadata.log_type
$Summary = strings.coalesce(metadata.description, metadata.product_event_type, security_result.summary, security_result.rule_name, security_result.description, security_result.threat_name, security_result.category_details)
$Hostname = strings.coalesce(principal.hostname, principal.asset.hostname, target.hostname, target.asset.hostname)
$File = strings.coalesce(target.file.full_path, about.file.full_path, target.url)
$Action = security_result.action
$Severity = security_result.severity
match:
$Summary, $File, $Hostname, $Action, $Severity, $Log_Type
outcome:
$Date = timestamp.get_timestamp(max(metadata.event_timestamp.seconds), "%F %T")
$Count = count(metadata.id)
order:
$Count desc
近期的端点勒索软件事件
(security_result.rule_name = /ransom/ nocase or security_result.category_details = /ransom/ nocase or security_result.threat_name = /ransom/ nocase or security_result.summary = /ransom/ nocase or security_result.description = /ransom/ nocase or metadata.description = /ransom/ nocase or metadata.product_event_type = /ransom/ nocase)
$Log_Type = metadata.log_type
$Summary = strings.coalesce(security_result.description, security_result.rule_name, security_result.threat_name, security_result.category_details, security_result.summary, metadata.description, metadata.product_event_type)
$Hostname = strings.coalesce(principal.hostname, principal.asset.hostname, target.hostname, target.asset.hostname)
$IP = strings.coalesce(principal.ip, principal.asset.ip, target.ip, target.asset.ip)
$File = strings.coalesce(target.file.full_path, about.file.full_path, target.url)
$Action = security_result.action
$Severity = security_result.severity
match:
$Summary, $File, $Hostname, $IP, $Action, $Severity, $Log_Type
outcome:
$Date = timestamp.get_timestamp(max(metadata.event_timestamp.seconds), "%F %T")
$Count = count(metadata.id)
order:
$Count desc
排名前 10 的勒索软件日志源
(security_result.rule_name = /ransom/ nocase or security_result.category_details = /ransom/ nocase or security_result.threat_name = /ransom/ nocase or extensions.vulns.vulnerabilities.description = /ransom/ nocase or metadata.product_event_type = /ransom/ nocase or security_result.summary = /ransom/ nocase or metadata.description = /ransom/ nocase or security_result.description = /ransom/ nocase)
$Log_Type = metadata.log_type
match:
$Log_Type
outcome:
$Date = timestamp.get_timestamp(max(metadata.event_timestamp.seconds), "%F %T")
$Count = count(metadata.id)
order:
$Count desc
limit:
10
按产品统计的勒索软件事件随时间的变化趋势
(security_result.rule_name = /ransom/ nocase or security_result.category_details = /ransom/ nocase or security_result.threat_name = /ransom/ nocase or extensions.vulns.vulnerabilities.description = /ransom/ nocase or metadata.product_event_type = /ransom/ nocase or security_result.summary = /ransom/ nocase or metadata.description = /ransom/ nocase or security_result.description = /ransom/ nocase)
$Product = metadata.product_name
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
match:
$Product, $Date
outcome:
$Count = count(metadata.id)
order:
$Date asc
近期勒索软件 NDR 事件
(metadata.event_type = "NETWORK_CONNECTION"
or metadata.event_type = "NETWORK_DHCP"
or metadata.event_type = "NETWORK_DNS"
or metadata.event_type = "NETWORK_FLOW"
or metadata.event_type = "NETWORK_FTP"
or metadata.event_type = "NETWORK_HTTP"
or metadata.event_type = "NETWORK_SMTP"
or metadata.event_type = "NETWORK_UNCATEGORIZED")
(security_result.rule_name = /ransom/ nocase or security_result.category_details = /ransom/ nocase or security_result.threat_name = /ransom/ nocase or security_result.summary = /ransom/ nocase
or security_result.description = /ransom/ nocase or metadata.description = /ransom/ nocase or metadata.product_event_type = /ransom/ nocase)
$Log_Type = metadata.log_type
$Summary = strings.coalesce(metadata.product_event_type, metadata.description, security_result.summary, security_result.description, security_result.rule_name, security_result.category_details, security_result.threat_name)
$Threat_Name = security_result.threat_name
$Category = security_result.category_details
$Hostname = strings.coalesce(principal.hostname, principal.asset.hostname, target.hostname, target.asset.hostname)
$File = strings.coalesce(target.file.full_path, about.file.full_path, target.url)
$Action = security_result.action
$Severity = security_result.severity
match:
$Summary, $File, $Threat_Name, $Category, $Hostname, $Action, $Severity, $Log_Type
outcome:
$Date = timestamp.get_timestamp(max(metadata.event_timestamp.seconds), "%F %T")
$Count = count(metadata.id)
order:
$Count desc
按主机名统计的近期勒索软件事件
(security_result.rule_name = /ransom/ nocase or security_result.category_details = /ransom/ nocase or security_result.threat_name = /ransom/ nocase or extensions.vulns.vulnerabilities.description = /ransom/ nocase or metadata.product_event_type = /ransom/ nocase or security_result.summary = /ransom/ nocase or metadata.description = /ransom/ nocase or security_result.description = /ransom/ nocase)
$Log_Type = metadata.log_type
$Summary = strings.coalesce(security_result.summary, security_result.description, metadata.description, metadata.product_event_type, security_result.rule_name , extensions.vulns.vulnerabilities.description, security_result.threat_name, security_result.category_details)
$Hostname = strings.coalesce(principal.hostname, principal.asset.hostname, target.hostname, target.asset.hostname)
$User = strings.coalesce(principal.user.userid, principal.user.email_addresses, principal.user.user_display_name, target.user.userid, target.user.email_addresses, target.user.user_display_name)
$File = strings.coalesce(target.file.full_path, about.file.full_path, target.url)
$Action = security_result.action
$Severity = security_result.severity
match:
$Summary, $File, $Hostname, $User, $Action, $Severity, $Log_Type
outcome:
$Date = timestamp.get_timestamp(max(metadata.event_timestamp.seconds), "%F %T")
$Count = count(metadata.id)
order:
$Count desc
角色和权限审核
此信息中心是一个深入分析信息中心，用于审核角色和直接资源权限的管理情况。
创建角色的前 10 位用户
更改资源权限的前 10 位用户
修改角色的前 10 位用户
最近创建的角色
权限发生变化的前 10 项资源
角色事件中排名前 10 的被屏蔽来源 IP
资源权限随时间的变化
一段时间内的 IAM 操作
修改的角色总数
修改角色的前 10 个来源 IP
随时间推移而删除的角色
关键角色的活动
创建的角色总数
随时间推移创建的角色
最近修改的角色
创建角色的前 10 个来源 IPS
角色生命周期 KPI
随时间推移而修改的角色
更改资源权限的前 10 个来源 IP
已删除的角色总数
删除角色的前 10 个来源 IP 地址
删除角色的前 10 名用户
图表名称
查询示例
创建角色的前 10 位用户
metadata.product_event_type = /Create.?Role/ nocase
or
(security_result.category_details = /RoleManagement/ nocase
and metadata.product_event_type = /add role definition/ nocase)
security_result.action = "ALLOW"
$Log_Type = metadata.log_type
$Initiator = strings.coalesce(principal.user.windows_sid, principal.user.userid, principal.user.email_addresses)
match:
$Log_Type, $Initiator
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
更改资源权限的前 10 位用户
metadata.event_type = "RESOURCE_PERMISSIONS_CHANGE"
security_result.action = "ALLOW"
$Initiator = strings.coalesce(principal.user.windows_sid, principal.user.userid, principal.user.email_addresses)
$Log_Type = metadata.log_type
match:
$Log_Type, $Initiator
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
修改角色的前 10 位用户
metadata.product_event_type = /Update.?Role/ nocase
or
(security_result.category_details = /RoleManagement/ nocase
and metadata.product_event_type = /update role definition/ nocase)
security_result.action = "ALLOW"
$Log_Type = metadata.log_type
$Initiator = strings.coalesce(principal.user.windows_sid, principal.user.userid, principal.user.email_addresses)
match:
$Log_Type, $Initiator
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
最近创建的角色
metadata.product_event_type = /Create.?Role/ nocase
or
(security_result.category_details = /RoleManagement/ nocase
and metadata.product_event_type = /add role definition/ nocase)
security_result.action = "ALLOW"
$Log_Type = metadata.log_type
$Initiator = strings.coalesce(principal.user.windows_sid, principal.user.userid, principal.user.email_addresses)
$IP_Address = principal.ip
$Date = timestamp.get_timestamp(metadata.event_timestamp.seconds, "%F %T ")
$Role = strings.coalesce(target.user.attribute.roles.name, target.resource.name)
match:
$Date, $Log_Type, $Initiator, $IP_Address, $Role
order:
$Date desc
权限发生变化的前 10 项资源
metadata.event_type = "RESOURCE_PERMISSIONS_CHANGE"
security_result.action = "ALLOW"
$Log_Type = metadata.log_type
$Resource_Name = target.resource.name
match:
$Log_Type, $Resource_Name
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
角色事件中排名前 10 的被屏蔽来源 IP
(metadata.product_event_type = /Create.?Role/ nocase
or
(security_result.category_details = /RoleManagement/ nocase
and metadata.product_event_type = /add role definition/ nocase))
or
(metadata.product_event_type = /Update.?Role/ nocase
or
(security_result.category_details = /RoleManagement/ nocase
and metadata.product_event_type = /update role definition/ nocase))
or
(metadata.product_event_type = /Delete.?Role/ nocase
or
(security_result.category_details = /RoleManagement/ nocase
and metadata.product_event_type = /delete role definition/ nocase))
security_result.action = "BLOCK"
$IP_Address = principal.ip
$Event = metadata.product_event_type
match:
$IP_Address, $Event
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
资源权限随时间的变化
metadata.event_type = "RESOURCE_PERMISSIONS_CHANGE"
security_result.action = "ALLOW"
$Log_Type = metadata.log_type
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
match:
$Log_Type, $Date
outcome:
$Count = count(metadata.id)
order:
$Date desc
一段时间内的 IAM 操作
metadata.event_type = "RESOURCE_PERMISSIONS_CHANGE"
or metadata.event_type = "USER_UNCATEGORIZED"
or metadata.event_type = "USER_BADGE_IN"
or metadata.event_type = "USER_COMMUNICATION"
or metadata.event_type = "USER_CHANGE_PASSWORD"
or metadata.event_type = "USER_LOGIN"
or metadata.event_type = "USER_LOGOUT"
or metadata.event_type = "USER_CREATION"
or metadata.event_type = "USER_DELETION"
or metadata.event_type = "USER_CHANGE_PERMISSIONS"
or metadata.event_type = "USER_RESOURCE_UPDATE_PERMISSIONS"
or metadata.event_type = "USER_RESOURCE_ACCESS"
or metadata.event_type = "USER_RESOURCE_CREATION"
or metadata.event_type = "USER_RESOURCE_DELETION"
or metadata.event_type = "USER_RESOURCE_UPDATE_CONTENT"
or metadata.event_type = "GROUP_UNCATEGORIZED"
or metadata.event_type = "GROUP_CREATION"
or metadata.event_type = "GROUP_DELETION"
or metadata.product_event_type = /(add|delete) group/ nocase
or metadata.event_type = "GROUP_MODIFICATION"
or metadata.product_event_type = /(RemoveUserFrom|AddUserTo|Add member to |Remove member from )|(?:group)/ nocase
or metadata.product_event_type = /(Create|Update|\bDelete).?Role/ nocase
or (security_result.category_details = /RoleManagement/ nocase
and metadata.product_event_type = /(add|update|delete) role definition/ nocase)
security_result.action = "ALLOW"
$Event = metadata.event_type
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
match:
$Date, $Event
outcome:
$Count = count(metadata.id)
order:
$Date desc
修改的角色总数
metadata.product_event_type = /Update.?Role/ nocase
or
(security_result.category_details = /RoleManagement/ nocase
and metadata.product_event_type = /update role definition/ nocase)
security_result.action = "ALLOW"
outcome:
$Count = count_distinct(strings.coalesce(target.user.attribute.roles.name, target.resource.name))
修改角色的前 10 个来源 IP
metadata.product_event_type = /Update.?Role/ nocase
or
(security_result.category_details = /RoleManagement/ nocase
and metadata.product_event_type = /update role definition/ nocase)
security_result.action = "ALLOW"
$Log_Type = metadata.log_type
$IP_Address = principal.ip
match:
$Log_Type, $IP_Address
outcome:
$Count = count(metadata.id)
order:
$Count
limit:
10
随时间推移而删除的角色
metadata.product_event_type = /Delete.?Role/ nocase
or
(security_result.category_details = /RoleManagement/ nocase
and metadata.product_event_type = /delete role definition/ nocase)
security_result.action = "ALLOW"
$Log_Type = metadata.log_type
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
match:
$Date, $Log_Type
outcome:
$Count = count(metadata.id)
order:
$Date desc
关键角色的活动
metadata.product_event_type = /Create|Remove|Add|Update/ nocase
strings.coalesce(principal.user.attribute.roles.name, principal.resource.name, target.user.attribute.roles.name, target.resource.name) = /admin/ nocase
security_result.action = "ALLOW"
$Log_Type = metadata.log_type
$Role = strings.coalesce(principal.user.attribute.roles.name, principal.resource.name, target.user.attribute.roles.name, target.resource.name)
$Event = metadata.product_event_type
$User = if(strings.coalesce(principal.user.attribute.roles.name, principal.resource.name) = /admin/ nocase, strings.coalesce(principal.user.windows_sid, principal.user.userid, principal.user.email_addresses),
if(strings.coalesce(target.user.attribute.roles.name, target.resource.name) = /admin/ nocase, strings.coalesce(target.user.windows_sid, target.user.userid, target.user.email_addresses), ""))
$IP = principal.ip
match:
$Role, $Event, $Log_Type, $User, $IP
outcome:
$Date = latest(metadata.event_timestamp)
dedup:
$Role
order:
$Date desc
创建的角色总数
metadata.product_event_type = /Create.?Role/ nocase
or
(security_result.category_details = /RoleManagement/ nocase
and metadata.product_event_type = /add role definition/ nocase)
security_result.action = "ALLOW"
outcome:
$Count = count_distinct(strings.coalesce(target.user.attribute.roles.name, target.resource.name))
随时间推移创建的角色
metadata.product_event_type = /Create.?Role/ nocase
or
(security_result.category_details = /RoleManagement/ nocase
and metadata.product_event_type = /add role definition/ nocase)
security_result.action = "ALLOW"
$Log_Type = metadata.log_type
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
match:
$Log_Type, $Date
outcome:
$Count = count(metadata.id)
order:
$Date desc
最近修改的角色
(metadata.event_type = "RESOURCE_WRITTEN"
and metadata.product_event_type = /UpdateRole/ nocase)
or
(security_result.category_details = /RoleManagement/ nocase
and metadata.product_event_type = /update role(?: definition)?/ nocase)
security_result.action = "ALLOW"
$Log_Type = metadata.log_type
$Initiator = strings.coalesce(principal.user.windows_sid, principal.user.userid, principal.user.email_addresses)
$Date = timestamp.get_timestamp(metadata.event_timestamp.seconds, "%F %T ")
$IP_Address = principal.ip
$Role = strings.coalesce(target.user.attribute.roles.name, target.resource.name)
match:
$Date, $Log_Type, $Initiator, $IP_Address, $Role
order:
$Date desc
创建角色的前 10 个来源 IPS
metadata.product_event_type = /Create.?Role/ nocase
or
(security_result.category_details = /RoleManagement/ nocase
and metadata.product_event_type = /add role definition/ nocase)
security_result.action = "ALLOW"
$Log_Type = metadata.log_type
$IP_Address = principal.ip
match:
$Log_Type, $IP_Address
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
角色生命周期 KPI
(metadata.product_event_type = /Create.?Role/ nocase
or
(security_result.category_details = /RoleManagement/ nocase and metadata.product_event_type = /add role definition/ nocase)
and security_result.action = "ALLOW")
or
(metadata.product_event_type = /Update.?Role/ nocase
or
(security_result.category_details = /RoleManagement/ nocase and metadata.product_event_type = /update role definition/ nocase)
and security_result.action = "ALLOW")
or
(metadata.product_event_type = /Delete.?Role/ nocase
or (security_result.category_details = /RoleManagement/ nocase and metadata.product_event_type = /delete role definition/ nocase)
and security_result.action = "ALLOW")
$Event = if((metadata.product_event_type = /Create.?Role/ nocase or (security_result.category_details = /RoleManagement/ nocase and metadata.product_event_type = /add role definition/ nocase)), "Total Creation",
if (metadata.product_event_type = /Update.?Role/ nocase or (security_result.category_details = /RoleManagement/ nocase and metadata.product_event_type = /update role definition/ nocase), "Total Modification", "Total Deletion"))
match:
$Event
outcome:
$Count = count_distinct(strings.coalesce(target.user.attribute.roles.name, target.resource.name))
order:
$Count desc
随时间推移而修改的角色
metadata.product_event_type = /Update.?Role/ nocase
or
(security_result.category_details = /RoleManagement/ nocase
and metadata.product_event_type = /update role definition/ nocase)
security_result.action = "ALLOW"
$Log_Type = metadata.log_type
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
match:
$Log_Type, $Date
outcome:
$Count = count(metadata.id)
order:
$Date desc
更改资源权限的前 10 个来源 IP
metadata.event_type = "RESOURCE_PERMISSIONS_CHANGE"
security_result.action = "ALLOW"
$Log_Type = metadata.log_type
$IP_Address = principal.ip
match:
$Log_Type, $IP_Address
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
已删除的角色总数
metadata.product_event_type = /Delete.?Role/ nocase
or
(security_result.category_details = /RoleManagement/ nocase
and metadata.product_event_type = /delete role definition/ nocase)
security_result.action = "ALLOW"
outcome:
$Count = count_distinct(strings.coalesce(target.user.attribute.roles.name, target.resource.name))
删除角色的前 10 个来源 IP 地址
metadata.product_event_type = /Delete.?Role/ nocase
or
(security_result.category_details = /RoleManagement/ nocase
and metadata.product_event_type = /delete role definition/ nocase)
security_result.action = "ALLOW"
$Log_Type = metadata.log_type
$IP_Address = principal.ip
match:
$Log_Type, $IP_Address
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
删除角色的前 10 名用户
metadata.product_event_type = /Delete.?Role/ nocase
or
(security_result.category_details = /RoleManagement/ nocase
and metadata.product_event_type = /delete role definition/ nocase)
security_result.action = "ALLOW"
$Log_Type = metadata.log_type
$Initiator = strings.coalesce(principal.user.windows_sid, principal.user.userid, principal.user.email_addresses)
match:
$Log_Type, $Initiator
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
SMB 枚举
此信息中心可为您提供有关 SMB 相关活动的可据以采取行动的分析洞见，包括枚举趋势、身份验证尝试以及用户和 IP 地址的访问模式。通过识别可疑行为和潜在威胁，有效降低风险。
按用户列出的前 10 次 SMB 枚举尝试
最近 SMB 身份验证尝试失败
SMB 枚举尝试协议分布
检测到枚举工具的分布
SMB 枚举中的前 10 个目标 IP
SMB 枚举状态分布
来源 IP 随时间的变化
SMB 命令随时间的变化
前 10 大来源 IP
平均枚举率
SMB 枚举中使用的前 10 个命令
SMB 枚举检测随时间的变化
SMB 身份验证状态分布情况
图表名称
查询示例
按用户列出的前 10 次 SMB 枚举尝试
security_result.rule_name = /smb.*enumeration/ nocase
or (target.process.command_line = /(?:nmap.*(?:\-p(?:\s)?(?:137|138|139|445|139,445)?)(?:(?:\s)?--script smb)?|smbmap|smbclient --list|enum4linux)/ nocase
and (target.port = 137
or target.port = 138
or target.port = 139
or target.port = 445))
$Command_Line = target.process.command_line
$User = target.user.userid
match:
$User, $Command_Line
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
最近 SMB 身份验证尝试失败
metadata.event_type = "NETWORK_CONNECTION"
or metadata.product_event_type = /5157/
target.port = 137
or target.port = 138
or target.port = 139
or target.port = 445
security_result.action = "BLOCK"
or security_result.summary = /failed/ nocase
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
$Hostname = principal.hostname
$Source_IP = principal.ip
$User = strings.coalesce(principal.user.userid, target.user.userid)
$Port = target.port
match:
$Date, $Hostname, $Source_IP, $Port, $User
order:
$Date desc
SMB 枚举尝试协议分布
security_result.rule_name = /smb.*enumeration/ nocase
or (target.process.command_line = /(?:nmap.*(?:\-p(?:\s)?(?:137|138|139|445|139,445)?)(?:(?:\s)?--script smb)?|smbmap|smbclient --list|enum4linux)/ nocase
and (target.port = 137
or target.port = 138
or target.port = 139
or target.port = 445))
$Protocol = network.ip_protocol
match:
$Protocol
outcome:
$Count = count(network.ip_protocol)
order:
$Count desc
检测到枚举工具的分布
security_result.rule_name = /smb.*enumeration/ nocase
or (target.process.command_line = /(?:\bnmap\b.*(?:\-p(?:\s)?(?:137|138|139|445|139,445)?)(?:(?:\s)?--script smb)?|smbmap|smbclient --list|enum4linux)/ nocase
and (target.port = 137
or target.port = 138
or target.port = 139
or target.port = 445))
$Tool = re.capture(target.process.command_line, `^\w+`)
match:
$Tool
outcome:
$Count = count(metadata.id)
order:
$Count desc
SMB 枚举中的前 10 个目标 IP
security_result.rule_name = /smb.*enumeration/ nocase
or (target.process.command_line = /(?:nmap.*(?:\-p(?:\s)?(?:137|138|139|445|139,445)?)(?:(?:\s)?--script smb)?|smbmap|smbclient --list|enum4linux)/ nocase
and (target.port = 137
or target.port = 138
or target.port = 139
or target.port = 445))
$Hostname = principal.hostname
$Target_IP = target.ip
match:
$Target_IP, $Hostname
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
SMB 枚举状态分布
security_result.rule_name = /smb.*enumeration/ nocase
or (target.process.command_line = /(?:nmap.*(?:\-p(?:\s)?(?:137|138|139|445|139,445)?)(?:(?:\s)?--script smb)?|smbmap|smbclient --list|enum4linux)/ nocase
and (target.port = 137
or target.port = 138
or target.port = 139
or target.port = 445))
$Status = if(security_result.action = "ALLOW", security_result.action, "BLOCK")
match:
$Status
outcome:
$Count = count(metadata.id)
order:
$Count desc
来源 IP 随时间的变化
target.port = 137
or target.port = 138
or target.port = 139
or target.port = 445
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
match:
$Date
outcome:
$Count = count_distinct(principal.ip)
order:
$Date desc
SMB 命令随时间的变化
target.process.command_line = /(?:nmap.*(?:\-p(?:\s)?(?:137|138|139|445|139,445)?)(?:(?:\s)?--script smb)?|smb(?:client|map|status)|enum4linux|(?:get|new|remove|set|close)\-smb)|\bnet\s+(?:use|view|share|session|file|user|group|localgroup|accounts|config|start|stop)\b/ nocase
target.port = 137
or target.port = 138
or target.port = 139
or target.port = 445
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
match:
$Date
outcome:
$Count = count(metadata.id)
order:
$Date desc
前 10 大来源 IP
target.port = 137
or target.port = 138
or target.port = 139
or target.port = 445
$Hostname = principal.hostname
$Source_IP = principal.ip
$Source_IP != ""
match:
$Source_IP, $Hostname
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
平均枚举率
stage Enumeration{
security_result.rule_name = /smb.*enumeration/ nocase
or (target.process.command_line = /(?:nmap.*(?:\-p(?:\s)?(?:137|138|139|445|139,445)?)(?:(?:\s)?--script smb)?|smbmap|smbclient --list|enum4linux)/ nocase
and (target.port = 137
or target.port = 138
or target.port = 139
or target.port = 445))
$Target_IP = target.ip
$Hour_Bucket = timestamp.get_hour(metadata.event_timestamp.seconds)
match:
$Hour_Bucket
outcome:
$Ip_Count = count_distinct($Target_IP)
}
outcome:
$Avg_Enumeration_Rate = math.round(avg($Enumeration.Ip_Count), 2)
SMB 枚举中使用的前 10 个命令
security_result.rule_name = /smb.*enumeration/ nocase
or (target.process.command_line = /(?:nmap.*(?:\-p(?:\s)?(?:137|138|139|445|139,445)?)(?:(?:\s)?--script smb)?|smbmap|smbclient --list|enum4linux)/ nocase
and (target.port = 137
or target.port = 138
or target.port = 139
or target.port = 445))
$Command_Line = target.process.command_line
match:
$Command_Line
outcome:
$Count = count(target.process.command_line)
order:
$Count desc
limit:
10
SMB 枚举检测随时间的变化
security_result.rule_name = /smb.*enumeration/ nocase
or (target.process.command_line = /(?:nmap.*(?:\-p(?:\s)?(?:137|138|139|445|139,445)?)(?:(?:\s)?--script smb)?|smbmap|smbclient --list|enum4linux)/ nocase
and (target.port = 137
or target.port = 138
or target.port = 139
or target.port = 445))
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
match:
$Date
outcome:
$Count = count(metadata.id)
order:
$Date desc
SMB 身份验证状态分布情况
metadata.event_type = "NETWORK_CONNECTION"
or metadata.product_event_type = /5156|5157/
target.port = 137
or target.port = 138
or target.port = 139
or target.port = 445
$Status = if(security_result.summary = /failed/, "BLOCK", security_result.action)
match:
$Status
outcome:
$Count = count(metadata.id)
order:
$Count desc
SecOps 审核和活动监控
此信息中心可提供有关安全态势的重要数据洞见，并跟踪 Chronicle Google API 中的事件、用户活动和遭阻止的操作。
一段时间内的事件
10 大活动类型
近期被屏蔽的操作
按事件类型划分的前 10 个来源 IP
指定时间段内的屏蔽事件
非工作时间异常事件
近期存在风险的操作
按风险操作排序的前 10 名用户
按事件类型划分的前 10 名用户
按位置划分的被屏蔽 SecOps 事件
按事件类型划分的操作：允许与阻止
非营业时间发生的异常操作（按类别）
图表名称
查询示例
一段时间内的事件
target.application = /(?:chronicle|backstory).googleapis\.com/ nocase
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
match:
$Date
outcome:
$Count = count(metadata.id)
order:
$Date desc
10 大活动类型
target.application = /(?:chronicle|backstory).googleapis\.com/ nocase
$Event_Type = metadata.event_type
match:
$Event_Type
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
近期被屏蔽的操作
target.application = /(?:chronicle|backstory).googleapis.com/ nocase
security_result.action = "BLOCK"
$Date = timestamp.get_timestamp((metadata.event_timestamp.seconds), "%F %T ")
$Description = metadata.description
$Event_Type = metadata.event_type
$User = principal.user.userid
match:
$Date, $Event_Type, $Description, $User
order:
$Date desc
按事件类型划分的前 10 个来源 IP
target.application = /(?:chronicle|backstory).googleapis\.com/ nocase
$Event_Type = metadata.event_type
$Source_IP = principal.ip
match:
$Event_Type, $Source_IP
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
指定时间段内的屏蔽事件
target.application = /(?:chronicle|backstory).googleapis.com/ nocase
security_result.action = "BLOCK"
$Date = timestamp.get_date((metadata.event_timestamp.seconds))
$Event_Type = re.capture(metadata.product_event_type, `\b[A-Za-z]+$`)
match:
$Date, $Event_Type
outcome:
$Count = count(metadata.id)
order:
$Date desc
非工作时间异常事件
target.application = /(?:chronicle|backstory).googleapis.com/ nocase
(
(timestamp.get_day_of_week(metadata.event_timestamp.seconds, "UTC") = 1 or timestamp.get_day_of_week(metadata.event_timestamp.seconds, "UTC") = 7)
or
((timestamp.get_day_of_week(metadata.event_timestamp.seconds, "UTC") >= 2 and timestamp.get_day_of_week(metadata.event_timestamp.seconds, "UTC") <= 6)
and
((timestamp.get_hour(metadata.event_timestamp.seconds, "UTC") >= 0 and timestamp.get_hour(metadata.event_timestamp.seconds, "UTC") <= 8) or timestamp.get_hour(metadata.event_timestamp.seconds, "UTC") > 19))
)
$Event_Type = metadata.event_type
$Product_Event = metadata.product_event_type
match:
$Event_Type, $Product_Event
outcome:
$Count = count(metadata.id)
$Date = timestamp.get_timestamp(max(metadata.event_timestamp.seconds), "%F %T ")
order:
$Date desc
近期存在风险的操作
target.application = /(?:chronicle|backstory).googleapis.com/ nocase
metadata.product_event_type = /\b(?:Delete|Remove|Disable|Update)/ nocase
$Date = timestamp.get_timestamp(metadata.event_timestamp.seconds)
$Event_Type = re.capture(metadata.product_event_type, `\b(?:Delete|Remove|Disable|Update)[A-Za-z]+`)
$Description = metadata.description
$User = re.capture(principal.user.userid, `subject\/([^\/]+)`)
match:
$Date, $Event_Type, $Description, $User
order:
$Date desc
按风险操作排序的前 10 名用户
target.application = /(?:chronicle|backstory).googleapis.com/ nocase
metadata.product_event_type = /\b(?:Delete|Remove|Disable|Update)/ nocase
$Event_Type = re.capture(metadata.product_event_type, `\b(?:Delete|Remove|Disable|Update)[A-Za-z]+`)
$User = re.capture(principal.user.userid, `subject\/([^\/]+)`)
match:
$User, $Event_Type
outcome:
$Count = count(metadata.id)
order:
$Count desc
按事件类型划分的前 10 名用户
target.application = /(?:chronicle|backstory).googleapis\.com/ nocase
$Event_Type = metadata.event_type
$User = principal.user.userid
match:
$User, $Event_Type
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
按位置划分的被屏蔽 SecOps 事件
target.application = /(?:chronicle|backstory).googleapis.com/ nocase
security_result.action = "BLOCK"
$Countries = principal.location.country_or_region
$Latitude = principal.location.region_coordinates.latitude
$Longitude = principal.location.region_coordinates.longitude
match:
$Countries, $Latitude, $Longitude
outcome:
$Count = count(metadata.id)
order:
$Count desc
按事件类型划分的操作：允许与阻止
target.application = /(?:chronicle|backstory).googleapis\.com/ nocase
security_result.action = "ALLOW"
or security_result.action = "BLOCK"
$Event_Type = metadata.event_type
$Action = security_result.action
match:
$Event_Type, $Action
outcome:
$Count = count(metadata.id)
order:
$Count desc
非营业时间发生的异常操作（按类别）
target.application = /(?:chronicle|backstory).googleapis.com/ nocase
(
(timestamp.get_day_of_week(metadata.event_timestamp.seconds, "UTC") = 1 or timestamp.get_day_of_week(metadata.event_timestamp.seconds, "UTC") = 7)
or
((timestamp.get_day_of_week(metadata.event_timestamp.seconds, "UTC") >= 2 and timestamp.get_day_of_week(metadata.event_timestamp.seconds, "UTC") <= 6)
and
((timestamp.get_hour(metadata.event_timestamp.seconds, "UTC") >= 0 and timestamp.get_hour(metadata.event_timestamp.seconds, "UTC") <= 8) or timestamp.get_hour(metadata.event_timestamp.seconds, "UTC") > 19))
)
$Event_Type = metadata.event_type
$Product_Event = metadata.product_event_type
$Service = re.capture(metadata.product_event_type, `([A-Za-z]+Service)`)
match:
$Product_Event, $Service
outcome:
$Date = timestamp.get_timestamp(max(metadata.event_timestamp.seconds), "%F %T ")
$Count = count(metadata.id)
order:
$Date desc
SecOps 日志监控
此信息中心可让您深入了解日志数据管理，重点显示了提取延迟时间和组件状态。它有助于您优化性能、减少数据丢失并增强安全监控。
安全状况管理
此信息中心可实时概览组织的安全状态，突出显示威胁、事件和漏洞。它包括检测、安全和系统更新摘要以及资产监控，使安全团队能够评估风险和威胁态势，并有效实施补救策略。这种集中式视图有助于提升整体安全状况并简化突发事件响应流程。
服务账号概览
此信息中心可提供有关使用模式、登录尝试和账号修改的深入分析，帮助安全团队和管理员监控服务账号活动。它有助于做出明智的决策，以识别安全风险、解决漏洞并确保系统完整性。注意：您可以根据需要使用可用的过滤条件来缩小结果范围。
流量最多的 10 大操作
近期修改的权限
一段时间内的成功登录次数
修改次数最多的 10 项用户权限
近期密码更改
随时间推移而删除的服务账号
一段时间内的登录失败次数
一段时间内的使用情况
最近删除的服务账号
按登录次数排名的前 10 个服务账号
最近创建的服务账号
前 10 大服务账号
服务账号随时间推移的创建情况
大量 Kerberos 服务票据请求
按登录失败次数排名的前 10 大来源 IP
按交互式登录次数排名的前 10 个来源 IP
一段时间内的互动式登录次数
密码随时间的变化
图表名称
查询示例
流量最多的 10 大操作
principal.user.account_type = "SERVICE_ACCOUNT_TYPE"
or principal.resource.resource_type = "SERVICE_ACCOUNT"
or principal.user.attribute.roles.type = "SERVICE_ACCOUNT"
or target.user.account_type = "SERVICE_ACCOUNT_TYPE"
or target.resource.resource_type = "SERVICE_ACCOUNT"
or target.user.attribute.roles.type = "SERVICE_ACCOUNT"
or strings.coalesce(principal.resource.type, principal.user.attribute.roles.name, principal.resource.resource_subtype, principal.user.userid, target.resource.type, target.user.attribute.roles.name, target.resource.resource_subtype, target.user.userid) = /(?i)service.*(?:account|^principal$)/ nocase
$Product_Event = metadata.product_event_type
$Product_Event != ""
match:
$Product_Event
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
近期修改的权限
metadata.event_type = "RESOURCE_PERMISSIONS_CHANGE"
or metadata.event_type = "USER_CHANGE_PERMISSIONS"
or metadata.event_type = "USER_RESOURCE_UPDATE_PERMISSIONS"
principal.user.account_type = "SERVICE_ACCOUNT_TYPE"
or principal.resource.resource_type = "SERVICE_ACCOUNT"
or principal.user.attribute.roles.type = "SERVICE_ACCOUNT"
or target.user.account_type = "SERVICE_ACCOUNT_TYPE"
or target.resource.resource_type = "SERVICE_ACCOUNT"
or target.user.attribute.roles.type = "SERVICE_ACCOUNT"
or strings.coalesce(principal.resource.type, principal.user.attribute.roles.name, principal.resource.resource_subtype, principal.user.userid, target.resource.type, target.user.attribute.roles.name, target.resource.resource_subtype, target.user.userid) = /(?i)service.*(?:account|^principal$)/ nocase
$Log_Type = metadata.log_type
$Initiator = strings.coalesce(principal.user.windows_sid, principal.user.userid, principal.user.email_addresses)
$User = strings.coalesce(target.user.userid, target.user.email_addresses)
$IP_Address = principal.ip
$Date = timestamp.get_timestamp(metadata.event_timestamp.seconds, "%F %T ")
match:
$Date, $Log_Type, $Initiator, $IP_Address, $User
order:
$Date desc
一段时间内的成功登录次数
metadata.event_type = "USER_LOGIN"
security_result.action = "ALLOW"
principal.user.account_type = "SERVICE_ACCOUNT_TYPE"
or principal.resource.resource_type = "SERVICE_ACCOUNT"
or principal.user.attribute.roles.type = "SERVICE_ACCOUNT"
or target.user.account_type = "SERVICE_ACCOUNT_TYPE"
or target.resource.resource_type = "SERVICE_ACCOUNT"
or target.user.attribute.roles.type = "SERVICE_ACCOUNT"
or strings.coalesce(principal.resource.type, principal.user.attribute.roles.name, principal.resource.resource_subtype, principal.user.userid, target.resource.type, target.user.attribute.roles.name, target.resource.resource_subtype, target.user.userid) = /(?i)service.*(?:account|^principal$)/ nocase
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
match:
$Date
outcome:
$Count = count(metadata.id)
order:
$Date desc
修改次数最多的 10 项用户权限
metadata.event_type = "RESOURCE_PERMISSIONS_CHANGE"
or metadata.event_type = "USER_CHANGE_PERMISSIONS"
or metadata.event_type = "USER_RESOURCE_UPDATE_PERMISSIONS"
principal.user.account_type = "SERVICE_ACCOUNT_TYPE"
or principal.resource.resource_type = "SERVICE_ACCOUNT"
or principal.user.attribute.roles.type = "SERVICE_ACCOUNT"
or target.user.account_type = "SERVICE_ACCOUNT_TYPE"
or target.resource.resource_type = "SERVICE_ACCOUNT"
or target.user.attribute.roles.type = "SERVICE_ACCOUNT"
or strings.coalesce(principal.resource.type, principal.user.attribute.roles.name, principal.resource.resource_subtype, principal.user.userid, target.resource.type, target.user.attribute.roles.name, target.resource.resource_subtype, target.user.userid) = /(?i)service.*(?:account|^principal$)/ nocase
$User = strings.coalesce(target.user.userid, target.user.email_addresses)
match:
$User
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
近期密码更改
metadata.event_type = "USER_CHANGE_PASSWORD"
principal.user.account_type = "SERVICE_ACCOUNT_TYPE"
or principal.resource.resource_type = "SERVICE_ACCOUNT"
or principal.user.attribute.roles.type = "SERVICE_ACCOUNT"
or target.user.account_type = "SERVICE_ACCOUNT_TYPE"
or target.resource.resource_type = "SERVICE_ACCOUNT"
or target.user.attribute.roles.type = "SERVICE_ACCOUNT"
or strings.coalesce(principal.resource.type, principal.user.attribute.roles.name, principal.resource.resource_subtype, principal.user.userid, target.resource.type, target.user.attribute.roles.name, target.resource.resource_subtype, target.user.userid) = /(?i)service.*(?:account|^principal$)/ nocase
$Log_Type = metadata.log_type
$Initiator = strings.coalesce(principal.user.windows_sid, principal.user.userid, principal.user.email_addresses)
$User = strings.coalesce(target.user.userid, target.user.email_addresses)
$IP_Address = principal.ip
$Date = timestamp.get_timestamp(metadata.event_timestamp.seconds, "%F %T ")
match:
$Date, $Log_Type, $Initiator, $IP_Address, $User
order:
$Date desc
随时间推移而删除的服务账号
metadata.event_type = "USER_DELETION"
or metadata.event_type = "USER_RESOURCE_DELETION"
principal.user.account_type = "SERVICE_ACCOUNT_TYPE"
or principal.resource.resource_type = "SERVICE_ACCOUNT"
or principal.user.attribute.roles.type = "SERVICE_ACCOUNT"
or target.user.account_type = "SERVICE_ACCOUNT_TYPE"
or target.resource.resource_type = "SERVICE_ACCOUNT"
or target.user.attribute.roles.type = "SERVICE_ACCOUNT"
or strings.coalesce(principal.resource.type, principal.user.attribute.roles.name, principal.resource.resource_subtype, principal.user.userid, target.resource.type, target.user.attribute.roles.name, target.resource.resource_subtype, target.user.userid) = /(?i)service.*(?:account|^principal$)/ nocase
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
match:
$Date
outcome:
$Count = count(metadata.id)
order:
$Date desc
一段时间内的登录失败次数
metadata.event_type = "USER_LOGIN"
security_result.action = "BLOCK"
principal.user.account_type = "SERVICE_ACCOUNT_TYPE"
or principal.resource.resource_type = "SERVICE_ACCOUNT"
or principal.user.attribute.roles.type = "SERVICE_ACCOUNT"
or target.user.account_type = "SERVICE_ACCOUNT_TYPE"
or target.resource.resource_type = "SERVICE_ACCOUNT"
or target.user.attribute.roles.type = "SERVICE_ACCOUNT"
or strings.coalesce(principal.resource.type, principal.user.attribute.roles.name, principal.resource.resource_subtype, principal.user.userid, target.resource.type, target.user.attribute.roles.name, target.resource.resource_subtype, target.user.userid) = /(?i)service.*(?:account|^principal$)/ nocase
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
match:
$Date
outcome:
$Count = count(metadata.id)
order:
$Date desc
一段时间内的使用情况
principal.user.account_type = "SERVICE_ACCOUNT_TYPE"
or principal.resource.resource_type = "SERVICE_ACCOUNT"
or principal.user.attribute.roles.type = "SERVICE_ACCOUNT"
or target.user.account_type = "SERVICE_ACCOUNT_TYPE"
or target.resource.resource_type = "SERVICE_ACCOUNT"
or target.user.attribute.roles.type = "SERVICE_ACCOUNT"
or strings.coalesce(principal.resource.type, principal.user.attribute.roles.name, principal.resource.resource_subtype, principal.user.userid, target.resource.type, target.user.attribute.roles.name, target.resource.resource_subtype, target.user.userid) = /(?i)service.*(?:account|^principal$)/ nocase
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
match:
$Date
outcome:
$Count = count(metadata.id)
order:
$Date desc
最近删除的服务账号
metadata.event_type = "USER_DELETION"
or metadata.event_type = "USER_RESOURCE_DELETION"
principal.user.account_type = "SERVICE_ACCOUNT_TYPE"
or principal.resource.resource_type = "SERVICE_ACCOUNT"
or principal.user.attribute.roles.type = "SERVICE_ACCOUNT"
or target.user.account_type = "SERVICE_ACCOUNT_TYPE"
or target.resource.resource_type = "SERVICE_ACCOUNT"
or target.user.attribute.roles.type = "SERVICE_ACCOUNT"
or strings.coalesce(principal.resource.type, principal.user.attribute.roles.name, principal.resource.resource_subtype, principal.user.userid, target.resource.type, target.user.attribute.roles.name, target.resource.resource_subtype, target.user.userid) = /(?i)service.*(?:account|^principal$)/ nocase
$Log_Type = metadata.log_type
$Initiator = strings.coalesce(principal.user.windows_sid, principal.user.userid, principal.user.email_addresses)
$User = strings.coalesce(target.user.userid, target.user.email_addresses)
$IP_Address = principal.ip
$Date = timestamp.get_timestamp(metadata.event_timestamp.seconds, "%F %T ")
match:
$Date, $Log_Type, $Initiator, $IP_Address, $User
order:
$Date desc
按登录次数排名的前 10 个服务账号
metadata.event_type = "USER_LOGIN"
principal.user.account_type = "SERVICE_ACCOUNT_TYPE"
or principal.resource.resource_type = "SERVICE_ACCOUNT"
or principal.user.attribute.roles.type = "SERVICE_ACCOUNT"
or target.user.account_type = "SERVICE_ACCOUNT_TYPE"
or target.resource.resource_type = "SERVICE_ACCOUNT"
or target.user.attribute.roles.type = "SERVICE_ACCOUNT"
or strings.coalesce(principal.resource.type, principal.user.attribute.roles.name, principal.resource.resource_subtype, principal.user.userid, target.resource.type, target.user.attribute.roles.name, target.resource.resource_subtype, target.user.userid) = /(?i)service.*(?:account|^principal$)/ nocase
$Service_Account = group(principal.user.userid, target.user.userid)
$Service_Account != ""
match:
$Service_Account
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
最近创建的服务账号
metadata.event_type = "USER_CREATION"
principal.user.account_type = "SERVICE_ACCOUNT_TYPE"
or principal.resource.resource_type = "SERVICE_ACCOUNT"
or principal.user.attribute.roles.type = "SERVICE_ACCOUNT"
or target.user.account_type = "SERVICE_ACCOUNT_TYPE"
or target.resource.resource_type = "SERVICE_ACCOUNT"
or target.user.attribute.roles.type = "SERVICE_ACCOUNT"
or strings.coalesce(principal.resource.type, principal.user.attribute.roles.name, principal.resource.resource_subtype, principal.user.userid, target.resource.type, target.user.attribute.roles.name, target.resource.resource_subtype, target.user.userid) = /(?i)service.*(?:account|^principal$)/ nocase
$Log_Type = metadata.log_type
$Initiator = strings.coalesce(principal.user.windows_sid, principal.user.userid, principal.user.email_addresses)
$User = strings.coalesce(target.user.userid, target.user.email_addresses)
$IP_Address = principal.ip
$Date = timestamp.get_timestamp(metadata.event_timestamp.seconds, "%F %T ")
match:
$Date, $Log_Type, $Initiator, $IP_Address, $User
order:
$Date desc
前 10 大服务账号
principal.user.account_type = "SERVICE_ACCOUNT_TYPE"
or principal.resource.resource_type = "SERVICE_ACCOUNT"
or principal.user.attribute.roles.type = "SERVICE_ACCOUNT"
or target.user.account_type = "SERVICE_ACCOUNT_TYPE"
or target.resource.resource_type = "SERVICE_ACCOUNT"
or target.user.attribute.roles.type = "SERVICE_ACCOUNT"
or strings.coalesce(principal.resource.type, principal.user.attribute.roles.name, principal.resource.resource_subtype, principal.user.userid, target.resource.type, target.user.attribute.roles.name, target.resource.resource_subtype, target.user.userid) = /(?i)service.*(?:account|^principal$)/ nocase
$Service_Account = group(principal.user.userid, target.user.userid)
$Service_Account != ""
match:
$Service_Account
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
服务账号随时间推移的创建情况
metadata.event_type = "USER_CREATION"
principal.user.account_type = "SERVICE_ACCOUNT_TYPE"
or principal.resource.resource_type = "SERVICE_ACCOUNT"
or principal.user.attribute.roles.type = "SERVICE_ACCOUNT"
or target.user.account_type = "SERVICE_ACCOUNT_TYPE"
or target.resource.resource_type = "SERVICE_ACCOUNT"
or target.user.attribute.roles.type = "SERVICE_ACCOUNT"
or strings.coalesce(principal.resource.type, principal.user.attribute.roles.name, principal.resource.resource_subtype, principal.user.userid, target.resource.type, target.user.attribute.roles.name, target.resource.resource_subtype, target.user.userid) = /(?i)service.*(?:account|^principal$)/ nocase
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
match:
$Date
outcome:
$Count = count(metadata.id)
order:
$Date desc
大量 Kerberos 服务票据请求
metadata.product_event_type = /4769/ nocase
target.application != /\$$/ nocase
additional.fields["TicketEncryptionType"] = /0x(1|2|3|12|17)/ nocase
additional.fields["TicketOptions"] = /0x408(1000|0000|1001)0/ nocase
$Host = principal.hostname
match:
$Host over 1h
outcome:
$Count = count_distinct(target.application)
condition:
$Count >= 10
order:
$Count desc
limit:
10
按登录失败次数排名的前 10 大来源 IP
metadata.event_type = "USER_LOGIN"
security_result.action = "BLOCK"
principal.user.account_type = "SERVICE_ACCOUNT_TYPE"
or principal.resource.resource_type = "SERVICE_ACCOUNT"
or principal.user.attribute.roles.type = "SERVICE_ACCOUNT"
or target.user.account_type = "SERVICE_ACCOUNT_TYPE"
or target.resource.resource_type = "SERVICE_ACCOUNT"
or target.user.attribute.roles.type = "SERVICE_ACCOUNT"
or strings.coalesce(principal.resource.type, principal.user.attribute.roles.name, principal.resource.resource_subtype, principal.user.userid, target.resource.type, target.user.attribute.roles.name, target.resource.resource_subtype, target.user.userid) = /(?i)service.*(?:account|^principal$)/ nocase
$Source_IP = principal.ip
$Source_IP != ""
match:
$Source_IP
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
按交互式登录次数排名的前 10 个来源 IP
metadata.event_type = "USER_LOGIN"
extensions.auth.mechanism = "INTERACTIVE"
or extensions.auth.mechanism = "CACHED_INTERACTIVE"
or extensions.auth.mechanism = "CACHED_REMOTE_INTERACTIVE"
or extensions.auth.mechanism = "REMOTE_INTERACTIVE"
principal.user.account_type = "SERVICE_ACCOUNT_TYPE"
or principal.resource.resource_type = "SERVICE_ACCOUNT"
or principal.user.attribute.roles.type = "SERVICE_ACCOUNT"
or target.user.account_type = "SERVICE_ACCOUNT_TYPE"
or target.resource.resource_type = "SERVICE_ACCOUNT"
or target.user.attribute.roles.type = "SERVICE_ACCOUNT"
or strings.coalesce(principal.resource.type, principal.user.attribute.roles.name, principal.resource.resource_subtype, principal.user.userid, target.resource.type, target.user.attribute.roles.name, target.resource.resource_subtype, target.user.userid) = /(?i)service.*(?:account|^principal$)/ nocase
$Source_IP = principal.ip
match:
$Source_IP
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
一段时间内的互动式登录次数
metadata.event_type = "USER_LOGIN"
extensions.auth.mechanism = "INTERACTIVE"
or extensions.auth.mechanism = "CACHED_INTERACTIVE"
or extensions.auth.mechanism = "CACHED_REMOTE_INTERACTIVE"
or extensions.auth.mechanism = "REMOTE_INTERACTIVE"
principal.user.account_type = "SERVICE_ACCOUNT_TYPE"
or principal.resource.resource_type = "SERVICE_ACCOUNT"
or principal.user.attribute.roles.type = "SERVICE_ACCOUNT"
or target.user.account_type = "SERVICE_ACCOUNT_TYPE"
or target.resource.resource_type = "SERVICE_ACCOUNT"
or target.user.attribute.roles.type = "SERVICE_ACCOUNT"
or strings.coalesce(principal.resource.type, principal.user.attribute.roles.name, principal.resource.resource_subtype, principal.user.userid, target.resource.type, target.user.attribute.roles.name, target.resource.resource_subtype, target.user.userid) = /(?i)service.*(?:account|^principal$)/ nocase
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
match:
$Date
outcome:
$Count = count(metadata.id)
order:
$Date desc
密码随时间的变化
metadata.event_type = "USER_CHANGE_PASSWORD"
principal.user.account_type = "SERVICE_ACCOUNT_TYPE"
or principal.resource.resource_type = "SERVICE_ACCOUNT"
or principal.user.attribute.roles.type = "SERVICE_ACCOUNT"
or target.user.account_type = "SERVICE_ACCOUNT_TYPE"
or target.resource.resource_type = "SERVICE_ACCOUNT"
or target.user.attribute.roles.type = "SERVICE_ACCOUNT"
or strings.coalesce(principal.resource.type, principal.user.attribute.roles.name, principal.resource.resource_subtype, principal.user.userid, target.resource.type, target.user.attribute.roles.name, target.resource.resource_subtype, target.user.userid) = /(?i)service.*(?:account|^principal$)/ nocase
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
match:
$Date
outcome:
$Count = count(metadata.id)
order:
$Date desc
单点登录 (SSO) 监控
此信息中心可帮助安全团队跟踪 SSO 活动、检测未经授权的访问，以及优化身份验证以提高安全性并确保合规性。
SSO 安全提醒
按操作划分的 SSO 登录次数随时间变化情况
未经授权的单点登录访问
单点登录成功率与失败率
用户登录失败尝试次数
按严重程度划分的 SSO 事件随时间的变化情况
单点登录总次数
单点登录活动日志
按前 10 大应用划分的 SSO 登录次数
单点登录使用趋势
单点登录异常登录位置
来源地理位置概览
按登录次数排名的前 10 名用户
按登录失败次数排名的前 10 个应用
10 大供应商提醒
图表名称
查询示例
SSO 安全提醒
$auth_type = extensions.auth.type
$auth_type = "SSO"
$alert_state = security_result.alert_state
$alert_state = "ALERTING"
$user = strings.coalesce(target.user.user_display_name, principal.user.user_display_name)
$user != ""
$action = security_result.action
$action != "UNKNOWN_ACTION"
$event_name = security_result.summary
$severity = security_result.severity
$category = security_result.category_details
match:
$event_name, $severity, $category
outcome :
$count = count($event_name)
按操作划分的 SSO 登录次数随时间变化情况
extensions.auth.type = "SSO"
$Action = security_result.action
$Event_Type = metadata.event_type
$Event_Type = "USER_LOGIN"
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
match:
$Date, $Action
outcome :
$Count = count(metadata.id)
未经授权的单点登录访问
extensions.auth.type = "SSO"
$User = strings.coalesce(target.user.userid, target.user.user_display_name, target.user.email_addresses, principal.user.userid, principal.user.user_display_name, principal.user.email_addresses)
$Action = security_result.action
$Action != "ALLOW"
$Summary = strings.coalesce(security_result.summary, metadata.description, security_result.description)
$Severity = security_result.severity
$Category = security_result.category_details
match:
$Summary,$User, $Severity, $Action,$Category
outcome :
$Count = count(metadata.id)
单点登录成功率与失败率
$auth_type = extensions.auth.type
$auth_type = "SSO"
$user = strings.coalesce(target.user.user_display_name, principal.user.user_display_name)
$user != ""
$action = security_result.action
$action != "UNKNOWN_ACTION"
match:
$action
outcome :
$count = count($action)
用户登录失败尝试次数
metadata.event_type = "USER_LOGIN"
extensions.auth.type = "SSO"
security_result.action = "BLOCK"
$User = strings.coalesce(target.user.userid, target.user.user_display_name, target.user.email_addresses, principal.user.userid, principal.user.user_display_name, principal.user.email_addresses)
$User != ""
match:
$User
outcome :
$Count = count(metadata.id)
order:
$Count desc
按严重程度划分的 SSO 事件随时间的变化情况
extensions.auth.type = "SSO"
$Severity = security_result.severity
(security_result.severity = "CRITICAL" or security_result.severity = "HIGH")
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
match:
$Date, $Severity
outcome :
$Count = count(metadata.id)
order:
$Date asc
单点登录总次数
$event_type = metadata.event_type
$event_type = "USER_LOGIN"
$auth_type = extensions.auth.type
$auth_type = "SSO"
$user = strings.coalesce(target.user.user_display_name, principal.user.user_display_name)
$user != ""
outcome :
$count = count($user)
单点登录活动日志
$auth_type = extensions.auth.type
$auth_type = "SSO"
$user = strings.coalesce(target.user.user_display_name, principal.user.user_display_name)
$user != ""
$location = principal.ip_geo_artifact.location.country_or_region
$summary = security_result.summary
$summary != ""
$action = security_result.action
match:
$summary, $location, $action
outcome :
$count = count($summary)
order:
$count desc
按前 10 大应用划分的 SSO 登录次数
$event_type = metadata.event_type
$event_type = "USER_LOGIN"
$auth_type = extensions.auth.type
$auth_type = "SSO"
$user = strings.coalesce(target.user.user_display_name, principal.user.user_display_name)
$user != ""
$application = target.application
$application != ""
match:
$application
outcome :
$count = count($application)
order:
$count desc
limit: 10
单点登录使用趋势
$auth_type = extensions.auth.type
$auth_type = "SSO"
$user = target.user.user_display_name
$user != ""
$location = principal.ip_geo_artifact.location.country_or_region
$date = timestamp.get_date(metadata.event_timestamp.seconds)
match:
$auth_type, $date
outcome :
$count = count($auth_type)
未经授权的单点登录访问
$auth_type = extensions.auth.type
$auth_type = "SSO"
$alert_state = security_result.alert_state
$user = strings.coalesce(target.user.user_display_name, principal.user.user_display_name)
$user != ""
$action = security_result.action
$action != "UNKNOWN_ACTION"
$event_name = security_result.summary
$event_name != ""
$severity = security_result.severity
$category = security_result.category_details
$category != ""
match:
$event_name,$user, $severity, $action,$category
outcome :
$count = count($event_name)
单点登录异常登录位置
$auth_type = extensions.auth.type
$auth_type = "SSO"
$user = strings.coalesce(target.user.user_display_name, principal.user.user_display_name)
$user != ""
$location = principal.ip_geo_artifact.location.country_or_region
$location != ""
$location != "United States"
match:
$location
outcome :
$count = count($location)
$latitude = max(principal.ip_geo_artifact.location.region_coordinates.latitude)
$longitude = max(principal.ip_geo_artifact.location.region_coordinates.longitude)
来源地理位置概览
metadata.event_type = "USER_LOGIN"
extensions.auth.type = "SSO"
$Location = principal.ip_geo_artifact.location.country_or_region
match:
$Location
outcome :
$Count = count(metadata.id)
$Latitude = max(principal.ip_geo_artifact.location.region_coordinates.latitude)
$Longitude = max(principal.ip_geo_artifact.location.region_coordinates.longitude)
按登录次数排名的前 10 名用户
$event_type = metadata.event_type
$event_type = "USER_LOGIN"
$auth_type = extensions.auth.type
$auth_type = "SSO"
$user = strings.coalesce(target.user.user_display_name, principal.user.user_display_name)
$user != ""
match:
$user
outcome :
$count = count($user)
order:
$count desc
limit:
10
按登录失败次数排名的前 10 个应用
metadata.event_type = "USER_LOGIN"
extensions.auth.type = "SSO"
security_result.action = "BLOCK"
$Application = target.application
$Application != ""
match:
$Application
outcome :
$Count = count(metadata.id)
Order:
$Count desc
limit:
10
10 大供应商提醒
extensions.auth.type = "SSO"
$Rule_Name = security_result.rule_name
$Rule_Name != ""
match:
$Rule_Name
outcome :
$Count = count(metadata.id)
order:
$Count desc
limit:
10
Sysmon 监控
此信息中心用于分析和监控由 sysmon 生成的日志。它可提供有关系统活动的深入信息，包括进程创建、网络连接和文件更改。通过汇总和直观呈现这些数据，该信息中心可帮助安全分析师识别可疑行为、跟踪潜在威胁并采取相应措施。
近期服务事件
10 大热门主持人
前 10 个 Sysmon 事件 ID
一段时间内的自动运行注册表更改
近期 WMI 事件
按签名状态划分的图片加载事件随时间的变化趋势
活动类型分布情况
不同的主机
10 大命令行
启动网络连接的前 10 个进程
活动类型细分
创建次数最多的 10 个文件
按来源进程列出的前 10 个 DNS 查询网域
不同用户数
前 10 个父进程
前 10 位用户
处理随时间变化的注入权限的访问事件
Sysmon 事件总数
前 10 个进程
按签名状态划分的驱动程序加载事件随时间的变化趋势
Sysmon 事件趋势
不同主机总数
Sysmon 事件随时间的变化趋势
排名前 10 的已修改注册表项
不同用户总数
图表名称
查询示例
近期服务事件
metadata.log_type = "WINDOWS_SYSMON"
metadata.product_event_type = "4"
or metadata.product_event_type = "5"
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
match:
$Date
outcome:
$Count = count(metadata.id)
order:
$Date desc
10 大热门主持人
$event.metadata.log_type = "WINDOWS_SYSMON"
$Hostname = $event.principal.hostname
$Hostname != ""
match:
$Hostname
outcome:
$Count = count($event.metadata.id)
order:
$Count desc
limit:
10
前 10 个 Sysmon 事件 ID
metadata.log_type = "WINDOWS_SYSMON"
$Event_ID = metadata.product_event_type
match:
$Event_ID
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
一段时间内的自动运行注册表更改
metadata.log_type = "WINDOWS_SYSMON"
metadata.product_event_type = "12"
or metadata.product_event_type = "13"
or metadata.product_event_type = "14"
target.registry.registry_key = /(?:HKCU|HKLM)\\Software\\Microsoft\\Windows(?:\sNT)?\\CurrentVersion\\(?:Run(?:Once)?|Winlogon\\(?:Shell|Userinit))/ nocase
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
match:
$Date
outcome:
$Count = count(metadata.id)
order:
$Date desc
近期 WMI 事件
metadata.log_type = "WINDOWS_SYSMON"
metadata.product_event_type = "19"
or metadata.product_event_type = "20"
or metadata.product_event_type = "21"
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
match:
$Date
outcome:
$Count = count(metadata.id)
order:
$Date desc
按签名状态划分的图片加载事件随时间的变化趋势
metadata.log_type = "WINDOWS_SYSMON"
metadata.product_event_type = "7"
$Signature_Status = target.resource.attribute.labels["SignatureStatus"]
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
match:
$Date, $Signature_Status
outcome:
$Count = count(metadata.id)
order:
$Date desc
活动类型分布情况
metadata.log_type = "WINDOWS_SYSMON"
$Event_Type = metadata.event_type
match:
$Event_Type
outcome:
$Count = count(metadata.id)
order:
$Count desc
不同的主机
$event.metadata.log_type = "WINDOWS_SYSMON"
outcome:
$Count = count_distinct($event.principal.hostname)
10 大命令行
metadata.log_type = "WINDOWS_SYSMON"
$Command = target.process.command_line
$Command != ""
match:
$Command
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
启动网络连接的前 10 个进程
metadata.log_type = "WINDOWS_SYSMON"
metadata.event_type = "NETWORK_CONNECTION"
$Process = principal.process.file.full_path
match:
$Process
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
活动类型细分
$event.metadata.log_type = "WINDOWS_SYSMON"
$Event_Type = $event.metadata.event_type
match:
$Event_Type
outcome:
$Count = count($event.metadata.id)
order:
$Count desc
创建次数最多的 10 个文件
$event.metadata.log_type = "WINDOWS_SYSMON"
$event.metadata.event_type = "FILE_CREATION"
$File = $event.target.file.full_path
match:
$File
outcome:
$Count = count($event.metadata.id)
order:
$Count desc
limit:
10
按来源进程列出的前 10 个 DNS 查询网域
metadata.log_type = "WINDOWS_SYSMON"
metadata.product_event_type = "22"
$Source_Process = strings.coalesce(principal.process.file.full_path, principal.hostname)
$Domain = network.dns.questions.name
match:
$Domain, $Source_Process
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
不同用户数
$event.metadata.log_type = "WINDOWS_SYSMON"
outcome:
$Count = count_distinct($event.principal.user.userid)
10 大热门主持人
metadata.log_type = "WINDOWS_SYSMON"
$Hostname = principal.hostname
$Hostname != ""
match:
$Hostname
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
前 10 个父进程
metadata.log_type = "WINDOWS_SYSMON"
$Process = principal.process.file.full_path
$Process != ""
match:
$Process
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
前 10 位用户
$event.metadata.log_type = "WINDOWS_SYSMON"
$User = $event.principal.user.userid
$User != ""
match:
$User
outcome:
$Count = count($event.metadata.id)
order:
$Count desc
limit:
10
处理随时间变化的注入权限的访问事件
metadata.log_type = "WINDOWS_SYSMON"
metadata.product_event_type = "10"
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
$Target_Process = target.process.file.full_path
match:
$Date, $Target_Process
outcome:
$Count = count(metadata.id)
order:
$Date desc
Sysmon 事件总数
$event.metadata.log_type = "WINDOWS_SYSMON"
outcome:
$Count = count($event.metadata.id)
前 10 个进程
metadata.log_type = "WINDOWS_SYSMON"
$Process = target.process.file.full_path
$Process != ""
match:
$Process
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
前 10 个进程
$event.metadata.log_type = "WINDOWS_SYSMON"
$Process = $event.target.process.file.full_path
$Process != ""
match:
$Process
outcome:
$Count = count($event.metadata.id)
order:
$Count desc
limit:
10
10 大命令行
$event.metadata.log_type = "WINDOWS_SYSMON"
$Command = $event.target.process.command_line
$Command != ""
match:
$Command
outcome:
$Count = count($event.metadata.id)
order:
$Count desc
limit:
10
前 10 个 Sysmon 事件 ID
$event.metadata.log_type = "WINDOWS_SYSMON"
$Event_ID = $event.metadata.product_event_type
match:
$Event_ID
outcome:
$Count = count($event.metadata.id)
order:
$Count desc
limit:
10
按签名状态划分的驱动程序加载事件随时间的变化趋势
metadata.log_type = "WINDOWS_SYSMON"
metadata.product_event_type = "6"
$Signature_Status = target.resource.attribute.labels["SignatureStatus"]
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
match:
$Date, $Signature_Status
outcome:
$Count = count(metadata.id)
order:
$Date desc
Sysmon 事件趋势
$event.metadata.log_type = "WINDOWS_SYSMON"
$Date = timestamp.get_date($event.metadata.event_timestamp.seconds)
match:
$Date
outcome:
$Count = count($event.metadata.id)
order:
$Date asc
启动网络连接的前 10 个进程
$event.metadata.log_type = "WINDOWS_SYSMON"
$event.metadata.event_type = "NETWORK_CONNECTION"
$Process = $event.principal.process.file.full_path
match:
$Process
outcome:
$Count = count($event.metadata.id)
order:
$Count desc
limit:
10
创建次数最多的 10 个文件
metadata.log_type = "WINDOWS_SYSMON"
metadata.event_type = "FILE_CREATION"
$Source = principal.process.file.full_path
$File = target.file.full_path
match:
$File, $Source
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
前 10 位用户
metadata.log_type = "WINDOWS_SYSMON"
$User = principal.user.userid
$User != ""
match:
$User
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
Sysmon 事件总数
metadata.log_type = "WINDOWS_SYSMON"
outcome:
$Count = count(metadata.id)
不同主机总数
metadata.log_type = "WINDOWS_SYSMON"
outcome:
$Count = count_distinct(principal.hostname)
Sysmon 事件随时间的变化趋势
metadata.log_type = "WINDOWS_SYSMON"
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
match:
$Date
outcome:
$Count = count(metadata.id)
order:
$Date desc
排名前 10 的已修改注册表项
metadata.log_type = "WINDOWS_SYSMON"
metadata.product_event_type = "13"
$Registry = target.registry.registry_key
match:
$Registry
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
不同用户总数
metadata.log_type = "WINDOWS_SYSMON"
outcome:
$Count = count_distinct(principal.user.userid)
前 10 个父进程
$event.metadata.log_type = "WINDOWS_SYSMON"
$Process = $event.principal.process.file.full_path
$Process != ""
match:
$Process
outcome:
$Count = count($event.metadata.id)
order:
$Count desc
limit:
10
用户生命周期审核
此信息中心是一个详细的信息中心，供安全经理和审核人员查看用户账号管理活动。它可提供用户生命周期的全面视图，帮助确保正确遵循配置和取消配置政策。
创建用户的前 10 个来源 IP
近期创建的用户账号
随时间推移而删除的用户
已停用或已删除账号的活动
删除用户的前 10 个来源 IP 地址
修改用户的前 10 位用户
用户事件随时间的变化趋势
用户创建时间随时间的变化趋势
最近修改了用户账号
用户数随时间的变化趋势
删除用户最多的 10 位用户
修改用户的前 10 个来源 IP
创建用户最多的 10 位用户
图表名称
查询示例
创建用户的前 10 个来源 IP
metadata.event_type = "USER_CREATION"
security_result.action = "ALLOW"
$Log_Type = metadata.log_type
$IP_Address = principal.ip
match:
$Log_Type, $IP_Address
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
近期创建的用户账号
metadata.event_type = "USER_CREATION"
security_result.action = "ALLOW"
$Log_Type = metadata.log_type
$Initiator = strings.coalesce(principal.user.windows_sid, principal.user.userid, principal.user.email_addresses)
$User = strings.coalesce(target.user.userid, target.user.email_addresses)
$IP_Address = principal.ip
$Date = timestamp.get_timestamp(metadata.event_timestamp.seconds, "%F %T ")
match:
$Date, $Log_Type, $Initiator, $IP_Address, $User
order:
$Date desc
随时间推移而删除的用户
metadata.event_type = "USER_DELETION"
security_result.action = "ALLOW"
$Log_Type = metadata.log_type
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
match:
$Date, $Log_Type
outcome:
$Count = count(metadata.id)
order:
$Date desc
已停用或已删除账号的活动
$User = strings.coalesce(target.user.userid, target.user.email_addresses, target.user.windows_sid)
$User != ""
match:
$User
outcome:
$Deletion_Time = max(if(metadata.event_type = "USER_DELETION", metadata.event_timestamp.seconds, 0))
$Deletion_Timestamp = timestamp.get_timestamp($Deletion_Time, "%F %T ")
$Recent_Activity = max(metadata.event_timestamp.seconds)
$Recent_Activity_Timestamp = timestamp.get_timestamp($Recent_Activity, "%F %T ")
$Status = if($Deletion_Time != 0 AND ($Recent_Activity > $Deletion_Time), "Active Deleted Account", "Inactive Deleted Account")
$Event_Activities = array_distinct(metadata.event_type)
condition:
arrays.contains($Event_Activities, "USER_DELETION") AND $Status != "Inactive Deleted Account"
order:
$User desc
unselect:
$Event_Activities, $Deletion_Time, $Recent_Activity
删除用户的前 10 个来源 IP 地址
metadata.event_type = "USER_DELETION"
security_result.action = "ALLOW"
$Log_Type = metadata.log_type
$IP_Address = principal.ip
match:
$Log_Type, $IP_Address
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
修改用户的前 10 位用户
metadata.event_type = "USER_CHANGE_PERMISSIONS"
or metadata.event_type = "USER_CHANGE_PASSWORD"
or metadata.event_type = "USER_RESOURCE_UPDATE_PERMISSIONS"
security_result.action = "ALLOW"
$Log_Type = metadata.log_type
$User = strings.coalesce(principal.user.windows_sid, principal.user.userid, principal.user.email_addresses)
match:
$Log_Type, $User
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
用户事件随时间的变化趋势
metadata.event_type = "USER_CREATION"
or metadata.event_type = "USER_DELETION"
or metadata.event_type = "USER_CHANGE_PERMISSIONS"
or metadata.event_type = "USER_CHANGE_PASSWORD"
or metadata.event_type = "USER_RESOURCE_UPDATE_PERMISSIONS"
security_result.action = "ALLOW"
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
$Event = metadata.event_type
match:
$Date, $Event
outcome:
$Count = count(metadata.id)
order:
$Date desc
用户创建时间随时间的变化趋势
metadata.event_type = "USER_CREATION"
security_result.action = "ALLOW"
$Log_Type = metadata.log_type
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
match:
$Date, $Log_Type
outcome:
$Count = count(metadata.id)
order:
$Date desc
最近修改了用户账号
metadata.event_type = "USER_CHANGE_PERMISSIONS"
or metadata.event_type = "USER_CHANGE_PASSWORD"
or metadata.event_type = "USER_RESOURCE_UPDATE_PERMISSIONS"
security_result.action = "ALLOW"
$Event_Type = metadata.event_type
$Log_Type = metadata.log_type
$User = strings.coalesce(target.user.userid, target.user.email_addresses)
$Initiator = strings.coalesce(principal.user.windows_sid, principal.user.userid, principal.user.email_addresses)
$IP_Address = principal.ip
$Date = timestamp.get_timestamp(metadata.event_timestamp.seconds, "%F %T ")
match:
$Date, $Log_Type, $Initiator, $IP_Address, $User, $Event_Type
order:
$Date desc
用户数随时间的变化趋势
metadata.event_type = "USER_CHANGE_PERMISSIONS"
or metadata.event_type = "USER_CHANGE_PASSWORD"
or metadata.event_type = "USER_RESOURCE_UPDATE_PERMISSIONS"
security_result.action = "ALLOW"
$Log_Type = metadata.log_type
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
match:
$Date, $Log_Type
outcome:
$Count = count(metadata.id)
order:
$Date desc
删除用户最多的 10 位用户
metadata.event_type = "USER_DELETION"
security_result.action = "ALLOW"
$Log_Type = metadata.log_type
$User = strings.coalesce(principal.user.windows_sid, principal.user.userid, principal.user.email_addresses)
match:
$Log_Type, $User
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
修改用户的前 10 个来源 IP
metadata.event_type = "USER_CHANGE_PERMISSIONS"
or metadata.event_type = "USER_CHANGE_PASSWORD"
or metadata.event_type = "USER_RESOURCE_UPDATE_PERMISSIONS"
security_result.action = "ALLOW"
$Log_Type = metadata.log_type
$IP_Address = principal.ip
match:
$Log_Type, $IP_Address
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
创建用户最多的 10 位用户
metadata.event_type = "USER_CREATION"
security_result.action = "ALLOW"
$Log_Type = metadata.log_type
$User = strings.coalesce(principal.user.windows_sid, principal.user.userid, principal.user.email_addresses)
match:
$Log_Type, $User
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
用户登录概览
此信息中心可全面分析身份验证活动，帮助您识别和监控登录事件。这有助于您检测可能存在风险的用户，分析登录状态和趋势，并了解地理位置活动和关联的主机。您还可以调查异常登录行为、应对潜在的安全违规行为，并通过持续监控和主动威胁检测来保持强大的安全性。
按国家/地区划分的登录次数
过去一天内的成功登录次数
按登录状态列出的 10 大 IP 地址
过去一天内用量最高的前 10 个源/目标通信方 - 字节数
按登录次数排序的前 10 个应用
按应用划分的登录次数
前 10 个来源-目标配对（按事件数）
成功登录次数
登录次数（按状态划分）
按登录失败次数排名的前 10 名用户
按登录状态划分的用户数
登录地点地图
登录次数（按状态随时间变化）
按登录状态划分的主机名
按目标 IP 划分的 Abu 事件数
按应用划分的登录次数
按登录失败次数排名的前 10 个 IP 地址
过去一天中排名前 5 的来源/目的地通信方
按成功登录次数排名的前 10 大主机名
凭据访问登录事件
登录失败次数
按登录状态划分的 IP 地址
按次数划分的登录失败次数（过去 24 小时）
按成功登录次数排名的前 10 个 IP 地址
登录次数排名前 10 位的国家/地区
按日期和日志类型划分的事件数
登录次数（按状态划分）
按登录失败次数排名的前 10 名主机名
过去一天内用量最高的前 10 个来源/目标通话者
初始访问登录事件
按登录状态排名的前 10 名用户
登录失败率
成功登录次数最多的 10 位用户
图表名称
查询示例
按国家/地区划分的登录次数
metadata.event_type = "USER_LOGIN"
$Country = principal.location.country_or_region
match:
$Country
outcome:
$Count = count(metadata.id)
order:
$Count desc
过去一天内的成功登录次数
metadata.event_type = "USER_LOGIN"
security_result.action = $action
$action = "ALLOW"
match:
$action
outcome:
$event_count = count_distinct(metadata.id)
按登录状态列出的 10 大 IP 地址
metadata.event_type = "USER_LOGIN"
$IP_Address = principal.ip
match:
$IP_Address
outcome:
$Count = count(metadata.id)
$Failed_Login_Count = sum(if(security_result.action = "BLOCK", 1, 0))
$Successful_Login_Count = sum(if(security_result.action = "ALLOW", 1, 0))
order:
$Count desc
limit:
10
过去一天内用量最高的前 10 个源/目标通信方 - 字节数
metadata.event_type = "NETWORK_CONNECTION"
$pip = principal.ip
$tip = target.ip
match:
$pip, $tip
outcome:
$event_count = count_distinct(metadata.id)
$bytes_sent = sum(network.sent_bytes)
$bytes_received = sum(network.received_bytes)
order:
$bytes_sent desc
limit:
10
按登录次数排序的前 10 个应用
metadata.event_type = "USER_LOGIN"
$Application = target.application
match:
$Application
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
按应用划分的登录次数
target.application != ""
$application = target.application
$login_status = security_result.action
match:
$application, $login_status
outcome:
$event_count = count_distinct(metadata.id)
order:
$event_count desc
前 10 个来源-目标配对（按事件数）
principal.hostname != ""
target.ip != ""
$source = principal.hostname
$target = target.ip
match:
$source, $target
outcome:
$event_count = count_distinct(metadata.id)
order:
$event_count desc
limit:
10
成功登录次数
metadata.event_type = "USER_LOGIN"
security_result.action = "ALLOW"
outcome:
$Count = count(metadata.id)
登录次数（按状态划分）
metadata.event_type = "USER_LOGIN"
$security_result = security_result.action
match:
$security_result
outcome:
$event_count = count_distinct(metadata.id)
按登录失败次数排名的前 10 名用户
metadata.event_type = "USER_LOGIN"
security_result.action = "BLOCK"
$User = target.user.userid
match:
$User
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
按登录状态划分的用户数
metadata.event_type = "USER_LOGIN"
$User = target.user.userid
match:
$User
outcome:
$Count = count(metadata.id)
$Failed_Login_Count = sum(if(security_result.action = "BLOCK", 1, 0))
$Successful_Login_Count = sum(if(security_result.action = "ALLOW", 1, 0))
order:
$Count desc
登录地点地图
metadata.event_type = "USER_LOGIN"
$IP_Address = principal.ip
$Latitude = principal.location.region_latitude
$Latitude != 0
$Longitude = principal.location.region_longitude
$Longitude != 0
match:
$IP_Address, $Latitude, $Longitude
outcome:
$Count = count(metadata.id)
order:
$Count desc
登录次数（按状态随时间变化）
metadata.event_type = "USER_LOGIN"
$Action = security_result.action
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
match:
$Action, $Date
outcome:
$Count = count(metadata.id)
order:
$Count asc
按登录状态划分的主机名
metadata.event_type = "USER_LOGIN"
$Hostname = principal.hostname
match:
$Hostname
outcome:
$Count = count(metadata.id)
$Failed_Login_Count = sum(if(security_result.action = "BLOCK", 1, 0))
$Successful_Login_Count = sum(if(security_result.action = "ALLOW", 1, 0))
order:
$Count desc
按目标 IP 划分的 Abu 事件数
principal.hostname = "abu"
$target = target.ip
match:
$target
outcome:
$event_count = count_distinct(metadata.id)
按应用划分的登录次数
metadata.event_type = "USER_LOGIN"
$Application = target.application
match:
$Application
outcome:
$Count = count(metadata.id)
$Failed_Login_Count = sum(if(security_result.action = "BLOCK", 1, 0))
$Successful_Login_Count = sum(if(security_result.action = "ALLOW", 1, 0))
order:
$Count desc
limit:
10
按登录失败次数排名的前 10 个 IP 地址
metadata.event_type = "USER_LOGIN"
security_result.action = "BLOCK"
$IP_Address = principal.ip
match:
$IP_Address
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
过去一天中排名前 5 的来源/目的地通信方
metadata.event_type = "NETWORK_CONNECTION"
$ip_pair = strings.concat(principal.ip,"/",target.ip)
principal.ip != "10.9.8.7"
match:
$ip_pair
outcome:
$event_count = count_distinct(metadata.id)
order:
$event_count desc
limit:
5
按成功登录次数排名的前 10 大主机名
metadata.event_type = "USER_LOGIN"
security_result.action = "ALLOW"
$Hostname = principal.hostname
match:
$Hostname
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
凭据访问登录事件
metadata.event_type = "USER_LOGIN"
strings.coalesce(security_result.attack_details.tactics.name, security_result.detection_fields["Tactic"]) = /Credential Access/ nocase
outcome:
$Count = count(metadata.id)
登录失败次数
metadata.event_type = "USER_LOGIN"
security_result.action = "BLOCK"
outcome:
$Count = count(metadata.id)
按登录状态划分的 IP 地址
metadata.event_type = "USER_LOGIN"
$IP_Address = principal.ip
match:
$IP_Address
outcome:
$Count = count(metadata.id)
$Failed_Login_Count = sum(if(security_result.action = "BLOCK", 1, 0))
$Successful_Login_Count = sum(if(security_result.action = "ALLOW", 1, 0))
order:
$Count desc
按次数划分的登录失败次数（过去 24 小时）
metadata.event_type = "USER_LOGIN"
security_result.action = "BLOCK"
$Date = timestamp.get_timestamp(metadata.event_timestamp.seconds)
$Hostname = principal.hostname
$IP_Address = principal.ip
$User = strings.coalesce(target.user.userid, target.user.user_display_name, principal.user.userid, principal.user.user_display_name)
match:
$Date, $User, $Hostname, $IP_Address
outcome:
$Failed_Logins = count(metadata.id)
order:
$Failed_Logins desc
按成功登录次数排名的前 10 个 IP 地址
metadata.event_type = "USER_LOGIN"
security_result.action = "ALLOW"
$IP_Address = principal.ip
match:
$IP_Address
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
登录次数排名前 10 位的国家/地区
metadata.event_type = "USER_LOGIN"
$Country = principal.location.country_or_region
match:
$Country
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
按日期和日志类型划分的事件数
$log_type = metadata.log_type
$date = timestamp.get_date(metadata.event_timestamp.seconds, "America/Los_Angeles")
match:
$date, $log_type
outcome:
$event_count = count_distinct(metadata.id)
order:
$event_count desc
登录次数（按状态划分）
metadata.event_type = "USER_LOGIN"
$Action = security_result.action
match:
$Action
outcome:
$Count = count(metadata.id)
order:
$Count desc
按登录失败次数排名的前 10 名主机名
metadata.event_type = "USER_LOGIN"
security_result.action = "BLOCK"
$Hostname = principal.hostname
match:
$Hostname
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
过去一天内用量最高的前 10 个来源/目标通话者
metadata.event_type = "NETWORK_CONNECTION"
$pip = principal.ip
$tip = target.ip
match:
$pip, $tip
outcome:
$event_count = count_distinct(metadata.id)
order:
$event_count desc
limit:
10
初始访问登录事件
metadata.event_type = "USER_LOGIN"
strings.coalesce(security_result.attack_details.tactics.name, security_result.detection_fields["Tactic"]) = /Initial Access/ nocase
outcome:
$Count = count(metadata.id)
按登录状态排名的前 10 名用户
metadata.event_type = "USER_LOGIN"
$User = target.user.userid
match:
$User
outcome:
$Count = count(metadata.id)
$Failed_Login_Count = sum(if(security_result.action = "BLOCK", 1, 0))
$Successful_Login_Count = sum(if(security_result.action = "ALLOW", 1, 0))
order:
$Count desc
limit:
10
登录失败率
metadata.event_type = "USER_LOGIN"
outcome:
$Total_Logins = count(metadata.id)
$Failed_Logins = sum(if(security_result.action = "BLOCK", 1, 0))
$Failure_Rate = math.round(($Failed_Logins / $Total_Logins), 2) * 100
成功登录次数最多的 10 位用户
metadata.event_type = "USER_LOGIN"
security_result.action = "ALLOW"
$User = target.user.userid
match:
$User
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
VPN 活动监控
此信息中心可提供与安全性相关的 VPN 事件分析。
地理位置连接来源
按用户和 IP 地址列出的前 10 次 VPN 尝试失败
VPN 使用趋势
VPN 带宽随时间变化的使用情况
来源平台分布
按事件数排名的前 10 名 VPN 用户
前 10 大目标 IP
有效 VPN 连接
VPN 连接成功与失败
图表名称
查询示例
地理位置连接来源
$log_type = metadata.log_type
$log_type = /VPN|Zscaler_ZPA|ZSCALER_DECEPTION|TWINGATE|SYMANTEC_VIP_AUTHHUB/nocase
$location = principal.location.country_or_region
$location != ""
match:
$location
outcome:
$event_count = count($location)
$latitude = max(principal.location.region_coordinates.latitude)
$longitude = max(principal.location.region_coordinates.longitude)
按用户和 IP 地址列出的前 10 次 VPN 尝试失败
$log_type = metadata.log_type
$log_type = /VPN|Zscaler_ZPA|ZSCALER_DECEPTION|TWINGATE|SYMANTEC_VIP_AUTHHUB/nocase
$summary = security_result.summary
($summary = /fail/ or additional.fields["connection-attempt-status"] = /fail/ or metadata.product_event_type = /fail/)
$user = principal.user.user_display_name
$src_ip = principal.ip
match:
$user,$src_ip
outcome:
$event_count = count(metadata.id)
order:
$event_count desc
limit :
10
VPN 使用趋势
$log_type = metadata.log_type
$log_type = /VPN|Zscaler_ZPA|ZSCALER_DECEPTION|TWINGATE|SYMANTEC_VIP_AUTHHUB/nocase
$date = timestamp.get_date(metadata.event_timestamp.seconds)
match:
$date
outcome:
$event_count = count(metadata.id)
order:
$date asc
VPN 带宽随时间变化的使用情况
$log_type = metadata.log_type
$log_type = /VPN|Zscaler_ZPA|ZSCALER_DECEPTION|TWINGATE|SYMANTEC_VIP_AUTHHUB/nocase
$date = timestamp.get_date(metadata.event_timestamp.seconds)
$sent_bytes = network.sent_bytes
$received_bytes = network.received_bytes
match:
$date
outcome:
$total_sent_bytes = sum($sent_bytes)
$total_received_bytes = sum($received_bytes)
$total_bandwidth = $total_sent_bytes + $total_received_bytes
$total_bandwidth_kb = $total_bandwidth/ 1024
order:
$date asc
VPN 使用趋势
$log_type = metadata.log_type
$log_type = /VPN|Zscaler_ZPA|ZSCALER_DECEPTION|TWINGATE|SYMANTEC_VIP_AUTHHUB/nocase
$date = timestamp.get_date(metadata.event_timestamp.seconds)
match:
$date
outcome:
$event_count = count(metadata.id)
order:
$date asc
来源平台分布
$log_type = metadata.log_type
$log_type = /VPN|Zscaler_ZPA|ZSCALER_DECEPTION|TWINGATE|SYMANTEC_VIP_AUTHHUB/nocase
$platform = principal.platform
match:
$platform
outcome:
$event_count = count(metadata.id)
按事件数排名的前 10 名 VPN 用户
$log_type = metadata.log_type
$log_type = /VPN|Zscaler_ZPA|ZSCALER_DECEPTION|TWINGATE|SYMANTEC_VIP_AUTHHUB/nocase
$user = strings.coalesce(principal.user.user_display_name,target.user.user_display_name)
$user != ""
match:
$user
outcome:
$event_count = count(metadata.id)
order:
$event_count desc
limit:
10
前 10 大目标 IP
$log_type = metadata.log_type
$log_type = /VPN|Zscaler_ZPA|ZSCALER_DECEPTION|TWINGATE|SYMANTEC_VIP_AUTHHUB/nocase
$dest_ip = target.ip
$dest_ip != ""
match:
$dest_ip
outcome:
$event_count = count(metadata.id)
order:
$event_count desc
limit:
10
VPN 带宽随时间变化的使用情况
$log_type = metadata.log_type
$log_type = /VPN|Zscaler_ZPA|ZSCALER_DECEPTION|TWINGATE|SYMANTEC_VIP_AUTHHUB/nocase
$date = timestamp.get_date(metadata.event_timestamp.seconds)
$sent_bytes = network.sent_bytes
$received_bytes = network.received_bytes
match:
$date
outcome:
$total_sent_bytes = sum($sent_bytes)
$total_received_bytes = sum($received_bytes)
$total_bandwidth = $total_sent_bytes + $total_received_bytes
$total_bandwidth_kb = $total_bandwidth/ 1024
order:
$date asc
有效 VPN 连接
$log_type = metadata.log_type
$log_type = /VPN|Zscaler_ZPA|ZSCALER_DECEPTION|TWINGATE|SYMANTEC_VIP_AUTHHUB/nocase
$src_ip = principal.ip
$dest_ip = target.ip
$end_time = additional.fields["connection-end-time"]
$end_time = "NA"
$user = target.user.user_display_name
$session_duration = timestamp.diff(metadata.ingested_timestamp.seconds,timestamp.as_unix_seconds(additional.fields["connection-start-time"]))
$session_duration > 100
match:
$user,$src_ip,$dest_ip,$session_duration
outcome:
$event_count = count(metadata.id)
order:
$session_duration desc,$user asc
地理位置连接来源
$log_type = metadata.log_type
$log_type = /VPN|Zscaler_ZPA|ZSCALER_DECEPTION|TWINGATE|SYMANTEC_VIP_AUTHHUB/nocase
$location = principal.location.country_or_region
$location != ""
match:
$location
outcome:
$event_count = count($location)
$latitude = max(principal.location.region_coordinates.latitude)
$longitude = max(principal.location.region_coordinates.longitude)
按用户和 IP 地址列出的前 10 次 VPN 尝试失败
$log_type = metadata.log_type
$log_type = /VPN|Zscaler_ZPA|ZSCALER_DECEPTION|TWINGATE|SYMANTEC_VIP_AUTHHUB/nocase
$summary = security_result.summary
($summary = /fail/ or additional.fields["connection-attempt-status"] = /fail/ or metadata.product_event_type = /fail/)
$user = principal.user.user_display_name
$src_ip = principal.ip
match:
$user,$src_ip
outcome:
$event_count = count(metadata.id)
order:
$event_count desc
limit :
10
来源平台分布
$log_type = metadata.log_type
$log_type = /VPN|Zscaler_ZPA|ZSCALER_DECEPTION|TWINGATE|SYMANTEC_VIP_AUTHHUB/nocase
$platform = principal.platform
match:
$platform
outcome:
$event_count = count(metadata.id)
有效 VPN 连接
$log_type = metadata.log_type
$log_type = /VPN|Zscaler_ZPA|ZSCALER_DECEPTION|TWINGATE|SYMANTEC_VIP_AUTHHUB/nocase
$src_ip = principal.ip
$dest_ip = target.ip
$end_time = additional.fields["connection-end-time"]
$end_time = "NA"
$user = target.user.user_display_name
$session_duration = timestamp.diff(metadata.ingested_timestamp.seconds,timestamp.as_unix_seconds(additional.fields["connection-start-time"]))
$session_duration > 100
match:
$user,$src_ip,$dest_ip,$session_duration
outcome:
$event_count = count(metadata.id)
order:
$session_duration desc,$user asc
VPN 连接成功与失败
$log_type = metadata.log_type
$log_type = /VPN|Zscaler_ZPA|ZSCALER_DECEPTION|TWINGATE|SYMANTEC_VIP_AUTHHUB/nocase
$summary = strings.coalesce(security_result.summary, metadata.product_event_type, additional.fields["connection-attempt-status"])
($summary = /fail/ or $summary = /success/)
match:
$summary
outcome:
$event_count = count(metadata.id)
VPN 连接成功与失败
$log_type = metadata.log_type
$log_type = /VPN|Zscaler_ZPA|ZSCALER_DECEPTION|TWINGATE|SYMANTEC_VIP_AUTHHUB/nocase
$summary = strings.coalesce(security_result.summary, metadata.product_event_type, additional.fields["connection-attempt-status"])
($summary = /fail/ or $summary = /success/)
match:
$summary
outcome:
$event_count = count(metadata.id)
按事件数排名的前 10 名 VPN 用户
$log_type = metadata.log_type
$log_type = /VPN|Zscaler_ZPA|ZSCALER_DECEPTION|TWINGATE|SYMANTEC_VIP_AUTHHUB/nocase
$user = strings.coalesce(principal.user.user_display_name,target.user.user_display_name)
$user != ""
match:
$user
outcome:
$event_count = count(metadata.id)
order:
$event_count desc
limit:
10
前 10 大目标 IP
$log_type = metadata.log_type
$log_type = /VPN|Zscaler_ZPA|ZSCALER_DECEPTION|TWINGATE|SYMANTEC_VIP_AUTHHUB/nocase
$dest_ip = target.ip
$dest_ip != ""
match:
$dest_ip
outcome:
$event_count = count(metadata.id)
order:
$event_count desc
limit:
10
Web 应用防火墙 (WAF) 监控
此信息中心旨在监控和分析 Web 应用防火墙活动，以增强安全性和威胁管理。它通过跟踪与 WAF 运行相关的各种指标和事件，提供有关 Web 应用安全的实时数据洞见，帮助您有效管理和应对潜在的 Web 威胁。
异常流量检测
前 10 个 WAF 规则命中次数
前 10 大来源 IP
被屏蔽的请求与允许的请求
攻击的地理位置
10 大攻击类型
前 10 个网址的命中次数
图表名称
查询示例
异常流量检测
$Log_Type = metadata.log_type
$Log_Type = /WAF/ nocase
$Action = security_result.action
$date = timestamp.get_date(metadata.event_timestamp.seconds)
match:
$date
outcome:
$count = count(metadata.id)
前 10 个 WAF 规则命中次数
$Log_Type = metadata.log_type
$Log_Type = /WAF/ nocase
$Rule_Name = security_result.rule_name
match:
$Rule_Name, $Log_Type
outcome:
$count = count(metadata.id)
order:
$count desc
limit:
10
前 10 大来源 IP
$Log_Type = metadata.log_type
$Log_Type = /WAF/ nocase
$Source_IP = principal.ip
$Geolocation = principal.location.country_or_region
match:
$Source_IP, $Geolocation
outcome:
$Action = array_distinct(security_result.action)
$count = count(metadata.id)
Order:
$count desc
limit:
10
被屏蔽的请求与允许的请求
$Log_Type = metadata.log_type
$Log_Type = /WAF/ nocase
$Action = security_result.action
match:
$Action
outcome:
$count = count(metadata.id)
被屏蔽的请求与允许的请求
$Log_Type = metadata.log_type
$Log_Type = /WAF/
$Action = security_result.action
match:
$Action
outcome:
$count = count(metadata.id)
攻击的地理位置
$Log_Type = metadata.log_type
$Log_Type = /WAF/
$Geolocation = principal.location.country_or_region
match:
$Geolocation
outcome:
$Latitude = max(principal.location.region_latitude)
$Longitude = max(principal.location.region_longitude)
$count = count(metadata.id)
前 10 大来源 IP
$Log_Type = metadata.log_type
$Log_Type = /WAF/
$Source_IP = principal.ip
$Source_IP != ""
$Geolocation = principal.location.country_or_region
match:
$Source_IP, $Geolocation
outcome:
$Action = array_distinct(security_result.action)
$count = count(metadata.id)
Order:
$count desc
limit:
10
10 大攻击类型
$Log_Type = metadata.log_type
$Log_Type = /WAF/ nocase
$Description = security_result.description
match:
$Description, $Log_Type
outcome:
$Action = array_distinct(security_result.action)
$count = count(metadata.id)
order:
$count desc
limit:
10
异常流量检测
$Log_Type = metadata.log_type
$Log_Type = /WAF/
$Action = security_result.action
$date = timestamp.get_date(metadata.event_timestamp.seconds)
match:
$date
outcome:
$count = count(metadata.id)
10 大攻击类型
$Log_Type = metadata.log_type
$Log_Type = /WAF/
$Description = security_result.description
$Description != ""
match:
$Description, $Log_Type
outcome:
$Action = array_distinct(security_result.action)
$count = count(metadata.id)
order:
$count desc
limit:
10
攻击的地理位置
$Log_Type = metadata.log_type
$Log_Type = /WAF/ nocase
$Geolocation = principal.location.country_or_region
match:
$Geolocation
outcome:
$Latitude = max(principal.location.region_latitude)
$Longitude = max(principal.location.region_longitude)
$count = count(metadata.id)
前 10 个网址的命中次数
$Log_Type = metadata.log_type
$Log_Type = /WAF/
$URL = target.url
$URL != ""
match:
$URL, $Log_Type
outcome:
$count = count(metadata.id)
order:
$count desc
limit:
10
前 10 个 WAF 规则命中次数
$Log_Type = metadata.log_type
$Log_Type = /WAF/
$Rule_Name = security_result.rule_name
$Rule_Name != ""
match:
$Rule_Name, $Log_Type
outcome:
$count = count(metadata.id)
order:
$count desc
limit:
10
前 10 个网址的命中次数
$Log_Type = metadata.log_type
$Log_Type = /WAF/ nocase
$URL = target.url
match:
$URL, $Log_Type
outcome:
$count = count(metadata.id)
order:
$count desc
limit:
10
Web Center 概览
此信息中心可监控和分析整个网络中的网站流量模式和用户活动。它可提供有关热门用户代理、来源、目的地和网址的分析洞见，帮助您跟踪使用情况并检测潜在风险。
弱 TLS 版本的使用情况随时间的变化
TLS 加密套件分布
前 10 个网址
最不常见的网址
未加密的通信分发
按 HTTP 方法划分的随时间变化的事件数
前 10 大目标 IP 地址
前 10 个网站类别
按 HTTP 方法划分的前 10 名用户
前 10 大 HTTP 用户代理
前 10 大来源 IP
按下载的字节数排名前 10 的用户
前 10 位用户
按被屏蔽网址数排名的前 10 个国家/地区
按 HTTP 响应代码划分的随时间变化的事件数
根据位置信息屏蔽网址
被屏蔽的网址（前 10 个）
网络故障率
按位置划分的已屏蔽 HTTP 事件
前 10 大正文 IP
按上传的字节数排名前 10 的用户
图表名称
查询示例
弱 TLS 版本的使用情况随时间的变化
metadata.event_type = "NETWORK_HTTP"
network.tls.version = /^tls/ nocase
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
$TLS_Version = network.tls.version
$TLS_Version != ""
match:
$Date, $TLS_Version
outcome:
$Count = count(metadata.id)
order:
$Date asc
TLS 加密套件分布
network.tls.cipher = /^tls/ nocase
$TLS = network.tls.cipher
$TLS != ""
match:
$TLS
outcome:
$Count = count(metadata.id)
order:
$Count desc
前 10 个网址
$event.metadata.event_type = "NETWORK_HTTP"
$URL = $event.target.url
$URL != ""
match:
$URL
outcome:
$Count = count($event.metadata.id)
order:
$Count desc
limit:
10
最不常见的网址
metadata.event_type = "NETWORK_HTTP"
$URL = target.url
$URL != ""
match:
$URL
outcome:
$Count = count(metadata.id)
order:
$Count asc
limit:
10
未加密的通信分发
metadata.event_type = "NETWORK_UNCATEGORIZED"
or metadata.event_type = "NETWORK_FLOW"
or metadata.event_type = "NETWORK_CONNECTION"
or metadata.event_type = "NETWORK_FTP"
or metadata.event_type = "NETWORK_DHCP"
or metadata.event_type = "NETWORK_DNS"
or metadata.event_type = "NETWORK_HTTP"
or metadata.event_type = "NETWORK_SMTP"
network.application_protocol = "HTTP"
or network.application_protocol = "SMTP"
or network.application_protocol = "DNS"
$Protocol = network.application_protocol
match:
$Protocol
outcome:
$Count = count(metadata.id)
order:
$Count desc
按 HTTP 方法划分的随时间变化的事件数
$event.metadata.event_type = "NETWORK_HTTP"
$Log_Type = $event.metadata.log_type
$Event_Type = $event.metadata.event_type
$HTTP_Method = $event.network.http.method
$HTTP_Method != ""
$Date = timestamp.get_date($event.metadata.event_timestamp.seconds)
match:
$Date, $Log_Type, $Event_Type, $HTTP_Method
outcome:
$Count = count($event.metadata.id)
order:
$Date asc
前 10 大目标 IP 地址
$event.metadata.event_type = "NETWORK_HTTP"
$Destination_IP = $event.target.ip
match:
$Destination_IP
outcome:
$Count = count($event.metadata.id)
order:
$Count desc
limit:
10
前 10 个网站类别
$event.metadata.event_type = "NETWORK_HTTP"
$Log_Type = $event.metadata.log_type
$Event_Type = $event.metadata.event_type
$Categories = $event.security_result.category_details
$Categories != ""
match:
$Event_Type, $Log_Type, $Categories
outcome:
$Count = count($event.metadata.id)
order:
$Count desc
limit:
10
按 HTTP 方法划分的前 10 名用户
metadata.event_type = "NETWORK_HTTP"
$User = principal.user.userid
$User != ""
$HTTP_Method = network.http.method
$HTTP_Method = /PUT|POST|DELETE/ nocase
match:
$User, $HTTP_Method
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
前 10 大 HTTP 用户代理
$event.metadata.event_type = "NETWORK_HTTP"
$User_Agent = $event.network.http.user_agent
$User_Agent != ""
match:
$User_Agent
outcome:
$Count = count($event.metadata.id)
order:
$Count desc
limit:
10
前 10 大来源 IP
metadata.event_type = "NETWORK_HTTP"
$Source_IP = principal.ip
match:
$Source_IP
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
按 HTTP 方法划分的随时间变化的事件数
metadata.event_type = "NETWORK_HTTP"
$Log_Type = metadata.log_type
$Event_Type = metadata.event_type
$HTTP_Method = network.http.method
$HTTP_Method != ""
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
match:
$Date, $Log_Type, $Event_Type, $HTTP_Method
outcome:
$Count = count(metadata.id)
order:
$Date asc
按下载的字节数排名前 10 的用户
metadata.event_type = "NETWORK_HTTP"
network.http.method = "GET"
$User = principal.user.userid
$User != ""
match:
$User
outcome:
$Count = sum(network.received_bytes)
order:
$Count desc
limit:
10
前 10 位用户
$event.metadata.event_type = "NETWORK_HTTP"
$User = $event.principal.user.userid
$User != ""
match:
$User
outcome:
$Count = count($event.metadata.id)
order:
$Count desc
limit:
10
最不常见的网址
$event.metadata.event_type = "NETWORK_HTTP"
$URL = $event.target.url
$URL != ""
match:
$URL
outcome:
$Count = count($event.metadata.id)
order:
$Count asc
limit:
10
前 10 个网址
metadata.event_type = "NETWORK_HTTP"
$URL = target.url
$URL != ""
match:
$URL
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
前 10 大目标 IP 地址
metadata.event_type = "NETWORK_HTTP"
$Destination_IP = target.ip
match:
$Destination_IP
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
前 10 大 HTTP 用户代理
metadata.event_type = "NETWORK_HTTP"
$User_Agent = network.http.user_agent
$User_Agent != ""
match:
$User_Agent
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
按被屏蔽网址数排名的前 10 个国家/地区
metadata.event_type = "NETWORK_HTTP"
security_result.action = "BLOCK"
$URL = target.url
$URL != ""
$Country = target.location.country_or_region
match:
$Country
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
按 HTTP 响应代码划分的随时间变化的事件数
$event.metadata.event_type = "NETWORK_HTTP"
$Response_Code = strings.concat($event.network.http.response_code, " ")
$Date = timestamp.get_date($event.metadata.event_timestamp.seconds)
match:
$Date, $Response_Code
outcome:
$Count = count($event.metadata.id)
order:
$Date asc
根据位置信息屏蔽网址
metadata.event_type = "NETWORK_HTTP"
security_result.action = "BLOCK"
$URL = target.url
$URL != ""
$Latitude = target.location.region_latitude
$Longitude = target.location.region_longitude
match:
$Latitude, $Longitude
outcome:
$Count = count(metadata.id)
order:
$Count desc
被屏蔽的网址（前 10 个）
$event.metadata.event_type = "NETWORK_HTTP"
$event.security_result.action = "BLOCK"
$Blocked_URL = $event.target.url
match:
$Blocked_URL
outcome:
$Event_Count = count($event.metadata.id)
order:
$Event_Count desc
limit:
10
按 HTTP 响应代码划分的随时间变化的事件数
metadata.event_type = "NETWORK_HTTP"
$Response_Code = strings.concat(network.http.response_code, " ")
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
match:
$Date, $Response_Code
outcome:
$Count = count(metadata.id)
order:
$Date asc
被屏蔽的网址（前 10 个）
metadata.event_type = "NETWORK_HTTP"
security_result.action = "BLOCK"
$Blocked_URL = target.url
match:
$Blocked_URL
outcome:
$Event_Count = count(metadata.id)
order:
$Event_Count desc
limit:
10
网络故障率
metadata.event_type = "NETWORK_HTTP"
$Response_Code = strings.concat(network.http.response_code, " ")
outcome:
$Total_Count = count(metadata.id)
$Failure_Count = sum(if($Response_Code = /^(4|5)/, 1, 0))
$Failure_Rate = math.round($Failure_Count / $Total_Count, 2) * 100
前 10 个网站类别
metadata.event_type = "NETWORK_HTTP"
$Log_Type = metadata.log_type
$Event_Type = metadata.event_type
$Categories = security_result.category_details
$Categories != ""
match:
$Event_Type, $Log_Type, $Categories
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
按位置划分的已屏蔽 HTTP 事件
$event.metadata.event_type = "NETWORK_HTTP"
$event.security_result.action = "BLOCK"
$URL = $event.target.url
$URL != ""
$Latitude = $event.target.location.region_latitude
$Longitude = $event.target.location.region_longitude
match:
$Latitude, $Longitude
outcome:
$Count = count($event.metadata.id)
order:
$Count desc
前 10 大正文 IP
$event.metadata.event_type = "NETWORK_HTTP"
$Source_IP = $event.principal.ip
match:
$Source_IP
outcome:
$Count = count($event.metadata.id)
order:
$Count desc
limit:
10
前 10 位用户
metadata.event_type = "NETWORK_HTTP"
$User = principal.user.userid
$User != ""
match:
$User
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
按上传的字节数排名前 10 的用户
metadata.event_type = "NETWORK_HTTP"
network.http.method = "POST"
$User = principal.user.userid
$User != ""
match:
$User
outcome:
$Count = sum(network.sent_bytes)
order:
$Count desc
limit:
10
Windows 安全概览
此信息中心会分析用户和系统活动，例如账号管理、登录模式、威胁详情和配置变更，从而全面了解 Windows 安全状况，并增强威胁检测和响应能力。
最近创建的计划任务
一段时间内的登录成功次数与登录失败次数
用户账号删除
登录失败次数最多的前 10 个用户账号
按主机划分的提醒分布情况 (Defender ATP)
Windows Defender ATP 威胁
威胁操作分布
安全性事件日志已清除
一段时间内的端点保护状态 (Defender 防病毒软件)
账号创建和删除随时间的变化
近期审核政策变更
威胁检测结果随时间的变化趋势
账号锁定摘要
特权群组修改
最近安装的服务
威胁检测摘要
10 大威胁文件路径
端点保护摘要（Microsoft Defender 防病毒软件）
登录类型分布情况
服务器上生成的最热门进程 (Windows Sysmon)
不同的远程登录国家/地区
防病毒版本分布（Microsoft Defender 防病毒）
创建用户账号
图表名称
查询示例
最近创建的计划任务
metadata.product_event_type = "4698"
metadata.event_type = "SCHEDULED_TASK_CREATION"
$Description = strings.coalesce(metadata.description,security_result.description,security_result.summary)
$Event_Type = metadata.event_type
$Source_Hostname = strings.coalesce(principal.hostname, principal.asset.hostname)
$Source_IP = strings.coalesce(principal.ip, principal.asset.ip)
$Source_User = strings.coalesce(principal.user.userid, principal.user.user_display_name, principal.user.email_addresses )
$Severity = security_result.severity
match:
$Source_User, $Source_Hostname, $Description ,$Source_IP , $Event_Type, $Severity
outcome:
$Count = count(metadata.id)
$Date = timestamp.get_timestamp(max(metadata.event_timestamp.seconds), "%F %T")
order :
$Date desc, $Count desc
一段时间内的登录成功次数与登录失败次数
(metadata.product_event_type = "4625" OR metadata.product_event_type = "4624")
$Action = security_result.action
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
match:
$Action, $Date
outcome:
$Count = count(metadata.id)
Order:
$Date asc
用户账号删除
(metadata.event_type = "USER_DELETION" OR metadata.product_event_type = "4726")
$Action = security_result.action
$Source_IP = strings.coalesce(principal.ip,principal.asset.ip)
$Hostname = strings.coalesce(principal.hostname,principal.asset.hostname, principal.asset.asset_id,intermediary.hostname)
$Source_User = strings.coalesce(principal.user.userid, principal.user.user_display_name, principal.user.email_addresses)
$Target_User = strings.coalesce(target.user.userid, target.user.user_display_name, target.user.email_addresses)
match:
$Source_IP, $Hostname, $Source_User, $Target_User,$Action
outcome :
$Count = count(metadata.id)
$Date = timestamp.get_timestamp(max(metadata.event_timestamp.seconds), "%F %T")
order:
$Date desc
登录失败次数最多的前 10 个用户账号
metadata.product_event_type = "4625"
$User = strings.coalesce(principal.user.userid, principal.user.user_display_name, principal.user.email_addresses, target.user.userid, target.user.user_display_name, target.user.email_addresses)
$Hostname = strings.coalesce(principal.hostname, principal.asset.hostname, intermediary.hostname, target.hostname, target.asset.hostname)
match:
$User, $Hostname
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
按主机划分的提醒分布情况 (Defender ATP)
metadata.product_event_type = "DeviceAlertEvents"
$Hostname = strings.coalesce(principal.hostname, principal.asset.hostname, target.hostname, target.asset.hostname)
match:
$Hostname
outcome:
$Critical = sum(if(security_result.severity = "CRITICAL", 1, 0))
$High = sum(if(security_result.severity = "HIGH", 1, 0))
$Medium = sum(if(security_result.severity = "MEDIUM", 1, 0))
$Low = sum(if(security_result.severity = "LOW", 1, 0))
$Information = sum(if(security_result.severity = "INFORMATIONAL", 1, 0))
$Error = sum(if(security_result.severity = "ERROR", 1, 0))
$Unknown_Severity = sum(if(security_result.severity = "UNKNOWN_SEVERITY", 1, 0))
$Count = count(security_result.severity)
order :
$Count desc
Windows Defender ATP 威胁
metadata.product_event_type = "DeviceAlertEvents"
$Threat_Name = security_result.threat_name
$Threat_Category = security_result.category_details
$Threat_Summary = security_result.summary
$Threat_Severity = security_result.severity
$Threat_Action = security_result.action
$Hostname = strings.coalesce(principal.hostname, principal.asset.hostname, target.hostname, target.asset.hostname)
$Threat_Name != ""
match:
$Threat_Name, $Threat_Category, $Threat_Severity, $Threat_Action, $Hostname, $Threat_Summary
outcome:
$Count = count(metadata.id)
order :
$Count desc
威胁操作分布
security_result.threat_name != ""
$Action = security_result.action
match:
$Action
outcome:
$Count = count(metadata.id)
安全性事件日志已清除
(metadata.product_event_type = "104" OR metadata.product_event_type = "1102" )
$Description = strings.coalesce(metadata.description,security_result.description,security_result.summary)
$Source_Hostname = strings.coalesce(principal.hostname, principal.asset.hostname)
$Severity = security_result.severity
match:
$Source_Hostname, $Description, $Severity
outcome:
$Count = count(metadata.id)
$Date = timestamp.get_timestamp(max(metadata.event_timestamp.seconds), "%F %T")
order :
$Count desc
一段时间内的端点保护状态 (Defender 防病毒软件)
(metadata.product_event_type = "MALWAREPROTECTION_RTP_DISABLED" OR metadata.product_event_type = "MALWAREPROTECTION_RTP_ENABLED")
$Event_Type = metadata.product_event_type
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
match:
$Date, $Event_Type
outcome:
$Count = count(metadata.id)
order :
$Date asc
账号创建和删除随时间的变化
(metadata.event_type = "USER_CREATION" OR metadata.event_type = "USER_DELETION" OR metadata.product_event_type = "4726" OR metadata.product_event_type = "4720")
$Event_Type = metadata.event_type
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
match:
$Event_Type, $Date
outcome:
$Count = count(metadata.id)
order:
$Date asc
近期审核政策变更
metadata.product_event_type= "4719"
$Description = metadata.description
$Hostname = strings.coalesce(principal.hostname, principal.asset.hostname)
$User = strings.coalesce(principal.user.userid, principal.user.user_display_name, principal.user.email_addresses)
$Source_Domain = principal.administrative_domain
$Category = extracted.fields["AuditPolicyChanges"]
$Changes = extracted.fields["Changes"]
$Severity = security_result.severity
match:
$User, $Source_Domain, $Hostname, $Description,$Severity, $Category, $Changes
outcome:
$Count = count(metadata.id)
$Date = timestamp.get_timestamp(max(metadata.event_timestamp.seconds), "%F %T")
order:
$Severity desc, $Count desc
威胁检测结果随时间的变化趋势
$Threat_Name = security_result.threat_name
$Threat_Name != ""
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
match:
$Threat_Name, $Date
outcome:
$Count = count(metadata.id)
order:
$Date asc
账号锁定摘要
metadata.product_event_type = "4740"
$User = strings.coalesce(principal.user.userid, principal.user.user_display_name, principal.user.email_addresses, target.user.userid, target.user.user_display_name, target.user.email_addresses)
$Hostname = strings.coalesce(principal.hostname, principal.asset.hostname)
match:
$User, $Hostname
outcome:
$Date = timestamp.get_timestamp(max(metadata.event_timestamp.seconds))
$Count = count(metadata.id)
order:
$Count desc
特权群组修改
(metadata.product_event_type = "4728" OR metadata.product_event_type = "4729" OR metadata.product_event_type = "4730" OR metadata.product_event_type = "4731" OR metadata.product_event_type = "4732" OR metadata.product_event_type = "4733")
$Event_Type = metadata.event_type
$Description = metadata.description
$Source_User = strings.coalesce(principal.user.userid, principal.user.user_display_name, principal.user.email_addresses)
$Target_User = strings.coalesce(target.user.userid, target.user.user_display_name, target.user.email_addresses)
$Target_Domain_Group = target.group.group_display_name
$Severity = security_result.severity
$Summary = additional.fields["Message"]
match:
$Source_User, $Target_User, $Target_Domain_Group, $Event_Type, $Description, $Severity, $Summary
outcome:
$Count = count(metadata.id)
$Date = timestamp.get_timestamp(max(metadata.event_timestamp.seconds), "%F %T")
order:
$Severity desc, $Count desc
最近安装的服务
metadata.product_event_type = "7045"
$Description = metadata.description
$User = strings.coalesce(principal.user.userid, principal.user.user_display_name, principal.user.email_addresses)
$Hostname = strings.coalesce(principal.hostname, principal.asset.hostname)
$Service_Name = extracted.fields["ServiceName"]
$Service_Filepath = target.process.file.full_path
$Service_Account = extracted.fields["ServiceAccount"]
$Service_Type = additional.fields["ServiceType"]
$Service_StartType = extracted.fields["ServiceStartType"]
$Severity = security_result.severity
match:
$User, $Hostname, $Description, $Service_Name, $Service_Filepath, $Service_Account, $Service_Type, $Service_StartType, $Severity
outcome:
$Count = count(metadata.id)
$Date = timestamp.get_timestamp(max(metadata.event_timestamp.seconds), "%F %T")
order:
$Severity desc, $Count desc
威胁检测摘要
$Threat_Name = security_result.threat_name
$Threat_Name != ""
$Log_Type = metadata.log_type
$Event_Type = metadata.product_event_type
$Action = security_result.action
$Severity = security_result.severity
$Description = strings.coalesce(metadata.description, security_result.description, security_result.summary)
$Source_Hostname = strings.coalesce(principal.hostname, principal.asset.hostname)
$File_Path = strings.coalesce(target.file.full_path, target.registry.registry_key, principal.process.file.full_path)
match:
$Log_Type, $Description, $Threat_Name, $Event_Type, $Source_Hostname, $File_Path, $Action, $Severity
outcome:
$Count = count(metadata.id)
$Date = timestamp.get_timestamp(max(metadata.event_timestamp.seconds), "%F %T")
order:
$Date desc,$Count desc
10 大威胁文件路径
security_result.action = "ALLOW" OR security_result.action = "ALLOW_WITH_MODIFICATION" OR security_result.action = "UNKNOWN_ACTION"
security_result.threat_name != ""
$Severity = security_result.severity
$File_Path = strings.coalesce(target.file.full_path, target.registry.registry_key, principal.process.file.full_path)
match:
$File_Path, $Severity
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
端点保护摘要（Microsoft Defender 防病毒软件）
(metadata.product_event_type = "MALWAREPROTECTION_RTP_DISABLED" OR metadata.product_event_type = "MALWAREPROTECTION_RTP_ENABLED")
$Description = strings.coalesce(metadata.description, security_result.description, security_result.summary)
$Severity = security_result.severity
$Action = security_result.action
$Hostname = strings.coalesce(principal.hostname, principal.asset.hostname, target.hostname, target.asset.hostname)
$Source_User = strings.coalesce(principal.user.user_display_name, principal.user.userid, principal.user.email_addresses)
$Version = metadata.product_version
match:
$Description, $Hostname, $Source_User, $Severity, $Action, $Version
outcome:
$Count = count(metadata.id)
$Date = timestamp.get_timestamp(max(metadata.event_timestamp.seconds), "%F %T")
order :
$Count desc, $Date desc
登录类型分布情况
metadata.product_event_type = "4624"
$Logon_type = extensions.auth.mechanism
match:
$Logon_type
outcome:
$Count = count(metadata.id)
服务器上生成的最热门进程 (Windows Sysmon)
metadata.product_event_type = "1"
$Hostname = strings.coalesce(principal.hostname, principal.asset.hostname)
$User = strings.coalesce(principal.user.userid, principal.user.user_display_name, principal.user.email_addresses)
$Severity = security_result.severity
$Description = security_result.summary
$Principal_Process_Path = principal.process.file.full_path
$Target_Process_Path = target.process.file.full_path
match :
$Hostname, $User, $Severity, $Principal_Process_Path, $Target_Process_Path
outcome:
$Count = count(metadata.id)
order:
$Count desc
不同的远程登录国家/地区
metadata.event_type = "USER_LOGIN"
metadata.product_event_type = "4624"
extensions.auth.mechanism = "REMOTE_INTERACTIVE"
$Logon = extensions.auth.mechanism
$Logon_type = extensions.auth.auth_details
$Source_IP = strings.coalesce(principal.ip, principal.asset.ip)
$Source_Hostname = strings.coalesce(principal.hostname, principal.asset.hostname)
$Source_User = strings.coalesce(principal.user.userid, principal.user.user_display_name, principal.user.email_addresses )
match:
$Source_User, $Source_IP, $Source_Hostname, $Logon, $Logon_type
outcome:
$Country = array_distinct(principal.ip_geo_artifact.location.country_or_region)
$Date = timestamp.get_timestamp(max(metadata.event_timestamp.seconds), "%F %T")
$Count = count(metadata.id)
order:
$Date desc
防病毒版本分布（Microsoft Defender 防病毒）
$Anti_Virus_Version = metadata.product_version
match:
$Anti_Virus_Version
outcome:
$Count = count_distinct(principal.hostname)
limit:
50
创建用户账号
(metadata.event_type = "USER_CREATION" OR metadata.product_event_type = "4720")
$Source_IP = strings.coalesce(principal.ip,principal.asset.ip)
$Hostname = strings.coalesce(principal.hostname,principal.asset.hostname, principal.asset.asset_id,intermediary.hostname)
$Source_User = strings.coalesce(principal.user.userid, principal.user.user_display_name, principal.user.email_addresses)
$Target_User = strings.coalesce(target.user.userid, target.user.user_display_name, target.user.email_addresses)
$Action = security_result.action
match:
$Source_IP, $Hostname, $Source_User, $Target_User,$Action
outcome :
$Count = count(metadata.id)
$Date = timestamp.get_timestamp(max(metadata.event_timestamp.seconds), "%F %T")
order:
$Date desc
无线网络安全
此信息中心可提供有关网络活动和安全性的数据分析，包括身份验证分布、登录失败、检测到恶意 AP 以及客户端连接行为。它有助于按严重程度跟踪安全事件、识别可疑 ID，并优化网络性能以实现主动风险管理。
检测到流氓接入点
按操作次数排名的前 10 种身份验证类型
按来源 MAC 地址(Cisco Meraki) 排名的前 10 个 SSID
按来源 MAC 列出的前 10 个接入点
按操作次数排序的前 10 大事件类型
按身份验证失败次数排名的前 10 个 MAC 地址
最近的身份验证失败（过去 24 小时）
源设备总数
效果最理想的 10 个广告内容描述
在恶意接入点上检测到的前 10 个客户端 IP
身份验证类型分布情况
检测到临时网络活动 (CISCO MERAKI)
可疑的无线活动
按身份验证失败次数列出的 SSID(Cisco Meraki)
严重程度分布
检测到的流氓接入点数量
来源地理位置概览
图表名称
查询示例
检测到流氓接入点
$Rogue = strings.coalesce(
if (extracted.fields["description"] = /Rogue|AP Detection|Spoof/ nocase, extracted.fields["description"], ""),
if (security_result.description = /Rogue|AP Detection|Spoof/ nocase, security_result.description, ""),
if (security_result.summary = /Rogue|AP Detection|Spoof/ nocase, security_result.summary, ""),
if (metadata.description = /Rogue|AP Detection|Spoof/ nocase, metadata.description,""))
$Rogue != ""
$Source_MAC = strings.coalesce(principal.mac, principal.asset.mac)
$ID = strings.coalesce(extracted.fields["ssid"], principal.resource.name)
$Description = strings.coalesce(metadata.description, security_result.summary)
$Source_IP= strings.coalesce(principal.ip, principal.asset.ip,extracted.fields["clientIp"])
$Log_Source = metadata.log_type
$Severity = security_result.severity
$Action = security_result.action
$Target_MAC = strings.coalesce(target.mac, target.asset.mac)
match:
$Log_Source, $Description,$Source_MAC, $Source_IP, $ID, $Target_MAC,$Severity,$Action
outcome:
$Count = count(metadata.id)
$Date = timestamp.get_timestamp(max(metadata.event_timestamp.seconds), "%F %T")
order :
$Severity desc,$Date desc
按操作次数排名的前 10 种身份验证类型
metadata.event_type = "USER_LOGIN"
$Logon_type = extensions.auth.type
$Action = security_result.action
match:
$Action,$Logon_type
outcome:
$Count = count(metadata.id)
order :
$Count desc
limit:
10
按来源 MAC 地址(Cisco Meraki) 排名的前 10 个 SSID
$SSID = extracted.fields["ssid"]
$Log_Type = metadata.log_type
$SSID != ""
$Action = security_result.action
match:
$SSID, $Action
outcome:
$Count = count_distinct(strings.coalesce(principal.mac, principal.asset.mac))
order:
$Count desc
limit:
10
按来源 MAC 列出的前 10 个接入点
$Access_Point = strings.coalesce(target.hostname, target.asset.hostname, principal.user.company_name, observer.hostname,intermediary.hostname)
$Log_Type = metadata.log_type
match:
$Access_Point, $Log_Type
outcome:
$Count = count_distinct(strings.coalesce(principal.mac, principal.asset.mac))
order :
$Count desc
limit :
10
按操作次数排序的前 10 大事件类型
$Event_Type = metadata.event_type
$Action = security_result.action
match:
$Event_Type,$Action
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
按身份验证失败次数排名的前 10 个 MAC 地址
$Authentication_Failed = strings.coalesce(
if (extracted.fields["description"] = /authentication failed/ nocase, extracted.fields["description"], ""),
if (security_result.description = /failed to connect/ nocase, security_result.description, ""),
if (security_result.summary = /Failed Authentication|authentication failed/ nocase, security_result.summary, ""),
if (metadata.description = /Authentication failed|verification failed/ nocase, metadata.description,""))
($Authentication_Failed != "" OR (metadata.event_type= "USER_LOGIN" AND security_result.action ="BLOCK"))
$MAC_Address = strings.coalesce(principal.mac, principal.asset.mac, target.mac, target.asset.mac)
$Severity = security_result.severity
match:
$MAC_Address, $Severity
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
最近的身份验证失败（过去 24 小时）
$Authentication_Failed = strings.coalesce(
if (extracted.fields["description"] = /authentication failed/ nocase, extracted.fields["description"], ""),
if (security_result.description = /failed to connect/ nocase, security_result.description, ""),
if (security_result.summary = /Failed Authentication|authentication failed/ nocase, security_result.summary, ""),
if (metadata.description = /Authentication failed|verification failed/ nocase, metadata.description, ""))
($Authentication_Failed != "" OR (metadata.event_type= "USER_LOGIN" AND security_result.action ="BLOCK"))
$Log_Source = metadata.log_type
$Source_MAC = strings.coalesce(principal.mac, principal.asset.mac)
$Source_IP = strings.coalesce(principal.ip, principal.asset.ip,extracted.fields["clientIp"])
$Severity = security_result.severity
$Action = security_result.action
$Security_Event_Type = metadata.product_event_type
$Target_MAC = strings.coalesce(target.mac, target.asset.mac)
$Description = strings.coalesce(metadata.description,extracted.fields["description"], security_result.description,security_result.summary)
$Access_Point = strings.coalesce(target.hostname, target.asset.hostname, principal.user.company_name, observer.hostname,intermediary.hostname)
match:
$Log_Source,$Description, $Source_MAC, $Source_IP, $Access_Point, $Target_MAC, $Action, $Severity
outcome:
$Count = count(metadata.id)
$Date = timestamp.get_timestamp(max(metadata.event_timestamp.seconds), "%F %T")
order :
$Date desc, $Severity desc
源设备总数
outcome:
$Count = count_distinct(strings.coalesce(principal.mac, principal.asset.mac))
效果最理想的 10 个广告内容描述
$Description = strings.coalesce(metadata.description,security_result.description,security_result.summary,extracted.fields["description"])
$Log_Type = metadata.log_type
$Description != ""
match:
$Log_Type, $Description
outcome :
$Count = count(metadata.id)
order :
$Count desc
limit:
10
在恶意接入点上检测到的前 10 个客户端 IP
$Rogue = strings.coalesce(
if (extracted.fields["description"] = /Rogue|AP Detection|Spoof/ nocase, extracted.fields["description"], ""),
if (security_result.description = /Rogue|AP Detection|Spoof/ nocase, security_result.description, ""),
if (security_result.summary = /Rogue|AP Detection|Spoof/ nocase, security_result.summary, ""),
if (metadata.description = /Rogue|AP Detection|Spoof/ nocase, metadata.description,""))
$Rogue != ""
$Client_IP = strings.coalesce(principal.ip,principal.asset.ip,extracted.fields["clientIp"])
$Action = security_result.action
match:
$Client_IP, $Action
outcome:
$Count = count(metadata.id)
order :
$Count desc
limit :
10
身份验证类型分布情况
$Logon_type = extensions.auth.type
match:
$Logon_type
outcome:
$Count = count(metadata.id)
检测到临时网络活动 (CISCO MERAKI)
extracted.fields["type"] = "adhoc_network_detected"
$Detection_Type = extracted.fields["type"]
$SSID = extracted.fields["ssid"]
$SSID != ""
$Source_IP = extracted.fields["clientIp"]
$Source_MAC = strings.coalesce(principal.mac, principal.asset.mac)
$Category = security_result.category
$Security_Description = security_result.description
match:
$Security_Description, $Detection_Type, $SSID, $Source_MAC, $Source_IP, $Category
outcome:
$Count = count(metadata.id)
$Date = timestamp.get_timestamp(max(metadata.event_timestamp.seconds), "%F %T")
order :
$Count desc
可疑的无线活动
(security_result.category = "NETWORK_MALICIOUS" OR security_result.category = "NETWORK_SUSPICIOUS" OR security_result.category = "NETWORK_CATEGORIZED_CONTENT" OR security_result.category = "NETWORK_COMMAND_AND_CONTROL" OR security_result.category = "NETWORK_DENIAL_OF_SERVICE" OR security_result.category = "NETWORK_RECON" OR security_result.category = "AUTH_VIOLATION")
$Log_Source = metadata.log_type
$Source_MAC = strings.coalesce(principal.mac, principal.asset.mac)
$ID = strings.coalesce(extracted.fields["ssid"], principal.resource.name)
$Source_IP = strings.coalesce(principal.ip, principal.asset.ip,extracted.fields["clientIp"])
$Severity = security_result.severity
$Action = security_result.action
$Target_MAC = strings.coalesce(target.mac, target.asset.mac)
$Description = strings.coalesce(metadata.description,extracted.fields["description"], security_result.description,security_result.summary)
match:
$Log_Source, $Description, $Source_IP, $Source_MAC, $ID, $Target_MAC , $Severity, $Action
outcome:
$Count = count(metadata.id)
$Date = timestamp.get_timestamp(max(metadata.event_timestamp.seconds), "%F %T")
order :
$Severity desc,$Date desc
按身份验证失败次数列出的 SSID(Cisco Meraki)
$Authentication_Failed = strings.coalesce(
if (extracted.fields["description"] = /authentication failed/ nocase, extracted.fields["description"], ""),
if (security_result.description = /failed to connect/ nocase,security_result.description, ""),
if (security_result.summary = /Failed Authentication/ nocase, security_result.summary, ""),
if (metadata.description = /Authentication failed|verification failed/ nocase, metadata.description,""))
($Authentication_Failed != "" OR (metadata.event_type= "USER_LOGIN" AND security_result.action ="BLOCK"))
$SSID = extracted.fields["ssid"]
$Source_IP = extracted.fields["clientIp"]
$SSID != ""
$Source_MAC = strings.coalesce(principal.mac, principal.asset.mac)
$Access_Point = strings.coalesce(target.hostname, target.asset.hostname, principal.user.company_name, observer.hostname,intermediary.hostname)
$AP_Model = target.asset.hardware.model
$Target_Url = target.url
$Source_Hostname = principal.hostname
$Resource_Name = principal.resource.name
match:
$SSID, $Source_MAC, $Source_IP, $Access_Point, $AP_Model, $Target_Url, $Source_Hostname, $Resource_Name
outcome:
$Count = count(metadata.id)
$Date = timestamp.get_timestamp(max(metadata.event_timestamp.seconds), "%F %T")
order :
$Count desc
严重程度分布
$Severity = security_result.severity
match:
$Severity
outcome:
$Count = count(metadata.id)
检测到的流氓接入点数量
$Rogue = strings.coalesce(
if (extracted.fields["description"] = /Rogue|AP Detection|Spoof/ nocase, extracted.fields["description"], ""),
if (security_result.description = /Rogue|AP Detection|Spoof/ nocase, security_result.description, ""),
if (security_result.summary = /Rogue|AP Detection|Spoof/ nocase, security_result.summary, ""),
if (metadata.description = /Rogue|AP Detection|Spoof/ nocase, metadata.description,""))
$Rogue != ""
outcome:
$Count = count_distinct(strings.coalesce(target.hostname, target.asset.hostname, principal.user.company_name, observer.hostname,intermediary.hostname))
来源地理位置概览
$Country = strings.coalesce(principal.location.country_or_region, principal.ip_geo_artifact.location.country_or_region)
$Country != ""
match:
$Country
outcome:
$Count = count(metadata.id)
$Latitude = max(principal.location.region_latitude)
$Longitude = max(principal.location.region_longitude)
order:
$Count desc
需要更多帮助？ 获得社区成员和 Google SecOps 专业人士的解答。
