執行 UDM 查詢
本文適用於資安作業中心 (SOC) 的管理員和分析師，他們希望使用精選的資訊主頁監控威脅情勢和系統健康狀態。這些預先定義的資訊主頁專為提供 Google Security Operations 中各種安全用途的能見度而設計。這份文件提供一系列精選的資訊主頁，以及 UDM 來源類型底層的查詢。
下表列出每個精選資訊主頁的圖表，以及查詢範例。您可以在查詢編輯器中使用這些查詢，也可以做為自訂小工具的基準。如要瞭解如何建立及管理資訊主頁，請參閱「管理資訊主頁 」。
應用程式控制
這個資訊主頁提供應用程式安全性的深入分析，協助安全團隊偵測未經授權的軟體，並落實使用政策。有助於掌握高風險行為、遭封鎖的嘗試和異常活動模式。
注意： 套用可用篩選器，即可修正資料並顯示相關結果。
一段時間內的應用程式執行次數
未獲核准的應用程式執行作業 (前 10 名) (稽核/允許模式)
從卸除式媒體執行的前 10 大應用程式
前 10 大因故遭到封鎖的應用程式執行作業
一段時間內的應用程式執行狀態
前 10 大封鎖的應用程式執行作業
從異常位置執行的應用程式
依封鎖執行作業次數排序的前 10 大主機
因執行作業遭封鎖而排名前 10 的使用者
封鎖的執行作業 - 每小時
圖表名稱
查詢示例
一段時間內的應用程式執行次數
metadata.product_event_type = /(execution|application) (allow|block)/ nocase
or security_result.threat_name = /application control/ nocase
$Date = timestamp.get_timestamp(metadata.event_timestamp.seconds, "%F")
match:
$Date
outcome:
$Count = count(metadata.id)
未獲核准的應用程式執行作業 (前 10 名) (稽核/允許模式)
metadata.product_event_type != /(execution|application) block/ nocase
metadata.product_event_type = /unapproved/ nocase
$Application = strings.coalesce(about.file.full_path, target.process.file.full_path, additional.fields["fname"])
match:
$Application
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
從卸除式媒體執行的前 10 大應用程式
metadata.product_event_type = /(execution|application) (allow|block)/ nocase
or security_result.threat_name = /application control/ nocase
strings.coalesce(about.file.full_path, target.process.file.full_path, additional.fields["fname"]) = /(^(D|E|F|G):)|\/\/removable|usb/ nocase
$Application = strings.coalesce(about.file.full_path, target.process.file.full_path, additional.fields["fname"])
match:
$Application
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
前 10 大因故遭到封鎖的應用程式執行作業
metadata.product_event_type = /(execution|application) block/ nocase
or security_result.threat_name = /application control/ nocase
security_result.action = "BLOCK"
$Application = strings.coalesce(about.file.full_path, target.process.file.full_path, additional.fields["fname"])
$Reason = strings.coalesce(target.resource.attribute.labels["categoryTupleDescription"], security_result.action_details, metadata.product_event_type)
match:
$Application, $Reason
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
一段時間內的應用程式執行狀態
metadata.product_event_type = /(execution|application) (allow|block)/ nocase
or security_result.threat_name = /application control/ nocase
$Action = strings.coalesce(if(security_result.action = "BLOCK", "BLOCK", "ALLOW"), if(metadata.product_event_type = /(execution|application) block/ nocase, "BLOCK", "ALLOW"))
$Date = timestamp.get_timestamp(metadata.event_timestamp.seconds,"%F")
match:
$Action, $Date
outcome:
$Count = count(metadata.id)
order:
$Date desc
前 10 大封鎖的應用程式執行作業
metadata.product_event_type = /(execution|application) block/ nocase
or security_result.threat_name = /application control/ nocase
security_result.action = "BLOCK"
$Application = strings.coalesce(about.file.full_path, target.process.file.full_path, additional.fields["fname"])
match:
$Application
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
從異常位置執行的應用程式
strings.coalesce(about.file.full_path, target.process.file.full_path, additional.fields["fname"]) = /C\:\\(?:Users|Temp|Windows)\\(?:.*\\(?:AppData|Downloads)?|Temp)?/ nocase
$File_Path = strings.coalesce(about.file.full_path, target.process.file.full_path, additional.fields["fname"])
match:
$File_Path
依封鎖執行作業次數排序的前 10 大主機
metadata.product_event_type = /(execution|application) block/ nocase
or security_result.threat_name = /application control/ nocase
security_result.action = "BLOCK"
$Host = strings.coalesce(principal.hostname, principal.asset.hostname, target.hostname)
match:
$Host
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
因執行作業遭封鎖而排名前 10 的使用者
metadata.product_event_type = /(execution|application) block/ nocase
or security_result.threat_name = /application control/ nocase
security_result.action = "BLOCK"
$User = strings.coalesce(target.user.userid, target.user.user_display_name, principal.user.userid, principal.user.user_display_name)
match:
$User
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
封鎖的執行作業 - 每小時
metadata.product_event_type = /(execution|application) block/ nocase
or security_result.threat_name = /application control/ nocase
security_result.action = "BLOCK"
$Hours = timestamp.get_timestamp(metadata.event_timestamp.seconds,"%F %H:00")
match:
$Hours
outcome:
$Count = count(metadata.id)
order:
$Hours desc
雲端存取安全代理程式
這個資訊主頁會顯示雲端應用程式使用情況、安全性事件、威脅和未經授權存取的總覽。這項功能會監控重要警報、使用者活動和動作，以及來源和目的地 IP 位址，以提升政策執行成效和風險應變能力。
前 10 大使用者代理程式
前 10 大應用程式
前 10 大 CASB 活動
前 10 大目的地 IP
前 10 大目的地主機名稱
依動作區分的事件：允許與封鎖
驗證類型分布
前 10 大供應商快訊
前 10 大來源主機名稱
OS 發行版
前 10 位使用者
前 10 名遭封鎖的使用者
依記錄類型顯示的歷來事件
前 10 大來源 IP
前 10 大事件類型
前 10 個網址
前 10 大 CASB 事件來源位置
圖表名稱
查詢示例
前 10 大使用者代理程式
metadata.log_type = /_CASB|SMARTSHEET|CISCO_SDWAN|NETSKOPE_CLIENT|ORACLE_NETSUITE|TAILSCALE/
$User_Agent = network.http.user_agent
$Log_Type = metadata.log_type
match:
$User_Agent, $Log_Type
outcome:
$Count = count(network.http.user_agent)
order:
$Count desc
limit:
10
前 10 大應用程式
metadata.log_type = /_CASB|SMARTSHEET|CISCO_SDWAN|NETSKOPE_CLIENT|ORACLE_NETSUITE|TAILSCALE/
$Application = target.application
$Log_Type = metadata.log_type
$Application != ""
match:
$Application, $Log_Type
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
前 10 大 CASB 活動
metadata.log_type = /_CASB|SMARTSHEET|CISCO_SDWAN|NETSKOPE_CLIENT|ORACLE_NETSUITE|TAILSCALE/
$Activity = strings.coalesce(security_result.summary, metadata.description)
$Log_Type = metadata.log_type
$Activity != ""
match:
$Activity, $Log_Type
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
前 10 大目的地 IP
metadata.log_type = /_CASB|SMARTSHEET|CISCO_SDWAN|NETSKOPE_CLIENT|ORACLE_NETSUITE|TAILSCALE/
$IP_Address = target.ip
$Log_Type = metadata.log_type
$IP_Address != ""
match:
$IP_Address, $Log_Type
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
前 10 大目的地主機名稱
metadata.log_type = /_CASB|SMARTSHEET|CISCO_SDWAN|NETSKOPE_CLIENT|ORACLE_NETSUITE|TAILSCALE/ nocase
$Hostname = target.hostname
$Log_Type = metadata.log_type
match:
$Hostname, $Log_Type
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
依動作區分的事件：允許與封鎖
metadata.log_type = /_CASB|SMARTSHEET|CISCO_SDWAN|NETSKOPE_CLIENT|ORACLE_NETSUITE|TAILSCALE/
security_result.action = "ALLOW"
or security_result.action = "BLOCK"
$Action = security_result.action
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
match:
$Action, $Date
outcome:
$Count = count(security_result.action)
驗證類型分布
metadata.log_type = /_CASB|SMARTSHEET|CISCO_SDWAN|NETSKOPE_CLIENT|ORACLE_NETSUITE|TAILSCALE/
$Log_Type = metadata.log_type
$Product_Event = metadata.product_event_type
$Authentication = extensions.auth.type
match:
$Log_Type, $Product_Event, $Authentication
outcome:
$Count = count(metadata.id)
前 10 大供應商快訊
metadata.log_type = /_CASB|SMARTSHEET|CISCO_SDWAN|NETSKOPE_CLIENT|ORACLE_NETSUITE|TAILSCALE/
$Rule_Name = security_result.rule_name
$Log_Type = metadata.log_type
$Rule_Name != ""
match:
$Rule_Name, $Log_Type
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
前 10 大 CASB 活動
metadata.log_type = /_CASB|SMARTSHEET|CISCO_SDWAN|NETSKOPE_CLIENT|ORACLE_NETSUITE|TAILSCALE/ nocase
$Activity = strings.coalesce(security_result.summary, metadata.description)
$Log_Type = metadata.log_type
match:
$Activity, $Log_Type
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
前 10 大供應商快訊
metadata.log_type = /_CASB|SMARTSHEET|CISCO_SDWAN|NETSKOPE_CLIENT|ORACLE_NETSUITE|TAILSCALE/ nocase
$Rule_Name = security_result.rule_name
$Log_Type = metadata.log_type
match:
$Rule_Name, $Log_Type
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
前 10 大來源主機名稱
metadata.log_type = /_CASB|SMARTSHEET|CISCO_SDWAN|NETSKOPE_CLIENT|ORACLE_NETSUITE|TAILSCALE/
$Hostname = principal.hostname
$Log_Type = metadata.log_type
$Hostname != ""
match:
$Hostname, $Log_Type
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
OS 發行版
metadata.log_type = /_CASB|SMARTSHEET|CISCO_SDWAN|NETSKOPE_CLIENT|ORACLE_NETSUITE|TAILSCALE/ nocase
$Platform = principal.platform
match:
$Platform
outcome:
$Count = count(metadata.id)
order:
$Count desc
前 10 位使用者
metadata.log_type = /_CASB|SMARTSHEET|CISCO_SDWAN|NETSKOPE_CLIENT|ORACLE_NETSUITE|TAILSCALE/ nocase
$User = principal.user.userid
$Log_Type = metadata.log_type
match:
$User, $Log_Type
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
前 10 大目的地主機名稱
metadata.log_type = /_CASB|SMARTSHEET|CISCO_SDWAN|NETSKOPE_CLIENT|ORACLE_NETSUITE|TAILSCALE/
$Hostname = target.hostname
$Log_Type = metadata.log_type
$Hostname != ""
match:
$Hostname, $Log_Type
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
前 10 名遭封鎖的使用者
metadata.log_type = /_CASB|SMARTSHEET|CISCO_SDWAN|NETSKOPE_CLIENT|ORACLE_NETSUITE|TAILSCALE/ nocase
security_result.action = "BLOCK"
$User = principal.user.userid
$Log_Type = metadata.log_type
match:
$User, $Log_Type
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
依記錄類型顯示的歷來事件
metadata.log_type = /_CASB|SMARTSHEET|CISCO_SDWAN|NETSKOPE_CLIENT|ORACLE_NETSUITE|TAILSCALE/ nocase
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
$Log_Type = metadata.log_type
match:
$Date, $Log_Type
outcome:
$Count = count(metadata.id)
order:
$Date asc
前 10 大使用者代理程式
metadata.log_type = /_CASB|SMARTSHEET|CISCO_SDWAN|NETSKOPE_CLIENT|ORACLE_NETSUITE|TAILSCALE/ nocase
$User_Agent = network.http.user_agent
$Log_Type = metadata.log_type
match:
$User_Agent, $Log_Type
outcome:
$Count = count(network.http.user_agent)
order:
$Count desc
limit:
10
依動作區分的事件：允許與封鎖
metadata.log_type = /_CASB|SMARTSHEET|CISCO_SDWAN|NETSKOPE_CLIENT|ORACLE_NETSUITE|TAILSCALE/ nocase
security_result.action = "ALLOW"
or security_result.action = "BLOCK"
$Action = security_result.action
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
match:
$Action, $Date
outcome:
$Count = count(security_result.action)
前 10 大應用程式
metadata.log_type = /_CASB|SMARTSHEET|CISCO_SDWAN|NETSKOPE_CLIENT|ORACLE_NETSUITE|TAILSCALE/ nocase
$Application = target.application
$Log_Type = metadata.log_type
match:
$Application, $Log_Type
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
前 10 大來源 IP
metadata.log_type = /_CASB|SMARTSHEET|CISCO_SDWAN|NETSKOPE_CLIENT|ORACLE_NETSUITE|TAILSCALE/ nocase
$IP_Address = principal.ip
$Log_Type = metadata.log_type
match:
$IP_Address, $Log_Type
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
前 10 大來源 IP
metadata.log_type = /_CASB|SMARTSHEET|CISCO_SDWAN|NETSKOPE_CLIENT|ORACLE_NETSUITE|TAILSCALE/
$IP_Address = principal.ip
$Log_Type = metadata.log_type
$IP_Address != ""
match:
$IP_Address, $Log_Type
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
前 10 大事件類型
metadata.log_type = /_CASB|SMARTSHEET|CISCO_SDWAN|NETSKOPE_CLIENT|ORACLE_NETSUITE|TAILSCALE/ nocase
$Event_Type = metadata.event_type
$Log_Type = metadata.log_type
match:
$Event_Type, $Log_Type
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
OS 發行版
metadata.log_type = /_CASB|SMARTSHEET|CISCO_SDWAN|NETSKOPE_CLIENT|ORACLE_NETSUITE|TAILSCALE/
$Platform = principal.platform
match:
$Platform
outcome:
$Count = count(metadata.id)
order:
$Count desc
前 10 大事件類型
metadata.log_type = /_CASB|SMARTSHEET|CISCO_SDWAN|NETSKOPE_CLIENT|ORACLE_NETSUITE|TAILSCALE/
$Event_Type = metadata.event_type
$Log_Type = metadata.log_type
match:
$Event_Type, $Log_Type
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
前 10 個網址
metadata.log_type = /_CASB|SMARTSHEET|CISCO_SDWAN|NETSKOPE_CLIENT|ORACLE_NETSUITE|TAILSCALE/
$URL = target.url
$Log_Type = metadata.log_type
$URL != ""
match:
$URL, $Log_Type
outcome:
$Count = count(target.url)
order:
$Count desc
limit:
10
依記錄類型顯示的歷來事件
metadata.log_type = /_CASB|SMARTSHEET|CISCO_SDWAN|NETSKOPE_CLIENT|ORACLE_NETSUITE|TAILSCALE/
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
$Log_Type = metadata.log_type
match:
$Date, $Log_Type
outcome:
$Count = count(metadata.id)
order:
$Date asc
前 10 大 CASB 事件來源位置
metadata.log_type = /_CASB|SMARTSHEET|CISCO_SDWAN|NETSKOPE_CLIENT|ORACLE_NETSUITE|TAILSCALE/ nocase
$Country = principal.location.country_or_region
$Latitude = principal.location.region_latitude
$Latitude != 0
$Longitude = principal.location.region_longitude
$Longitude != 0
match:
$Country, $Latitude, $Longitude
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
前 10 大 CASB 事件來源位置
metadata.log_type = /_CASB|SMARTSHEET|CISCO_SDWAN|NETSKOPE_CLIENT|ORACLE_NETSUITE|TAILSCALE/
$Country = principal.location.country_or_region
$Latitude = principal.location.region_latitude
$Latitude != 0
$Longitude = principal.location.region_longitude
$Longitude != 0
match:
$Country, $Latitude, $Longitude
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
前 10 名遭封鎖的使用者
metadata.log_type = /_CASB|SMARTSHEET|CISCO_SDWAN|NETSKOPE_CLIENT|ORACLE_NETSUITE|TAILSCALE/
security_result.action = "BLOCK"
$User = principal.user.userid
$Log_Type = metadata.log_type
$User != ""
match:
$User, $Log_Type
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
前 10 個網址
metadata.log_type = /_CASB|SMARTSHEET|CISCO_SDWAN|NETSKOPE_CLIENT|ORACLE_NETSUITE|TAILSCALE/ nocase
$URL = target.url
$Log_Type = metadata.log_type
match:
$URL, $Log_Type
outcome:
$Count = count(target.url)
order:
$Count desc
limit:
10
前 10 位使用者
metadata.log_type = /_CASB|SMARTSHEET|CISCO_SDWAN|NETSKOPE_CLIENT|ORACLE_NETSUITE|TAILSCALE/
$User = principal.user.userid
$Log_Type = metadata.log_type
$User != ""
match:
$User, $Log_Type
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
驗證類型分布
metadata.log_type = /_CASB|SMARTSHEET|CISCO_SDWAN|NETSKOPE_CLIENT|ORACLE_NETSUITE|TAILSCALE/ nocase
$Log_Type = metadata.log_type
$Product_Event = metadata.product_event_type
$Authentication = extensions.auth.type
match:
$Log_Type, $Product_Event, $Authentication
outcome:
$Count = count(metadata.id)
前 10 大來源主機名稱
metadata.log_type = /_CASB|SMARTSHEET|CISCO_SDWAN|NETSKOPE_CLIENT|ORACLE_NETSUITE|TAILSCALE/ nocase
$Hostname = principal.hostname
$Log_Type = metadata.log_type
match:
$Hostname, $Log_Type
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
前 10 大目的地 IP
metadata.log_type = /_CASB|SMARTSHEET|CISCO_SDWAN|NETSKOPE_CLIENT|ORACLE_NETSUITE|TAILSCALE/ nocase
$IP_Address = target.ip
$Log_Type = metadata.log_type
match:
$IP_Address, $Log_Type
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
Chrome Enterprise 進階版營運
這個資訊主頁會顯示 Chrome Enterprise 進階版與 Google SecOps 整合的總覽。包括受管理瀏覽器和設定檔的相關資訊。
側載瀏覽器擴充功能
安裝次數最多的瀏覽器擴充功能
Chrome 活動
Chrome 遙測健康狀態
前 10 大受管理瀏覽器 (依 Chrome 版本)
作業系統前 10 大受管理瀏覽器
管理機構
最常用的瀏覽器擴充功能
安裝瀏覽器擴充功能最多的前 10 名使用者
依權限封鎖瀏覽器擴充功能
安裝次數最少的瀏覽器擴充功能
圖表名稱
查詢示例
側載瀏覽器擴充功能
metadata.log_type = "CHROME_MANAGEMENT"
metadata.product_event_type = "browserExtensionInstallEvent"
target.resource.attribute.labels["extension_source"] != "CHROME_WEBSTORE"
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
$Source_Store = target.resource.attribute.labels["extension_source"]
$Browser_Extension = target.resource.name
$Browser_Extension_ID = target.resource.product_object_id
match:
$Date, $Source_Store, $Browser_Extension, $Browser_Extension_ID
安裝次數最多的瀏覽器擴充功能
metadata.log_type = "CHROME_MANAGEMENT"
metadata.product_event_type = "browserExtensionInstallEvent"
target.resource.attribute.labels["extension_action"] = "INSTALL"
$Browser_Extension = target.resource.name
$Browser_Extension_ID = target.resource.product_object_id
$Extension_Version = target.resource.attribute.labels["extension_version"]
$Extension_Source = target.resource.attribute.labels["extension_source"]
match:
$Browser_Extension, $Browser_Extension_ID, $Extension_Version, $Extension_Source
outcome:
$Count = count(metadata.id)
order:
$Count desc
Chrome 活動
metadata.log_type = "CHROME_MANAGEMENT"
metadata.product_event_type != ""
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
$Event_Type = metadata.product_event_type
match:
$Date, $Event_Type
outcome:
$Count = count(metadata.id)
Chrome 遙測健康狀態
metadata.log_type = "CHROME_MANAGEMENT"
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
match:
$Date
outcome:
$Count = count(metadata.id)
order:
$Date desc
前 10 大受管理瀏覽器 (依 Chrome 版本)
metadata.log_type = "CHROME_MANAGEMENT"
network.http.parsed_user_agent.browser_version != ""
principal.application != ""
$Browser_Version = network.http.parsed_user_agent.browser_version
$Application = principal.application
match:
$Browser_Version, $Application
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
作業系統前 10 大受管理瀏覽器
metadata.log_type = "CHROME_MANAGEMENT"
network.http.parsed_user_agent.os != ""
principal.application != ""
$OS = network.http.parsed_user_agent.os
$Application = principal.application
match:
$OS, $Application
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
管理機構
metadata.log_type = "CHROME_MANAGEMENT"
target.domain.name != ""
$Organization = target.domain.name
match:
$Organization
outcome:
$Count = count(principal.user.email_addresses)
order:
$Count desc
最常用的瀏覽器擴充功能
metadata.log_type = "CHROME_MANAGEMENT"
metadata.product_event_type = "browserExtensionInstallEvent"
target.resource.attribute.labels["extension_action"] = "INSTALL"
or target.resource.attribute.labels["extension_action"] = "UPDATE"
$Browser_Extension = target.resource.name
$Browser_Extension_ID = target.resource.product_object_id
$Extension_Version = target.resource.attribute.labels["extension_version"]
$Extension_Source = target.resource.attribute.labels["extension_source"]
match:
$Browser_Extension, $Browser_Extension_ID, $Extension_Version, $Extension_Source
outcome:
$Total_Unique_Instances = count(metadata.id)
order:
$Total_Unique_Instances desc
安裝瀏覽器擴充功能最多的前 10 名使用者
metadata.log_type = "CHROME_MANAGEMENT"
metadata.product_event_type = "browserExtensionInstallEvent"
$User = principal.user.email_addresses
match:
$User
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
依權限封鎖瀏覽器擴充功能
metadata.log_type = "CHROME_MANAGEMENT"
metadata.product_event_type = "extensionTelemetryEvent"
target.resource.name = "COOKIES_GET_ALL_INFO"
or target.resource.name = "COOKIES_GET_INFO"
or target.resource.name = "TABS_API_INFO"
$Browser_Extension = target.resource_ancestors.name
$Browser_Extension_ID = target.resource_ancestors.product_object_id
$Extension_Version = target.resource_ancestors.attribute.labels["extension_version"]
$Extension_Source = target.resource_ancestors.attribute.labels["extension_source"]
$Severity = security_result.severity
match:
$Browser_Extension, $Browser_Extension_ID, $Extension_Version, $Extension_Source, $Severity
outcome:
$Permissions = array_distinct(target.resource.name)
$Count = count(metadata.id)
order:
$Browser_Extension asc
安裝次數最少的瀏覽器擴充功能
metadata.log_type = "CHROME_MANAGEMENT"
metadata.product_event_type = "browserExtensionInstallEvent"
target.resource.attribute.labels["extension_action"] = "INSTALL"
$Browser_Extension = target.resource.name
$Browser_Extension_ID = target.resource.product_object_id
$Extension_Version = target.resource.attribute.labels["extension_version"]
$Extension_Source = target.resource.attribute.labels["extension_source"]
match:
$Browser_Extension, $Browser_Extension_ID, $Extension_Version, $Extension_Source
outcome:
$Count = count(metadata.id)
order:
$Count asc
Chrome Enterprise 進階版安全防護
這個資訊主頁可即時深入瞭解 Chrome 相關安全性事件，例如機密資料轉移、存取高風險網域、資料保護事件、惡意軟體和網路釣魚嘗試，以及密碼安全性問題。讓資安團隊監控、調查及因應 Chrome 相關威脅。
Chrome 資料遺失防護：資料洞察
Chrome 資料遺失防護：敏感網頁傳輸總數
Chrome 資料遺失防護：敏感檔案列印總數
Chrome 資料遺失防護：機密檔案上傳總數
密碼重複使用事件
Chrome 高風險網域
密碼外洩事件
惡意軟體事件
造訪不安全的網站
網路釣魚事件
Chrome DLP：機密內容傳輸總數
Chrome DLP：敏感檔案下載總數
Chrome DLP：偵測到敏感內容的使用者
Chrome DLP：機密內容網域
圖表名稱
查詢示例
Chrome 資料遺失防護：資料洞察
metadata.product_event_type = /sensitiveDataEvent|contentTransferEvent/ nocase
security_result.summary = /CONTENT_MATCHED_SENSITIVE_DATA_TYPES/ nocase or extracted.fields["reason"] = /CONTENT_MATCHED_SENSITIVE_DATA_TYPES/ nocase
$Sensitive_Data_Type = extracted.fields["matched_detectors[0].detector_id"]
$Trigger_Type = security_result.about.labels.value
match:
$Sensitive_Data_Type, $Trigger_Type
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
Chrome 資料遺失防護：敏感網頁傳輸總數
metadata.product_event_type = /Sensitive data transfer|SENSITIVE_DATA_TRANSFER|sensitiveDataEvent|sensitiveDataTransferEvent/ nocase
security_result.about.labels.value = /web_content_upload/ nocase
outcome:
$Sensitive_Web_Transfer = count(metadata.id)
Chrome 資料遺失防護：敏感檔案列印總數
metadata.product_event_type = /Sensitive data transfer|SENSITIVE_DATA_TRANSFER|sensitiveDataEvent|sensitiveDataTransferEvent/ nocase
security_result.about.labels.value = /print/ nocase
outcome:
$Sensitive_File_Print = count(metadata.id)
Chrome 資料遺失防護：機密檔案上傳總數
metadata.product_event_type = /Sensitive data transfer|SENSITIVE_DATA_TRANSFER|sensitiveDataEvent|sensitiveDataTransferEvent/ nocase
security_result.about.labels.value = /file_upload/ nocase
outcome:
$Sensitive_File_Upload = count(metadata.id)
密碼重複使用事件
metadata.product_event_type = /PASSWORD_REUSE|passwordReuseEvent/ nocase
$Action = security_result.action_details
$Severity = security_result.severity
$User = strings.coalesce(principal.user.userid , principal.user.user_display_name, principal.user.email_addresses)
$Summary = strings.coalesce(security_result.summary, security_result.description, metadata.product_event_type, security_result.category_details)
$URL = target.url
match:
$User, $Summary, $Severity, $Action, $URL
outcome:
$Date = timestamp.get_timestamp(max(metadata.event_timestamp.seconds), "%F %T")
$Count = count(metadata.id)
order:
$Count desc
Chrome 高風險網域
extracted.fields["url_info.risk_infos[0].risk_level"] = "HIGH"
target.url != ""
$URL = target.url
$Category = security_result.category
$Action = security_result.action_details
$Severity = principal.security_result.severity
$Risk_Level = extracted.fields["url_info.risk_infos[0].risk_level"]
$Threat_Type = extracted.fields["url_info.risk_infos[0].threat_type"]
$Domain = re.capture(target.url, `^(?:https?:\/\/)?(?:www\.)?([^\/:]+)`)
match:
$URL, $Domain, $Category, $Severity, $Risk_Level, $Threat_Type, $Action
outcome:
$Date = timestamp.get_timestamp(max(metadata.event_timestamp.seconds), "%F %T")
$Count = count(metadata.id)
order:
$Count desc
密碼外洩事件
metadata.product_event_type = /passwordBreachEvent/ nocase
$User = strings.coalesce(principal.user.userid, principal.user.user_display_name, principal.user.email_addresses, target.user.userid, target.user.user_display_name, target.user.email_addresses)
$Summary = strings.coalesce(security_result.summary, security_result.description, metadata.product_event_type, security_result.category_details)
$URL = target.url
$Action = security_result.action_details
$Severity = security_result.severity
match:
$User, $Summary, $URL, $Severity, $Action
outcome:
$Date = timestamp.get_timestamp(max(metadata.event_timestamp.seconds), "%F %T")
$Count = count(metadata.id)
order:
$Date desc
惡意軟體事件
metadata.product_event_type = /dangerousDownloadEvent|contentTransferEvent/ nocase
(extracted.fields["content_risk[0].risk_level"] = "HIGH" or extracted.fields["content_risk_level"] = "HIGH")
(extracted.fields["content_risk[0].threat_type"] = "MALWARE")
$File_Hash = target.file.sha256
$File_Path = target.file.full_path
$Category = security_result.category
$Severity = security_result.severity
$Risk_Level = strings.coalesce(extracted.fields["content_risk[0].risk_level"],extracted.fields["content_risk_level"])
match:
$File_Path, $File_Hash, $Category, $Severity, $Risk_Level
outcome:
$Date = timestamp.get_timestamp(max(metadata.event_timestamp.seconds), "%F %T")
$Summary = array_distinct(security_result.summary)
$Action = array_distinct(security_result.action_details)
$Count = count(metadata.id)
order:
$Count desc
造訪不安全的網站
metadata.product_event_type = /badNavigationEvent/ nocase
(extracted.fields["url_info.risk_infos[0].risk_level"] = "HIGH" OR extracted.fields["url_info.risk_level"] = "HIGH")
//(extracted.fields["content_risk[0].threat_type"] = "MALWARE" or extracted.fields["tab_url_info.threat_type"] = "MALWARE")
$URL = target.url
$Category = security_result.category
$Threat_Type = extracted.fields["url_info.risk_infos[0].threat_type"]
$User = strings.coalesce(principal.user.userid, principal.user.user_display_name, principal.user.email_addresses)
$Risk_Level = strings.coalesce(extracted.fields["url_info.risk_infos[0].risk_level"], extracted.fields["url_info.risk_level"])
match:
$User, $URL, $Category, $Threat_Type, $Risk_Level
outcome:
$Action = array_distinct(security_result.action_details)
$Date = timestamp.get_timestamp(max(metadata.event_timestamp.seconds), "%F %T")
$Count = count(metadata.id)
order:
$Count desc
網路釣魚事件
extracted.fields["url_info.risk_infos[0].threat_type"] = "SOCIAL_ENGINEERING"
$URL = target.url
$Category = security_result.category
$Action = security_result.action_details
$Severity = principal.security_result.severity
$Risk_Level = extracted.fields["url_info.risk_infos[0].risk_level"]
$User = strings.coalesce(principal.user.userid, principal.user.user_display_name, principal.user.email_addresses, target.user.userid, target.user.user_display_name, target.user.email_addresses)
match:
$User, $URL, $Category, $Severity, $Risk_Level, $Action
outcome:
$Date = timestamp.get_timestamp(max(metadata.event_timestamp.seconds), "%F %T")
$Count = count(metadata.id)
order:
$Count desc
Chrome DLP：機密內容傳輸總數
metadata.product_event_type = /Sensitive data transfer|SENSITIVE_DATA_TRANSFER|sensitiveDataEvent|sensitiveDataTransferEvent/ nocase
outcome:
$Total_Sensitive_Content_Transfer = count(metadata.id)
Chrome DLP：敏感檔案下載總數
metadata.product_event_type = /Sensitive data transfer|SENSITIVE_DATA_TRANSFER|sensitiveDataEvent|sensitiveDataTransferEvent/ nocase
security_result.about.labels.value = /file_download/ nocase
outcome:
$Sensitive_File_Download = count(metadata.id)
Chrome DLP：偵測到敏感內容的使用者
metadata.product_event_type = /sensitiveDataEvent/ nocase or security_result.summary = /CONTENT_MATCHED_SENSITIVE_DATA_TYPES/ nocase
$Device_IP = extracted.fields["remote_ip"]
$Device_ID = extracted.fields["device_id"]
$Action = security_result.action_details
$Severity = principal.security_result.severity
$Trigger_Type = security_result.about.labels.value
$Sensitive_Data_Type = extracted.fields["matched_detectors[0].display_name"]
$Device_User = strings.coalesce(extracted.fields["device_user"], extracted.fields["profile_user"])
match:
$Device_User, $Device_IP, $Device_ID, $Trigger_Type, $Sensitive_Data_Type, $Action, $Severity
outcome:
$Date = timestamp.get_timestamp(max(metadata.event_timestamp.seconds), "%F %T")
$Count = count(metadata.id)
order:
$Count desc
Chrome DLP：機密內容網域
metadata.product_event_type = /Sensitive data transfer|SENSITIVE_DATA_TRANSFER|sensitiveDataEvent|sensitiveDataTransferEvent/ nocase
or security_result.summary = /CONTENT_MATCHED_SENSITIVE_DATA_TYPES/ nocase
target.url != ""
$Domain = target.url
$Action = security_result.action_details
$Severity = security_result.severity
$Sensitive_Data_Type = extracted.fields["matched_detectors[0].display_name"]
match:
$Domain, $Action, $Severity, $Sensitive_Data_Type
outcome:
$Date = timestamp.get_timestamp(max(metadata.event_timestamp.seconds), "%F %T")
$Count = count(metadata.id)
order:
$Count desc
CIS Controls 法規遵循總覽
這個資訊主頁可清楚顯示 CIS 重要安全控制措施的遵循情況，有助於強化安全管理。追蹤重要法規遵循指標，例如資產清查準確度、安全漏洞修復進度、備份可靠性、存取權控管強制執行情況，以及事件應變準備程度。
不活躍使用者 (超過 7 天)
近期遭封鎖的應用程式執行作業
單一登入驗證摘要
IDS / IPS 事件分布
一段時間內的權限帳戶 MFA 事件
前 10 個有重大/高嚴重性安全漏洞的系統
近期網路釣魚事件
隨著時間推移，加密演算法強度不足
權限隨時間的變化
近期建立的使用者帳戶
一段時間內建立的使用者帳戶
VPN 連線成功與失敗趨勢 (一段時間內)
隨時間推移的惡意軟體偵測次數
依存在時間區分的高/重大安全漏洞
登入次數最多的前 10 個服務帳戶
惡意軟體檔案詳細資料
網路惡意活動
權限帳戶活動和修改
一段時間內的登入事件 (按動作劃分)
資料安全事件分布
資料刪除和清除事件
安全漏洞掃描趨勢
歷來網路釣魚事件
最近的備份事件
依嚴重性分類的前 10 大電子郵件威脅
歷來備份事件
一段時間內的裝置總數
前 10 大封鎖的應用程式執行作業
權限帳戶的 MFA 嘗試遭封鎖
圖表名稱
查詢示例
不活躍使用者 (超過 7 天)
stage inactive_users {
(metadata.event_type = "USER_UNCATEGORIZED"
or metadata.event_type = "USER_LOGIN"
or metadata.event_type = "USER_LOGOUT"
or metadata.event_type = "USER_CREATION"
or metadata.event_type = "USER_CHANGE_PASSWORD"
or metadata.event_type = "USER_CHANGE_PERMISSIONS"
or metadata.event_type = "USER_BADGE_IN"
or metadata.event_type = "USER_DELETION"
or metadata.event_type = "USER_RESOURCE_CREATION"
or metadata.event_type = "USER_RESOURCE_UPDATE_CONTENT"
or metadata.event_type = "USER_RESOURCE_UPDATE_PERMISSIONS"
or metadata.event_type = "USER_COMMUNICATION"
or metadata.event_type = "USER_RESOURCE_ACCESS"
or metadata.event_type = "USER_RESOURCE_DELETION")
principal.user.last_login_time.seconds > 0
$Event_Type = metadata.event_type
$User = strings.coalesce(principal.user.userid, principal.user.user_display_name, principal.user.email_addresses)
$User != ""
$Log_Type = metadata.log_type
match:
$User, $Event_Type, $Log_Type
outcome:
$Logtime = max(metadata.event_timestamp.seconds)
$Lastime = max(principal.user.last_login_time.seconds)
$Time_Difference = cast.as_int(max(metadata.event_timestamp.seconds - principal.user.last_login_time.seconds)/86400)
condition:
$Time_Difference > 7
}
$User = $inactive_users.User
$Event_Type = $inactive_users.Event_Type
$Log_Type = $inactive_users.Log_Type
match:
$User, $Event_Type, $Log_Type
outcome:
$Last_Login = timestamp.get_timestamp(max($inactive_users.Lastime))
$Latest_Login = timestamp.get_timestamp(max($inactive_users.Logtime))
$Time_Difference = max($inactive_users.Time_Difference)
order:
$Time_Difference desc
近期遭封鎖的應用程式執行作業
(metadata.product_event_type = /(execution|application) block/ nocase or security_result.summary = /(execution|application) block/ or metadata.description = /(execution|application) block/ nocase or security_result.threat_name = /application control/ nocase)
(security_result.action = "BLOCK" or security_result.action_details = /block/ nocase or (target.resource.attribute.labels.key = "categoryBehavior" and target.resource.attribute.labels.value = /blocked/ nocase))
$Application = strings.coalesce(about.file.full_path, target.process.file.full_path, additional.fields["fname"], principal.application, target.application)
$Description = strings.coalesce(target.resource.attribute.labels["categoryTupleDescription"], security_result.summary, metadata.product_event_type, security_result.description, metadata.description, security_result.action_details)
$Log_Type = metadata.log_type
$Severity = security_result.severity
match:
$Application, $Description, $Severity, $Log_Type
outcome:
$Count = count(metadata.id)
$Date = timestamp.get_timestamp(max(metadata.event_timestamp.seconds), "%F %T")
order:
$Count desc
單一登入驗證摘要
extensions.auth.type = "SSO"
(metadata.event_type = "USER_LOGIN" or metadata.event_type = "USER_LOGOUT")
$Description = strings.coalesce(security_result.summary, metadata.description, security_result.description, metadata.product_event_type)
$User = strings.coalesce(principal.user.userid, principal.user.user_display_name, principal.user.email_addresses,target.user.userid, target.user.user_display_name, target.user.email_addresses)
$Source_Hostname = strings.coalesce(principal.hostname, principal.asset.hostname)
$Source_IP = strings.coalesce(principal.ip,principal.asset.ip)
$Action = security_result.action
$Severity = security_result.severity
match:
$User, $Description, $Source_Hostname, $Source_IP, $Action, $Severity
outcome:
$Count = count(metadata.id)
$Date = timestamp.get_timestamp(max(metadata.event_timestamp.seconds), "%F %T")
order:
$Severity desc, $Date desc
IDS / IPS 事件分布
metadata.log_type = /_IDS|_IPS|AWS_SECURITY_HUB|EXTRAHOP|GUARDDUTY|MICROSOFT_ATA|ORCA|OSSEC|SURICATA_EVE|VMWARE_TANZU/ nocase
(metadata.event_type = "SCAN_UNCATEGORIZED"
or metadata.event_type = "SCAN_NETWORK"
or metadata.event_type = "NETWORK_CONNECTION"
or metadata.event_type = "NETWORK_DHCP"
or metadata.event_type = "NETWORK_DNS"
or metadata.event_type = "NETWORK_FLOW"
or metadata.event_type = "NETWORK_FTP"
or metadata.event_type = "NETWORK_HTTP"
or metadata.event_type = "NETWORK_HTTP"
or metadata.event_type = "NETWORK_SMTP")
$Category = security_result.category
match:
$Category
outcome:
$Count = count(metadata.id)
order:
$Count desc
一段時間內的權限帳戶 MFA 事件
(re.regex(metadata.product_name, "MULTI-FACTOR_AUTHENTICATION") or re.regex(additional.fields["AuthenticationRequirement"], `multiFactorAuthentication`) nocase or re.regex(security_result.detection_fields.value, `MFA`) nocase or re.regex(metadata.product_event_type, `mfa(?:\S)?auth|auth(?:.*)?mfa`) nocase)
$User = strings.coalesce(principal.user.userid, principal.user.user_display_name, principal.user.email_addresses, target.user.userid, target.user.user_display_name,target.user.email_addresses)
$User = /admin|root|administrator|security|support|default/ nocase //It will be updated as per the client's environment.
$Action = security_result.action
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
match:
$Date, $Action
outcome:
$Count = count(metadata.id)
order:
$Date asc
前 10 個有重大/高嚴重性安全漏洞的系統
metadata.log_type = /ARMIS_VULNERABILITIES|FINGERPRINT_JS|NUCLEUS_VULNERABILITY|QUALYS_ASSET_CONTEXT|QUALYS_SCAN|QUALYS_VIRTUAL_SCANNER|QUALYS_VM|RAPID7_INSIGHT|RAPID7_NEXPOSE|SNYK_SDLC|SPUR_FEEDS|STACKHAWK|SUBLIMESECURITY|SYMANTEC_SA|TENABLE_IO|TENABLE_OT|TENABLE_SC|UPGUARD|URLSCAN_IO/ nocase
(principal.asset.vulnerabilities.severity = "HIGH" or extensions.vulns.vulnerabilities.severity = "HIGH" or security_result.severity = "HIGH"
or target.asset.vulnerabilities.severity = "HIGH") or (principal.asset.vulnerabilities.severity = "CRITICAL" or extensions.vulns.vulnerabilities.severity = "CRITICAL"
or security_result.severity = "CRITICAL" or target.asset.vulnerabilities.severity = "CRITICAL")
$Severity =
if (principal.asset.vulnerabilities.severity != "UNKNOWN_SEVERITY",
principal.asset.vulnerabilities.severity,
if (target.asset.vulnerabilities.severity != "UNKNOWN_SEVERITY",
target.asset.vulnerabilities.severity,
if (extensions.vulns.vulnerabilities.severity != "UNKNOWN_SEVERITY",
extensions.vulns.vulnerabilities.severity,
"UNKNOWN_SEVERITY")))
$Vulnerability = strings.coalesce(
if(principal.asset.vulnerabilities.name != "" and principal.asset.vulnerabilities.description != "",
strings.concat(principal.asset.vulnerabilities.name, " : ", principal.asset.vulnerabilities.description),
strings.coalesce(principal.asset.vulnerabilities.name, principal.asset.vulnerabilities.description)),
if(additional.fields["ScanReference"] != "" and metadata.description != "",
strings.concat(additional.fields["ScanReference"], " : ", metadata.description),
strings.coalesce(additional.fields["ScanReference"], metadata.description)),
if(extensions.vulns.vulnerabilities.vendor_vulnerability_id != "" and extensions.vulns.vulnerabilities.description != "",
strings.concat(extensions.vulns.vulnerabilities.vendor_vulnerability_id, " : ", extensions.vulns.vulnerabilities.description),
strings.coalesce(extensions.vulns.vulnerabilities.vendor_vulnerability_id, extensions.vulns.vulnerabilities.description)
)
)
($Vulnerability != " : " and $Vulnerability != "")
$Hostname = strings.coalesce(principal.hostname,principal.asset.hostname, target.hostname, target.asset.hostname)
$Log_Type = metadata.log_type
match:
$Hostname, $Vulnerability, $Severity, $Log_Type
outcome:
$Date = timestamp.get_timestamp(max(metadata.event_timestamp.seconds), "%F %T")
$Count = count(strings.coalesce(extensions.vulns.vulnerabilities.name, extensions.vulns.vulnerabilities.description, extensions.vulns.vulnerabilities.vendor_vulnerability_id,
principal.asset.vulnerabilities.name, target.asset.vulnerabilities.name, additional.fields["ScanReference"]))
order:
$Count desc
limit:
10
近期網路釣魚事件
metadata.log_type = /MAIL|ABNORMAL_SECURITY|AREA1|COFENSE_TRIAGE|FIREEYE|FORCEPOINT|FORTINET|KNOWBE4_PHISHER|MICROSOFT_GRAPH_ALERT|MIMECAST_URL_LOGS|OBSERVEIT|OFFICE_365|PHISHLABS|PROOFPOINT|SYMANTEC_VIP|VOLTAGE|WORKSPACE_ALERTS/ nocase
(security_result.category = "MAIL_PHISHING" or re.regex(security_result.threat_name,`Phish`) nocase or re.regex(security_result.category_details,`Phish`)nocase)
security_result.threat_name != "NOT_PHISHING"
$Security_Event_Type = metadata.product_event_type
$Summary = strings.coalesce(security_result.summary, metadata.description, security_result.description)
$Sender = strings.coalesce(network.email.from, principal.user.email_addresses)
$Subject = network.email.subject
$File_Path = strings.coalesce(target.file.full_path, about.file.full_path, target.file.names)
$File_Type = strings.coalesce(about.file.mime_type, target.file.mime_type)
match:
$Security_Event_Type, $Sender, $Subject, $File_Path, $File_Type, $Summary
outcome:
$Count = count(metadata.id)
$Receiver_Count = count_distinct(strings.coalesce(network.email.to, network.email.reply_to, target.user.email_addresses))
$Date = timestamp.get_timestamp(max(metadata.event_timestamp.seconds), "%F %T")
order:
$Count desc
隨著時間推移，加密演算法強度不足
(((target.resource.attribute.labels.key = "keyProperties_type" or target.resource.attribute.labels.key = "requestParameters.keySpec" or target.resource.attribute.labels.key = /key/ nocase) and target.resource.attribute.labels.value = /^(RSA-)|DES|RC4|MD5|SHA1|SHA-1/) or network.tls.cipher = /^(RSA-)|DES|RC4|MD5|SHA1|SHA-1/)
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
$Log_Type = metadata.log_type
match:
$Date, $Log_Type
outcome:
$Count = count(metadata.id)
order:
$Date asc
權限隨時間的變化
(metadata.event_type = "RESOURCE_PERMISSIONS_CHANGE" or metadata.event_type = "USER_CHANGE_PERMISSIONS" or metadata.event_type = "USER_RESOURCE_UPDATE_PERMISSIONS")
security_result.action = "ALLOW"
$Log_Type = metadata.log_type
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
match:
$Date, $Log_Type
outcome:
$Count = count(metadata.id)
order:
$Date asc
近期建立的使用者帳戶
metadata.event_type = "USER_CREATION"
security_result.action = "ALLOW"
$Log_Type = metadata.log_type
$Source_IP = strings.coalesce(principal.ip,principal.asset.ip)
$Source_Hostname = strings.coalesce(principal.hostname, principal.asset.hostname, principal.mac, principal.asset.mac, extracted.fields["access_device.hostname"],
if(target.resource.attribute.labels.key = "Private DnsName",target.resource.attribute.labels.value, ""),
principal.resource.product_object_id, target.resource.product_object_id,
if(security_result.detection_fields.key = "actor_2",security_result.detection_fields.value, "")
)
$Initiator = strings.coalesce(principal.user.userid, principal.user.user_display_name, principal.user.email_addresses)
$User_Created = strings.coalesce(target.user.userid, target.user.user_display_name, target.user.email_addresses)
match:
$Log_Type, $Source_IP, $Source_Hostname, $Initiator, $User_Created
outcome:
$Date = timestamp.get_timestamp(max(metadata.event_timestamp.seconds), "%F %T ")
order:
$Date desc
一段時間內建立的使用者帳戶
metadata.event_type = "USER_CREATION"
security_result.action = "ALLOW"
$Log_Type = metadata.log_type
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
match:
$Date, $Log_Type
outcome:
$Count = count(metadata.id)
order:
$Date asc
VPN 連線成功與失敗趨勢 (一段時間內)
metadata.log_type = /VPN|ZSCALER_ZPA|ZSCALER_DECEPTION|TWINGATE|SYMANTEC_VIP_AUTHHUB/ nocase
$Action = if ((strings.coalesce(security_result.summary, metadata.product_event_type, extracted.fields["connection-attempt-status"]) = /Success|Authenticated/ nocase), "SUCCESS", "FAIL")
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
match:
$Date, $Action
outcome:
$Count = count(metadata.id)
order:
$Count desc
隨時間推移的惡意軟體偵測次數
(metadata.product_event_type = /malware/ nocase or security_result.summary = /malware/ nocase or security_result.category_details = /malware/ nocase or metadata.description = /malware/ nocase or security_result.threat_name = /malware/ nocase or security_result.rule_name = /malware/ nocase or security_result.category = "SOFTWARE_MALICIOUS")
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
$Action = security_result.action
match :
$Date, $Action
outcome:
$Count = count(metadata.id)
order:
$Date asc
依存在時間區分的高/重大安全漏洞
(principal.asset.vulnerabilities.severity = "CRITICAL" or extensions.vulns.vulnerabilities.severity = "CRITICAL"
or security_result.severity = "CRITICAL" or target.asset.vulnerabilities.severity = "CRITICAL") OR
(principal.asset.vulnerabilities.severity = "HIGH" or extensions.vulns.vulnerabilities.severity = "HIGH"
or security_result.severity = "HIGH" or target.asset.vulnerabilities.severity = "HIGH")
(timestamp.as_unix_seconds(additional.fields["first_found"]) > 0 or extensions.vulns.vulnerabilities.first_found.seconds > 0)
$Severity =
if (principal.asset.vulnerabilities.severity != "UNKNOWN_SEVERITY",
principal.asset.vulnerabilities.severity,
if (target.asset.vulnerabilities.severity != "UNKNOWN_SEVERITY",
target.asset.vulnerabilities.severity,
if (extensions.vulns.vulnerabilities.severity != "UNKNOWN_SEVERITY",
extensions.vulns.vulnerabilities.severity,
"UNKNOWN_SEVERITY")))
$Vulnerability = strings.coalesce(
if(principal.asset.vulnerabilities.name != "" and principal.asset.vulnerabilities.description != "",
strings.concat(principal.asset.vulnerabilities.name, " : ", principal.asset.vulnerabilities.description),
strings.coalesce(principal.asset.vulnerabilities.name, principal.asset.vulnerabilities.description)),
if(additional.fields["ScanReference"] != "" and metadata.description != "",
strings.concat(additional.fields["ScanReference"], " : ", metadata.description),
strings.coalesce(additional.fields["ScanReference"], metadata.description)),
if(extensions.vulns.vulnerabilities.vendor_vulnerability_id != "" and extensions.vulns.vulnerabilities.description != "",
strings.concat(extensions.vulns.vulnerabilities.vendor_vulnerability_id, " : ", extensions.vulns.vulnerabilities.description),
strings.coalesce(extensions.vulns.vulnerabilities.vendor_vulnerability_id, extensions.vulns.vulnerabilities.description)
)
)
($Vulnerability != " : " and $Vulnerability != "")
$Log_Type = metadata.log_type
match:
$Vulnerability, $Log_Type, $Severity
outcome:
$Age_Max = max(cast.as_int((metadata.event_timestamp.seconds - if(timestamp.as_unix_seconds(additional.fields["first_found"]) > 0,
timestamp.as_unix_seconds(additional.fields["first_found"]), if(extensions.vulns.vulnerabilities.first_found.seconds > 0,
extensions.vulns.vulnerabilities.first_found.seconds, metadata.event_timestamp.seconds))) / 86400))
$Count = count(strings.coalesce(extensions.vulns.vulnerabilities.name, extensions.vulns.vulnerabilities.description, extensions.vulns.vulnerabilities.vendor_vulnerability_id,
principal.asset.vulnerabilities.name, target.asset.vulnerabilities.name, additional.fields["ScanReference"]))
order:
$Age_Max desc
登入次數最多的前 10 個服務帳戶
metadata.event_type = "USER_LOGIN"
principal.user.account_type = "SERVICE_ACCOUNT_TYPE"
or principal.resource.resource_type = "SERVICE_ACCOUNT"
or principal.user.attribute.roles.type = "SERVICE_ACCOUNT"
or target.user.account_type = "SERVICE_ACCOUNT_TYPE"
or target.resource.resource_type = "SERVICE_ACCOUNT"
or target.user.attribute.roles.type = "SERVICE_ACCOUNT"
or strings.coalesce(principal.resource.type, principal.user.attribute.roles.name, principal.resource.resource_subtype, principal.user.userid, principal.user.user_display_name, principal.user.email_addresses,target.resource.type, target.user.attribute.roles.name, target.resource.resource_subtype, target.user.userid, target.user.user_display_name, target.user.email_addresses) = /(?i)service.*(?:account|^principal$)/ nocase
$Service_Account = strings.coalesce(principal.user.userid, principal.user.user_display_name, principal.user.email_addresses, target.user.userid, target.user.user_display_name, target.user.email_addresses)
$Service_Account != ""
$Action = security_result.action
match:
$Service_Account, $Action
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
惡意軟體檔案詳細資料
(metadata.product_event_type = /malware/ nocase or security_result.summary = /malware/ nocase or security_result.category_details = /malware/ nocase or metadata.description = /malware/ nocase or security_result.threat_name = /malware/ nocase or security_result.rule_name = /malware/ nocase or security_result.category = "SOFTWARE_MALICIOUS")
$Source_User = strings.coalesce(principal.user.user_display_name, principal.user.userid, principal.user.email_addresses)
$File_Name = strings.coalesce(target.file.full_path, about.file.full_path)
$File_Name != ""
$File_Type = strings.coalesce(target.file.mime_type, about.file.mime_type)
$Severity = security_result.severity
$Action = security_result.action
match :
$File_Name, $File_Type, $Source_User, $Severity, $Action
outcome:
$Count = count(metadata.id)
$Date = timestamp.get_timestamp(max(metadata.event_timestamp.seconds), "%F %T")
order:
$Count desc
網路惡意活動
(metadata.event_type = "NETWORK_UNCATEGORIZED"
or metadata.event_type = "NETWORK_FLOW"
or metadata.event_type = "NETWORK_CONNECTION"
or metadata.event_type = "NETWORK_FTP"
or metadata.event_type = "NETWORK_DHCP"
or metadata.event_type = "NETWORK_DNS"
or metadata.event_type = "NETWORK_HTTP"
or metadata.event_type = "NETWORK_SMTP")
(security_result.category = "NETWORK_DENIAL_OF_SERVICE" or security_result.category = "NETWORK_MALICIOUS" or security_result.category = "NETWORK_SUSPICIOUS" or
security_result.category = "SOFTWARE_MALICIOUS" or security_result.category = "SOFTWARE_SUSPICIOUS" or security_result.category = "NETWORK_RECON")
$Log_Type = metadata.log_type
$Category = security_result.category
$Summary = strings.coalesce(security_result.description, security_result.summary, metadata.description, security_result.rule_name, metadata.product_event_type)
$Hostname = strings.coalesce(principal.asset.hostname, principal.hostname, principal.mac, principal.asset.mac, target.hostname, target.asset.hostname, target.mac, target.asset.mac,
target.resource.product_object_id, principal.group.product_object_id, principal.ip, principal.asset.ip, target.ip, target.asset.ip)
$Action = security_result.action
match:
$Summary, $Category, $Hostname, $Log_Type, $Action
outcome:
$Count = count(metadata.id)
$Date = timestamp.get_timestamp(max(metadata.event_timestamp.seconds), "%F %T")
order:
$Count desc
權限帳戶活動和修改
metadata.event_type = "GROUP_CREATION" or metadata.event_type = "GROUP_MODIFICATION" or metadata.event_type = "GROUP_DELETION" or metadata.event_type = "USER_LOGIN" or metadata.product_event_type = /(RemoveUserFrom|AddUserTo|Add member to |Remove member from )|(?:group)/ nocase
$User = strings.coalesce(principal.user.userid, principal.user.user_display_name, principal.user.email_addresses, target.user.userid,target.user.user_display_name,target.user.email_addresses)
($User = /admin|root|svc|adm|privilege/ nocase or principal.user.attribute.roles.type = "SERVICE_ACCOUNT" or principal.user.attribute.roles.type = "ADMINISTRATOR" or principal.user.account_type = "DOMAIN_ACCOUNT_TYPE" or principal.user.account_type = "SERVICE_ACCOUNT_TYPE")
$Event_Type = metadata.event_type
$Source_IP = strings.coalesce(principal.ip, principal.asset.ip, principal.hostname, principal.asset.hostname, principal.mac)
$Target_Resource = strings.coalesce(target.resource.name, target.file.full_path, target.resource.product_object_id, target.group.product_object_id, target.user.group_identifiers, target.group.group_display_name)
$Target_Resourcetype = target.resource.resource_type
$Action = security_result.action
$Security_Event_Type = metadata.product_event_type
$Summary = strings.coalesce(additional.fields["Message"], security_result.summary, security_result.description, metadata.description)
match:
$Event_Type, $User,$Source_IP, $Target_Resource, $Action, $Security_Event_Type, $Summary
outcome:
$Count = count(metadata.id)
$Date = timestamp.get_timestamp(max(metadata.event_timestamp.seconds), "%F %H:%M:%S")
order:
$Count desc
一段時間內的登入事件 (按動作劃分)
metadata.event_type = "USER_LOGIN"
$Action = security_result.action
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
match:
$Date, $Action
outcome:
$Count = count(metadata.id)
order:
$Date asc
資料安全事件分布
metadata.log_type = /ARUBA_CENTRAL|CLOUDFLARE_WARP|DELL_CYBERSENSE|FORGEROCK_OPENIDM|IMPERVA_DRA|IMPERVA_SECURESPHERE|IBM_OPENPAGES|INTEL471_WATCHER_ALERTS|METABASE|OKERA_DAP|OPENCANARY|RUBRIK_POLARIS|SENTRY|TINES|TINTRI|VARONIS/ nocase
$Event_Type = metadata.event_type
match:
$Event_Type
outcome:
$Count = count(metadata.id)
order:
$Count desc
資料刪除和清除事件
(metadata.event_type = "FILE_DELETION"
or metadata.event_type = "RESOURCE_DELETION"
or metadata.event_type = "SYSTEM_AUDIT_LOG_WIPE"
or metadata.event_type = "REGISTRY_DELETION"
or metadata.event_type = "SETTING_DELETION"
or metadata.event_type = "USER_RESOURCE_DELETION"
or metadata.event_type = "GROUP_DELETION"
or metadata.event_type = "SERVICE_DELETION"
or metadata.event_type = "SCHEDULED_TASK_DELETION"
or strings.coalesce(metadata.product_event_type, security_result.summary, security_result.description, security_result.action_details) = /delet(?:e|ed|ion|ing)|purge/ nocase)
security_result.action = "ALLOW"
$Description = strings.coalesce(security_result.summary, security_result.description, metadata.description, security_result.action_details)
$Product_Event_Type = metadata.product_event_type
$Event_Type = metadata.event_type
$Log_Type = metadata.log_type
$Target_Resource = strings.coalesce(target.resource.name, target.file.full_path, target.resource.product_object_id, target.group.product_object_id, target.user.group_identifiers)
$User = strings.coalesce(principal.user.user_display_name, principal.user.userid, principal.user.email_addresses, target.user.userid,target.user.user_display_name,target.user.email_addresses)
match:
$User, $Log_Type, $Description, $Product_Event_Type, $Event_Type, $Target_Resource
outcome:
$Date = timestamp.get_timestamp(max(metadata.event_timestamp.seconds), "%F %T")
$Count = count(metadata.id)
order:
$Date desc, $Count desc
安全漏洞掃描趨勢
metadata.log_type = /ARMIS_VULNERABILITIES|FINGERPRINT_JS|NUCLEUS_VULNERABILITY|QUALYS_ASSET_CONTEXT|QUALYS_SCAN|QUALYS_VIRTUAL_SCANNER|QUALYS_VM|RAPID7_INSIGHT|RAPID7_NEXPOSE|SNYK_SDLC|SPUR_FEEDS|STACKHAWK|SUBLIMESECURITY|SYMANTEC_SA|TENABLE_IO|TENABLE_OT|TENABLE_SC|UPGUARD|URLSCAN_IO/ nocase
(metadata.event_type = "SCAN_VULN_HOST" or additional.fields["Type"] = "Scan" or security_result.detection_fields.key = /scan/ nocase or security_result.detection_fields.value = /scan/ nocase)
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
$Log_Type = metadata.log_type
match:
$Log_Type, $Date
outcome:
$Count = count(metadata.id)
order:
$Date asc
歷來網路釣魚事件
metadata.log_type = /MAIL|ABNORMAL_SECURITY|AREA1|COFENSE_TRIAGE|FIREEYE|FORCEPOINT|FORTINET|KNOWBE4_PHISHER|MICROSOFT_GRAPH_ALERT|MIMECAST_URL_LOGS|OBSERVEIT|OFFICE_365|PHISHLABS|PROOFPOINT|SYMANTEC_VIP|VOLTAGE|WORKSPACE_ALERTS/ nocase
(security_result.category = "MAIL_PHISHING" or re.regex(security_result.threat_name,`Phish`) nocase or re.regex(security_result.category_details,`Phish`)nocase)
security_result.threat_name != "NOT_PHISHING"
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
$Severity = security_result.severity
match:
$Date, $Severity
outcome:
$Count = count(metadata.id)
order:
$Date asc
最近的備份事件
(metadata.log_type = /COHESITY|DRUVA_BACKUP|VEEAM|VERITAS_NETBACKUP/ nocase or metadata.log_type = "RUBRIK")
$Description = strings.coalesce(metadata.description, security_result.description, security_result.summary)
$Log_Type = metadata.log_type
$Event_Type = metadata.event_type
$Security_Event_Type = metadata.product_event_type
$Action = security_result.action
match:
$Description, $Security_Event_Type, $Event_Type, $Action, $Log_Type
outcome:
$Count = count(metadata.id)
$Date = timestamp.get_timestamp(max(metadata.event_timestamp.seconds), "%F %T ")
order:
$Count desc
依嚴重性分類的前 10 大電子郵件威脅
metadata.log_type = /MAIL|ABNORMAL_SECURITY|AREA1|COFENSE_TRIAGE|FIREEYE|FORCEPOINT|FORTINET|KNOWBE4_PHISHER|MICROSOFT_GRAPH_ALERT|MIMECAST_URL_LOGS|OBSERVEIT|OFFICE_365|PHISHLABS|PROOFPOINT|SYMANTEC_VIP|VOLTAGE|WORKSPACE_ALERTS/ nocase
security_result.category = "MAIL_SPAM"
or security_result.category = "MAIL_SPOOFING"
or security_result.category = "SOFTWARE_MALICIOUS"
or (security_result.category = "MAIL_PHISHING" and security_result.threat_name!= "NOT_PHISHING")
or strings.coalesce(security_result.threat_name, security_result.category_details) = /Phish|Mail/ nocase
$Severity = security_result.severity
$Threat_Name = strings.coalesce(security_result.threat_name, security_result.category_details)
$Threat_Name != ""
match:
$Threat_Name, $Severity
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
歷來備份事件
(metadata.log_type = /COHESITY|DRUVA_BACKUP|VEEAM|VERITAS_NETBACKUP/ nocase or metadata.log_type = "RUBRIK")
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
$Log_Type = metadata.log_type
match:
$Date, $Log_Type
outcome:
$Count = count(metadata.id)
order:
$Date asc
一段時間內的裝置總數
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
match:
$Date
outcome:
$Count = count_distinct(strings.coalesce(principal.hostname, principal.asset.hostname, target.hostname, target.asset.hostname))
order:
$Date asc
前 10 大封鎖的應用程式執行作業
(metadata.product_event_type = /(execution|application) block/ nocase or security_result.summary = /(execution|application) block/ or metadata.description = /(execution|application) block/ nocase or security_result.threat_name = /application control/ nocase)
(security_result.action = "BLOCK" or security_result.action_details = /block/ nocase or (target.resource.attribute.labels.key = "categoryBehavior" and target.resource.attribute.labels.value = /blocked/ nocase))
$Application = strings.coalesce(about.file.full_path, target.process.file.full_path, additional.fields["fname"], principal.application, target.application)
$Description = strings.coalesce(target.resource.attribute.labels["categoryTupleDescription"], security_result.summary, metadata.product_event_type, security_result.description, metadata.description, security_result.action_details)
match:
$Application, $Description, metadata.log_type
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
權限帳戶的 MFA 嘗試遭封鎖
(re.regex(metadata.product_name, "MULTI-FACTOR_AUTHENTICATION") or re.regex(additional.fields["AuthenticationRequirement"], `multiFactorAuthentication`) nocase or re.regex(security_result.detection_fields.value, `MFA`) nocase or re.regex(metadata.product_event_type, `mfa(?:\S)?auth|auth(?:.*)?mfa`) nocase)
security_result.action = "BLOCK"
$User = strings.coalesce(principal.user.userid, principal.user.user_display_name, principal.user.email_addresses, target.user.userid, target.user.user_display_name,target.user.email_addresses)
$User = /admin|root|administrator|security|support|default/ nocase //It will be updated as per the client's environment.
$Reason = strings.coalesce(security_result.summary, metadata.product_event_type)
$Location = strings.coalesce(principal.location.country_or_region, principal.ip_geo_artifact.location.country_or_region)
$Source_IP = strings.coalesce(principal.ip, principal.asset.ip)
$Log_Type = metadata.log_type
$Severity = security_result.severity
match:
$Reason, $User, $Source_IP, $Location, $Severity, $Log_Type
outcome:
$Count = count(metadata.id)
$Date = timestamp.get_timestamp(max(metadata.event_timestamp.seconds), "%F %T")
order:
$Count desc
Cloud Key Management 總覽
這個資訊主頁會詳細顯示貴機構雲端基礎架構中的金鑰管理活動。資訊主頁會監控金鑰、憑證和密鑰在整個生命週期 (建立、刪除、啟用、輪替和停用) 的狀態，以便偵測異常或未經授權的活動。
一段時間內停用的物件
依記錄類型劃分的事件總數
建立物件的前 10 名使用者
隨時間刪除的物件
一段時間內建立的物件
啟用物件的前 10 大來源 IP
前 10 名使用者旋轉物件
一段時間內旋轉的物件
前 10 大來源 IP 旋轉物件
刪除物件的前 10 名使用者
前 10 大旋轉物件
前 10 大停用物件
前 10 名遭封鎖的使用者
啟用物件的前 10 名使用者
最近建立的物件 (過去 24 小時)
已啟用物件的前 10 名
前 10 大使用者代理程式
建立物件的前 10 大來源 IP
前 10 大物件位置
已啟用物件的變化趨勢
前 10 個遭封鎖的來源 IP
地理位置建立的物件
停用物件的前 10 名使用者
停用物件的前 10 大來源 IP
最近刪除的物件(過去 24 小時)
前 10 大來源 IP 位址 刪除物件
圖表名稱
查詢示例
一段時間內停用的物件
((((metadata.log_type = /AZURE_KEYVAULT_AUDIT/ nocase and (additional.fields["resultType"] = /Allow|Success/ nocase or security_result.action = "ALLOW")) or
(target.application = "kms.amazonaws.com" and security_result.action = "ALLOW")) and metadata.product_event_type = /Disable/ nocase) or
(metadata.log_type = /GCP_CLOUDAUDIT/ nocase and metadata.product_event_type = /UpdateCryptoKeyVersion|Disable/ nocase and metadata.product_event_type = /key|secret|certificate/ nocase and
target.resource.attribute.labels.value = /DISABLED/ nocase and security_result.action = "ALLOW"))
$Log_Type = strings.coalesce(metadata.log_type, target.application)
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
match:
$Log_Type, $Date
outcome:
$Count = count(metadata.id)
order:
$Date asc
依記錄類型劃分的事件總數
(metadata.log_type = /AZURE_KEYVAULT_AUDIT|GCP_CLOUDAUDIT/ nocase or target.application = "kms.amazonaws.com")
$Log_Type = strings.coalesce(metadata.log_type, target.application)
match:
$Log_Type
outcome:
$Count = count(metadata.id)
order:
$Count desc
建立物件的前 10 名使用者
((((metadata.log_type = /AZURE_KEYVAULT_AUDIT/ nocase and (additional.fields["resultType"] = /Allow|Success/ nocase or security_result.action = "ALLOW")) or
(target.application = "kms.amazonaws.com" and security_result.action = "ALLOW")) and metadata.product_event_type = /Create/ nocase) or
(metadata.log_type = /GCP_CLOUDAUDIT/ nocase and metadata.product_event_type = /Create/ nocase and metadata.product_event_type = /key|secret|certificate/ nocase and
metadata.product_event_type != /version/ nocase and security_result.action = "ALLOW"))
$User = strings.coalesce(principal.user.userid, principal.user.user_display_name, principal.user.email_addresses, principal.user.group_identifiers)
$Log_Type = strings.coalesce(metadata.log_type, target.application)
match:
$User, $Log_Type
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
隨時間刪除的物件
((((metadata.log_type = /AZURE_KEYVAULT_AUDIT/ nocase and (additional.fields["resultType"] = /Allow|Success/ nocase or security_result.action = "ALLOW")) or
(target.application = "kms.amazonaws.com" and security_result.action = "ALLOW")) and metadata.product_event_type = /Delete/ nocase) or
(metadata.log_type = /GCP_CLOUDAUDIT/ nocase and metadata.product_event_type = /Delete|Destroy/ nocase and metadata.product_event_type = /key|secret|certificate/ nocase
and security_result.action = "ALLOW"))
$Log_Type = strings.coalesce(metadata.log_type, target.application)
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
match:
$Log_Type, $Date
outcome:
$Count = count(metadata.id)
order:
$Date asc
一段時間內建立的物件
((((metadata.log_type = /AZURE_KEYVAULT_AUDIT/ nocase and ((additional.fields["resultType"] = /Allow|Success/ nocase) or (security_result.action = "ALLOW"))) or
(target.application = "kms.amazonaws.com" and security_result.action = "ALLOW")) and metadata.product_event_type = /Create/ nocase) or
(metadata.log_type = /GCP_CLOUDAUDIT/ nocase and metadata.product_event_type = /Create/ nocase and metadata.product_event_type = /key|secret|certificate/ nocase and
metadata.product_event_type != /version/ nocase and security_result.action = "ALLOW"))
$Log_Type = strings.coalesce(metadata.log_type, target.application)
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
match:
$Log_Type, $Date
outcome:
$Count = count(metadata.id)
order:
$Date asc
啟用物件的前 10 大來源 IP
((((metadata.log_type = /AZURE_KEYVAULT_AUDIT/ nocase and (additional.fields["resultType"] = /Allow|Success/ nocase or security_result.action = "ALLOW")) or
(target.application = "kms.amazonaws.com" and security_result.action = "ALLOW")) and metadata.product_event_type = /Enable/ nocase) or
(metadata.log_type = /GCP_CLOUDAUDIT/ nocase and metadata.product_event_type = /UpdateCryptoKeyVersion|Enable/ nocase and metadata.product_event_type = /key|secret|certificate/ nocase and
target.resource.attribute.labels.value = /ENABLED/ nocase and security_result.action = "ALLOW"))
$Source_IP = strings.coalesce(principal.ip, principal.asset.ip)
$Log_Type = strings.coalesce(metadata.log_type, target.application)
match:
$Source_IP, $Log_Type
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
前 10 名使用者旋轉物件
((((metadata.log_type = /AZURE_KEYVAULT_AUDIT/ nocase and (additional.fields["resultType"] = /Allow|Success/ nocase or security_result.action = "ALLOW")) or
(target.application = "kms.amazonaws.com" and security_result.action = "ALLOW")) and metadata.product_event_type = /Rotate|KeyRotation/ nocase) or
(metadata.log_type = /GCP_CLOUDAUDIT/ nocase and metadata.product_event_type = /CreateCryptoKeyVersion|updateCryptoKeyPrimaryVersion|Rotate/ nocase and metadata.product_event_type = /key|secret|certificate/ nocase and security_result.action = "ALLOW"))
$User = strings.coalesce(principal.user.userid, principal.user.user_display_name, principal.user.email_addresses, principal.user.group_identifiers)
$Log_Type = strings.coalesce(metadata.log_type, target.application)
match:
$User, $Log_Type
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
一段時間內旋轉的物件
((((metadata.log_type = /AZURE_KEYVAULT_AUDIT/ nocase and (additional.fields["resultType"] = /Allow|Success/ nocase or security_result.action = "ALLOW")) or
(target.application = "kms.amazonaws.com" and security_result.action = "ALLOW")) and metadata.product_event_type = /Rotate|KeyRotation/ nocase) or
(metadata.log_type = /GCP_CLOUDAUDIT/ nocase and metadata.product_event_type = /CreateCryptoKeyVersion|updateCryptoKeyPrimaryVersion|Rotate/ nocase and metadata.product_event_type = /key|secret|certificate/ nocase and security_result.action = "ALLOW"))
$Log_Type = strings.coalesce(metadata.log_type, target.application)
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
match:
$Log_Type, $Date
outcome:
$Count = count(metadata.id)
order:
$Date asc
前 10 大來源 IP 旋轉物件
((((metadata.log_type = /AZURE_KEYVAULT_AUDIT/ nocase and (additional.fields["resultType"] = /Allow|Success/ nocase or security_result.action = "ALLOW")) or
(target.application = "kms.amazonaws.com" and security_result.action = "ALLOW")) and metadata.product_event_type = /Rotate|KeyRotation/ nocase) or
(metadata.log_type = /GCP_CLOUDAUDIT/ nocase and metadata.product_event_type = /CreateCryptoKeyVersion|updateCryptoKeyPrimaryVersion|Rotate/ nocase and metadata.product_event_type = /key|secret|certificate/ nocase and security_result.action = "ALLOW"))
$Source_IP = strings.coalesce(principal.ip, principal.asset.ip)
$Log_Type = strings.coalesce(metadata.log_type, target.application)
match:
$Source_IP, $Log_Type
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
刪除物件的前 10 名使用者
((((metadata.log_type = /AZURE_KEYVAULT_AUDIT/ nocase and (additional.fields["resultType"] = /Allow|Success/ nocase or security_result.action = "ALLOW")) or
(target.application = "kms.amazonaws.com" and security_result.action = "ALLOW")) and metadata.product_event_type = /Delete/ nocase) or
(metadata.log_type = /GCP_CLOUDAUDIT/ nocase and metadata.product_event_type = /Delete|Destroy/ nocase and metadata.product_event_type = /key|secret|certificate/ nocase
and security_result.action = "ALLOW"))
$User = strings.coalesce(principal.user.userid, principal.user.user_display_name, principal.user.email_addresses, principal.user.group_identifiers)
$Log_Type = strings.coalesce(metadata.log_type, target.application)
match:
$User, $Log_Type
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
前 10 大旋轉物件
((((metadata.log_type = /AZURE_KEYVAULT_AUDIT/ nocase and (additional.fields["resultType"] = /Allow|Success/ nocase or security_result.action = "ALLOW")) or
(target.application = "kms.amazonaws.com" and security_result.action = "ALLOW")) and metadata.product_event_type = /Rotate|KeyRotation/ nocase) or
(metadata.log_type = /GCP_CLOUDAUDIT/ nocase and metadata.product_event_type = /CreateCryptoKeyVersion|updateCryptoKeyPrimaryVersion|Rotate/ nocase and metadata.product_event_type = /key|secret|certificate/ nocase and security_result.action = "ALLOW"))
$Object_ID = strings.coalesce(target.resource.product_object_id, principal.user.product_object_id, principal.resource.product_object_id)
$Log_Type = strings.coalesce(metadata.log_type, target.application)
match:
$Object_ID, $Log_Type
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
前 10 大停用物件
((((metadata.log_type = /AZURE_KEYVAULT_AUDIT/ nocase and (additional.fields["resultType"] = /Allow|Success/ nocase or security_result.action = "ALLOW")) or
(target.application = "kms.amazonaws.com" and security_result.action = "ALLOW")) and metadata.product_event_type = /Disable/ nocase) or
(metadata.log_type = /GCP_CLOUDAUDIT/ nocase and metadata.product_event_type = /UpdateCryptoKeyVersion|Disable/ nocase and metadata.product_event_type = /key|secret|certificate/ nocase and
target.resource.attribute.labels.value = /DISABLED/ nocase and security_result.action = "ALLOW"))
$Object_ID = strings.coalesce(target.resource.product_object_id, principal.user.product_object_id, principal.resource.product_object_id)
$Log_Type = strings.coalesce(metadata.log_type, target.application)
match:
$Object_ID, $Log_Type
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
前 10 名遭封鎖的使用者
((metadata.log_type = /AZURE_KEYVAULT_AUDIT|GCP_CLOUDAUDIT/ nocase and (additional.fields["resultType"] = /Fail/ nocase or security_result.action = "BLOCK")) or
(target.application = "kms.amazonaws.com" and security_result.action = "BLOCK"))
$Event_Type = metadata.event_type
$User = strings.coalesce(principal.user.userid, principal.user.user_display_name, principal.user.email_addresses, principal.user.group_identifiers)
match:
$User, $Event_Type
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
啟用物件的前 10 名使用者
((((metadata.log_type = /AZURE_KEYVAULT_AUDIT/ nocase and (additional.fields["resultType"] = /Allow|Success/ nocase or security_result.action = "ALLOW")) or
(target.application = "kms.amazonaws.com" and security_result.action = "ALLOW")) and metadata.product_event_type = /Enable/ nocase) or
(metadata.log_type = /GCP_CLOUDAUDIT/ nocase and metadata.product_event_type = /UpdateCryptoKeyVersion|Enable/ nocase and metadata.product_event_type = /key|secret|certificate/ nocase and
target.resource.attribute.labels.value = /ENABLED/ nocase and security_result.action = "ALLOW"))
$User = strings.coalesce(principal.user.userid, principal.user.user_display_name, principal.user.email_addresses, principal.user.group_identifiers)
$Log_Type = strings.coalesce(metadata.log_type, target.application)
match:
$User, $Log_Type
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
最近建立的物件 (過去 24 小時)
((((metadata.log_type = /AZURE_KEYVAULT_AUDIT/ nocase and (additional.fields["resultType"] = /Allow|Success/ nocase or security_result.action = "ALLOW")) or
(target.application = "kms.amazonaws.com" and security_result.action = "ALLOW")) and metadata.product_event_type = /Create/ nocase) or
(metadata.log_type = /GCP_CLOUDAUDIT/ nocase and metadata.product_event_type = /Create/ nocase and metadata.product_event_type = /key|secret|certificate/ nocase and
metadata.product_event_type != /version/ nocase and security_result.action = "ALLOW"))
$Source_IP = strings.coalesce(principal.ip, principal.asset.ip)
$Security_Event_Type = metadata.product_event_type
$User = strings.coalesce(principal.user.userid, principal.user.user_display_name, principal.user.email_addresses, principal.user.group_identifiers)
$Object_ID = strings.coalesce(target.resource.product_object_id, principal.user.product_object_id, principal.resource.product_object_id)
$Log_Type = strings.coalesce(metadata.log_type, target.application)
$Location = principal.location.country_or_region
$Date = timestamp.get_timestamp(metadata.event_timestamp.seconds, "%F %T ")
match:
$Date , $Log_Type, $Object_ID, $Security_Event_Type, $User, $Source_IP, $Location
order:
$Date desc
已啟用物件的前 10 名
((((metadata.log_type = /AZURE_KEYVAULT_AUDIT/ nocase and (additional.fields["resultType"] = /Allow|Success/ nocase or security_result.action = "ALLOW")) or
(target.application = "kms.amazonaws.com" and security_result.action = "ALLOW")) and metadata.product_event_type = /Enable/ nocase) or
(metadata.log_type = /GCP_CLOUDAUDIT/ nocase and metadata.product_event_type = /UpdateCryptoKeyVersion|Enable/ nocase and metadata.product_event_type = /key|secret|certificate/ nocase and
target.resource.attribute.labels.value = /ENABLED/ nocase and security_result.action = "ALLOW"))
$Object_ID = strings.coalesce(target.resource.product_object_id, principal.user.product_object_id, principal.resource.product_object_id)
$Log_Type = strings.coalesce(metadata.log_type, target.application)
match:
$Object_ID, $Log_Type
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
前 10 大使用者代理程式
(metadata.log_type = /AZURE_KEYVAULT_AUDIT|GCP_CLOUDAUDIT/ nocase or target.application = "kms.amazonaws.com")
$User_Agent = network.http.user_agent
$Log_Type = strings.coalesce(metadata.log_type, target.application)
match:
$User_Agent, $Log_Type
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
建立物件的前 10 大來源 IP
((((metadata.log_type = /AZURE_KEYVAULT_AUDIT/ nocase and (additional.fields["resultType"] = /Allow|Success/ nocase or security_result.action = "ALLOW")) or
(target.application = "kms.amazonaws.com" and security_result.action = "ALLOW")) and metadata.product_event_type = /Create/ nocase) or
(metadata.log_type = /GCP_CLOUDAUDIT/ nocase and metadata.product_event_type = /Create/ nocase and metadata.product_event_type = /key|secret|certificate/ nocase and
metadata.product_event_type != /version/ nocase and security_result.action = "ALLOW"))
$Source_IP = strings.coalesce(principal.ip, principal.asset.ip)
$Log_Type = strings.coalesce(metadata.log_type, target.application)
match:
$Source_IP, $Log_Type
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
前 10 大物件位置
(metadata.log_type = /AZURE_KEYVAULT_AUDIT|GCP_CLOUDAUDIT/ nocase or target.application = "kms.amazonaws.com")
$Object_ID = strings.coalesce(target.resource.product_object_id, principal.user.product_object_id, principal.resource.product_object_id)
$Log_Type = strings.coalesce(metadata.log_type, target.application)
$Location = target.location.name
match:
$Location, $Log_Type
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
已啟用物件的變化趨勢
((((metadata.log_type = /AZURE_KEYVAULT_AUDIT/ nocase and (additional.fields["resultType"] = /Allow|Success/ nocase or security_result.action = "ALLOW")) or
(target.application = "kms.amazonaws.com" and security_result.action = "ALLOW")) and metadata.product_event_type = /Enable/ nocase) or
(metadata.log_type = /GCP_CLOUDAUDIT/ nocase and metadata.product_event_type = /UpdateCryptoKeyVersion|Enable/ nocase and metadata.product_event_type = /key|secret|certificate/ nocase and
target.resource.attribute.labels.value = /ENABLED/ nocase and security_result.action = "ALLOW"))
$Log_Type = strings.coalesce(metadata.log_type, target.application)
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
match:
$Log_Type, $Date
outcome:
$Count = count(metadata.id)
order:
$Date asc
前 10 個遭封鎖的來源 IP
((metadata.log_type = /AZURE_KEYVAULT_AUDIT|GCP_CLOUDAUDIT/ nocase and (additional.fields["resultType"] = /Fail/ nocase or security_result.action = "BLOCK")) or
(target.application = "kms.amazonaws.com" and security_result.action = "BLOCK"))
$Event_Type = metadata.event_type
$Source_IP = strings.coalesce(principal.ip, principal.asset.ip)
match:
$Source_IP, $Event_Type
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
地理位置建立的物件
((((metadata.log_type = /AZURE_KEYVAULT_AUDIT/ nocase and (additional.fields["resultType"] = /Allow|Success/ nocase or security_result.action = "ALLOW")) or
(target.application = "kms.amazonaws.com" and security_result.action = "ALLOW")) and metadata.product_event_type = /Create/ nocase) or
(metadata.log_type = /GCP_CLOUDAUDIT/ nocase and metadata.product_event_type = /Create/ nocase and metadata.product_event_type = /key|secret|certificate/ nocase and
metadata.product_event_type != /version/ nocase and security_result.action = "ALLOW"))
$Country = principal.ip_geo_artifact.location.country_or_region
$Country != ""
match:
$Country
outcome:
$Count = count(metadata.id)
$Latitude = max(principal.ip_geo_artifact.location.region_coordinates.latitude)
$Longitude = max(principal.ip_geo_artifact.location.region_coordinates.longitude)
order:
$Count desc
停用物件的前 10 名使用者
((((metadata.log_type = /AZURE_KEYVAULT_AUDIT/ nocase and (additional.fields["resultType"] = /Allow|Success/ nocase or security_result.action = "ALLOW")) or
(target.application = "kms.amazonaws.com" and security_result.action = "ALLOW")) and metadata.product_event_type = /Disable/ nocase) or
(metadata.log_type = /GCP_CLOUDAUDIT/ nocase and metadata.product_event_type = /UpdateCryptoKeyVersion|Disable/ nocase and metadata.product_event_type = /key|secret|certificate/ nocase and
target.resource.attribute.labels.value = /DISABLED/ nocase and security_result.action = "ALLOW"))
$User = strings.coalesce(principal.user.userid, principal.user.user_display_name, principal.user.email_addresses, principal.user.group_identifiers)
$Log_Type = strings.coalesce(metadata.log_type, target.application)
match:
$User, $Log_Type
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
停用物件的前 10 大來源 IP
((((metadata.log_type = /AZURE_KEYVAULT_AUDIT/ nocase and (additional.fields["resultType"] = /Allow|Success/ nocase or security_result.action = "ALLOW")) or
(target.application = "kms.amazonaws.com" and security_result.action = "ALLOW")) and metadata.product_event_type = /Disable/ nocase) or
(metadata.log_type = /GCP_CLOUDAUDIT/ nocase and metadata.product_event_type = /UpdateCryptoKeyVersion|Disable/ nocase and metadata.product_event_type = /key|secret|certificate/ nocase and
target.resource.attribute.labels.value = /DISABLED/ nocase and security_result.action = "ALLOW"))
$Source_IP = strings.coalesce(principal.ip, principal.asset.ip)
$Log_Type = strings.coalesce(metadata.log_type, target.application)
match:
$Source_IP, $Log_Type
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
最近刪除的物件(過去 24 小時)
((metadata.log_type = "AZURE_KEYVAULT_AUDIT" and additional.fields["resultType"] = /Allow|Success/ nocase) or
(target.application = "kms.amazonaws.com" and security_result.action = "ALLOW"))
metadata.product_event_type = /Delete/ nocase
$Source_IP = strings.coalesce(principal.ip, principal.asset.ip)
$Security_Event_Type = metadata.product_event_type
$User = strings.coalesce(principal.user.userid, principal.user.user_display_name, principal.user.email_addresses, principal.user.group_identifiers)
$Object_ID = strings.coalesce(target.resource.product_object_id, principal.user.product_object_id, principal.resource.product_object_id)
$Location = principal.location.country_or_region
$Log_Type = strings.coalesce(metadata.log_type, target.application)
$Date = timestamp.get_timestamp(metadata.event_timestamp.seconds, "%F %T ")
match:
$Date, $Log_Type, $Object_ID, $Security_Event_Type, $User, $Source_IP, $Location
order:
$Date desc
limit:
10
前 10 大來源 IP 位址 刪除物件
((((metadata.log_type = /AZURE_KEYVAULT_AUDIT/ nocase and (additional.fields["resultType"] = /Allow|Success/ nocase or security_result.action = "ALLOW")) or
(target.application = "kms.amazonaws.com" and security_result.action = "ALLOW")) and metadata.product_event_type = /Delete/ nocase) or
(metadata.log_type = /GCP_CLOUDAUDIT/ nocase and metadata.product_event_type = /Delete|Destroy/ nocase and metadata.product_event_type = /key|secret|certificate/ nocase
and security_result.action = "ALLOW"))
$Source_IP = strings.coalesce(principal.ip, principal.asset.ip)
$Log_Type = strings.coalesce(metadata.log_type, target.application)
match:
$Source_IP, $Log_Type
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
雲端安全防護機制總覽
這個資訊主頁會追蹤 Google Cloud、AWS 和 Azure 的重要指標，提供 Cloud Security 狀態洞察資料。
Cloud Storage 服務總覽
這個資訊主頁提供實用的雲端儲存空間活動洞察資料，例如建立、刪除、存取、更新的資源，以及權限變更。包括一段時間內事件和快訊的趨勢視覺化效果，以及重點使用者、IP 位址、使用者代理程式和資源位置。這項資訊有助於識別異常模式、監控快訊，以及在保護雲端環境的同時維持資料完整性。
存取資源的前 10 大來源 IP
依地理位置存取的資源
前 10 大使用者代理程式
更新資源的前 10 大來源 IP
存取次數最多的前 10 項資源
一段時間內刪除的資源
前 10 名遭封鎖的使用者
最近建立的資源 (過去 24 小時)
一段時間內存取的資源
變更資源權限的前 10 大來源 IP
最近刪除的資源 (過去 24 小時)
前 10 個遭封鎖的來源 IP
歷來事件
前 10 大資源位置
刪除資源的前 10 大來源 IP
資源權限隨時間變更
建立資源的前 10 大來源 IP
存取資源的前 10 名使用者
權限變更次數前 10 名的資源
更新資源的前 10 名使用者
變更資源權限的前 10 位使用者
一段時間內建立的資源
更新前 10 項資源
刪除資源的前 10 名使用者
建立資源的前 10 名使用者
隨時間更新的資源
公開共用的 bucket
圖表名稱
查詢示例
存取資源的前 10 大來源 IP
(
(metadata.log_type = /(AWS_CLOUDTRAIL|GCP_CLOUDAUDIT)/ nocase
and metadata.event_type = "RESOURCE_READ"
and metadata.product_event_type = /(storage|bucket)/ nocase)
or
(metadata.log_type = /AZURE/ nocase
and metadata.product_event_type = /microsoft\.storage\/storageaccounts\/read/ nocase)
)
security_result.action = "ALLOW"
$Log_Type = metadata.log_type
$IP_Address = principal.ip
match:
$Log_Type, $IP_Address
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
依地理位置存取的資源
(
(metadata.log_type = /(AWS_CLOUDTRAIL|GCP_CLOUDAUDIT)/ nocase
and metadata.event_type = "RESOURCE_READ"
and metadata.product_event_type = /(storage|bucket)/ nocase)
or
(metadata.log_type = /AZURE/ nocase
and metadata.product_event_type = /microsoft\.storage\/storageaccounts\/read/ nocase)
)
security_result.action = "ALLOW"
$Country = principal.location.country_or_region
$Country != ""
$Latitude = principal.location.region_coordinates.latitude
$Longitude = principal.location.region_coordinates.longitude
match:
$Country, $Latitude, $Longitude
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
前 10 大使用者代理程式
(metadata.log_type = /AWS_CLOUDTRAIL|GCP_CLOUDAUDIT/ nocase
and metadata.product_event_type = /storage|bucket/ nocase
and (metadata.event_type = "RESOURCE_CREATION"
or metadata.event_type = "RESOURCE_DELETION"
or metadata.event_type = "RESOURCE_PERMISSIONS_CHANGE"
or metadata.event_type = "RESOURCE_READ"
or metadata.event_type = "RESOURCE_WRITTEN"))
or
(metadata.log_type = /AZURE/ nocase
and metadata.product_event_type = /microsoft\.storage\/storageaccounts\/(?:write|delete|read)/ nocase)
network.http.user_agent != ""
$Log_Type = metadata.log_type
$User_Agent = network.http.user_agent
match:
$Log_Type, $User_Agent
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
更新資源的前 10 大來源 IP
(
(metadata.log_type = /(AWS_CLOUDTRAIL|GCP_CLOUDAUDIT)/ nocase
and metadata.event_type = "RESOURCE_WRITTEN"
and metadata.product_event_type = /(storage|bucket)/ nocase)
or
(metadata.log_type = /AZURE/ nocase
and metadata.product_event_type = /microsoft\.storage\/storageaccounts\/(?:write|.*\/write)?/ nocase)
)
security_result.action = "ALLOW"
$Log_Type = metadata.log_type
$IP_Address = principal.ip
match:
$Log_Type, $IP_Address
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
存取次數最多的前 10 項資源
(
(metadata.log_type = /(AWS_CLOUDTRAIL|GCP_CLOUDAUDIT)/ nocase
and metadata.event_type = "RESOURCE_READ"
and metadata.product_event_type = /(storage|bucket)/ nocase)
or
(metadata.log_type = /AZURE/ nocase
and metadata.product_event_type = /microsoft\.storage\/storageaccounts\/(?:write|.*\/write)?/ nocase)
)
security_result.action = "ALLOW"
$Log_Type = metadata.log_type
$Resource_Name = target.resource.name
match:
$Log_Type, $Resource_Name
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
一段時間內刪除的資源
(
(metadata.log_type = /(AWS_CLOUDTRAIL|GCP_CLOUDAUDIT)/ nocase
and metadata.event_type = "RESOURCE_DELETION"
and metadata.product_event_type = /(storage|bucket)/ nocase)
or
(metadata.log_type = /AZURE/ nocase
and metadata.product_event_type = /microsoft\.storage\/storageaccounts\/delete/ nocase)
)
security_result.action = "ALLOW"
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
$Log_Type = metadata.log_type
match:
$Date, $Log_Type
outcome:
$Count = count(metadata.id)
前 10 名遭封鎖的使用者
(metadata.log_type = /AWS_CLOUDTRAIL|GCP_CLOUDAUDIT/ nocase
and metadata.product_event_type = /storage|bucket/ nocase
and (metadata.event_type = "RESOURCE_CREATION"
or metadata.event_type = "RESOURCE_DELETION"
or metadata.event_type = "RESOURCE_PERMISSIONS_CHANGE"
or metadata.event_type = "RESOURCE_READ"
or metadata.event_type = "RESOURCE_WRITTEN"))
or
(metadata.log_type = /AZURE/ nocase
and metadata.product_event_type = /microsoft\.storage\/storageaccounts\/(?:write|delete|read)/ nocase)
security_result.action = "BLOCK"
$Event_Type = metadata.event_type
$User = principal.user.userid
match:
$Event_Type, $User
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
最近建立的資源 (過去 24 小時)
(
(metadata.log_type = /AWS_CLOUDTRAIL|GCP_CLOUDAUDIT/ nocase
and metadata.event_type = "RESOURCE_CREATION"
and metadata.product_event_type = /storage|bucket/ nocase)
or
(metadata.log_type = /AZURE/ nocase
and metadata.product_event_type = /microsoft\.storage\/storageaccounts\/write/ nocase)
)
security_result.action = "ALLOW"
$Log_Type = metadata.log_type
$IP_Address = principal.ip
$User = principal.user.userid
$Resource_Name = target.resource.name
$Location = principal.location.country_or_region
$Date = timestamp.get_timestamp(metadata.event_timestamp.seconds, "%F %T ")
match:
$Date, $Log_Type, $IP_Address, $User, $Location, $Resource_Name
order:
$Date desc
一段時間內存取的資源
(
(metadata.log_type = /(AWS_CLOUDTRAIL|GCP_CLOUDAUDIT)/ nocase
and metadata.event_type = "RESOURCE_READ"
and metadata.product_event_type = /(storage|bucket)/ nocase)
or
(metadata.log_type = /AZURE/ nocase
and metadata.product_event_type = /microsoft\.storage\/storageaccounts\/read/ nocase)
)
security_result.action = "ALLOW"
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
$Log_Type = metadata.log_type
match:
$Date, $Log_Type
outcome:
$Count = count(metadata.id)
變更資源權限的前 10 大來源 IP
(
(metadata.log_type = /AWS_CLOUDTRAIL|GCP_CLOUDAUDIT/ nocase
and metadata.event_type = "RESOURCE_PERMISSIONS_CHANGE"
and metadata.product_event_type = /storage|bucket/ nocase)
or
(metadata.log_type = /AZURE/ nocase
and metadata.product_event_type = /microsoft\.authorization\/(?:policyassignments|roledefinitions)?\/write/ nocase
and target.resource.resource_type = "STORAGE_BUCKET")
)
security_result.action = "ALLOW"
$Log_Type = metadata.log_type
$IP_Address = principal.ip
match:
$Log_Type, $IP_Address
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
最近刪除的資源 (過去 24 小時)
(
(metadata.log_type = /(AWS_CLOUDTRAIL|GCP_CLOUDAUDIT)/ nocase
and metadata.event_type = "RESOURCE_DELETION"
and metadata.product_event_type = /(storage|bucket)/ nocase)
or
(metadata.log_type = /AZURE/ nocase
and metadata.product_event_type = /microsoft\.storage\/storageaccounts\/delete/ nocase)
)
security_result.action = "ALLOW"
$Log_Type = metadata.log_type
$IP_Address = principal.ip
$User = principal.user.userid
$Resource_Name = target.resource.name
$Location = principal.location.country_or_region
$Date = timestamp.get_timestamp(metadata.event_timestamp.seconds, "%F %T ")
match:
$Date, $Log_Type, $IP_Address, $User, $Location, $Resource_Name
order:
$Date desc
前 10 個遭封鎖的來源 IP
(metadata.log_type = /AWS_CLOUDTRAIL|GCP_CLOUDAUDIT/ nocase
and metadata.product_event_type = /storage|bucket/ nocase
and (metadata.event_type = "RESOURCE_CREATION"
or metadata.event_type = "RESOURCE_DELETION"
or metadata.event_type = "RESOURCE_PERMISSIONS_CHANGE"
or metadata.event_type = "RESOURCE_READ"
or metadata.event_type = "RESOURCE_WRITTEN"))
or
(metadata.log_type = /AZURE/ nocase
and metadata.product_event_type = /microsoft\.storage\/storageaccounts\/(?:write|delete|read)/ nocase)
security_result.action = "BLOCK"
$Event_Type = metadata.event_type
$IP_Address = principal.ip
match:
$Event_Type, $IP_Address
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
歷來事件
(metadata.log_type = /AWS_CLOUDTRAIL|GCP_CLOUDAUDIT/ nocase
and metadata.product_event_type = /storage|bucket/ nocase
and (metadata.event_type = "RESOURCE_CREATION"
or metadata.event_type = "RESOURCE_DELETION"
or metadata.event_type = "RESOURCE_PERMISSIONS_CHANGE"
or metadata.event_type = "RESOURCE_READ"
or metadata.event_type = "RESOURCE_WRITTEN"))
or
(metadata.log_type = /AZURE/ nocase
and metadata.product_event_type = /microsoft\.storage\/storageaccounts\/(?:write|delete|read)/ nocase)
$Log_Type = metadata.log_type
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
match:
$Log_Type, $Date
outcome:
$Count = count(metadata.id)
前 10 大資源位置
(metadata.log_type = /AWS_CLOUDTRAIL|GCP_CLOUDAUDIT/ nocase
and metadata.product_event_type = /storage|bucket/ nocase
and (metadata.event_type = "RESOURCE_CREATION"
or metadata.event_type = "RESOURCE_DELETION"
or metadata.event_type = "RESOURCE_PERMISSIONS_CHANGE"
or metadata.event_type = "RESOURCE_READ"
or metadata.event_type = "RESOURCE_WRITTEN"))
or
(metadata.log_type = /AZURE/ nocase
and metadata.product_event_type = /microsoft\.storage[\/\.]storageaccounts[\/\.](?:write|delete|read)/ nocase)
target.location.name != ""
security_result.action = "ALLOW"
$Location = target.location.name
$Log_Type = metadata.log_type
match:
$Location, $Log_Type
outcome:
$Count = count_distinct(metadata.id)
order:
$Count desc
limit:
10
刪除資源的前 10 大來源 IP
(
(metadata.log_type = /(AWS_CLOUDTRAIL|GCP_CLOUDAUDIT)/ nocase
and metadata.event_type = "RESOURCE_DELETION"
and metadata.product_event_type = /(storage|bucket)/ nocase)
or
(metadata.log_type = /AZURE/ nocase
and metadata.product_event_type = /microsoft\.storage\/storageaccounts\/delete/ nocase)
)
security_result.action = "ALLOW"
$Log_Type = metadata.log_type
$IP_Address = principal.ip
match:
$Log_Type, $IP_Address
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
資源權限隨時間變更
(
(metadata.log_type = /AWS_CLOUDTRAIL|GCP_CLOUDAUDIT/ nocase
and metadata.event_type = "RESOURCE_PERMISSIONS_CHANGE"
and metadata.product_event_type = /storage|bucket/ nocase)
or
(metadata.log_type = /AZURE/ nocase
and metadata.product_event_type = /microsoft\.authorization\/(?:policyassignments|roledefinitions)?\/write/ nocase
and target.resource.resource_type = "STORAGE_BUCKET")
)
security_result.action = "ALLOW"
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
$Log_Type = metadata.log_type
match:
$Date, $Log_Type
outcome:
$Count = count(metadata.id)
建立資源的前 10 大來源 IP
(
(metadata.log_type = /AWS_CLOUDTRAIL|GCP_CLOUDAUDIT/ nocase
and metadata.event_type = "RESOURCE_CREATION"
and metadata.product_event_type = /storage|bucket/ nocase)
or
(metadata.log_type = /AZURE/ nocase
and metadata.product_event_type = /microsoft\.storage\/storageaccounts\/write/ nocase)
)
security_result.action = "ALLOW"
$Log_Type = metadata.log_type
$IP_Address = principal.ip
match:
$Log_Type, $IP_Address
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
存取資源的前 10 名使用者
(
(metadata.log_type = /(AWS_CLOUDTRAIL|GCP_CLOUDAUDIT)/ nocase
and metadata.event_type = "RESOURCE_READ"
and metadata.product_event_type = /(storage|bucket)/ nocase)
or
(metadata.log_type = /AZURE/ nocase
and metadata.product_event_type = /microsoft\.storage\/storageaccounts\/read/ nocase)
)
security_result.action = "ALLOW"
$Log_Type = metadata.log_type
$User = principal.user.userid
match:
$Log_Type, $User
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
權限變更次數前 10 名的資源
(
(metadata.log_type = /AWS_CLOUDTRAIL|GCP_CLOUDAUDIT/ nocase
and metadata.event_type = "RESOURCE_PERMISSIONS_CHANGE"
and metadata.product_event_type = /storage|bucket/ nocase)
or
(metadata.log_type = /AZURE/ nocase
and metadata.product_event_type = /microsoft\.authorization\/(?:policyassignments|roledefinitions)?\/write/ nocase
and target.resource.resource_type = "STORAGE_BUCKET")
)
security_result.action = "ALLOW"
$Log_Type = metadata.log_type
$Resource_Name = target.resource.name
match:
$Log_Type, $Resource_Name
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
更新資源的前 10 名使用者
(
(metadata.log_type = /(AWS_CLOUDTRAIL|GCP_CLOUDAUDIT)/ nocase
and metadata.event_type = "RESOURCE_WRITTEN"
and metadata.product_event_type = /(storage|bucket)/ nocase)
or
(metadata.log_type = /AZURE/ nocase
and metadata.product_event_type = /microsoft\.storage\/storageaccounts\/(?:write|.*\/write)?/ nocase)
)
security_result.action = "ALLOW"
$Log_Type = metadata.log_type
$User = principal.user.userid
match:
$Log_Type, $User
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
變更資源權限的前 10 位使用者
(
(metadata.log_type = /AWS_CLOUDTRAIL|GCP_CLOUDAUDIT/ nocase
and metadata.event_type = "RESOURCE_PERMISSIONS_CHANGE"
and metadata.product_event_type = /storage|bucket/ nocase)
or
(metadata.log_type = /AZURE/ nocase
and metadata.product_event_type = /microsoft\.authorization\/(?:policyassignments|roledefinitions)?\/write/ nocase
and target.resource.resource_type = "STORAGE_BUCKET")
)
security_result.action = "ALLOW"
$Log_Type = metadata.log_type
$User = principal.user.userid
match:
$Log_Type, $User
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
一段時間內建立的資源
(
(metadata.log_type = /AWS_CLOUDTRAIL|GCP_CLOUDAUDIT/ nocase
and metadata.event_type = "RESOURCE_CREATION"
and metadata.product_event_type = /storage|bucket/ nocase)
or
(metadata.log_type = /AZURE/ nocase
and metadata.product_event_type = /microsoft\.storage\/storageaccounts\/write/ nocase)
)
security_result.action = "ALLOW"
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
$Log_Type = metadata.log_type
match:
$Date, $Log_Type
outcome:
$Count = count(metadata.id)
更新前 10 項資源
(
(metadata.log_type = /(AWS_CLOUDTRAIL|GCP_CLOUDAUDIT)/ nocase
and metadata.event_type = "RESOURCE_WRITTEN"
and metadata.product_event_type = /(storage|bucket)/ nocase)
or
(metadata.log_type = /AZURE/ nocase
and metadata.product_event_type = /microsoft\.storage\/storageaccounts\/(?:write|.*\/write)?/ nocase)
)
security_result.action = "ALLOW"
$Log_Type = metadata.log_type
$Resource_Name = target.resource.name
match:
$Log_Type, $Resource_Name
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
刪除資源的前 10 名使用者
(
(metadata.log_type = /(AWS_CLOUDTRAIL|GCP_CLOUDAUDIT)/ nocase
and metadata.event_type = "RESOURCE_DELETION"
and metadata.product_event_type = /(storage|bucket)/ nocase)
or
(metadata.log_type = /AZURE/ nocase
and metadata.product_event_type = /microsoft\.storage\/storageaccounts\/delete/ nocase)
)
security_result.action = "ALLOW"
$Log_Type = metadata.log_type
$User = principal.user.userid
match:
$Log_Type, $User
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
建立資源的前 10 名使用者
(
(metadata.log_type = /AWS_CLOUDTRAIL|GCP_CLOUDAUDIT/ nocase
and metadata.event_type = "RESOURCE_CREATION"
and metadata.product_event_type = /storage|bucket/ nocase)
or
(metadata.log_type = /AZURE/ nocase
and metadata.product_event_type = /microsoft\.storage\/storageaccounts\/write/ nocase)
)
security_result.action = "ALLOW"
$Log_Type = metadata.log_type
$User = principal.user.userid
match:
$Log_Type, $User
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
隨時間更新的資源
(
(metadata.log_type = /(AWS_CLOUDTRAIL|GCP_CLOUDAUDIT)/ nocase
and metadata.event_type = "RESOURCE_WRITTEN"
and metadata.product_event_type = /(storage|bucket)/ nocase)
or
(metadata.log_type = /AZURE/ nocase
and metadata.product_event_type = /microsoft\.storage\/storageaccounts\/(?:write|.*\/write)?/ nocase)
)
security_result.action = "ALLOW"
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
$Log_Type = metadata.log_type
match:
$Date, $Log_Type
outcome:
$Count = count(metadata.id)
公開共用的 bucket
(metadata.log_type = "AZURE_ACTIVITY"
and metadata.product_event_type = "Microsoft.Storage/storageAccounts/write" nocase
and security_result.detection_fields["allowBlobPublicAccess"] = "true")
or
(metadata.log_type = "GCP_CLOUDAUDIT"
and metadata.product_event_type = "storage.setIamPermissions"
and target.application = "storage.googleapis.com"
and security_result.action = "ALLOW"
and target.resource.attribute.labels["ser_binding_deltas_action"] = "ADD"
and target.resource.attribute.labels["ser_binding_deltas_role"] = /roles\/storage.*/
and target.resource.attribute.labels["ser_binding_deltas_member"] = /allUsers|allAuthenticatedUsers/
and target.resource.resource_type = "STORAGE_BUCKET"
)
or
(metadata.log_type = "AWS_CLOUDTRAIL"
and metadata.ingestion_labels["EventSource"] = "s3.amazonaws.com" nocase
and metadata.product_event_type = /PutBucketPublicAccessBlock/ nocase
and (target.resource.attribute.labels["BlockPublicAcls"] = "false"
or target.resource.attribute.labels["BlockPublicPolicy"] = "false"
or target.resource.attribute.labels["IgnorePublicAcls"] = "false"
or target.resource.attribute.labels["RestrictPublicBuckets"] = "false")
)
$Date = timestamp.get_timestamp(metadata.event_timestamp.seconds, "%F %T ")
$Log_Type = metadata.log_type
$User = principal.user.userid
$Resource_Name = target.resource.name
match:
$Date, $Log_Type, $User, $Resource_Name
DDoS 總覽
這個資訊主頁會全面分析分散式阻斷服務 (DDoS) 活動，深入瞭解攻擊趨勢、模式和行為。有助於找出網路中的威脅向量和高風險區域，讓資安團隊有效偵測、應對及減輕 DDoS 攻擊。
前 10 大供應商快訊
依動作列出的前 10 大來源 IP
依事件類型劃分的事件
依記錄類型劃分的供應商警告趨勢
依記錄類型顯示的歷來事件
依說明顯示事件
來源地理位置總覽
圖表名稱
查詢示例
前 10 大供應商快訊
(metadata.log_type = /ddos/ nocase or (security_result.description = /ddos/ nocase or security_result.summary = /ddos/ nocase or metadata.description = /ddos/ nocase))
$Rule_Name = security_result.rule_name
$Rule_Name != ""
$Log_Type = metadata.log_type
$Action = security_result.action
match:
$Rule_Name, $Log_Type, $Action
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
依動作列出的前 10 大來源 IP
(metadata.log_type = /ddos/ nocase or (security_result.description = /ddos/ nocase or security_result.summary = /ddos/ nocase or metadata.description = /ddos/ nocase))
$Source_Ip = strings.coalesce(principal.ip, principal.asset.ip)
$Action = security_result.action
match:
$Source_Ip, $Action
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
依事件類型劃分的事件
(metadata.log_type = /ddos/ nocase or (security_result.description = /ddos/ nocase or security_result.summary = /ddos/ nocase or metadata.description = /ddos/ nocase))
$Event_Type = metadata.event_type
match:
$Event_Type
outcome:
$Count = count(metadata.id)
order:
$Count desc
依記錄類型劃分的供應商警告趨勢
(metadata.log_type = /ddos/ nocase or (security_result.description = /ddos/ nocase or security_result.summary = /ddos/ nocase or metadata.description = /ddos/ nocase))
security_result.rule_name != ""
$Log_Type = metadata.log_type
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
match:
$Date, $Log_Type
outcome:
$Count = count(metadata.id)
order:
$Date asc
依記錄類型顯示的歷來事件
(metadata.log_type = /ddos/ nocase or (security_result.description = /ddos/ nocase or security_result.summary = /ddos/ nocase or metadata.description = /ddos/ nocase))
$Log_Type = metadata.log_type
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
match:
$Date, $Log_Type
outcome:
$Count = count(metadata.id)
order:
$Date asc
依說明顯示事件
(metadata.log_type = /ddos/ nocase or (security_result.description = /ddos/ nocase or security_result.summary = /ddos/ nocase or metadata.description = /ddos/ nocase))
$Description = strings.coalesce(metadata.description,security_result.summary,security_result.description)
$Log_Type = metadata.log_type
$Source_IP = strings.coalesce(principal.ip, principal.asset.ip)
$Destination_IP = strings.coalesce(target.ip, target.asset.ip)
$Action = security_result.action
$Destination_Hostname = strings.coalesce(target.hostname, target.asset.hostname)
$File = principal.process.file.full_path
match:
$Description, $Source_IP, $Destination_IP, $Destination_Hostname, $Action, $Log_Type
outcome:
$Count = count(metadata.id)
$Date = timestamp.get_timestamp(max(metadata.event_timestamp.seconds), "%F %T")
order:
$Count desc
來源地理位置總覽
(metadata.log_type = /ddos/ nocase or (security_result.description = /ddos/ nocase or security_result.summary = /ddos/ nocase or metadata.description = /ddos/ nocase))
$Country = principal.ip_geo_artifact.location.country_or_region
$Country !=""
match:
$Country
outcome:
$Count = count(metadata.id)
$Latitude = max(principal.ip_geo_artifact.location.region_latitude)
$Longitude = max(principal.ip_geo_artifact.location.region_longitude)
order:
$Count desc
DNS 監控
這個資訊主頁會詳細顯示 DNS 活動和網路健康狀態，包括 DNS 事件、查詢趨勢，以及允許和封鎖的查詢分布情形。透過異常狀況、位置和 DNS 失敗的視覺化呈現方式，有效率地監控、偵測威脅及排解問題。
注意： 套用可用篩選器，即可修正資料並顯示相關結果。
前 10 大允許的 DNS 查詢
排名前 10 的 DNS 允許類別
DNS 事件總數
檢舉主辦人
前 10 大 DNS 問題
依記錄類型劃分的 DNS 事件總數
排名前 10 的 DNS 封鎖類別
一段時間內的成功 DNS 回應
常見的 DNS 活動
前 10 大遭封鎖的 DNS 查詢
依動作分類的 DNS 查詢：允許與封鎖
一段時間內的 DNS 事件 (按記錄類型劃分)
DNS 記錄類型細目
DNS 回應失敗次數 (隨時間變化)
前 10 大來源 IP
隨時間變化的 DNS 記錄類型
一段時間內的 DNS 事件記錄總量
依記錄類型進行 DNS 查詢
回報主辦人總數
隨時間變化的 DNS 查詢
前 10 大 DNS 查詢 (依位置)
圖表名稱
查詢示例
前 10 大允許的 DNS 查詢
metadata.event_type = "NETWORK_DNS"
network.dns.questions.name != ""
security_result.action = "ALLOW"
$Log_Type = metadata.log_type
$DNS_Questions_Name = network.dns.questions.name
match:
$DNS_Questions_Name, $Log_Type
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
排名前 10 的 DNS 允許類別
metadata.event_type = "NETWORK_DNS"
security_result.action = "ALLOW"
security_result.category_details != ""
$Log_Type = metadata.log_type
$Category = security_result.category_details
match:
$Category, $Log_Type
outcome:
$Count = count($Category)
order:
$Count desc
limit:
10
DNS 事件總數
metadata.event_type = "NETWORK_DNS"
outcome:
$Count = count(metadata.id)
檢舉主辦人
metadata.event_type = "NETWORK_DNS"
$Hostname = principal.hostname
match:
$Hostname
前 10 大 DNS 問題
$event.metadata.log_type = /EXTRAHOP_DNS|UMBRELLA_DNS/ nocase
$event.metadata.event_type = "NETWORK_DNS"
$Questions_Name = $event.network.dns.questions.name
match:
$Questions_Name
outcome:
$Count = count($event.metadata.id)
order:
$Count desc
limit:
10
DNS 事件總數
$event.metadata.log_type = /EXTRAHOP_DNS|UMBRELLA_DNS/ nocase
$event.metadata.event_type = "NETWORK_DNS"
outcome:
$Count = count($event.metadata.id)
依記錄類型劃分的 DNS 事件總數
$event.metadata.log_type = /EXTRAHOP_DNS|UMBRELLA_DNS/ nocase
$event.metadata.event_type = "NETWORK_DNS"
$Log_Type = $event.metadata.log_type
$Event_Type = $event.metadata.event_type
match:
$Log_Type, $Event_Type
outcome:
$Count = count($event.metadata.id)
order:
$Count asc
排名前 10 的 DNS 封鎖類別
metadata.event_type = "NETWORK_DNS"
security_result.action = "BLOCK"
security_result.category_details != ""
$Log_Type = metadata.log_type
$Category = security_result.category_details
match:
$Category, $Log_Type
outcome:
$Count = count($Category)
order:
$Count desc
limit:
10
一段時間內的成功 DNS 回應
$event.metadata.log_type = /EXTRAHOP_DNS|UMBRELLA_DNS/ nocase
$event.metadata.event_type = "NETWORK_DNS"
$event.network.dns.response = true
$event.network.application_protocol = "DNS"
$Answered = $event.network.dns.response
$Date = timestamp.get_date($event.metadata.event_timestamp.seconds)
match:
$Date, $Answered
outcome:
$Count = count($event.metadata.id)
order:
$Date asc
常見的 DNS 活動
metadata.event_type = "NETWORK_DNS"
$Log_Type = metadata.log_type
$Source_IP = principal.ip
$Description = strings.coalesce(metadata.description, security_result.summary)
$DNS_Questions_Name = network.dns.questions.name
match:
$Source_IP, $Log_Type, $Description, $DNS_Questions_Name
outcome:
$Count = count(metadata.id)
order:
$Count desc
前 10 大遭封鎖的 DNS 查詢
metadata.event_type = "NETWORK_DNS"
network.dns.questions.name != ""
security_result.action = "BLOCK"
$Log_Type = metadata.log_type
$DNS_Questions_Name = network.dns.questions.name
match:
$DNS_Questions_Name, $Log_Type
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
依動作分類的 DNS 查詢：允許與封鎖
metadata.event_type = "NETWORK_DNS"
network.dns.questions.name != ""
security_result.action = "ALLOW"
or security_result.action = "BLOCK"
$Action = security_result.action
match:
$Action
outcome:
$Count = count(metadata.id)
order:
$Count desc
一段時間內的 DNS 事件 (按記錄類型劃分)
metadata.event_type = "NETWORK_DNS"
$Log_Type = metadata.log_type
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
match:
$Date, $Log_Type
outcome:
$Count = count(metadata.id)
order:
$Date desc
DNS 記錄類型細目
$event.metadata.log_type = /EXTRAHOP_DNS|UMBRELLA_DNS/ nocase
$event.metadata.event_type = "NETWORK_DNS"
$Log_Type = $event.metadata.log_type
$Event_Type = $event.metadata.event_type
$DNS_Record_Type = $event.additional.fields["dns_record_type"]
$DNS_Record_Type != ""
$Return_Message = $event.additional.fields["dns_return_message"]
$Date = timestamp.get_timestamp($event.metadata.event_timestamp.seconds)
$Description = $event.metadata.description
match:
$Date, $Log_Type, $DNS_Record_Type, $Description, $Return_Message
order:
$Date desc
limit:
50
DNS 回應失敗次數 (隨時間變化)
metadata.event_type = "NETWORK_DNS"
network.dns.response_code = 3
or network.dns.response_code = 5
$Denied = strings.concat(network.dns.response_code, " ")
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
match:
$Denied, $Date
outcome:
$Count = count(metadata.id)
order:
$Date desc
前 10 大來源 IP
$event.metadata.log_type = /EXTRAHOP_DNS|UMBRELLA_DNS/ nocase
$event.metadata.event_type = "NETWORK_DNS"
$Log_Type = $event.metadata.log_type
$Event_Type = $event.metadata.event_type
$Source_IP = $event.principal.ip
$Source_IP != ""
match:
$Source_IP, $Event_Type, $Log_Type
outcome:
$Count = count($event.metadata.id)
order:
$Count desc
limit:
10
隨時間變化的 DNS 記錄類型
$event.metadata.log_type = /EXTRAHOP_DNS|UMBRELLA_DNS/ nocase
$event.metadata.event_type = "NETWORK_DNS"
$Record_Types = $event.additional.fields["dns_record_type"]
$Date = timestamp.get_date($event.metadata.event_timestamp.seconds)
match:
$Record_Types, $Date
outcome:
$Count = count($event.metadata.id)
order:
$Date asc
依記錄類型劃分的 DNS 事件總數
metadata.event_type = "NETWORK_DNS"
$Log_Type = metadata.log_type
match:
$Log_Type
outcome:
$Count = count(metadata.id)
order:
$Count desc
一段時間內的 DNS 事件記錄總量
$event.metadata.log_type = /EXTRAHOP_DNS|UMBRELLA_DNS/ nocase
$event.metadata.event_type = "NETWORK_DNS"
$Log_Type = $event.metadata.log_type
$Date = timestamp.get_date($event.metadata.event_timestamp.seconds)
match:
$Date, $Log_Type
outcome:
$Count = count($event.metadata.id)
order:
$Date asc
DNS 回應失敗次數 (隨時間變化)
$event.metadata.log_type = /EXTRAHOP_DNS|UMBRELLA_DNS/ nocase
$event.network.dns.response_code = 3
or $event.network.dns.response_code = 5
$event.metadata.event_type = "NETWORK_DNS"
$Denied = $event.network.dns.response_code
$Date = timestamp.get_date($event.metadata.event_timestamp.seconds)
match:
$Denied, $Date
outcome:
$Count = count($event.metadata.id)
order:
$Date asc
DNS 記錄類型細目
metadata.event_type = "NETWORK_DNS"
$Log_Type = metadata.log_type
$Event_Type = metadata.event_type
$Source_IP = principal.ip
$Hostname = principal.hostname
$DNS_Record_Type = strings.coalesce(additional.fields["dns_record_type"], extracted.fields["query_type"], extracted.fields["qtype_name"])
$Return_Message = additional.fields["dns_return_message"]
$Date = timestamp.get_timestamp(metadata.event_timestamp.seconds)
$Description = strings.coalesce(metadata.description, security_result.summary)
match:
$Date, $Log_Type, $Source_IP, $Hostname, $DNS_Record_Type, $Description, $Return_Message
order:
$Date desc
前 10 大來源 IP
metadata.event_type = "NETWORK_DNS"
$Log_Type = metadata.log_type
$Source_IP = principal.ip
match:
$Source_IP, $Log_Type
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
依記錄類型進行 DNS 查詢
metadata.event_type = "NETWORK_DNS"
network.dns.questions.name != ""
$Record_Types = strings.coalesce(additional.fields["dns_record_type"], extracted.fields["query_type"], extracted.fields["qtype_name"])
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
match:
$Date, $Record_Types
outcome:
$Count = count(metadata.id)
order:
$Date desc
回報主辦人總數
metadata.event_type = "NETWORK_DNS"
outcome:
$Count = count_distinct(principal.hostname)
隨時間變化的 DNS 查詢
metadata.event_type = "NETWORK_DNS"
network.dns.questions.name != ""
$Log_Type = metadata.log_type
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
match:
$Date, $Log_Type
outcome:
$Count = count(network.dns.questions.name)
order:
$Date desc
一段時間內的成功 DNS 回應
metadata.event_type = "NETWORK_DNS"
network.dns.response = true
$Answered = network.dns.response
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
match:
$Date, $Answered
outcome:
$Count = count(metadata.id)
order:
$Date desc
常見的 DNS 活動
$event.metadata.log_type = /EXTRAHOP_DNS|UMBRELLA_DNS/ nocase
$event.metadata.event_type = "NETWORK_DNS"
$Log_Type = $event.metadata.log_type
$Source_IP = $event.principal.ip
$Description = $event.metadata.description
$DQ_Name = $event.network.dns.questions.name
match:
$Source_IP, $Description, $DQ_Name
outcome:
$Count = count($event.metadata.id)
order:
$Count desc
limit:
50
前 10 大 DNS 查詢 (依位置)
metadata.event_type = "NETWORK_DNS"
network.dns.questions.name != ""
$Questions_Name = network.dns.questions.name
$Country = principal.ip_geo_artifact.location.country_or_region
$Latitude = principal.ip_geo_artifact.location.region_latitude
$Longitude = principal.ip_geo_artifact.location.region_longitude
match:
$Questions_Name, $Country, $Latitude, $Longitude
outcome:
$Count = count(metadata.id)
limit:
10
資料擷取與健康狀態
這個資訊主頁提供資料流程的重要洞察資訊，顯示擷取的事件和錯誤計數，讓您清楚掌握潛在問題。包括記錄類型分布和擷取事件狀態的視覺化資料，以及最近的擷取活動和每日記錄資訊。透過追蹤不同時間範圍的擷取處理量，這個資訊主頁有助於找出趨勢和問題，提升貴機構管理資料擷取作業的能力，並維持順暢的運作。
Bindplane 代理程式記錄 - 記錄 (依嚴重性分組，隨時間變化)
主辦方回報活動後經過的天數 (過去 7 天)
Bindplane 代理程式記錄 - 訊息數量
圖表名稱
查詢示例
Bindplane 代理程式記錄 - 記錄 (依嚴重性分組，隨時間變化)
metadata.log_type = "BINDPLANE_AGENT"
metadata.ingestion_labels.key = "ingestion_source"
metadata.ingestion_labels.value = $agent
metadata.description = $message
security_result.severity = $severity
timestamp.get_timestamp(metadata.event_timestamp.seconds) = $timestamp
match:
$severity, $timestamp
outcome:
$total = count(metadata.id)
order :
$severity
主辦方回報活動後經過的天數 (過去 7 天)
$host = principal.hostname
$event_time = metadata.event_timestamp.seconds
match:
$host
outcome:
$last_seen_timestamp = timestamp.get_timestamp(max($event_time))
$days_since_last_seen = math.round((timestamp.current_seconds() - max($event_time)) / 86400, 0)
order:
$days_since_last_seen desc
Bindplane 代理程式記錄 - 訊息數量
metadata.log_type = "BINDPLANE_AGENT"
metadata.ingestion_labels.key = "ingestion_source"
metadata.ingestion_labels.value = $agent
metadata.description = $message
security_result.severity = $severity
match:
$severity, $message
outcome:
$total = count(metadata.id)
$first_seen = timestamp.get_timestamp(min(metadata.event_timestamp.seconds))
$last_seen = timestamp.get_timestamp(max(metadata.event_timestamp.seconds))
資料遺失防護 (DLP)
這個資訊主頁會顯示與 DLP 事件相關的重要指標。
前 10 位使用者
嘗試存取機密資料
一段時間內的資料遺失防護事件趨勢
依動作顯示事件
依嚴重性分類的資料遺失防護違規事項
前 10 大資料遺失防護政策違規事件類型
一段時間內的資料遺失防護違規事件
前 10 大主機
前 10 項資料遺失防護規則
按資料外洩嘗試次數排名的前 10 名使用者
前 10 大檔案
圖表名稱
查詢示例
前 10 位使用者
$log_type = metadata.log_type
$log_type = /DLP/ nocase
$user= strings.coalesce(principal.user.user_display_name,principal.user.userid)
$user != ""
match:
$user
outcome:
$user_count = count(metadata.id)
order:
$user_count desc
limit: 10
嘗試存取機密資料
$log_type = metadata.log_type
$log_type = /DLP/ nocase
$event_type = metadata.event_type
$security_event_type = metadata.product_event_type
$security_event_type = /Sensitive/
$user = strings.coalesce(principal.user.user_display_name,principal.user.userid)
$action = security_result.action_details
$hostname = principal.hostname
$src_ip = principal.ip
$file_path = target.file.full_path
match:
$user,$action,$src_ip,$hostname,$file_path
outcome:
$event_count = count(metadata.id)
order:
$event_count desc
一段時間內的資料遺失防護事件趨勢
$date = timestamp.get_date(metadata.event_timestamp.seconds)
$log_type = metadata.log_type
$log_type = /DLP/ nocase
match:
$date
outcome:
$event_count = count(metadata.id)
依動作顯示事件
$log_type = metadata.log_type
$log_type = /DLP/ nocase
$action = security_result.action_details
$action != ""
match:
$action
outcome:
$event_count = count(metadata.id)
order:
$action asc
依嚴重性分類的資料遺失防護違規事項
$date = timestamp.get_date(metadata.event_timestamp.seconds)
$log_type=metadata.log_type
$log_type = /DLP/ nocase
$severity =security_result.severity
$security_event_type=metadata.product_event_type
$security_event_type = /Violation/ nocase
match:
$severity
outcome:
$count = count(metadata.id)
order:
$severity desc
前 10 大資料遺失防護政策違規事件類型
$log_type = metadata.log_type
$log_type = /DLP/ nocase
$event_type = metadata.product_event_type
$user = principal.user.user_display_name
$reason = strings.coalesce(security_result.summary,metadata.description,metadata.product_event_type)
$reason = /violation/ nocase
match:
$event_type
outcome:
$event_count = count(metadata.id)
$Count_user = count_distinct($user)
order:
$event_count desc
limit:
10
一段時間內的資料遺失防護違規事件
$date = timestamp.get_date(metadata.event_timestamp.seconds)
$log_type=metadata.log_type
$log_type = /DLP/ nocase
$security_event_type=metadata.product_event_type
$security_event_type = /Violation/ nocase
match:
$date
outcome:
$count = count(metadata.id)
order:
$date asc
前 10 大主機
$log_type = metadata.log_type
$log_type = /DLP/ nocase
$hostname= strings.coalesce(principal.hostname, principal.asset.hostname)
$hostname != ""
match:
$hostname
outcome:
$event_count = count(metadata.id)
order:
$event_count desc
limit: 10
前 10 項資料遺失防護規則
$log_type = metadata.log_type
$log_type = /DLP/
$rule_name = security_result.rule_name
$rule_name != ""
match:
$rule_name
outcome:
$event_count = count(metadata.id)
order:
$event_count desc
limit: 10
按資料外洩嘗試次數排名的前 10 名使用者
$log_type = metadata.log_type
$log_type = /DLP/ nocase
$user = strings.coalesce(principal.user.user_display_name,principal.user.userid)
$user !=""
$reason = strings.coalesce(metadata.product_event_type,security_result.summary,metadata.description)
$reason = /exfiltration/ nocase
$action = security_result.action_details
match:
$user
outcome:
$Action = array_distinct($action)
$Reason = array_distinct($reason)
$event_count = count(metadata.id)
order:
$event_count desc
limit:
10
前 10 大檔案
$log_type = metadata.log_type
$log_type = /DLP/
$file_name = strings.coalesce(target.file.full_path, additional.fields["fname"])
match:
$file_name
outcome:
$event_count = count(metadata.id)
order:
$event_count desc
limit: 10
資料安全監控
這個資訊主頁會全面顯示資料安全性工具提供的安全性事件，並著重於事件嚴重性、採取的動作和觸發規則等指標。這項功能會追蹤熱門主機、使用者和地理模式，以找出新興威脅和趨勢。
依嚴重程度分類的事件
依記錄類型顯示的歷來事件
依動作劃分的事件
來源地理位置熱視圖
事件類型分布
事件總數
依說明列出的前 10 大事件
前 10 大來源主機名稱
前 10 名來源使用者名稱
觸發次數最多的前 10 項資料安全產品規則
圖表名稱
查詢示例
依嚴重程度分類的事件
metadata.log_type = /ARUBA_CENTRAL|CLOUDFLARE_WARP|DELL_CYBERSENSE|FORGEROCK_OPENIDM|IMPERVA_DRA|IMPERVA_SECURESPHERE|IBM_OPENPAGES|INTEL471_WATCHER_ALERTS|OKERA_DAP|OPENCANARY|RUBRIK_POLARIS|SENTRY|TINES|TINTRI|VARONIS/ nocase
$Severity = security_result.severity
match:
$Severity
outcome:
$Count = count(metadata.id)
order:
$Count desc
依記錄類型顯示的歷來事件
$Log_Type = metadata.log_type
$Log_Type = /ARUBA_CENTRAL|CLOUDFLARE_WARP|DELL_CYBERSENSE|FORGEROCK_OPENIDM|IMPERVA_DRA|IMPERVA_SECURESPHERE|IBM_OPENPAGES|INTEL471_WATCHER_ALERTS|OKERA_DAP|OPENCANARY|RUBRIK_POLARIS|SENTRY|TINES|TINTRI|VARONIS/ nocase
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
match:
$Date, $Log_Type
outcome:
$Count = count(metadata.id)
order:
$Date asc
依動作劃分的事件
metadata.log_type = /ARUBA_CENTRAL|CLOUDFLARE_WARP|DELL_CYBERSENSE|FORGEROCK_OPENIDM|IMPERVA_DRA|IMPERVA_SECURESPHERE|IBM_OPENPAGES|INTEL471_WATCHER_ALERTS|OKERA_DAP|OPENCANARY|RUBRIK_POLARIS|SENTRY|TINES|TINTRI|VARONIS/ nocase
$Action = security_result.action
match:
$Action
outcome:
$Count = count(metadata.id)
order:
$Count desc
來源地理位置熱視圖
metadata.log_type = /ARUBA_CENTRAL|CLOUDFLARE_WARP|DELL_CYBERSENSE|FORGEROCK_OPENIDM|IMPERVA_DRA|IMPERVA_SECURESPHERE|IBM_OPENPAGES|INTEL471_WATCHER_ALERTS|OKERA_DAP|OPENCANARY|RUBRIK_POLARIS|SENTRY|TINES|TINTRI|VARONIS/ nocase
$Country = principal.ip_geo_artifact.location.country_or_region
match:
$Country
outcome:
$Count = count(metadata.id)
$Latitude = max(principal.ip_geo_artifact.location.region_latitude)
$Longitude = max(principal.ip_geo_artifact.location.region_longitude)
order:
$Count desc
事件類型分布
metadata.log_type = /ARUBA_CENTRAL|CLOUDFLARE_WARP|DELL_CYBERSENSE|FORGEROCK_OPENIDM|IMPERVA_DRA|IMPERVA_SECURESPHERE|IBM_OPENPAGES|INTEL471_WATCHER_ALERTS|OKERA_DAP|OPENCANARY|RUBRIK_POLARIS|SENTRY|TINES|TINTRI|VARONIS/ nocase
$Event_Type = metadata.event_type
match:
$Event_Type
outcome:
$Count = count(metadata.id)
order:
$Count desc
事件總數
metadata.log_type = /ARUBA_CENTRAL|CLOUDFLARE_WARP|DELL_CYBERSENSE|FORGEROCK_OPENIDM|IMPERVA_DRA|IMPERVA_SECURESPHERE|IBM_OPENPAGES|INTEL471_WATCHER_ALERTS|OKERA_DAP|OPENCANARY|RUBRIK_POLARIS|SENTRY|TINES|TINTRI|VARONIS/
outcome:
$Count = count(metadata.id)
依說明列出的前 10 大事件
metadata.log_type = /ARUBA_CENTRAL|CLOUDFLARE_WARP|DELL_CYBERSENSE|FORGEROCK_OPENIDM|IMPERVA_DRA|IMPERVA_SECURESPHERE|IBM_OPENPAGES|INTEL471_WATCHER_ALERTS|OKERA_DAP|OPENCANARY|RUBRIK_POLARIS|SENTRY|TINES|TINTRI|VARONIS/ nocase
$Summary = strings.coalesce(metadata.description,security_result.description,security_result.summary)
$Summary != ""
match:
$Summary
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
前 10 大來源主機名稱
metadata.log_type = /ARUBA_CENTRAL|CLOUDFLARE_WARP|DELL_CYBERSENSE|FORGEROCK_OPENIDM|IMPERVA_DRA|IMPERVA_SECURESPHERE|IBM_OPENPAGES|INTEL471_WATCHER_ALERTS|OKERA_DAP|OPENCANARY|RUBRIK_POLARIS|SENTRY|TINES|TINTRI|VARONIS/ nocase
$Hostname= strings.coalesce(principal.hostname, principal.asset.hostname)
$Hostname!=""
match:
$Hostname
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
前 10 名來源使用者名稱
metadata.log_type = /ARUBA_CENTRAL|CLOUDFLARE_WARP|DELL_CYBERSENSE|FORGEROCK_OPENIDM|IMPERVA_DRA|IMPERVA_SECURESPHERE|IBM_OPENPAGES|INTEL471_WATCHER_ALERTS|OKERA_DAP|OPENCANARY|RUBRIK_POLARIS|SENTRY|TINES|TINTRI|VARONIS/ nocase
$User = strings.coalesce(principal.user.user_display_name, principal.user.userid, principal.user.email_addresses)
$User != ""
match:
$User
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
觸發次數最多的前 10 項資料安全產品規則
metadata.log_type = /ARUBA_CENTRAL|CLOUDFLARE_WARP|DELL_CYBERSENSE|FORGEROCK_OPENIDM|IMPERVA_DRA|IMPERVA_SECURESPHERE|IBM_OPENPAGES|INTEL471_WATCHER_ALERTS|OKERA_DAP|OPENCANARY|RUBRIK_POLARIS|SENTRY|TINES|TINTRI|VARONIS/ nocase
$Rule_Name = security_result.rule_name
$Rule_Name !=""
match:
$Rule_Name
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
資料庫監控
這個資訊主頁會追蹤使用者活動、執行的 SQL 陳述式、登入趨勢和事件嚴重程度，深入瞭解資料庫作業、安全性、效能和健康狀態。這有助於找出異常行為、確保作業效率，以及主動管理資料庫環境中的風險。
注意： 根據特定記錄類型套用篩選器，即可在資訊主頁上顯示相關結果。
依動作劃分的事件
依嚴重程度分類的物件
指定期間內登入失敗次數
依 CREATE 陳述式排名的前 10 名使用者
已授予特殊存取權
DROP 陳述式前 10 大使用者
前 10 大資料庫相關檔案路徑
近期檔案作業
依 CREATE 陳述式劃分的近期使用者
最近登入失敗的嘗試
DDL 陳述式
執行的前 10 大陳述式
最近成功登入嘗試
依資料庫連線劃分的近期使用者
指定期間內成功登入次數
歷來授權事件
應用程式流量變化趨勢
DROP 陳述式的近期使用者
各記錄類型的 DDL 陳述式隨時間變化
依應用程式劃分的資料庫事件
嚴重程度分布
圖表名稱
查詢示例
依動作劃分的事件
$Action = security_result.action
match:
$Action
outcome:
$Count = count(metadata.id)
order:
$Count desc
依嚴重程度分類的物件
$Object_id = strings.coalesce(target.resource.product_object_id, principal.resource.product_object_id)
$Object_id != ""
$Severity = security_result.severity
$User = strings.coalesce(principal.user.userid, principal.user.user_display_name, principal.user.email_addresses, target.user.userid, target.user.user_display_name, target.user.email_addresses)
$Summary = strings.coalesce(target.process.command_line, security_result.action_details, security_result.description, extracted.fields["textPayload"], extracted.fields["cmd_line"])
$IP = strings.coalesce(principal.ip, principal.asset.ip, target.ip, target.asset.ip)
$Log_Type = metadata.log_type
match:
$Object_id, $Summary, $User, $IP, $Severity, $Log_Type
outcome:
$Count = count(metadata.id)
$Date = timestamp.get_timestamp(max(metadata.event_timestamp.seconds), "%F %T")
order:
$Count desc
指定期間內登入失敗次數
((metadata.event_type = "USER_LOGIN" and security_result.action = "BLOCK") or (metadata.event_type = "GENERIC_EVENT" and (extracted.fields["token_metadata.event_type"] = "DB_LOGIN_FAILED")))
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
$Log_Type = metadata.log_type
match:
$Date, $Log_Type
outcome:
$Count = count(metadata.id)
order:
$Date asc
依 CREATE 陳述式排名的前 10 名使用者
(target.process.command_line = /create/ nocase or extracted.fields["textPayload"] = /create/ nocase or additional.fields["statement"] = /create/ nocase or security_result.description = /create/ nocase or metadata.product_event_type = /create/ nocase)
$User = strings.coalesce(principal.user.userid, principal.user.user_display_name, principal.user.email_addresses, target.user.userid, target.user.user_display_name, target.user.email_addresses)
$Log_Type = metadata.log_type
match:
$User, $Log_Type
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
已授予特殊存取權
$Summary = strings.coalesce(if (target.process.command_line = /grant|revoke|(alter|create|drop|delete)\s+(user|role|database|server\s+role|login|table|trigger|function)|set\s+(role|password)|rename|backup|restore|impersonate|superuser/ nocase,target.process.command_line, ""),
if (extracted.fields["textPayload"] = /grant|revoke|(alter|create|drop|delete)\s+(user|role|database|server\s+role|login|table|trigger|function)|set\s+(role|password)|rename|backup|restore|impersonate|superuser/ nocase,extracted.fields["textPayload"], ""),
if (additional.fields["statement"] = /grant|revoke|(alter|create|drop|delete)\s+(user|role|database|server\s+role|login|table|trigger|function)|set\s+(role|password)|rename|backup|restore|impersonate|superuser/ nocase,additional.fields["statement"], ""),
if (security_result.description = /grant|revoke|(alter|create|drop|delete)\s+(user|role|database|server\s+role|login|table|trigger|function)|set\s+(role|password)|rename|backup|restore|impersonate|superuser/ nocase,security_result.description, ""),
if (metadata.product_event_type = /grant|revoke|(alter|create|drop|delete)\s+(user|role|database|server\s+role|login|table|trigger|function)|set\s+(role|password)|rename|backup|restore|impersonate|superuser/ nocase, strings.concat(metadata.product_event_type, " : ", extracted.fields["cmd_line"]), ""))
$Summary != ""
$User = strings.coalesce(principal.user.userid, principal.user.user_display_name, principal.user.email_addresses, target.user.userid, target.user.user_display_name, target.user.email_addresses)
$Hostname = strings.coalesce(principal.hostname, principal.asset.hostname, target.hostname, target.asset.hostname, target.resource.name)
$Log_Type = metadata.log_type
match:
$User, $Hostname, $Summary, $Log_Type
outcome:
$Count = count(metadata.id)
$Date = timestamp.get_timestamp(max(metadata.event_timestamp.seconds), "%F %T")
order:
$Count desc
DROP 陳述式前 10 大使用者
(target.process.command_line = /drop/ nocase or extracted.fields["textPayload"] = /drop/ nocase or additional.fields["statement"] = /drop/ nocase or security_result.description = /drop/ nocase or metadata.product_event_type = /drop/ nocase)
$User = strings.coalesce(principal.user.userid, principal.user.user_display_name, principal.user.email_addresses, target.user.userid, target.user.user_display_name, target.user.email_addresses)
$Log_Type = metadata.log_type
match:
$User, $Log_Type
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
前 10 大資料庫相關檔案路徑
$File_Path = target.file.full_path
$File_Path != ""
$Log_Type = metadata.log_type
match:
$File_Path, $Log_Type
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
近期檔案作業
$File = target.file.full_path
$File != ""
$Summary = strings.coalesce(target.process.command_line, security_result.description, security_result.action_details, extracted.fields["textPayload"], extracted.fields["cmd_line"])
$User = strings.coalesce(principal.user.userid, principal.user.user_display_name, principal.user.email_addresses, target.user.userid, target.user.user_display_name, target.user.email_addresses)
$Log_Type = metadata.log_type
match:
$User, $File, $Summary, $Log_Type
outcome:
$Count = count(metadata.id)
$Date = timestamp.get_timestamp(max(metadata.event_timestamp.seconds), "%F %T")
order:
$Count desc
依 CREATE 陳述式劃分的近期使用者
$Summary = strings.coalesce(if (target.process.command_line = /create/ nocase, target.process.command_line, ""),
if (extracted.fields["textPayload"] = /create/ nocase, extracted.fields["textPayload"], ""),
if (additional.fields["statement"] = /create/ nocase, additional.fields["statement"], ""),
if (security_result.description = /create/ nocase, security_result.description, "" ),
if (metadata.product_event_type = /create/ nocase, strings.concat(metadata.product_event_type, " : " ,extracted.fields["cmd_line"]), ""))
$Summary != ""
$User = strings.coalesce(principal.user.userid, principal.user.user_display_name, principal.user.email_addresses, target.user.userid, target.user.user_display_name, target.user.email_addresses)
$Hostname = strings.coalesce(principal.hostname, principal.asset.hostname, target.hostname, target.asset.hostname, target.resource.name)
$Log_Type = metadata.log_type
match:
$User, $Hostname, $Summary, $Log_Type
outcome:
$Count = count(metadata.id)
$Date = timestamp.get_timestamp(max(metadata.event_timestamp.seconds), "%F %T")
order:
$Count desc
最近登入失敗的嘗試
((metadata.event_type = "USER_LOGIN" and security_result.action = "BLOCK") or (metadata.event_type = "GENERIC_EVENT" and (extracted.fields["token_metadata.event_type"] = "DB_LOGIN_FAILED")))
$Log_Type = metadata.log_type
$User = strings.coalesce(principal.user.userid, principal.user.user_display_name, principal.user.email_addresses, target.user.userid, target.user.user_display_name, target.user.email_addresses)
$Hostname = strings.coalesce(principal.hostname, principal.asset.hostname, target.hostname, target.asset.hostname, target.resource.name)
$Summary = strings.coalesce(extracted.fields["textPayload"], extracted.fields["cmd_line"], principal.user.attribute.permissions.name, security_result.action_details, security_result.description)
match:
$User, $Hostname, $Summary, $Log_Type
outcome:
$Count = count(metadata.id)
$Date = timestamp.get_timestamp(max(metadata.event_timestamp.seconds), "%F %T")
order:
$Count desc
DDL 陳述式
$DDL_Statements = strings.coalesce(if (target.process.command_line = /alter|create|drop|rename|truncate|comment/ nocase, target.process.command_line, ""),
if (extracted.fields["textPayload"] = /alter|create|drop|rename|truncate|comment/ nocase, extracted.fields["textPayload"], ""),
if (additional.fields["statement"] = /alter|create|drop|rename|truncate|comment/ nocase, additional.fields["statement"], ""),
if (security_result.description = /alter|create|drop|rename|truncate|comment/ nocase, security_result.description, "" ),
if (metadata.product_event_type = /alter|create|drop|rename|truncate|comment/ nocase, strings.concat(metadata.product_event_type, " : " ,extracted.fields["cmd_line"]), ""))
$DDL_Statements != ""
$User = strings.coalesce(principal.user.userid, principal.user.user_display_name, principal.user.email_addresses, target.user.userid, target.user.user_display_name, target.user.email_addresses)
$Hostname = strings.coalesce(principal.hostname, principal.asset.hostname, target.hostname, target.asset.hostname, target.resource.name)
$Log_Type = metadata.log_type
match:
$DDL_Statements, $User, $Hostname, $Log_Type
outcome:
$Count = count(metadata.id)
$Date = timestamp.get_timestamp(max(metadata.event_timestamp.seconds), "%F %T")
order:
$Count desc
執行的前 10 大陳述式
$Command_Line = strings.coalesce(target.process.command_line, extracted.fields["textPayload"], additional.fields["statement"], extracted.fields["cmd_line"] security_result.description)
$Log_Type = metadata.log_type
match:
$Command_Line ,$Log_Type
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
最近成功登入嘗試
((metadata.event_type = "USER_LOGIN" and security_result.action = "ALLOW") or (metadata.event_type = "GENERIC_EVENT" and (extracted.fields["token_metadata.event_type"] = "DB_LOGIN_SUCCESS")))
$Log_Type = metadata.log_type
$User = strings.coalesce(principal.user.userid, principal.user.user_display_name, principal.user.email_addresses, target.user.userid, target.user.user_display_name, target.user.email_addresses)
$Hostname = strings.coalesce(principal.hostname, principal.asset.hostname, target.hostname, target.asset.hostname, target.resource.name)
$Summary = strings.coalesce(extracted.fields["textPayload"], extracted.fields["cmd_line"], principal.user.attribute.permissions.name, security_result.action_details, security_result.description)
match:
$User, $Hostname, $Summary, $Log_Type
outcome:
$Count = count(metadata.id)
$Date = timestamp.get_timestamp(max(metadata.event_timestamp.seconds), "%F %T")
order:
$Count desc
依資料庫連線劃分的近期使用者
(metadata.product_event_type = /connection/ nocase or security_result.description = /Connection/ nocase or additional.fields["operation_name"]= /Connection/ nocase or extracted.fields["textPayload"] = /connection/ nocase or additional.fields["ctx"] = /conn/ nocase)
$User = strings.coalesce(principal.user.userid, principal.user.user_display_name, principal.user.email_addresses, target.user.userid, target.user.user_display_name, target.user.email_addresses)
$Summary = strings.coalesce(extracted.fields["textPayload"], security_result.description, security_result.action_details, metadata.description)
$Hostname = strings.coalesce(principal.hostname, principal.asset.hostname, target.hostname, target.asset.hostname, target.resource.name)
$Log_Type = metadata.log_type
match:
$User, $Hostname, $Summary, $Log_Type
outcome:
$Count = count(metadata.id)
$Date = timestamp.get_timestamp(max(metadata.event_timestamp.seconds), "%F %T")
order:
$Count desc
指定期間內成功登入次數
((metadata.event_type = "USER_LOGIN" and security_result.action = "ALLOW") or (metadata.event_type = "GENERIC_EVENT" and (extracted.fields["token_metadata.event_type"] = "DB_LOGIN_SUCCESS")))
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
$Log_Type = metadata.log_type
match:
$Date, $Log_Type
outcome:
$Count = count(metadata.id)
order:
$Date asc
歷來授權事件
(target.process.command_line = /grant/ nocase or extracted.fields["textPayload"] = /grant/ nocase or additional.fields["statement"] = /grant/ nocase or security_result.description = /grant/ nocase or metadata.product_event_type = /grant/ nocase)
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
$Log_Type = metadata.log_type
match:
$Date, $Log_Type
outcome:
$Count = count(metadata.id)
order:
$Date asc
應用程式流量變化趨勢
$Application = target.application
$Application != ""
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
match:
$Application, $Date
outcome:
$Count = count(metadata.id)
order:
$Date asc
DROP 陳述式的近期使用者
$Summary = strings.coalesce(if (target.process.command_line = /drop/ nocase, additional.fields["statement"], ""),
if (extracted.fields["textPayload"] = /drop/ nocase, extracted.fields["textPayload"], ""),
if (additional.fields["statement"] = /drop/ nocase, additional.fields["statement"], ""),
if (security_result.description = /drop/ nocase, security_result.description, "" ),
if (metadata.product_event_type = /drop/ nocase, strings.concat(metadata.product_event_type, " : " ,extracted.fields["cmd_line"]), ""))
$Summary != ""
$User = strings.coalesce(principal.user.userid, principal.user.user_display_name, principal.user.email_addresses, target.user.userid, target.user.user_display_name, target.user.email_addresses)
$Hostname = strings.coalesce(principal.hostname, principal.asset.hostname, target.hostname, target.asset.hostname, target.resource.name)
$Log_Type = metadata.log_type
match:
$User, $Hostname, $Summary, $Log_Type
outcome:
$Count = count(metadata.id)
$Date = timestamp.get_timestamp(max(metadata.event_timestamp.seconds), "%F %T")
order:
$Count desc
各記錄類型的 DDL 陳述式隨時間變化
(target.process.command_line = /alter|create|drop|rename|truncate|comment/ nocase or extracted.fields["textPayload"] = /alter|create|drop|rename|truncate|comment/ nocase or additional.fields["statement"] = /alter|create|drop|rename|truncate|comment/ nocase or security_result.description = /alter|create|drop|rename|truncate|comment/ nocase or metadata.product_event_type = /alter|create|drop|rename|truncate|comment/ nocase)
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
$Log_Type = metadata.log_type
match:
$Date, $Log_Type
outcome:
$Count = count(metadata.id)
order:
$Date asc
依應用程式劃分的資料庫事件
$Application = target.application
$Application != ""
$Log_Type = metadata.log_type
$User = strings.coalesce(principal.user.userid, principal.user.user_display_name, principal.user.email_addresses, target.user.userid, target.user.user_display_name, target.user.email_addresses)
$Hostname = strings.coalesce(principal.hostname, principal.asset.hostname, target.hostname, target.asset.hostname, target.resource.name)
$Summary = strings.coalesce(extracted.fields["textPayload"], extracted.fields["cmd_line"],target.process.command_line, security_result.action_details, security_result.description)
match:
$Application, $Summary, $User, $Hostname, $Log_Type
outcome:
$Count = count(metadata.id)
$Date = timestamp.get_timestamp(max(metadata.event_timestamp.seconds), "%F %T")
order:
$Count desc
嚴重程度分布
$Severity = security_result.severity
match:
$Severity
outcome:
$Count = count(metadata.id)
order:
$Count desc
欺騙行為監控
這個資訊主頁會全面顯示與詐騙相關的活動，深入分析事件趨勢、模式和行為。此外，這項功能還會醒目顯示誘餌網路中的高風險區域，讓安全團隊有效分析、監控及因應威脅。
注意： 根據特定記錄類型套用篩選器，即可在資訊主頁上顯示相關結果。
前 10 大目的地 IP
前 10 大來源 IP
依記錄類型顯示的歷來事件
前 10 大通訊埠和通訊協定
來源地理位置總覽
前 10 大目的地主機名稱
誘餌的網路攻擊鏈階段細目 (Zscaler Deception)
前 10 大來源使用者
依記錄類型列出的前 10 大事件類型
前 10 大目標誘餌資源類型 (Zscaler Deception)
高風險分數前 10 名的誘餌 (Zscaler Deception)
按誘餌網路細分的活動 (Zscaler Deception)
依嚴重程度分類的事件
圖表名稱
查詢示例
前 10 大目的地 IP
$Destination_IP = strings.coalesce(target.ip, target.asset.ip)
$Log_Type = metadata.log_type
match:
$Destination_IP, $Log_Type
outcome:
$Count = count(metadata.id)
Order:
$Count desc
limit:
10
前 10 大來源 IP
$Source_IP = strings.coalesce(principal.ip, principal.asset.ip)
$Log_Type = metadata.log_type
match:
$Source_IP, $Log_Type
outcome:
$Count = count(metadata.id)
Order:
$Count desc
limit:
10
依記錄類型顯示的歷來事件
$Log_Type = metadata.log_type
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
match:
$Date, $Log_Type
outcome:
$Count = count(metadata.id)
前 10 大通訊埠和通訊協定
$Port = target.port
match:
$Port
outcome:
$Protocol = array_distinct(network.application_protocol)
$Count = count(metadata.id)
order:
$Count desc
limit:
10
來源地理位置總覽
$Country = principal.ip_geo_artifact.location.country_or_region
$Country != ""
match:
$Country
outcome:
$Count = count(metadata.id)
$Latitude = max(principal.ip_geo_artifact.location.region_latitude)
$Longitude = max(principal.ip_geo_artifact.location.region_longitude)
order:
$Count desc
前 10 大目的地主機名稱
$Destination_Hostname = strings.coalesce(target.hostname,target.asset.hostname)
$Log_Type = metadata.log_type
match:
$Destination_Hostname, $Log_Type
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
誘餌的網路攻擊鏈階段細目 (Zscaler Deception)
$Kill_Chain = strings.coalesce(additional.fields["kill_chain_phase"],extracted.fields["kill_chain_phase"])
$Decoy_Server = strings.coalesce(additional.fields["decoy_recon_server_type"],extracted.fields["decoy_recon_server_type"])
$Attack_Type = strings.coalesce(additional.fields["decoy_recon_dataset_type"],extracted.fields["decoy_recon_dataset_type"])
$Source_User = strings.coalesce(principal.user.user_display_name, principal.user.userid, principal.user.email_addresses)
$Destination_Hostname = strings.coalesce(target.hostname, target.asset.hostname)
$Source_IP = strings.coalesce(principal.ip, principal.asset.ip)
$Destination_IP = strings.coalesce(target.ip, target.asset.ip)
$Log_Type = metadata.log_type
match:
$Kill_Chain ,$Decoy_Server ,$Attack_Type, $Destination_Hostname, $Source_User, $Source_IP, $Destination_IP, $Log_Type
outcome:
$Count = count(metadata.id)
$Date = timestamp.get_timestamp(max(metadata.event_timestamp.seconds), "%F %T")
order:
$Count desc
前 10 大來源使用者
$Source_User = strings.coalesce(principal.user.userid, principal.user.email_addresses, principal.user.user_display_name)
$Log_Type = metadata.log_type
match:
$Source_User, $Log_Type
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
依記錄類型列出的前 10 大事件類型
$Log_Type = metadata.log_type
$Event_Type = metadata.event_type
match:
$Event_Type, $Log_Type
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
前 10 大目標誘餌資源類型 (Zscaler Deception)
$Resource_Type = target.resource.type
$Destination_Hostname = strings.coalesce(target.hostname, target.asset.hostname)
match:
$Resource_Type, $Destination_Hostname
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
高風險分數前 10 名的誘餌 (Zscaler Deception)
$Decoy_Server = strings.coalesce(additional.fields["decoy_recon_server_type"], extracted.fields["decoy_recon_server_type"])
$Attack_Type = strings.coalesce(additional.fields["decoy_recon_dataset_type"], extracted.fields["decoy_recon_dataset_type"])
$Risk_Score = security_result.risk_score
$Log_Type = metadata.log_type
match:
$Decoy_Server, $Attack_Type , $Risk_Score, $Log_Type
outcome:
$Count = count(metadata.id)
$Date = timestamp.get_timestamp(max(metadata.event_timestamp.seconds), "%F %T")
order:
$Risk_Score desc
limit :
10
按誘餌網路細分的活動 (Zscaler Deception)
$Decoy_Network = strings.coalesce(additional.fields["decoy_network_name"],extracted.fields["decoy_network_name"])
$Attack_Type = strings.coalesce(additional.fields["decoy_recon_dataset_type"],extracted.fields["decoy_recon_dataset_type"])
$Log_Type = metadata.log_type
match:
$Decoy_Network, $Attack_Type, $Log_Type
outcome:
$Count = count(metadata.id)
$Date = timestamp.get_timestamp(max(metadata.event_timestamp.seconds), "%F %T")
order:
$Count desc
依嚴重程度分類的事件
$Severity = security_result.severity
match:
$Severity
outcome:
$Count = count(metadata.id)
EDR 警告總覽
這個資訊主頁會全面顯示資產、事件和主動偵測到的威脅，讓您進一步掌握及控管情況。
前 10 大 EDR 快訊
EDR 警告總數
作用中的 EDR 感應器
根據 EDR 警告排名前 10 的主機
EDR 感應器數量
前 10 項技術
根據 EDR 警告判斷嚴重程度
10 大策略
一段時間內的 EDR 快訊總數
根據 EDR 快訊列出的前 10 位使用者
圖表名稱
查詢示例
前 10 大 EDR 快訊
$event.metadata.log_type = /LIMACHARLIE_EDR|CS_EDR|CS_DETECTS|ESET_EDR|CHECKPOINT_EDR|SOPHOS_EDR|OSQUERY_EDR|DIGITALGUARDIAN_EDR|SENTINEL_DV|MICROSOFT_DEFENDER_ENDPOINT|SENTINEL_EDR|UPTYCS_EDR|SYMANTEC_EDR|FORTINET_FORTIEDR|REDCANARY_EDR|CYBEREASON_EDR|MICROSOFT_DEFENDER_IDENTITY|DEEP_INSTINCT_EDR|CB_EDR|PAN_EDR|FIREEYE_HX|WATCHGUARD_EDR/ nocase
$Log_Type = $event.metadata.log_type
$Detection = $event.security_result.summary
$Detection != ""
match:
$Detection, $Log_Type
outcome:
$Count = count($event.security_result.summary)
order:
$Count desc
limit:
10
前 10 大 EDR 快訊
$event.metadata.log_type = /LIMACHARLIE_EDR|CS_EDR|CS_DETECTS|ESET_EDR|CHECKPOINT_EDR|SOPHOS_EDR|OSQUERY_EDR|DIGITALGUARDIAN_EDR|SENTINEL_DV|MICROSOFT_DEFENDER_ENDPOINT|SENTINEL_EDR|UPTYCS_EDR|SYMANTEC_EDR|FORTINET_FORTIEDR|REDCANARY_EDR|CYBEREASON_EDR|MICROSOFT_DEFENDER_IDENTITY|DEEP_INSTINCT_EDR|CB_EDR|PAN_EDR|FIREEYE_HX|WATCHGUARD_EDR/ nocase
$Log_Type = $event.metadata.log_type
$Detection = $event.security_result.summary
$Detection != ""
match:
$Detection, $Log_Type
outcome:
$Count = count($event.security_result.summary)
order:
$Count desc
limit:
10
EDR 警告總數
$event.metadata.log_type = /LIMACHARLIE_EDR|CS_EDR|CS_DETECTS|ESET_EDR|CHECKPOINT_EDR|SOPHOS_EDR|OSQUERY_EDR|DIGITALGUARDIAN_EDR|SENTINEL_DV|MICROSOFT_DEFENDER_ENDPOINT|SENTINEL_EDR|UPTYCS_EDR|SYMANTEC_EDR|FORTINET_FORTIEDR|REDCANARY_EDR|CYBEREASON_EDR|MICROSOFT_DEFENDER_IDENTITY|DEEP_INSTINCT_EDR|CB_EDR|PAN_EDR|FIREEYE_HX|WATCHGUARD_EDR/ nocase
outcome:
$Count = count($event.security_result.summary)
作用中的 EDR 感應器
$event.metadata.log_type = /LIMACHARLIE_EDR|CS_EDR|CS_DETECTS|ESET_EDR|CHECKPOINT_EDR|SOPHOS_EDR|OSQUERY_EDR|DIGITALGUARDIAN_EDR|SENTINEL_DV|MICROSOFT_DEFENDER_ENDPOINT|SENTINEL_EDR|UPTYCS_EDR|SYMANTEC_EDR|FORTINET_FORTIEDR|REDCANARY_EDR|CYBEREASON_EDR|MICROSOFT_DEFENDER_IDENTITY|DEEP_INSTINCT_EDR|CB_EDR|PAN_EDR|FIREEYE_HX|WATCHGUARD_EDR/ nocase
$EDR_Asset = strings.coalesce($event.principal.asset.hostname, $event.principal.hostname)
$EDR_Asset != ""
match:
$EDR_Asset
limit:
50
根據 EDR 警告排名前 10 的主機
$event.metadata.log_type = /LIMACHARLIE_EDR|CS_EDR|CS_DETECTS|ESET_EDR|CHECKPOINT_EDR|SOPHOS_EDR|OSQUERY_EDR|DIGITALGUARDIAN_EDR|SENTINEL_DV|MICROSOFT_DEFENDER_ENDPOINT|SENTINEL_EDR|UPTYCS_EDR|SYMANTEC_EDR|FORTINET_FORTIEDR|REDCANARY_EDR|CYBEREASON_EDR|MICROSOFT_DEFENDER_IDENTITY|DEEP_INSTINCT_EDR|CB_EDR|PAN_EDR|FIREEYE_HX|WATCHGUARD_EDR/ nocase
$Hostname = strings.coalesce($event.principal.asset.hostname, $event.principal.hostname)
$Hostname != ""
match:
$Hostname
outcome:
$Count = count($event.security_result.summary)
order:
$Count desc
limit:
10
EDR 感應器數量
$event.metadata.log_type = /LIMACHARLIE_EDR|CS_EDR|CS_DETECTS|ESET_EDR|CHECKPOINT_EDR|SOPHOS_EDR|OSQUERY_EDR|DIGITALGUARDIAN_EDR|SENTINEL_DV|MICROSOFT_DEFENDER_ENDPOINT|SENTINEL_EDR|UPTYCS_EDR|SYMANTEC_EDR|FORTINET_FORTIEDR|REDCANARY_EDR|CYBEREASON_EDR|MICROSOFT_DEFENDER_IDENTITY|DEEP_INSTINCT_EDR|CB_EDR|PAN_EDR|FIREEYE_HX|WATCHGUARD_EDR/ nocase
outcome:
$Count = count_distinct(strings.coalesce($event.principal.asset.hostname, $event.principal.hostname))
前 10 項技術
$event.metadata.log_type = /LIMACHARLIE_EDR|CS_EDR|CS_DETECTS|ESET_EDR|CHECKPOINT_EDR|SOPHOS_EDR|OSQUERY_EDR|DIGITALGUARDIAN_EDR|SENTINEL_DV|MICROSOFT_DEFENDER_ENDPOINT|SENTINEL_EDR|UPTYCS_EDR|SYMANTEC_EDR|FORTINET_FORTIEDR|REDCANARY_EDR|CYBEREASON_EDR|MICROSOFT_DEFENDER_IDENTITY|DEEP_INSTINCT_EDR|CB_EDR|PAN_EDR|FIREEYE_HX|WATCHGUARD_EDR/ nocase
$Technique_ID = strings.coalesce($event.security_result.attack_details.techniques.id, $event.security_result.detection_fields["Technique ID"])
$Technique = strings.coalesce($event.security_result.attack_details.techniques.name, $event.security_result.detection_fields["Technique"])
$Technique_ID != ""
$Technique != ""
match:
$Technique_ID, $Technique
outcome:
$Count = count($event.security_result.summary)
order:
$Count desc
limit:
10
根據 EDR 警告判斷嚴重程度
$event.metadata.log_type = /LIMACHARLIE_EDR|CS_EDR|CS_DETECTS|ESET_EDR|CHECKPOINT_EDR|SOPHOS_EDR|OSQUERY_EDR|DIGITALGUARDIAN_EDR|SENTINEL_DV|MICROSOFT_DEFENDER_ENDPOINT|SENTINEL_EDR|UPTYCS_EDR|SYMANTEC_EDR|FORTINET_FORTIEDR|REDCANARY_EDR|CYBEREASON_EDR|MICROSOFT_DEFENDER_IDENTITY|DEEP_INSTINCT_EDR|CB_EDR|PAN_EDR|FIREEYE_HX|WATCHGUARD_EDR/ nocase
$event.security_result.summary != ""
$Severity = $event.security_result.severity
match:
$Severity
outcome:
$Count = count($event.security_result.summary)
order:
$Severity asc
limit:
10
根據 EDR 警告判斷嚴重程度
$event.metadata.log_type = /LIMACHARLIE_EDR|CS_EDR|CS_DETECTS|ESET_EDR|CHECKPOINT_EDR|SOPHOS_EDR|OSQUERY_EDR|DIGITALGUARDIAN_EDR|SENTINEL_DV|MICROSOFT_DEFENDER_ENDPOINT|SENTINEL_EDR|UPTYCS_EDR|SYMANTEC_EDR|FORTINET_FORTIEDR|REDCANARY_EDR|CYBEREASON_EDR|MICROSOFT_DEFENDER_IDENTITY|DEEP_INSTINCT_EDR|CB_EDR|PAN_EDR|FIREEYE_HX|WATCHGUARD_EDR/ nocase
$event.security_result.summary != ""
$Severity = $event.security_result.severity
match:
$Severity
outcome:
$Count = count($event.security_result.summary)
order:
$Severity asc
limit:
10
10 大策略
$event.metadata.log_type = /LIMACHARLIE_EDR|CS_EDR|CS_DETECTS|ESET_EDR|CHECKPOINT_EDR|SOPHOS_EDR|OSQUERY_EDR|DIGITALGUARDIAN_EDR|SENTINEL_DV|MICROSOFT_DEFENDER_ENDPOINT|SENTINEL_EDR|UPTYCS_EDR|SYMANTEC_EDR|FORTINET_FORTIEDR|REDCANARY_EDR|CYBEREASON_EDR|MICROSOFT_DEFENDER_IDENTITY|DEEP_INSTINCT_EDR|CB_EDR|PAN_EDR|FIREEYE_HX|WATCHGUARD_EDR/ nocase
$Tactic_ID = strings.coalesce($event.security_result.attack_details.tactics.id, $event.security_result.detection_fields["Tactic ID"])
$Tactic_Name = strings.coalesce($event.security_result.attack_details.tactics.name, $event.security_result.detection_fields["Tactic"])
$Tactic_ID != ""
$Tactic_Name != ""
match:
$Tactic_ID, $Tactic_Name
outcome:
$Count = count($event.security_result.summary)
order:
$Count desc
limit:
10
一段時間內的 EDR 快訊總數
$event.metadata.log_type = /LIMACHARLIE_EDR|CS_EDR|CS_DETECTS|ESET_EDR|CHECKPOINT_EDR|SOPHOS_EDR|OSQUERY_EDR|DIGITALGUARDIAN_EDR|SENTINEL_DV|MICROSOFT_DEFENDER_ENDPOINT|SENTINEL_EDR|UPTYCS_EDR|SYMANTEC_EDR|FORTINET_FORTIEDR|REDCANARY_EDR|CYBEREASON_EDR|MICROSOFT_DEFENDER_IDENTITY|DEEP_INSTINCT_EDR|CB_EDR|PAN_EDR|FIREEYE_HX|WATCHGUARD_EDR/ nocase
$Log_Type = $event.metadata.log_type
$Date = timestamp.get_date($event.metadata.event_timestamp.seconds)
match:
$Date, $Log_Type
outcome:
$Count = count($event.security_result.summary)
order:
$Date asc
作用中的 EDR 感應器
$event.metadata.log_type = /LIMACHARLIE_EDR|CS_EDR|CS_DETECTS|ESET_EDR|CHECKPOINT_EDR|SOPHOS_EDR|OSQUERY_EDR|DIGITALGUARDIAN_EDR|SENTINEL_DV|MICROSOFT_DEFENDER_ENDPOINT|SENTINEL_EDR|UPTYCS_EDR|SYMANTEC_EDR|FORTINET_FORTIEDR|REDCANARY_EDR|CYBEREASON_EDR|MICROSOFT_DEFENDER_IDENTITY|DEEP_INSTINCT_EDR|CB_EDR|PAN_EDR|FIREEYE_HX|WATCHGUARD_EDR/ nocase
$EDR_Asset = strings.coalesce($event.principal.asset.hostname, $event.principal.hostname)
$EDR_Asset != ""
match:
$EDR_Asset
limit:
50
一段時間內的 EDR 快訊總數
$event.metadata.log_type = /LIMACHARLIE_EDR|CS_EDR|CS_DETECTS|ESET_EDR|CHECKPOINT_EDR|SOPHOS_EDR|OSQUERY_EDR|DIGITALGUARDIAN_EDR|SENTINEL_DV|MICROSOFT_DEFENDER_ENDPOINT|SENTINEL_EDR|UPTYCS_EDR|SYMANTEC_EDR|FORTINET_FORTIEDR|REDCANARY_EDR|CYBEREASON_EDR|MICROSOFT_DEFENDER_IDENTITY|DEEP_INSTINCT_EDR|CB_EDR|PAN_EDR|FIREEYE_HX|WATCHGUARD_EDR/ nocase
$Log_Type = $event.metadata.log_type
$Date = timestamp.get_date($event.metadata.event_timestamp.seconds)
match:
$Date, $Log_Type
outcome:
$Count = count($event.security_result.summary)
order:
$Date asc
前 10 項技術
$event.metadata.log_type = /LIMACHARLIE_EDR|CS_EDR|CS_DETECTS|ESET_EDR|CHECKPOINT_EDR|SOPHOS_EDR|OSQUERY_EDR|DIGITALGUARDIAN_EDR|SENTINEL_DV|MICROSOFT_DEFENDER_ENDPOINT|SENTINEL_EDR|UPTYCS_EDR|SYMANTEC_EDR|FORTINET_FORTIEDR|REDCANARY_EDR|CYBEREASON_EDR|MICROSOFT_DEFENDER_IDENTITY|DEEP_INSTINCT_EDR|CB_EDR|PAN_EDR|FIREEYE_HX|WATCHGUARD_EDR/ nocase
$Technique_ID = strings.coalesce($event.security_result.attack_details.techniques.id, $event.security_result.detection_fields["Technique ID"])
$Technique = strings.coalesce($event.security_result.attack_details.techniques.name, $event.security_result.detection_fields["Technique"])
$Technique_ID != ""
$Technique != ""
match:
$Technique_ID, $Technique
outcome:
$Count = count($event.security_result.summary)
order:
$Count desc
limit:
10
根據 EDR 快訊列出的前 10 位使用者
$event.metadata.log_type = /LIMACHARLIE_EDR|CS_EDR|CS_DETECTS|ESET_EDR|CHECKPOINT_EDR|SOPHOS_EDR|OSQUERY_EDR|DIGITALGUARDIAN_EDR|SENTINEL_DV|MICROSOFT_DEFENDER_ENDPOINT|SENTINEL_EDR|UPTYCS_EDR|SYMANTEC_EDR|FORTINET_FORTIEDR|REDCANARY_EDR|CYBEREASON_EDR|MICROSOFT_DEFENDER_IDENTITY|DEEP_INSTINCT_EDR|CB_EDR|PAN_EDR|FIREEYE_HX|WATCHGUARD_EDR/ nocase
$User = $event.principal.user.user_display_name
$User != ""
match:
$User
outcome:
$Count = count($event.security_result.summary)
order:
$Count desc
limit:
10
根據 EDR 快訊列出的前 10 位使用者
$event.metadata.log_type = /LIMACHARLIE_EDR|CS_EDR|CS_DETECTS|ESET_EDR|CHECKPOINT_EDR|SOPHOS_EDR|OSQUERY_EDR|DIGITALGUARDIAN_EDR|SENTINEL_DV|MICROSOFT_DEFENDER_ENDPOINT|SENTINEL_EDR|UPTYCS_EDR|SYMANTEC_EDR|FORTINET_FORTIEDR|REDCANARY_EDR|CYBEREASON_EDR|MICROSOFT_DEFENDER_IDENTITY|DEEP_INSTINCT_EDR|CB_EDR|PAN_EDR|FIREEYE_HX|WATCHGUARD_EDR/ nocase
$User = $event.principal.user.user_display_name
$User != ""
match:
$User
outcome:
$Count = count($event.security_result.summary)
order:
$Count desc
limit:
10
10 大策略
$event.metadata.log_type = /LIMACHARLIE_EDR|CS_EDR|CS_DETECTS|ESET_EDR|CHECKPOINT_EDR|SOPHOS_EDR|OSQUERY_EDR|DIGITALGUARDIAN_EDR|SENTINEL_DV|MICROSOFT_DEFENDER_ENDPOINT|SENTINEL_EDR|UPTYCS_EDR|SYMANTEC_EDR|FORTINET_FORTIEDR|REDCANARY_EDR|CYBEREASON_EDR|MICROSOFT_DEFENDER_IDENTITY|DEEP_INSTINCT_EDR|CB_EDR|PAN_EDR|FIREEYE_HX|WATCHGUARD_EDR/ nocase
$Tactic_ID = strings.coalesce($event.security_result.attack_details.tactics.id, $event.security_result.detection_fields["Tactic ID"])
$Tactic_Name = strings.coalesce($event.security_result.attack_details.tactics.name, $event.security_result.detection_fields["Tactic"])
$Tactic_ID != ""
$Tactic_Name != ""
match:
$Tactic_ID, $Tactic_Name
outcome:
$Count = count($event.security_result.summary)
order:
$Count desc
limit:
10
EDR 警告總數
$event.metadata.log_type = /LIMACHARLIE_EDR|CS_EDR|CS_DETECTS|ESET_EDR|CHECKPOINT_EDR|SOPHOS_EDR|OSQUERY_EDR|DIGITALGUARDIAN_EDR|SENTINEL_DV|MICROSOFT_DEFENDER_ENDPOINT|SENTINEL_EDR|UPTYCS_EDR|SYMANTEC_EDR|FORTINET_FORTIEDR|REDCANARY_EDR|CYBEREASON_EDR|MICROSOFT_DEFENDER_IDENTITY|DEEP_INSTINCT_EDR|CB_EDR|PAN_EDR|FIREEYE_HX|WATCHGUARD_EDR/ nocase
outcome:
$Count = count($event.security_result.summary)
EDR 感應器數量
$event.metadata.log_type = /LIMACHARLIE_EDR|CS_EDR|CS_DETECTS|ESET_EDR|CHECKPOINT_EDR|SOPHOS_EDR|OSQUERY_EDR|DIGITALGUARDIAN_EDR|SENTINEL_DV|MICROSOFT_DEFENDER_ENDPOINT|SENTINEL_EDR|UPTYCS_EDR|SYMANTEC_EDR|FORTINET_FORTIEDR|REDCANARY_EDR|CYBEREASON_EDR|MICROSOFT_DEFENDER_IDENTITY|DEEP_INSTINCT_EDR|CB_EDR|PAN_EDR|FIREEYE_HX|WATCHGUARD_EDR/ nocase
outcome:
$Count = count_distinct(strings.coalesce($event.principal.asset.hostname, $event.principal.hostname))
根據 EDR 警告排名前 10 的主機
$event.metadata.log_type = /LIMACHARLIE_EDR|CS_EDR|CS_DETECTS|ESET_EDR|CHECKPOINT_EDR|SOPHOS_EDR|OSQUERY_EDR|DIGITALGUARDIAN_EDR|SENTINEL_DV|MICROSOFT_DEFENDER_ENDPOINT|SENTINEL_EDR|UPTYCS_EDR|SYMANTEC_EDR|FORTINET_FORTIEDR|REDCANARY_EDR|CYBEREASON_EDR|MICROSOFT_DEFENDER_IDENTITY|DEEP_INSTINCT_EDR|CB_EDR|PAN_EDR|FIREEYE_HX|WATCHGUARD_EDR/ nocase
$Hostname = strings.coalesce($event.principal.asset.hostname, $event.principal.hostname)
$Hostname != ""
match:
$Hostname
outcome:
$Count = count($event.security_result.summary)
order:
$Count desc
limit:
10
電子郵件活動總覽
這個資訊主頁會提供電子郵件流量的詳細摘要，包括總量、允許與封鎖的電子郵件、不重複寄件者、不重複收件者，以及頂尖寄件者和收件者的重要統計資料。這項功能可提供通訊模式的實用洞察資料，並提升電子郵件安全性、篩選成效和整體電子郵件管理。
最近的電子郵件事件
封鎖的電子郵件
前 5 名收件者 (依記錄類型)
允許的電子郵件事件
電子郵件事件總數
依事件類型列出的前 10 大電子郵件記錄來源
依記錄類型列出的前 5 大寄件者
不重複寄件者
不重複收件者
圖表名稱
查詢示例
最近的電子郵件事件
$event.metadata.event_type = "EMAIL_UNCATEGORIZED"
or $event.metadata.event_type = "EMAIL_TRANSACTION"
$Sender = $event.network.email.from
$Recipient = $event.network.email.to
$Subject = $event.network.email.subject
$Subject != ""
$Date = timestamp.get_timestamp($event.metadata.event_timestamp.seconds)
$Action = $event.security_result.action
match:
$Date, $Sender, $Recipient, $Subject, $Action
order:
$Date desc
limit:
50
封鎖的電子郵件
$event.metadata.event_type = "EMAIL_UNCATEGORIZED"
or $event.metadata.event_type = "EMAIL_TRANSACTION"
$event.security_result.action = "BLOCK"
outcome:
$Count = count($event.metadata.id)
前 5 名收件者 (依記錄類型)
$event.metadata.event_type = "EMAIL_UNCATEGORIZED"
or $event.metadata.event_type = "EMAIL_TRANSACTION"
$Log_Type = $event.metadata.log_type
$Recipients = $event.network.email.to
$Recipients != ""
match:
$Log_Type, $Recipients
outcome:
$Count = count($event.metadata.id)
order:
$Count desc
limit:
5
允許的電子郵件事件
$event.metadata.event_type = "EMAIL_UNCATEGORIZED"
or $event.metadata.event_type = "EMAIL_TRANSACTION"
$event.security_result.action = "ALLOW"
outcome:
$Count = count($event.metadata.id)
前 5 名收件者 (依記錄類型)
$event.metadata.event_type = "EMAIL_UNCATEGORIZED"
or $event.metadata.event_type = "EMAIL_TRANSACTION"
$Log_Type = $event.metadata.log_type
$Recipients = $event.network.email.to
$Recipients != ""
match:
$Log_Type, $Recipients
outcome:
$Count = count($event.metadata.id)
order:
$Count desc
limit:
5
電子郵件事件總數
$event.metadata.event_type = "EMAIL_UNCATEGORIZED"
or $event.metadata.event_type = "EMAIL_TRANSACTION"
outcome:
$Count = count($event.metadata.id)
依事件類型列出的前 10 大電子郵件記錄來源
$event.metadata.event_type = "EMAIL_UNCATEGORIZED"
or $event.metadata.event_type = "EMAIL_TRANSACTION"
$Event_Type = $event.metadata.event_type
$Log_Type = $event.metadata.log_type
match:
$Log_Type, $Event_Type
outcome:
$Count = count($event.metadata.id)
order:
$Count desc
limit:
10
允許的電子郵件事件
$event.metadata.event_type = "EMAIL_UNCATEGORIZED"
or $event.metadata.event_type = "EMAIL_TRANSACTION"
$event.security_result.action = "ALLOW"
outcome:
$Count = count($event.metadata.id)
依記錄類型列出的前 5 大寄件者
$event.metadata.event_type = "EMAIL_UNCATEGORIZED"
or $event.metadata.event_type = "EMAIL_TRANSACTION"
$Log_Type = $event.metadata.log_type
$Sender = $event.network.email.from
$Sender != ""
match:
$Log_Type, $Sender
outcome:
$Count = count($event.metadata.id)
order:
$Count desc
limit:
5
不重複寄件者
$event.metadata.event_type = "EMAIL_UNCATEGORIZED"
or $event.metadata.event_type = "EMAIL_TRANSACTION"
outcome:
$Count = count_distinct($event.network.email.from)
不重複寄件者
$event.metadata.event_type = "EMAIL_UNCATEGORIZED"
or $event.metadata.event_type = "EMAIL_TRANSACTION"
outcome:
$Count = count_distinct($event.network.email.from)
電子郵件事件總數
$event.metadata.event_type = "EMAIL_UNCATEGORIZED"
or $event.metadata.event_type = "EMAIL_TRANSACTION"
outcome:
$Count = count($event.metadata.id)
依記錄類型列出的前 5 大寄件者
$event.metadata.event_type = "EMAIL_UNCATEGORIZED"
or $event.metadata.event_type = "EMAIL_TRANSACTION"
$Log_Type = $event.metadata.log_type
$Sender = $event.network.email.from
$Sender != ""
match:
$Log_Type, $Sender
outcome:
$Count = count($event.metadata.id)
order:
$Count desc
limit:
5
最近的電子郵件事件
$event.metadata.event_type = "EMAIL_UNCATEGORIZED"
or $event.metadata.event_type = "EMAIL_TRANSACTION"
$Sender = $event.network.email.from
$Recipient = $event.network.email.to
$Subject = $event.network.email.subject
$Subject != ""
$Date = timestamp.get_timestamp($event.metadata.event_timestamp.seconds)
$Action = $event.security_result.action
match:
$Date, $Sender, $Recipient, $Subject, $Action
order:
$Date desc
limit:
50
不重複收件者
$event.metadata.event_type = "EMAIL_UNCATEGORIZED"
or $event.metadata.event_type = "EMAIL_TRANSACTION"
outcome:
$Count = count_distinct($event.network.email.to)
封鎖的電子郵件
$event.metadata.event_type = "EMAIL_UNCATEGORIZED"
or $event.metadata.event_type = "EMAIL_TRANSACTION"
$event.security_result.action = "BLOCK"
outcome:
$Count = count($event.metadata.id)
不重複收件者
$event.metadata.event_type = "EMAIL_UNCATEGORIZED"
or $event.metadata.event_type = "EMAIL_TRANSACTION"
outcome:
$Count = count_distinct($event.network.email.to)
依事件類型列出的前 10 大電子郵件記錄來源
$event.metadata.event_type = "EMAIL_UNCATEGORIZED"
or $event.metadata.event_type = "EMAIL_TRANSACTION"
$Event_Type = $event.metadata.event_type
$Log_Type = $event.metadata.log_type
match:
$Log_Type, $Event_Type
outcome:
$Count = count($event.metadata.id)
order:
$Count desc
limit:
10
電子郵件安全防護總覽
這個資訊主頁會提供電子郵件威脅的相關資訊，例如網路釣魚、惡意軟體、勒索軟體和企業電子郵件入侵 (BEC)。這份報告會提供安全性相關事件、惡意寄件者、來源 IP 和目標電子郵件地址的總覽。
前 10 大已識別網域
偵測到的網路釣魚行為總數
電子郵件類別隨時間變化
前 10 個可疑網址
偵測到網路釣魚
前 10 大惡意來源 IP
依類別分類的電子郵件威脅
一段時間內採取的行動
過去一段時間內偵測到的電子郵件威脅
近期作用中的威脅
封鎖的網址與允許的網址
前 10 大惡意寄件者
最近的惡意附件
前 10 大目標電子郵件
前 10 大高嚴重性威脅
前 10 大惡意位置
依嚴重性分類的前 10 大電子郵件威脅
威脅狀態分布
安全結果動作分配
圖表名稱
查詢示例
前 10 大已識別網域
$event.metadata.log_type = /ABNORMAL_SECURITY|AREA1|AVANAN_EMAIL|BARRACUDA_EMAIL|CISCO_EMAIL_SECURITY|COFENSE_TRIAGE|EXCHANGE_MAIL|FIREEYE_EMPS|FIREEYE_ETP|FORCEPOINT_EMAILSECURITY|FORCEPOINT_MAIL_RELAY|FORTINET_FORTIMAIL|KNOWBE4_PHISHER|MAILMARSHAL|MICROSOFT_DEFENDER_MAIL|MIMECAST_MAIL|MIMECAST_URL_LOGS|OBSERVEIT|OFFICE_365|POSTFIX_MAIL|PROOFPOINT_MAIL|PROOFPOINT_MAIL_FILTER|PROOFPOINT_ON_DEMAND|PROOFPOINT_SENDMAIL_SENTRION|PROOFPOINT_SER|PROOFPOINT_TAP_FORENSICS|PROOFPOINT_TRAP|SENDMAIL|SEPPMAIL|SYMANTEC_VIP|VIRTRU_EMAIL_ENCRYPTION|VOLTAGE|WORKSPACE_ALERTS|ZIX_EMAIL_ENCRYPTION|PHISHLABS/ nocase
$event.metadata.event_type = "EMAIL_UNCATEGORIZED"
or $event.metadata.event_type = "EMAIL_TRANSACTION"
or $event.metadata.event_type = "NETWORK_HTTP"
$event.principal.administrative_domain != ""
$Domain = $event.principal.administrative_domain
match:
$Domain
outcome:
$Count = count($event.metadata.id)
order:
$Count desc
limit:
10
偵測到的網路釣魚行為總數
$event.metadata.log_type = /ABNORMAL_SECURITY|AREA1|AVANAN_EMAIL|BARRACUDA_EMAIL|CISCO_EMAIL_SECURITY|COFENSE_TRIAGE|EXCHANGE_MAIL|FIREEYE_EMPS|FIREEYE_ETP|FORCEPOINT_EMAILSECURITY|FORCEPOINT_MAIL_RELAY|FORTINET_FORTIMAIL|KNOWBE4_PHISHER|MAILMARSHAL|MICROSOFT_DEFENDER_MAIL|MIMECAST_MAIL|MIMECAST_URL_LOGS|OBSERVEIT|OFFICE_365|POSTFIX_MAIL|PROOFPOINT_MAIL|PROOFPOINT_MAIL_FILTER|PROOFPOINT_ON_DEMAND|PROOFPOINT_SENDMAIL_SENTRION|PROOFPOINT_SER|PROOFPOINT_TAP_FORENSICS|PROOFPOINT_TRAP|SENDMAIL|SEPPMAIL|SYMANTEC_VIP|VIRTRU_EMAIL_ENCRYPTION|VOLTAGE|WORKSPACE_ALERTS|ZIX_EMAIL_ENCRYPTION|PHISHLABS/ nocase
$event.metadata.event_type = "EMAIL_UNCATEGORIZED"
or $event.metadata.event_type = "EMAIL_TRANSACTION"
or $event.metadata.event_type = "NETWORK_HTTP"
$event.security_result.category = "MAIL_PHISHING"
outcome:
$Count = count_distinct($event.principal.user.email_addresses)
電子郵件類別隨時間變化
$event.metadata.log_type = /ABNORMAL_SECURITY|AREA1|AVANAN_EMAIL|BARRACUDA_EMAIL|CISCO_EMAIL_SECURITY|COFENSE_TRIAGE|EXCHANGE_MAIL|FIREEYE_EMPS|FIREEYE_ETP|FORCEPOINT_EMAILSECURITY|FORCEPOINT_MAIL_RELAY|FORTINET_FORTIMAIL|KNOWBE4_PHISHER|MAILMARSHAL|MICROSOFT_DEFENDER_MAIL|MIMECAST_MAIL|MIMECAST_URL_LOGS|OBSERVEIT|OFFICE_365|POSTFIX_MAIL|PROOFPOINT_MAIL|PROOFPOINT_MAIL_FILTER|PROOFPOINT_ON_DEMAND|PROOFPOINT_SENDMAIL_SENTRION|PROOFPOINT_SER|PROOFPOINT_TAP_FORENSICS|PROOFPOINT_TRAP|SENDMAIL|SEPPMAIL|SYMANTEC_VIP|VIRTRU_EMAIL_ENCRYPTION|VOLTAGE|WORKSPACE_ALERTS|ZIX_EMAIL_ENCRYPTION|PHISHLABS/ nocase
$event.metadata.event_type = "EMAIL_UNCATEGORIZED"
or $event.metadata.event_type = "EMAIL_TRANSACTION"
or $event.metadata.event_type = "NETWORK_HTTP"
$Category = $event.security_result.category
$Date = timestamp.get_date($event.metadata.event_timestamp.seconds)
match:
$Date, $Category
outcome:
$Count = count($event.metadata.id)
order:
$Date asc
前 10 個可疑網址
$event.metadata.log_type = /ABNORMAL_SECURITY|AREA1|AVANAN_EMAIL|BARRACUDA_EMAIL|CISCO_EMAIL_SECURITY|COFENSE_TRIAGE|EXCHANGE_MAIL|FIREEYE_EMPS|FIREEYE_ETP|FORCEPOINT_EMAILSECURITY|FORCEPOINT_MAIL_RELAY|FORTINET_FORTIMAIL|KNOWBE4_PHISHER|MAILMARSHAL|MICROSOFT_DEFENDER_MAIL|MIMECAST_MAIL|MIMECAST_URL_LOGS|OBSERVEIT|OFFICE_365|POSTFIX_MAIL|PROOFPOINT_MAIL|PROOFPOINT_MAIL_FILTER|PROOFPOINT_ON_DEMAND|PROOFPOINT_SENDMAIL_SENTRION|PROOFPOINT_SER|PROOFPOINT_TAP_FORENSICS|PROOFPOINT_TRAP|SENDMAIL|SEPPMAIL|SYMANTEC_VIP|VIRTRU_EMAIL_ENCRYPTION|VOLTAGE|WORKSPACE_ALERTS|ZIX_EMAIL_ENCRYPTION|PHISHLABS/ nocase
$event.metadata.event_type = "EMAIL_UNCATEGORIZED"
or $event.metadata.event_type = "EMAIL_TRANSACTION"
or $event.metadata.event_type = "NETWORK_HTTP"
$event.security_result.category = "MAIL_PHISHING"
or $event.security_result.category = "MAIL_SPAM"
or $event.security_result.category = "MAIL_SPOOFING"
or $event.security_result.category = "SOFTWARE_MALICIOUS"
strings.coalesce($event.target.url, $event.security_result.about.url,$event.security_result.detection_fields["detectedUrls"]) != ""
$URL = strings.coalesce($event.target.url, $event.security_result.about.url,$event.security_result.detection_fields["detectedUrls"])
match:
$URL
outcome:
$Count = count($event.metadata.id)
order:
$Count desc
limit:
10
偵測到網路釣魚
$event.metadata.log_type = /ABNORMAL_SECURITY|AREA1|AVANAN_EMAIL|BARRACUDA_EMAIL|CISCO_EMAIL_SECURITY|COFENSE_TRIAGE|EXCHANGE_MAIL|FIREEYE_EMPS|FIREEYE_ETP|FORCEPOINT_EMAILSECURITY|FORCEPOINT_MAIL_RELAY|FORTINET_FORTIMAIL|KNOWBE4_PHISHER|MAILMARSHAL|MICROSOFT_DEFENDER_MAIL|MIMECAST_MAIL|MIMECAST_URL_LOGS|OBSERVEIT|OFFICE_365|POSTFIX_MAIL|PROOFPOINT_MAIL|PROOFPOINT_MAIL_FILTER|PROOFPOINT_ON_DEMAND|PROOFPOINT_SENDMAIL_SENTRION|PROOFPOINT_SER|PROOFPOINT_TAP_FORENSICS|PROOFPOINT_TRAP|SENDMAIL|SEPPMAIL|SYMANTEC_VIP|VIRTRU_EMAIL_ENCRYPTION|VOLTAGE|WORKSPACE_ALERTS|ZIX_EMAIL_ENCRYPTION|PHISHLABS/ nocase
$event.metadata.event_type = "EMAIL_UNCATEGORIZED"
or $event.metadata.event_type = "EMAIL_TRANSACTION"
or $event.metadata.event_type = "NETWORK_HTTP"
$event.security_result.category = "MAIL_PHISHING"
$Email = $event.principal.user.email_addresses
match:
$Email
前 10 大惡意來源 IP
$event.metadata.log_type = /ABNORMAL_SECURITY|AREA1|AVANAN_EMAIL|BARRACUDA_EMAIL|CISCO_EMAIL_SECURITY|COFENSE_TRIAGE|EXCHANGE_MAIL|FIREEYE_EMPS|FIREEYE_ETP|FORCEPOINT_EMAILSECURITY|FORCEPOINT_MAIL_RELAY|FORTINET_FORTIMAIL|KNOWBE4_PHISHER|MAILMARSHAL|MICROSOFT_DEFENDER_MAIL|MIMECAST_MAIL|MIMECAST_URL_LOGS|OBSERVEIT|OFFICE_365|POSTFIX_MAIL|PROOFPOINT_MAIL|PROOFPOINT_MAIL_FILTER|PROOFPOINT_ON_DEMAND|PROOFPOINT_SENDMAIL_SENTRION|PROOFPOINT_SER|PROOFPOINT_TAP_FORENSICS|PROOFPOINT_TRAP|SENDMAIL|SEPPMAIL|SYMANTEC_VIP|VIRTRU_EMAIL_ENCRYPTION|VOLTAGE|WORKSPACE_ALERTS|ZIX_EMAIL_ENCRYPTION|PHISHLABS/ nocase
$event.metadata.event_type = "EMAIL_UNCATEGORIZED"
or $event.metadata.event_type = "EMAIL_TRANSACTION"
or $event.metadata.event_type = "NETWORK_HTTP"
$event.security_result.detection_fields["judgement"] = /MALICIOUS/ nocase
$event.principal.ip != ""
$Source_IP = $event.principal.ip
match:
$Source_IP
outcome:
$Count = count($event.principal.ip)
order:
$Count desc
limit:
10
依類別分類的電子郵件威脅
$event.metadata.log_type = /ABNORMAL_SECURITY|AREA1|AVANAN_EMAIL|BARRACUDA_EMAIL|CISCO_EMAIL_SECURITY|COFENSE_TRIAGE|EXCHANGE_MAIL|FIREEYE_EMPS|FIREEYE_ETP|FORCEPOINT_EMAILSECURITY|FORCEPOINT_MAIL_RELAY|FORTINET_FORTIMAIL|KNOWBE4_PHISHER|MAILMARSHAL|MICROSOFT_DEFENDER_MAIL|MIMECAST_MAIL|MIMECAST_URL_LOGS|OBSERVEIT|OFFICE_365|POSTFIX_MAIL|PROOFPOINT_MAIL|PROOFPOINT_MAIL_FILTER|PROOFPOINT_ON_DEMAND|PROOFPOINT_SENDMAIL_SENTRION|PROOFPOINT_SER|PROOFPOINT_TAP_FORENSICS|PROOFPOINT_TRAP|SENDMAIL|SEPPMAIL|SYMANTEC_VIP|VIRTRU_EMAIL_ENCRYPTION|VOLTAGE|WORKSPACE_ALERTS|ZIX_EMAIL_ENCRYPTION|PHISHLABS/ nocase
$Threat_Name = $event.security_result.category_details
$Category = $event.security_result.category
match:
$Threat_Name, $Category
outcome:
$Count = count($event.security_result.threat_name)
order:
$Count desc
limit:
50
一段時間內採取的行動
$event.metadata.log_type = /ABNORMAL_SECURITY|AREA1|AVANAN_EMAIL|BARRACUDA_EMAIL|CISCO_EMAIL_SECURITY|COFENSE_TRIAGE|EXCHANGE_MAIL|FIREEYE_EMPS|FIREEYE_ETP|FORCEPOINT_EMAILSECURITY|FORCEPOINT_MAIL_RELAY|FORTINET_FORTIMAIL|KNOWBE4_PHISHER|MAILMARSHAL|MICROSOFT_DEFENDER_MAIL|MIMECAST_MAIL|MIMECAST_URL_LOGS|OBSERVEIT|OFFICE_365|POSTFIX_MAIL|PROOFPOINT_MAIL|PROOFPOINT_MAIL_FILTER|PROOFPOINT_ON_DEMAND|PROOFPOINT_SENDMAIL_SENTRION|PROOFPOINT_SER|PROOFPOINT_TAP_FORENSICS|PROOFPOINT_TRAP|SENDMAIL|SEPPMAIL|SYMANTEC_VIP|VIRTRU_EMAIL_ENCRYPTION|VOLTAGE|WORKSPACE_ALERTS|ZIX_EMAIL_ENCRYPTION|PHISHLABS/ nocase
$event.metadata.event_type = "EMAIL_UNCATEGORIZED"
or $event.metadata.event_type = "EMAIL_TRANSACTION"
or $event.metadata.event_type = "NETWORK_HTTP"
$Action = $event.security_result.action
$Date = timestamp.get_date($event.metadata.event_timestamp.seconds)
match:
$Date, $Action
outcome:
$Count = count($event.metadata.id)
order:
$Date asc
過去一段時間內偵測到的電子郵件威脅
$event.metadata.log_type = /ABNORMAL_SECURITY|AREA1|AVANAN_EMAIL|BARRACUDA_EMAIL|CISCO_EMAIL_SECURITY|COFENSE_TRIAGE|EXCHANGE_MAIL|FIREEYE_EMPS|FIREEYE_ETP|FORCEPOINT_EMAILSECURITY|FORCEPOINT_MAIL_RELAY|FORTINET_FORTIMAIL|KNOWBE4_PHISHER|MAILMARSHAL|MICROSOFT_DEFENDER_MAIL|MIMECAST_MAIL|MIMECAST_URL_LOGS|OBSERVEIT|OFFICE_365|POSTFIX_MAIL|PROOFPOINT_MAIL|PROOFPOINT_MAIL_FILTER|PROOFPOINT_ON_DEMAND|PROOFPOINT_SENDMAIL_SENTRION|PROOFPOINT_SER|PROOFPOINT_TAP_FORENSICS|PROOFPOINT_TRAP|SENDMAIL|SEPPMAIL|SYMANTEC_VIP|VIRTRU_EMAIL_ENCRYPTION|VOLTAGE|WORKSPACE_ALERTS|ZIX_EMAIL_ENCRYPTION|PHISHLABS/ nocase
$event.metadata.event_type = "EMAIL_UNCATEGORIZED"
or $event.metadata.event_type = "EMAIL_TRANSACTION"
or $event.metadata.event_type = "NETWORK_HTTP"
$Threat_Name = $event.security_result.threat_name
$Date = timestamp.get_date($event.metadata.event_timestamp.seconds)
match:
$Date, $Threat_Name
outcome:
$Count = count($event.metadata.id)
order:
$Date asc
過去一段時間內偵測到的電子郵件威脅
$event.metadata.log_type = /ABNORMAL_SECURITY|AREA1|AVANAN_EMAIL|BARRACUDA_EMAIL|CISCO_EMAIL_SECURITY|COFENSE_TRIAGE|EXCHANGE_MAIL|FIREEYE_EMPS|FIREEYE_ETP|FORCEPOINT_EMAILSECURITY|FORCEPOINT_MAIL_RELAY|FORTINET_FORTIMAIL|KNOWBE4_PHISHER|MAILMARSHAL|MICROSOFT_DEFENDER_MAIL|MIMECAST_MAIL|MIMECAST_URL_LOGS|OBSERVEIT|OFFICE_365|POSTFIX_MAIL|PROOFPOINT_MAIL|PROOFPOINT_MAIL_FILTER|PROOFPOINT_ON_DEMAND|PROOFPOINT_SENDMAIL_SENTRION|PROOFPOINT_SER|PROOFPOINT_TAP_FORENSICS|PROOFPOINT_TRAP|SENDMAIL|SEPPMAIL|SYMANTEC_VIP|VIRTRU_EMAIL_ENCRYPTION|VOLTAGE|WORKSPACE_ALERTS|ZIX_EMAIL_ENCRYPTION|PHISHLABS/ nocase
$event.metadata.event_type = "EMAIL_UNCATEGORIZED"
or $event.metadata.event_type = "EMAIL_TRANSACTION"
or $event.metadata.event_type = "NETWORK_HTTP"
$Threat_Name = $event.security_result.threat_name
$Date = timestamp.get_date($event.metadata.event_timestamp.seconds)
match:
$Date, $Threat_Name
outcome:
$Count = count($event.metadata.id)
order:
$Date asc
近期作用中的威脅
$event.metadata.log_type = /ABNORMAL_SECURITY|AREA1|AVANAN_EMAIL|BARRACUDA_EMAIL|CISCO_EMAIL_SECURITY|COFENSE_TRIAGE|EXCHANGE_MAIL|FIREEYE_EMPS|FIREEYE_ETP|FORCEPOINT_EMAILSECURITY|FORCEPOINT_MAIL_RELAY|FORTINET_FORTIMAIL|KNOWBE4_PHISHER|MAILMARSHAL|MICROSOFT_DEFENDER_MAIL|MIMECAST_MAIL|MIMECAST_URL_LOGS|OBSERVEIT|OFFICE_365|POSTFIX_MAIL|PROOFPOINT_MAIL|PROOFPOINT_MAIL_FILTER|PROOFPOINT_ON_DEMAND|PROOFPOINT_SENDMAIL_SENTRION|PROOFPOINT_SER|PROOFPOINT_TAP_FORENSICS|PROOFPOINT_TRAP|SENDMAIL|SEPPMAIL|SYMANTEC_VIP|VIRTRU_EMAIL_ENCRYPTION|VOLTAGE|WORKSPACE_ALERTS|ZIX_EMAIL_ENCRYPTION|PHISHLABS/ nocase
$event.metadata.event_type = "EMAIL_UNCATEGORIZED"
or $event.metadata.event_type = "EMAIL_TRANSACTION"
or $event.metadata.event_type = "NETWORK_HTTP"
$Threat_Name = $event.security_result.threat_name
$Status = $event.security_result.threat_status
match:
$Threat_Name, $Status
outcome:
$Count = count($event.metadata.id)
$Date = timestamp.get_timestamp(max($event.metadata.event_timestamp.seconds))
order:
$Date desc
limit:
50
封鎖的網址與允許的網址
$event.metadata.log_type = /ABNORMAL_SECURITY|AREA1|AVANAN_EMAIL|BARRACUDA_EMAIL|CISCO_EMAIL_SECURITY|COFENSE_TRIAGE|EXCHANGE_MAIL|FIREEYE_EMPS|FIREEYE_ETP|FORCEPOINT_EMAILSECURITY|FORCEPOINT_MAIL_RELAY|FORTINET_FORTIMAIL|KNOWBE4_PHISHER|MAILMARSHAL|MICROSOFT_DEFENDER_MAIL|MIMECAST_MAIL|MIMECAST_URL_LOGS|OBSERVEIT|OFFICE_365|POSTFIX_MAIL|PROOFPOINT_MAIL|PROOFPOINT_MAIL_FILTER|PROOFPOINT_ON_DEMAND|PROOFPOINT_SENDMAIL_SENTRION|PROOFPOINT_SER|PROOFPOINT_TAP_FORENSICS|PROOFPOINT_TRAP|SENDMAIL|SEPPMAIL|SYMANTEC_VIP|VIRTRU_EMAIL_ENCRYPTION|VOLTAGE|WORKSPACE_ALERTS|ZIX_EMAIL_ENCRYPTION|PHISHLABS/ nocase
$event.metadata.event_type = "EMAIL_UNCATEGORIZED"
or $event.metadata.event_type = "EMAIL_TRANSACTION"
or $event.metadata.event_type = "NETWORK_HTTP"
$event.security_result.action = "ALLOW"
or $event.security_result.action = "BLOCK"
$Action = $event.security_result.action
$Date = timestamp.get_date($event.metadata.event_timestamp.seconds)
match:
$Date, $Action
outcome:
$Count = count($event.target.url)
order:
$Count desc
偵測到網路釣魚
$event.metadata.log_type = /ABNORMAL_SECURITY|AREA1|AVANAN_EMAIL|BARRACUDA_EMAIL|CISCO_EMAIL_SECURITY|COFENSE_TRIAGE|EXCHANGE_MAIL|FIREEYE_EMPS|FIREEYE_ETP|FORCEPOINT_EMAILSECURITY|FORCEPOINT_MAIL_RELAY|FORTINET_FORTIMAIL|KNOWBE4_PHISHER|MAILMARSHAL|MICROSOFT_DEFENDER_MAIL|MIMECAST_MAIL|MIMECAST_URL_LOGS|OBSERVEIT|OFFICE_365|POSTFIX_MAIL|PROOFPOINT_MAIL|PROOFPOINT_MAIL_FILTER|PROOFPOINT_ON_DEMAND|PROOFPOINT_SENDMAIL_SENTRION|PROOFPOINT_SER|PROOFPOINT_TAP_FORENSICS|PROOFPOINT_TRAP|SENDMAIL|SEPPMAIL|SYMANTEC_VIP|VIRTRU_EMAIL_ENCRYPTION|VOLTAGE|WORKSPACE_ALERTS|ZIX_EMAIL_ENCRYPTION|PHISHLABS/ nocase
$event.metadata.event_type = "EMAIL_UNCATEGORIZED"
or $event.metadata.event_type = "EMAIL_TRANSACTION"
or $event.metadata.event_type = "NETWORK_HTTP"
$event.security_result.category = "MAIL_PHISHING"
$Email = $event.principal.user.email_addresses
match:
$Email
前 10 大惡意寄件者
$event.metadata.log_type = /ABNORMAL_SECURITY|AREA1|AVANAN_EMAIL|BARRACUDA_EMAIL|CISCO_EMAIL_SECURITY|COFENSE_TRIAGE|EXCHANGE_MAIL|FIREEYE_EMPS|FIREEYE_ETP|FORCEPOINT_EMAILSECURITY|FORCEPOINT_MAIL_RELAY|FORTINET_FORTIMAIL|KNOWBE4_PHISHER|MAILMARSHAL|MICROSOFT_DEFENDER_MAIL|MIMECAST_MAIL|MIMECAST_URL_LOGS|OBSERVEIT|OFFICE_365|POSTFIX_MAIL|PROOFPOINT_MAIL|PROOFPOINT_MAIL_FILTER|PROOFPOINT_ON_DEMAND|PROOFPOINT_SENDMAIL_SENTRION|PROOFPOINT_SER|PROOFPOINT_TAP_FORENSICS|PROOFPOINT_TRAP|SENDMAIL|SEPPMAIL|SYMANTEC_VIP|VIRTRU_EMAIL_ENCRYPTION|VOLTAGE|WORKSPACE_ALERTS|ZIX_EMAIL_ENCRYPTION|PHISHLABS/ nocase
$event.metadata.event_type = "EMAIL_UNCATEGORIZED"
or $event.metadata.event_type = "EMAIL_TRANSACTION"
or $event.metadata.event_type = "NETWORK_HTTP"
$event.security_result.detection_fields["judgement"] = /MALICIOUS/ nocase
$event.network.email.from != ""
$Sender = $event.network.email.from
match:
$Sender
outcome:
$Count = count($event.network.email.from)
order:
$Count desc
limit:
10
最近的惡意附件
$event.metadata.log_type = /ABNORMAL_SECURITY|AREA1|AVANAN_EMAIL|BARRACUDA_EMAIL|CISCO_EMAIL_SECURITY|COFENSE_TRIAGE|EXCHANGE_MAIL|FIREEYE_EMPS|FIREEYE_ETP|FORCEPOINT_EMAILSECURITY|FORCEPOINT_MAIL_RELAY|FORTINET_FORTIMAIL|KNOWBE4_PHISHER|MAILMARSHAL|MICROSOFT_DEFENDER_MAIL|MIMECAST_MAIL|MIMECAST_URL_LOGS|OBSERVEIT|OFFICE_365|POSTFIX_MAIL|PROOFPOINT_MAIL|PROOFPOINT_MAIL_FILTER|PROOFPOINT_ON_DEMAND|PROOFPOINT_SENDMAIL_SENTRION|PROOFPOINT_SER|PROOFPOINT_TAP_FORENSICS|PROOFPOINT_TRAP|SENDMAIL|SEPPMAIL|SYMANTEC_VIP|VIRTRU_EMAIL_ENCRYPTION|VOLTAGE|WORKSPACE_ALERTS|ZIX_EMAIL_ENCRYPTION|PHISHLABS/ nocase
$event.metadata.event_type = "EMAIL_UNCATEGORIZED"
or $event.metadata.event_type = "EMAIL_TRANSACTION"
or $event.metadata.event_type = "NETWORK_HTTP"
strings.coalesce($event.about.file.full_path, $event.security_result.detection_fields["attachmentNames"]) != ""
$Attachment = strings.coalesce($event.about.file.full_path, $event.security_result.detection_fields["attachmentNames"])
$Category = $event.security_result.category
$Sender = $event.network.email.from
$Receiver = $event.network.email.to
$Status = $event.additional.fields["remediationStatus"]
$Date = timestamp.get_date($event.metadata.event_timestamp.seconds)
match:
$Date, $Sender, $Receiver, $Attachment, $Category, $Status
order:
$Date desc
limit:
50
偵測到的網路釣魚行為總數
$event.metadata.log_type = /ABNORMAL_SECURITY|AREA1|AVANAN_EMAIL|BARRACUDA_EMAIL|CISCO_EMAIL_SECURITY|COFENSE_TRIAGE|EXCHANGE_MAIL|FIREEYE_EMPS|FIREEYE_ETP|FORCEPOINT_EMAILSECURITY|FORCEPOINT_MAIL_RELAY|FORTINET_FORTIMAIL|KNOWBE4_PHISHER|MAILMARSHAL|MICROSOFT_DEFENDER_MAIL|MIMECAST_MAIL|MIMECAST_URL_LOGS|OBSERVEIT|OFFICE_365|POSTFIX_MAIL|PROOFPOINT_MAIL|PROOFPOINT_MAIL_FILTER|PROOFPOINT_ON_DEMAND|PROOFPOINT_SENDMAIL_SENTRION|PROOFPOINT_SER|PROOFPOINT_TAP_FORENSICS|PROOFPOINT_TRAP|SENDMAIL|SEPPMAIL|SYMANTEC_VIP|VIRTRU_EMAIL_ENCRYPTION|VOLTAGE|WORKSPACE_ALERTS|ZIX_EMAIL_ENCRYPTION|PHISHLABS/ nocase
$event.metadata.event_type = "EMAIL_UNCATEGORIZED"
or $event.metadata.event_type = "EMAIL_TRANSACTION"
or $event.metadata.event_type = "NETWORK_HTTP"
$event.security_result.category = "MAIL_PHISHING"
outcome:
$Count = count_distinct($event.principal.user.email_addresses)
前 10 大目標電子郵件
$event.metadata.log_type = /ABNORMAL_SECURITY|AREA1|AVANAN_EMAIL|BARRACUDA_EMAIL|CISCO_EMAIL_SECURITY|COFENSE_TRIAGE|EXCHANGE_MAIL|FIREEYE_EMPS|FIREEYE_ETP|FORCEPOINT_EMAILSECURITY|FORCEPOINT_MAIL_RELAY|FORTINET_FORTIMAIL|KNOWBE4_PHISHER|MAILMARSHAL|MICROSOFT_DEFENDER_MAIL|MIMECAST_MAIL|MIMECAST_URL_LOGS|OBSERVEIT|OFFICE_365|POSTFIX_MAIL|PROOFPOINT_MAIL|PROOFPOINT_MAIL_FILTER|PROOFPOINT_ON_DEMAND|PROOFPOINT_SENDMAIL_SENTRION|PROOFPOINT_SER|PROOFPOINT_TAP_FORENSICS|PROOFPOINT_TRAP|SENDMAIL|SEPPMAIL|SYMANTEC_VIP|VIRTRU_EMAIL_ENCRYPTION|VOLTAGE|WORKSPACE_ALERTS|ZIX_EMAIL_ENCRYPTION|PHISHLABS/ nocase
$event.metadata.event_type = "EMAIL_UNCATEGORIZED"
or $event.metadata.event_type = "EMAIL_TRANSACTION"
or $event.metadata.event_type = "NETWORK_HTTP"
$event.target.user.email_addresses != ""
$Target = $event.target.user.email_addresses
match:
$Target
outcome:
$Count = count($event.target.user.email_addresses)
order:
$Count desc
limit:
10
電子郵件類別隨時間變化
$event.metadata.log_type = /ABNORMAL_SECURITY|AREA1|AVANAN_EMAIL|BARRACUDA_EMAIL|CISCO_EMAIL_SECURITY|COFENSE_TRIAGE|EXCHANGE_MAIL|FIREEYE_EMPS|FIREEYE_ETP|FORCEPOINT_EMAILSECURITY|FORCEPOINT_MAIL_RELAY|FORTINET_FORTIMAIL|KNOWBE4_PHISHER|MAILMARSHAL|MICROSOFT_DEFENDER_MAIL|MIMECAST_MAIL|MIMECAST_URL_LOGS|OBSERVEIT|OFFICE_365|POSTFIX_MAIL|PROOFPOINT_MAIL|PROOFPOINT_MAIL_FILTER|PROOFPOINT_ON_DEMAND|PROOFPOINT_SENDMAIL_SENTRION|PROOFPOINT_SER|PROOFPOINT_TAP_FORENSICS|PROOFPOINT_TRAP|SENDMAIL|SEPPMAIL|SYMANTEC_VIP|VIRTRU_EMAIL_ENCRYPTION|VOLTAGE|WORKSPACE_ALERTS|ZIX_EMAIL_ENCRYPTION|PHISHLABS/ nocase
$event.metadata.event_type = "EMAIL_UNCATEGORIZED"
or $event.metadata.event_type = "EMAIL_TRANSACTION"
or $event.metadata.event_type = "NETWORK_HTTP"
$Category = $event.security_result.category
$Date = timestamp.get_date($event.metadata.event_timestamp.seconds)
match:
$Date, $Category
outcome:
$Count = count($event.metadata.id)
order:
$Date asc
前 10 個可疑網址
$event.metadata.log_type = /ABNORMAL_SECURITY|AREA1|AVANAN_EMAIL|BARRACUDA_EMAIL|CISCO_EMAIL_SECURITY|COFENSE_TRIAGE|EXCHANGE_MAIL|FIREEYE_EMPS|FIREEYE_ETP|FORCEPOINT_EMAILSECURITY|FORCEPOINT_MAIL_RELAY|FORTINET_FORTIMAIL|KNOWBE4_PHISHER|MAILMARSHAL|MICROSOFT_DEFENDER_MAIL|MIMECAST_MAIL|MIMECAST_URL_LOGS|OBSERVEIT|OFFICE_365|POSTFIX_MAIL|PROOFPOINT_MAIL|PROOFPOINT_MAIL_FILTER|PROOFPOINT_ON_DEMAND|PROOFPOINT_SENDMAIL_SENTRION|PROOFPOINT_SER|PROOFPOINT_TAP_FORENSICS|PROOFPOINT_TRAP|SENDMAIL|SEPPMAIL|SYMANTEC_VIP|VIRTRU_EMAIL_ENCRYPTION|VOLTAGE|WORKSPACE_ALERTS|ZIX_EMAIL_ENCRYPTION|PHISHLABS/ nocase
$event.metadata.event_type = "EMAIL_UNCATEGORIZED"
or $event.metadata.event_type = "EMAIL_TRANSACTION"
or $event.metadata.event_type = "NETWORK_HTTP"
$event.security_result.category = "MAIL_PHISHING"
or $event.security_result.category = "MAIL_SPAM"
or $event.security_result.category = "MAIL_SPOOFING"
or $event.security_result.category = "SOFTWARE_MALICIOUS"
strings.coalesce($event.target.url, $event.security_result.about.url,$event.security_result.detection_fields["detectedUrls"]) != ""
$URL = strings.coalesce($event.target.url, $event.security_result.about.url,$event.security_result.detection_fields["detectedUrls"])
match:
$URL
outcome:
$Count = count($event.metadata.id)
order:
$Count desc
limit:
10
一段時間內採取的行動
$event.metadata.log_type = /ABNORMAL_SECURITY|AREA1|AVANAN_EMAIL|BARRACUDA_EMAIL|CISCO_EMAIL_SECURITY|COFENSE_TRIAGE|EXCHANGE_MAIL|FIREEYE_EMPS|FIREEYE_ETP|FORCEPOINT_EMAILSECURITY|FORCEPOINT_MAIL_RELAY|FORTINET_FORTIMAIL|KNOWBE4_PHISHER|MAILMARSHAL|MICROSOFT_DEFENDER_MAIL|MIMECAST_MAIL|MIMECAST_URL_LOGS|OBSERVEIT|OFFICE_365|POSTFIX_MAIL|PROOFPOINT_MAIL|PROOFPOINT_MAIL_FILTER|PROOFPOINT_ON_DEMAND|PROOFPOINT_SENDMAIL_SENTRION|PROOFPOINT_SER|PROOFPOINT_TAP_FORENSICS|PROOFPOINT_TRAP|SENDMAIL|SEPPMAIL|SYMANTEC_VIP|VIRTRU_EMAIL_ENCRYPTION|VOLTAGE|WORKSPACE_ALERTS|ZIX_EMAIL_ENCRYPTION|PHISHLABS/ nocase
$event.metadata.event_type = "EMAIL_UNCATEGORIZED"
or $event.metadata.event_type = "EMAIL_TRANSACTION"
or $event.metadata.event_type = "NETWORK_HTTP"
$Action = $event.security_result.action
$Date = timestamp.get_date($event.metadata.event_timestamp.seconds)
match:
$Date, $Action
outcome:
$Count = count($event.metadata.id)
order:
$Date asc
前 10 大高嚴重性威脅
$event.metadata.log_type = /ABNORMAL_SECURITY|AREA1|AVANAN_EMAIL|BARRACUDA_EMAIL|CISCO_EMAIL_SECURITY|COFENSE_TRIAGE|EXCHANGE_MAIL|FIREEYE_EMPS|FIREEYE_ETP|FORCEPOINT_EMAILSECURITY|FORCEPOINT_MAIL_RELAY|FORTINET_FORTIMAIL|KNOWBE4_PHISHER|MAILMARSHAL|MICROSOFT_DEFENDER_MAIL|MIMECAST_MAIL|MIMECAST_URL_LOGS|OBSERVEIT|OFFICE_365|POSTFIX_MAIL|PROOFPOINT_MAIL|PROOFPOINT_MAIL_FILTER|PROOFPOINT_ON_DEMAND|PROOFPOINT_SENDMAIL_SENTRION|PROOFPOINT_SER|PROOFPOINT_TAP_FORENSICS|PROOFPOINT_TRAP|SENDMAIL|SEPPMAIL|SYMANTEC_VIP|VIRTRU_EMAIL_ENCRYPTION|VOLTAGE|WORKSPACE_ALERTS|ZIX_EMAIL_ENCRYPTION|PHISHLABS/ nocase
$event.metadata.event_type = "EMAIL_UNCATEGORIZED"
or $event.metadata.event_type = "EMAIL_TRANSACTION"
or $event.metadata.event_type = "NETWORK_HTTP"
$event.security_result.category_details != ""
$event.security_result.severity = "HIGH"
$Category = $event.security_result.category_details
$Category != ""
match:
$Category
outcome:
$Count = count($event.metadata.id)
order:
$Count desc
limit:
10
前 10 大惡意來源 IP
$event.metadata.log_type = /ABNORMAL_SECURITY|AREA1|AVANAN_EMAIL|BARRACUDA_EMAIL|CISCO_EMAIL_SECURITY|COFENSE_TRIAGE|EXCHANGE_MAIL|FIREEYE_EMPS|FIREEYE_ETP|FORCEPOINT_EMAILSECURITY|FORCEPOINT_MAIL_RELAY|FORTINET_FORTIMAIL|KNOWBE4_PHISHER|MAILMARSHAL|MICROSOFT_DEFENDER_MAIL|MIMECAST_MAIL|MIMECAST_URL_LOGS|OBSERVEIT|OFFICE_365|POSTFIX_MAIL|PROOFPOINT_MAIL|PROOFPOINT_MAIL_FILTER|PROOFPOINT_ON_DEMAND|PROOFPOINT_SENDMAIL_SENTRION|PROOFPOINT_SER|PROOFPOINT_TAP_FORENSICS|PROOFPOINT_TRAP|SENDMAIL|SEPPMAIL|SYMANTEC_VIP|VIRTRU_EMAIL_ENCRYPTION|VOLTAGE|WORKSPACE_ALERTS|ZIX_EMAIL_ENCRYPTION|PHISHLABS/ nocase
$event.metadata.event_type = "EMAIL_UNCATEGORIZED"
or $event.metadata.event_type = "EMAIL_TRANSACTION"
or $event.metadata.event_type = "NETWORK_HTTP"
$event.security_result.detection_fields["judgement"] = /MALICIOUS/ nocase
$event.principal.ip != ""
$Source_IP = $event.principal.ip
match:
$Source_IP
outcome:
$Count = count($event.principal.ip)
order:
$Count desc
limit:
10
前 10 大惡意寄件者
$event.metadata.log_type = /ABNORMAL_SECURITY|AREA1|AVANAN_EMAIL|BARRACUDA_EMAIL|CISCO_EMAIL_SECURITY|COFENSE_TRIAGE|EXCHANGE_MAIL|FIREEYE_EMPS|FIREEYE_ETP|FORCEPOINT_EMAILSECURITY|FORCEPOINT_MAIL_RELAY|FORTINET_FORTIMAIL|KNOWBE4_PHISHER|MAILMARSHAL|MICROSOFT_DEFENDER_MAIL|MIMECAST_MAIL|MIMECAST_URL_LOGS|OBSERVEIT|OFFICE_365|POSTFIX_MAIL|PROOFPOINT_MAIL|PROOFPOINT_MAIL_FILTER|PROOFPOINT_ON_DEMAND|PROOFPOINT_SENDMAIL_SENTRION|PROOFPOINT_SER|PROOFPOINT_TAP_FORENSICS|PROOFPOINT_TRAP|SENDMAIL|SEPPMAIL|SYMANTEC_VIP|VIRTRU_EMAIL_ENCRYPTION|VOLTAGE|WORKSPACE_ALERTS|ZIX_EMAIL_ENCRYPTION|PHISHLABS/ nocase
$event.metadata.event_type = "EMAIL_UNCATEGORIZED"
or $event.metadata.event_type = "EMAIL_TRANSACTION"
or $event.metadata.event_type = "NETWORK_HTTP"
$event.security_result.detection_fields["judgement"] = /MALICIOUS/ nocase
$event.network.email.from != ""
$Sender = $event.network.email.from
match:
$Sender
outcome:
$Count = count($event.network.email.from)
order:
$Count desc
limit:
10
封鎖的網址與允許的網址
$event.metadata.log_type = /ABNORMAL_SECURITY|AREA1|AVANAN_EMAIL|BARRACUDA_EMAIL|CISCO_EMAIL_SECURITY|COFENSE_TRIAGE|EXCHANGE_MAIL|FIREEYE_EMPS|FIREEYE_ETP|FORCEPOINT_EMAILSECURITY|FORCEPOINT_MAIL_RELAY|FORTINET_FORTIMAIL|KNOWBE4_PHISHER|MAILMARSHAL|MICROSOFT_DEFENDER_MAIL|MIMECAST_MAIL|MIMECAST_URL_LOGS|OBSERVEIT|OFFICE_365|POSTFIX_MAIL|PROOFPOINT_MAIL|PROOFPOINT_MAIL_FILTER|PROOFPOINT_ON_DEMAND|PROOFPOINT_SENDMAIL_SENTRION|PROOFPOINT_SER|PROOFPOINT_TAP_FORENSICS|PROOFPOINT_TRAP|SENDMAIL|SEPPMAIL|SYMANTEC_VIP|VIRTRU_EMAIL_ENCRYPTION|VOLTAGE|WORKSPACE_ALERTS|ZIX_EMAIL_ENCRYPTION|PHISHLABS/ nocase
$event.metadata.event_type = "EMAIL_UNCATEGORIZED"
or $event.metadata.event_type = "EMAIL_TRANSACTION"
or $event.metadata.event_type = "NETWORK_HTTP"
$event.security_result.action = "ALLOW"
or $event.security_result.action = "BLOCK"
$Action = $event.security_result.action
$Date = timestamp.get_date($event.metadata.event_timestamp.seconds)
match:
$Date, $Action
outcome:
$Count = count($event.target.url)
order:
$Count desc
最近的惡意附件
$event.metadata.log_type = /ABNORMAL_SECURITY|AREA1|AVANAN_EMAIL|BARRACUDA_EMAIL|CISCO_EMAIL_SECURITY|COFENSE_TRIAGE|EXCHANGE_MAIL|FIREEYE_EMPS|FIREEYE_ETP|FORCEPOINT_EMAILSECURITY|FORCEPOINT_MAIL_RELAY|FORTINET_FORTIMAIL|KNOWBE4_PHISHER|MAILMARSHAL|MICROSOFT_DEFENDER_MAIL|MIMECAST_MAIL|MIMECAST_URL_LOGS|OBSERVEIT|OFFICE_365|POSTFIX_MAIL|PROOFPOINT_MAIL|PROOFPOINT_MAIL_FILTER|PROOFPOINT_ON_DEMAND|PROOFPOINT_SENDMAIL_SENTRION|PROOFPOINT_SER|PROOFPOINT_TAP_FORENSICS|PROOFPOINT_TRAP|SENDMAIL|SEPPMAIL|SYMANTEC_VIP|VIRTRU_EMAIL_ENCRYPTION|VOLTAGE|WORKSPACE_ALERTS|ZIX_EMAIL_ENCRYPTION|PHISHLABS/ nocase
$event.metadata.event_type = "EMAIL_UNCATEGORIZED"
or $event.metadata.event_type = "EMAIL_TRANSACTION"
or $event.metadata.event_type = "NETWORK_HTTP"
strings.coalesce($event.about.file.full_path, $event.security_result.detection_fields["attachmentNames"]) != ""
$Attachment = strings.coalesce($event.about.file.full_path, $event.security_result.detection_fields["attachmentNames"])
$Category = $event.security_result.category
$Sender = $event.network.email.from
$Receiver = $event.network.email.to
$Status = $event.additional.fields["remediationStatus"]
$Date = timestamp.get_date($event.metadata.event_timestamp.seconds)
match:
$Date, $Sender, $Receiver, $Attachment, $Category, $Status
order:
$Date desc
limit:
50
前 10 大惡意位置
$event.metadata.log_type = /ABNORMAL_SECURITY|AREA1|AVANAN_EMAIL|BARRACUDA_EMAIL|CISCO_EMAIL_SECURITY|COFENSE_TRIAGE|EXCHANGE_MAIL|FIREEYE_EMPS|FIREEYE_ETP|FORCEPOINT_EMAILSECURITY|FORCEPOINT_MAIL_RELAY|FORTINET_FORTIMAIL|KNOWBE4_PHISHER|MAILMARSHAL|MICROSOFT_DEFENDER_MAIL|MIMECAST_MAIL|MIMECAST_URL_LOGS|OBSERVEIT|OFFICE_365|POSTFIX_MAIL|PROOFPOINT_MAIL|PROOFPOINT_MAIL_FILTER|PROOFPOINT_ON_DEMAND|PROOFPOINT_SENDMAIL_SENTRION|PROOFPOINT_SER|PROOFPOINT_TAP_FORENSICS|PROOFPOINT_TRAP|SENDMAIL|SEPPMAIL|SYMANTEC_VIP|VIRTRU_EMAIL_ENCRYPTION|VOLTAGE|WORKSPACE_ALERTS|ZIX_EMAIL_ENCRYPTION|PHISHLABS/ nocase
$event.metadata.event_type = "EMAIL_UNCATEGORIZED"
or $event.metadata.event_type = "EMAIL_TRANSACTION"
or $event.metadata.event_type = "NETWORK_HTTP"
$event.security_result.detection_fields["judgement"] = /MALICIOUS/ nocase
$event.principal.location.country_or_region != ""
$Countries = $event.principal.location.country_or_region
$Latitude = $event.principal.location.region_coordinates.latitude
$Longitude = $event.principal.location.region_coordinates.longitude
match:
$Countries, $Latitude, $Longitude
outcome:
$Count = count($event.metadata.id)
order:
$Count desc
limit:
10
依類別分類的電子郵件威脅
$event.metadata.log_type = /ABNORMAL_SECURITY|AREA1|AVANAN_EMAIL|BARRACUDA_EMAIL|CISCO_EMAIL_SECURITY|COFENSE_TRIAGE|EXCHANGE_MAIL|FIREEYE_EMPS|FIREEYE_ETP|FORCEPOINT_EMAILSECURITY|FORCEPOINT_MAIL_RELAY|FORTINET_FORTIMAIL|KNOWBE4_PHISHER|MAILMARSHAL|MICROSOFT_DEFENDER_MAIL|MIMECAST_MAIL|MIMECAST_URL_LOGS|OBSERVEIT|OFFICE_365|POSTFIX_MAIL|PROOFPOINT_MAIL|PROOFPOINT_MAIL_FILTER|PROOFPOINT_ON_DEMAND|PROOFPOINT_SENDMAIL_SENTRION|PROOFPOINT_SER|PROOFPOINT_TAP_FORENSICS|PROOFPOINT_TRAP|SENDMAIL|SEPPMAIL|SYMANTEC_VIP|VIRTRU_EMAIL_ENCRYPTION|VOLTAGE|WORKSPACE_ALERTS|ZIX_EMAIL_ENCRYPTION|PHISHLABS/ nocase
$Threat_Name = $event.security_result.category_details
$Category = $event.security_result.category
match:
$Threat_Name, $Category
outcome:
$Count = count($event.security_result.threat_name)
order:
$Count desc
limit:
50
依嚴重性分類的前 10 大電子郵件威脅
$event.metadata.log_type = /ABNORMAL_SECURITY|AREA1|AVANAN_EMAIL|BARRACUDA_EMAIL|CISCO_EMAIL_SECURITY|COFENSE_TRIAGE|EXCHANGE_MAIL|FIREEYE_EMPS|FIREEYE_ETP|FORCEPOINT_EMAILSECURITY|FORCEPOINT_MAIL_RELAY|FORTINET_FORTIMAIL|KNOWBE4_PHISHER|MAILMARSHAL|MICROSOFT_DEFENDER_MAIL|MIMECAST_MAIL|MIMECAST_URL_LOGS|OBSERVEIT|OFFICE_365|POSTFIX_MAIL|PROOFPOINT_MAIL|PROOFPOINT_MAIL_FILTER|PROOFPOINT_ON_DEMAND|PROOFPOINT_SENDMAIL_SENTRION|PROOFPOINT_SER|PROOFPOINT_TAP_FORENSICS|PROOFPOINT_TRAP|SENDMAIL|SEPPMAIL|SYMANTEC_VIP|VIRTRU_EMAIL_ENCRYPTION|VOLTAGE|WORKSPACE_ALERTS|ZIX_EMAIL_ENCRYPTION|PHISHLABS/ nocase
$event.metadata.event_type = "EMAIL_UNCATEGORIZED"
or $event.metadata.event_type = "EMAIL_TRANSACTION"
or $event.metadata.event_type = "NETWORK_HTTP"
$event.security_result.category_details != ""
$Severity = $event.security_result.severity
$Threat_Name = $event.security_result.category_details
$Threat_Name != ""
match:
$Threat_Name, $Severity
outcome:
$Count = count($event.security_result.severity)
order:
$Count desc
limit:
10
近期作用中的威脅
$event.metadata.log_type = /ABNORMAL_SECURITY|AREA1|AVANAN_EMAIL|BARRACUDA_EMAIL|CISCO_EMAIL_SECURITY|COFENSE_TRIAGE|EXCHANGE_MAIL|FIREEYE_EMPS|FIREEYE_ETP|FORCEPOINT_EMAILSECURITY|FORCEPOINT_MAIL_RELAY|FORTINET_FORTIMAIL|KNOWBE4_PHISHER|MAILMARSHAL|MICROSOFT_DEFENDER_MAIL|MIMECAST_MAIL|MIMECAST_URL_LOGS|OBSERVEIT|OFFICE_365|POSTFIX_MAIL|PROOFPOINT_MAIL|PROOFPOINT_MAIL_FILTER|PROOFPOINT_ON_DEMAND|PROOFPOINT_SENDMAIL_SENTRION|PROOFPOINT_SER|PROOFPOINT_TAP_FORENSICS|PROOFPOINT_TRAP|SENDMAIL|SEPPMAIL|SYMANTEC_VIP|VIRTRU_EMAIL_ENCRYPTION|VOLTAGE|WORKSPACE_ALERTS|ZIX_EMAIL_ENCRYPTION|PHISHLABS/ nocase
$event.metadata.event_type = "EMAIL_UNCATEGORIZED"
or $event.metadata.event_type = "EMAIL_TRANSACTION"
or $event.metadata.event_type = "NETWORK_HTTP"
$Threat_Name = $event.security_result.threat_name
$Status = $event.security_result.threat_status
match:
$Threat_Name, $Status
outcome:
$Count = count($event.metadata.id)
$Date = timestamp.get_timestamp(max($event.metadata.event_timestamp.seconds))
order:
$Date desc
limit:
50
威脅狀態分布
$event.metadata.log_type = /ABNORMAL_SECURITY|AREA1|AVANAN_EMAIL|BARRACUDA_EMAIL|CISCO_EMAIL_SECURITY|COFENSE_TRIAGE|EXCHANGE_MAIL|FIREEYE_EMPS|FIREEYE_ETP|FORCEPOINT_EMAILSECURITY|FORCEPOINT_MAIL_RELAY|FORTINET_FORTIMAIL|KNOWBE4_PHISHER|MAILMARSHAL|MICROSOFT_DEFENDER_MAIL|MIMECAST_MAIL|MIMECAST_URL_LOGS|OBSERVEIT|OFFICE_365|POSTFIX_MAIL|PROOFPOINT_MAIL|PROOFPOINT_MAIL_FILTER|PROOFPOINT_ON_DEMAND|PROOFPOINT_SENDMAIL_SENTRION|PROOFPOINT_SER|PROOFPOINT_TAP_FORENSICS|PROOFPOINT_TRAP|SENDMAIL|SEPPMAIL|SYMANTEC_VIP|VIRTRU_EMAIL_ENCRYPTION|VOLTAGE|WORKSPACE_ALERTS|ZIX_EMAIL_ENCRYPTION|PHISHLABS/ nocase
$event.metadata.event_type = "EMAIL_UNCATEGORIZED"
or $event.metadata.event_type = "EMAIL_TRANSACTION"
or $event.metadata.event_type = "NETWORK_HTTP"
$Status = $event.security_result.threat_status
match:
$Status
outcome:
$Count = count($event.security_result.threat_name)
order:
$Count desc
安全結果動作分配
$event.metadata.log_type = /ABNORMAL_SECURITY|AREA1|AVANAN_EMAIL|BARRACUDA_EMAIL|CISCO_EMAIL_SECURITY|COFENSE_TRIAGE|EXCHANGE_MAIL|FIREEYE_EMPS|FIREEYE_ETP|FORCEPOINT_EMAILSECURITY|FORCEPOINT_MAIL_RELAY|FORTINET_FORTIMAIL|KNOWBE4_PHISHER|MAILMARSHAL|MICROSOFT_DEFENDER_MAIL|MIMECAST_MAIL|MIMECAST_URL_LOGS|OBSERVEIT|OFFICE_365|POSTFIX_MAIL|PROOFPOINT_MAIL|PROOFPOINT_MAIL_FILTER|PROOFPOINT_ON_DEMAND|PROOFPOINT_SENDMAIL_SENTRION|PROOFPOINT_SER|PROOFPOINT_TAP_FORENSICS|PROOFPOINT_TRAP|SENDMAIL|SEPPMAIL|SYMANTEC_VIP|VIRTRU_EMAIL_ENCRYPTION|VOLTAGE|WORKSPACE_ALERTS|ZIX_EMAIL_ENCRYPTION|PHISHLABS/ nocase
$event.metadata.event_type = "EMAIL_UNCATEGORIZED"
or $event.metadata.event_type = "EMAIL_TRANSACTION"
or $event.metadata.event_type = "NETWORK_HTTP"
$Action = $event.security_result.action
match:
$Action
outcome:
$Count = count($event.security_result.action)
order:
$Count desc
安全結果動作分配
$event.metadata.log_type = /ABNORMAL_SECURITY|AREA1|AVANAN_EMAIL|BARRACUDA_EMAIL|CISCO_EMAIL_SECURITY|COFENSE_TRIAGE|EXCHANGE_MAIL|FIREEYE_EMPS|FIREEYE_ETP|FORCEPOINT_EMAILSECURITY|FORCEPOINT_MAIL_RELAY|FORTINET_FORTIMAIL|KNOWBE4_PHISHER|MAILMARSHAL|MICROSOFT_DEFENDER_MAIL|MIMECAST_MAIL|MIMECAST_URL_LOGS|OBSERVEIT|OFFICE_365|POSTFIX_MAIL|PROOFPOINT_MAIL|PROOFPOINT_MAIL_FILTER|PROOFPOINT_ON_DEMAND|PROOFPOINT_SENDMAIL_SENTRION|PROOFPOINT_SER|PROOFPOINT_TAP_FORENSICS|PROOFPOINT_TRAP|SENDMAIL|SEPPMAIL|SYMANTEC_VIP|VIRTRU_EMAIL_ENCRYPTION|VOLTAGE|WORKSPACE_ALERTS|ZIX_EMAIL_ENCRYPTION|PHISHLABS/ nocase
$event.metadata.event_type = "EMAIL_UNCATEGORIZED"
or $event.metadata.event_type = "EMAIL_TRANSACTION"
or $event.metadata.event_type = "NETWORK_HTTP"
$Action = $event.security_result.action
match:
$Action
outcome:
$Count = count($event.security_result.action)
order:
$Count desc
前 10 大目標電子郵件
$event.metadata.log_type = /ABNORMAL_SECURITY|AREA1|AVANAN_EMAIL|BARRACUDA_EMAIL|CISCO_EMAIL_SECURITY|COFENSE_TRIAGE|EXCHANGE_MAIL|FIREEYE_EMPS|FIREEYE_ETP|FORCEPOINT_EMAILSECURITY|FORCEPOINT_MAIL_RELAY|FORTINET_FORTIMAIL|KNOWBE4_PHISHER|MAILMARSHAL|MICROSOFT_DEFENDER_MAIL|MIMECAST_MAIL|MIMECAST_URL_LOGS|OBSERVEIT|OFFICE_365|POSTFIX_MAIL|PROOFPOINT_MAIL|PROOFPOINT_MAIL_FILTER|PROOFPOINT_ON_DEMAND|PROOFPOINT_SENDMAIL_SENTRION|PROOFPOINT_SER|PROOFPOINT_TAP_FORENSICS|PROOFPOINT_TRAP|SENDMAIL|SEPPMAIL|SYMANTEC_VIP|VIRTRU_EMAIL_ENCRYPTION|VOLTAGE|WORKSPACE_ALERTS|ZIX_EMAIL_ENCRYPTION|PHISHLABS/ nocase
$event.metadata.event_type = "EMAIL_UNCATEGORIZED"
or $event.metadata.event_type = "EMAIL_TRANSACTION"
or $event.metadata.event_type = "NETWORK_HTTP"
$event.target.user.email_addresses != ""
$Target = $event.target.user.email_addresses
match:
$Target
outcome:
$Count = count($event.target.user.email_addresses)
order:
$Count desc
limit:
10
前 10 大惡意位置
$event.metadata.log_type = /ABNORMAL_SECURITY|AREA1|AVANAN_EMAIL|BARRACUDA_EMAIL|CISCO_EMAIL_SECURITY|COFENSE_TRIAGE|EXCHANGE_MAIL|FIREEYE_EMPS|FIREEYE_ETP|FORCEPOINT_EMAILSECURITY|FORCEPOINT_MAIL_RELAY|FORTINET_FORTIMAIL|KNOWBE4_PHISHER|MAILMARSHAL|MICROSOFT_DEFENDER_MAIL|MIMECAST_MAIL|MIMECAST_URL_LOGS|OBSERVEIT|OFFICE_365|POSTFIX_MAIL|PROOFPOINT_MAIL|PROOFPOINT_MAIL_FILTER|PROOFPOINT_ON_DEMAND|PROOFPOINT_SENDMAIL_SENTRION|PROOFPOINT_SER|PROOFPOINT_TAP_FORENSICS|PROOFPOINT_TRAP|SENDMAIL|SEPPMAIL|SYMANTEC_VIP|VIRTRU_EMAIL_ENCRYPTION|VOLTAGE|WORKSPACE_ALERTS|ZIX_EMAIL_ENCRYPTION|PHISHLABS/ nocase
$event.metadata.event_type = "EMAIL_UNCATEGORIZED"
or $event.metadata.event_type = "EMAIL_TRANSACTION"
or $event.metadata.event_type = "NETWORK_HTTP"
$event.security_result.detection_fields["judgement"] = /MALICIOUS/ nocase
$event.principal.location.country_or_region != ""
$Countries = $event.principal.location.country_or_region
$Latitude = $event.principal.location.region_coordinates.latitude
$Longitude = $event.principal.location.region_coordinates.longitude
match:
$Countries, $Latitude, $Longitude
outcome:
$Count = count($event.metadata.id)
order:
$Count desc
limit:
10
前 10 大高嚴重性威脅
$event.metadata.log_type = /ABNORMAL_SECURITY|AREA1|AVANAN_EMAIL|BARRACUDA_EMAIL|CISCO_EMAIL_SECURITY|COFENSE_TRIAGE|EXCHANGE_MAIL|FIREEYE_EMPS|FIREEYE_ETP|FORCEPOINT_EMAILSECURITY|FORCEPOINT_MAIL_RELAY|FORTINET_FORTIMAIL|KNOWBE4_PHISHER|MAILMARSHAL|MICROSOFT_DEFENDER_MAIL|MIMECAST_MAIL|MIMECAST_URL_LOGS|OBSERVEIT|OFFICE_365|POSTFIX_MAIL|PROOFPOINT_MAIL|PROOFPOINT_MAIL_FILTER|PROOFPOINT_ON_DEMAND|PROOFPOINT_SENDMAIL_SENTRION|PROOFPOINT_SER|PROOFPOINT_TAP_FORENSICS|PROOFPOINT_TRAP|SENDMAIL|SEPPMAIL|SYMANTEC_VIP|VIRTRU_EMAIL_ENCRYPTION|VOLTAGE|WORKSPACE_ALERTS|ZIX_EMAIL_ENCRYPTION|PHISHLABS/ nocase
$event.metadata.event_type = "EMAIL_UNCATEGORIZED"
or $event.metadata.event_type = "EMAIL_TRANSACTION"
or $event.metadata.event_type = "NETWORK_HTTP"
$event.security_result.category_details != ""
$event.security_result.severity = "HIGH"
$Category = $event.security_result.category_details
match:
$Category
outcome:
$Count = count($event.metadata.id)
order:
$Count desc
limit:
10
威脅狀態分布
$event.metadata.log_type = /ABNORMAL_SECURITY|AREA1|AVANAN_EMAIL|BARRACUDA_EMAIL|CISCO_EMAIL_SECURITY|COFENSE_TRIAGE|EXCHANGE_MAIL|FIREEYE_EMPS|FIREEYE_ETP|FORCEPOINT_EMAILSECURITY|FORCEPOINT_MAIL_RELAY|FORTINET_FORTIMAIL|KNOWBE4_PHISHER|MAILMARSHAL|MICROSOFT_DEFENDER_MAIL|MIMECAST_MAIL|MIMECAST_URL_LOGS|OBSERVEIT|OFFICE_365|POSTFIX_MAIL|PROOFPOINT_MAIL|PROOFPOINT_MAIL_FILTER|PROOFPOINT_ON_DEMAND|PROOFPOINT_SENDMAIL_SENTRION|PROOFPOINT_SER|PROOFPOINT_TAP_FORENSICS|PROOFPOINT_TRAP|SENDMAIL|SEPPMAIL|SYMANTEC_VIP|VIRTRU_EMAIL_ENCRYPTION|VOLTAGE|WORKSPACE_ALERTS|ZIX_EMAIL_ENCRYPTION|PHISHLABS/ nocase
$event.metadata.event_type = "EMAIL_UNCATEGORIZED"
or $event.metadata.event_type = "EMAIL_TRANSACTION"
or $event.metadata.event_type = "NETWORK_HTTP"
$Status = $event.security_result.threat_status
match:
$Status
outcome:
$Count = count($event.security_result.threat_name)
order:
$Count desc
依嚴重性分類的前 10 大電子郵件威脅
$event.metadata.log_type = /ABNORMAL_SECURITY|AREA1|AVANAN_EMAIL|BARRACUDA_EMAIL|CISCO_EMAIL_SECURITY|COFENSE_TRIAGE|EXCHANGE_MAIL|FIREEYE_EMPS|FIREEYE_ETP|FORCEPOINT_EMAILSECURITY|FORCEPOINT_MAIL_RELAY|FORTINET_FORTIMAIL|KNOWBE4_PHISHER|MAILMARSHAL|MICROSOFT_DEFENDER_MAIL|MIMECAST_MAIL|MIMECAST_URL_LOGS|OBSERVEIT|OFFICE_365|POSTFIX_MAIL|PROOFPOINT_MAIL|PROOFPOINT_MAIL_FILTER|PROOFPOINT_ON_DEMAND|PROOFPOINT_SENDMAIL_SENTRION|PROOFPOINT_SER|PROOFPOINT_TAP_FORENSICS|PROOFPOINT_TRAP|SENDMAIL|SEPPMAIL|SYMANTEC_VIP|VIRTRU_EMAIL_ENCRYPTION|VOLTAGE|WORKSPACE_ALERTS|ZIX_EMAIL_ENCRYPTION|PHISHLABS/ nocase
$event.metadata.event_type = "EMAIL_UNCATEGORIZED"
or $event.metadata.event_type = "EMAIL_TRANSACTION"
or $event.metadata.event_type = "NETWORK_HTTP"
$event.security_result.category_details != ""
$Severity = $event.security_result.severity
$Threat_Name = $event.security_result.category_details
match:
$Threat_Name, $Severity
outcome:
$Count = count($event.security_result.severity)
order:
$Count desc
limit:
10
前 10 大已識別網域
$event.metadata.log_type = /ABNORMAL_SECURITY|AREA1|AVANAN_EMAIL|BARRACUDA_EMAIL|CISCO_EMAIL_SECURITY|COFENSE_TRIAGE|EXCHANGE_MAIL|FIREEYE_EMPS|FIREEYE_ETP|FORCEPOINT_EMAILSECURITY|FORCEPOINT_MAIL_RELAY|FORTINET_FORTIMAIL|KNOWBE4_PHISHER|MAILMARSHAL|MICROSOFT_DEFENDER_MAIL|MIMECAST_MAIL|MIMECAST_URL_LOGS|OBSERVEIT|OFFICE_365|POSTFIX_MAIL|PROOFPOINT_MAIL|PROOFPOINT_MAIL_FILTER|PROOFPOINT_ON_DEMAND|PROOFPOINT_SENDMAIL_SENTRION|PROOFPOINT_SER|PROOFPOINT_TAP_FORENSICS|PROOFPOINT_TRAP|SENDMAIL|SEPPMAIL|SYMANTEC_VIP|VIRTRU_EMAIL_ENCRYPTION|VOLTAGE|WORKSPACE_ALERTS|ZIX_EMAIL_ENCRYPTION|PHISHLABS/ nocase
$event.metadata.event_type = "EMAIL_UNCATEGORIZED"
or $event.metadata.event_type = "EMAIL_TRANSACTION"
or $event.metadata.event_type = "NETWORK_HTTP"
$event.principal.administrative_domain != ""
$Domain = $event.principal.administrative_domain
match:
$Domain
outcome:
$Count = count($event.metadata.id)
order:
$Count desc
limit:
10
FEDRAMP 持續監控
這個資訊主頁會清楚顯示系統的法規遵循和安全狀態。這項服務會追蹤安全漏洞，並根據 FedRAMP 標準控管效力，協助您維持法規遵循狀態，並優先採取補救措施。
傳入連線總數
有可用更新的系統
最近的媒體保護供應商快訊
前 10 個遭封鎖的網域
依方向顯示的網路流量變化趨勢
依嚴重程度分類的安全漏洞
前 10 大因故遭到封鎖的應用程式執行作業
一段時間內使用較舊的傳輸層安全標準 (TLS) 版本
登入次數 (依狀態和時間)
多重驗證註冊狀態
高嚴重性警示最多的前 10 個端點
前 10 大傳入 IP 位址
一段時間內，媒體保護供應商快訊的動作
最近 10 位使用者徽章感應記錄
高嚴重性端點偵測記錄 (一段時間內)
傳出連線總數
登入失敗次數最多的前 10 位使用者
TLS 密碼分配
依嚴重性分類的資料遺失防護違規事項
依年齡層區分的安全漏洞
變更使用者帳戶權限
前 10 大傳出 IP 位址
依據具備權限的動作列出的前 10 名使用者
圖表名稱
查詢示例
傳入連線總數
metadata.event_type = "NETWORK_CONNECTION"
network.direction = "INBOUND"
outcome:
$Count = count_distinct(principal.ip)
有可用更新的系統
metadata.product_event_type = "40"
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
$Hostname = strings.coalesce(principal.asset.hostname, principal.hostname)
match:
$Hostname, $Date
outcome:
$Count = count(metadata.id)
order:
$Date asc
最近的媒體保護供應商快訊
strings.coalesce(metadata.product_event_type, security_result.rule_name, security_result.summary) = /\busb|removable|drive\b/ nocase
$Vendor_Alert = strings.coalesce(metadata.product_event_type, security_result.rule_name, security_result.summary)
$User = strings.coalesce(principal.user.user_display_name, target.user.user_display_name)
$Source_IP = strings.coalesce(principal.asset.ip, principal.ip)
$File_Name = target.file.full_path
$Action = security_result.action
$Date = timestamp.get_timestamp(metadata.event_timestamp.seconds, "%F %T ")
match:
$Date, $Vendor_Alert, $Source_IP, $User, $File_Name, $Action
order:
$Date desc
前 10 個遭封鎖的網域
security_result.action = "BLOCK"
$Destination_Domain = strings.coalesce(target.administrative_domain, about.administrative_domain, target.ip_geo_artifact.network.dns_domain)
$Destination_Domain != ""
match:
$Destination_Domain
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
依方向顯示的網路流量變化趨勢
metadata.event_type = "NETWORK_UNCATEGORIZED"
or metadata.event_type = "NETWORK_FLOW"
or metadata.event_type = "NETWORK_CONNECTION"
or metadata.event_type = "NETWORK_FTP"
or metadata.event_type = "NETWORK_DHCP"
or metadata.event_type = "NETWORK_DNS"
or metadata.event_type = "NETWORK_HTTP"
or metadata.event_type = "NETWORK_SMTP"
$Direction = network.direction
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
match:
$Direction, $Date
outcome:
$Count = count(metadata.id)
order:
$Date desc
依嚴重程度分類的安全漏洞
$Severity =
if (principal.asset.vulnerabilities.severity != "UNKNOWN_SEVERITY",
principal.asset.vulnerabilities.severity,
if (target.asset.vulnerabilities.severity != "UNKNOWN_SEVERITY",
target.asset.vulnerabilities.severity,
if (extensions.vulns.vulnerabilities.severity != "UNKNOWN_SEVERITY",
extensions.vulns.vulnerabilities.severity,
"UNKNOWN_SEVERITY")))
match:
$Severity
outcome:
$Event_Count = count(strings.coalesce(extensions.vulns.vulnerabilities.name, extensions.vulns.vulnerabilities.description, extensions.vulns.vulnerabilities.vendor_vulnerability_id, principal.asset.vulnerabilities.name, target.asset.vulnerabilities.name, additional.fields["ScanReference"]))
order:
$Severity desc
前 10 大因故遭到封鎖的應用程式執行作業
metadata.product_event_type = /(execution|application) block/ nocase
or security_result.threat_name = /application control/ nocase
security_result.action = "BLOCK"
$Application = strings.coalesce(about.file.full_path, target.process.file.full_path, additional.fields["fname"])
$Reason = strings.coalesce(target.resource.attribute.labels["categoryTupleDescription"], security_result.action_details, metadata.product_event_type)
match:
$Application, $Reason
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
一段時間內使用較舊的傳輸層安全標準 (TLS) 版本
network.tls.version != /1(\.|_)?(2|3)/ nocase
$Cipher_Version = network.tls.version
$Cipher_Version != ""
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
match:
$Cipher_Version, $Date
outcome:
$Count = count(metadata.id)
order:
$Date desc
登入次數 (依狀態和時間)
metadata.event_type = "USER_LOGIN"
$Action = security_result.action
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
match:
$Action, $Date
outcome:
$Count = count(metadata.id)
order:
$Date desc
多重驗證註冊狀態
metadata.product_name = "MULTI-FACTOR_AUTHENTICATION"
or strings.coalesce(additional.fields["AuthenticationRequirement"], security_result.detection_fields.value) = /mfa|multi(?:\s|\S)?factor(?:\s|\S)?authentication|/ nocase
metadata.product_event_type = "enrollment"
or target.resource_ancestors.resource_subtype = "AuthenticatorEnrollment"
$Result = security_result.summary
match:
$Result
outcome:
$Count = count(metadata.id)
order:
$Count desc
高嚴重性警示最多的前 10 個端點
principal.hostname != ""
$Hostname = principal.hostname
$Severity = security_result.severity
$Severity = "CRITICAL" or $Severity = "HIGH"
match:
$Hostname, $Severity
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
前 10 大傳入 IP 位址
network.direction = "INBOUND"
$Log_Type = metadata.log_type
$Source_IP = principal.ip
match:
$Log_Type, $Source_IP
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
一段時間內，媒體保護供應商快訊的動作
strings.coalesce(metadata.product_event_type, security_result.rule_name, security_result.summary) = /\busb|removable|drive\b/ nocase
$Action = security_result.action
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
match:
$Date, $Action
outcome:
$Count = count(metadata.id)
order:
$Date desc
最近 10 位使用者徽章感應記錄
(metadata.event_type = "USER_BADGE_IN"
or metadata.event_type = "USER_RESOURCE_ACCESS"
or metadata.event_type = "USER_UNCATEGORIZED")
strings.coalesce(metadata.description, security_result.action_details, security_result.description, security_result.summary, additional.fields["plasectrxEvtypename"]) = /(?:access\sgranted|badge\sin)/ nocase
$User = strings.coalesce(principal.user.user_display_name, principal.user.email_addresses, additional.fields["person"], principal.user.userid)
$Location = strings.coalesce(security_result.rule_labels["Place"], additional.fields["site"], target.location.name, principal.resource.name)
$Date = timestamp.get_timestamp(metadata.event_timestamp.seconds, "%F %H:%M:%S ")
match:
$Date, $User, $Location
order:
$Date desc
limit:
10
高嚴重性端點偵測記錄 (一段時間內)
principal.hostname != ""
$Severity = security_result.severity
$Severity = "CRITICAL" or $Severity = "HIGH"
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
match:
$Severity, $Date
outcome:
$Count = count(metadata.id)
order:
$Count desc
傳出連線總數
metadata.event_type = "NETWORK_CONNECTION"
network.direction = "OUTBOUND"
outcome:
$Count = count_distinct(target.ip)
登入失敗次數最多的前 10 位使用者
metadata.event_type = "USER_LOGIN"
security_result.action = "BLOCK"
target.user.userid != ""
$User = target.user.userid
match:
$User
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
TLS 密碼分配
network.tls.cipher != /1(\.|_)?(2|3)/ nocase
$TLS_Cipher = network.tls.cipher
$TLS_Cipher != ""
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
match:
$TLS_Cipher, $Date
outcome:
$Count = count(metadata.id)
order:
$Count desc
依嚴重性分類的資料遺失防護違規事項
metadata.log_type = /DLP/ nocase
metadata.product_event_type = /Violation/ nocase
$Severity = security_result.severity
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
match:
$Severity
outcome:
$Count = count(metadata.id)
order:
$Severity desc
依年齡層區分的安全漏洞
(timestamp.as_unix_seconds(additional.fields["first_found"]) > 0
or extensions.vulns.vulnerabilities.first_found.seconds > 0
or principal.asset.vulnerabilities.first_found.seconds > 0)
$Vulnerability = strings.coalesce(
if(principal.asset.vulnerabilities.name != "" and principal.asset.vulnerabilities.description != "",
strings.concat(principal.asset.vulnerabilities.name, " : ", principal.asset.vulnerabilities.description),
strings.coalesce(principal.asset.vulnerabilities.name, principal.asset.vulnerabilities.description)),
if(additional.fields["ScanReference"] != "" and metadata.description != "",
strings.concat(additional.fields["ScanReference"], " : ", metadata.description),
strings.coalesce(additional.fields["ScanReference"], metadata.description)),
if(extensions.vulns.vulnerabilities.vendor_vulnerability_id != "" and extensions.vulns.vulnerabilities.description != "",
strings.concat(extensions.vulns.vulnerabilities.vendor_vulnerability_id, " : ", extensions.vulns.vulnerabilities.description),
strings.coalesce(extensions.vulns.vulnerabilities.vendor_vulnerability_id, extensions.vulns.vulnerabilities.description)
)
)
$Vulnerability != " : "
$Vulnerability != ""
$Log_Type = metadata.log_type
match:
$Vulnerability, $Log_Type
outcome:
$Age = max(cast.as_int((metadata.event_timestamp.seconds - if(timestamp.as_unix_seconds(additional.fields["first_found"]) > 0, timestamp.as_unix_seconds(additional.fields["first_found"]), if(extensions.vulns.vulnerabilities.first_found.seconds > 0, extensions.vulns.vulnerabilities.first_found.seconds, if(principal.asset.vulnerabilities.first_found.seconds > 0, principal.asset.vulnerabilities.first_found.seconds, metadata.event_timestamp.seconds)))) / 86400))
$Days_Range = if($Age <= 30, "0-30 Days",
if($Age <= 60, "31-60 Days",
if($Age <= 90, "61-90 Days", "> 90 Days")))
$Count = count(strings.coalesce(extensions.vulns.vulnerabilities.name, extensions.vulns.vulnerabilities.description, extensions.vulns.vulnerabilities.vendor_vulnerability_id, principal.asset.vulnerabilities.name, additional.fields["ScanReference"]))
order:
$Age desc
變更使用者帳戶權限
metadata.event_type = "USER_CHANGE_PERMISSIONS"
principal.user.userid != ""
outcome:
$Count = count_distinct(metadata.id)
前 10 大傳出 IP 位址
network.direction = "OUTBOUND"
$Log_Type = metadata.log_type
$Destination_IP = target.ip
match:
$Log_Type, $Destination_IP
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
依據具備權限的動作列出的前 10 名使用者
principal.user.attribute.roles.type = "ADMINISTRATOR"
or strings.coalesce(principal.user.attribute.roles.name, principal.user.userid) = /Admin|Root|Super/ nocase
$User = principal.user.userid
$Action = metadata.product_event_type
match:
$User, $Action
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
防火牆活動監控
這個資訊主頁提供防火牆活動的相關資訊，有助於提升安全性及效能管理。這項服務會追蹤與防火牆活動相關的各種指標和事件，即時提供網路安全洞察，協助使用者有效管理及因應潛在威脅。
觸發罕見的防火牆規則
觸發次數最多的前 10 項防火牆規則
依地理位置顯示的連線數
最常連線的目的地
依 IP 傳入的資料
依 IP 區分的資料流出量
熱門連結來源
封鎖的流量與允許的流量
前 10 大遭封鎖的 IP
圖表名稱
查詢示例
觸發罕見的防火牆規則
$event_type = metadata.event_type
$event_type >= 16000 and $event_type <= 16007
$log_type = metadata.log_type
$rule_name = security_result.rule_name
$rule_name !=""
$date = timestamp.get_date(metadata.event_timestamp.seconds)
match:
$rule_name
outcome:
$Count = count($rule_name)
order: $Count asc
limit: 10
觸發次數最多的前 10 項防火牆規則
$event_type = metadata.event_type
$event_type >= 16000 and $event_type <= 16007
$log_type = metadata.log_type
$rule_name = security_result.rule_name
$rule_name !=""
match:
$rule_name
outcome:
$Count = count(metadata.id)
order: $Count desc
limit: 10
依地理位置顯示的連線數
$event_type = metadata.event_type
$event_type >= 16000 and $event_type <= 16007
$log_type = metadata.log_type
$rule_name = security_result.rule_name
$rule_name !=""
$country = principal.location.country_or_region
$country != ""
$direction = network.direction
match:
$country
outcome:
$event_count = count_distinct($country)
$latitude = max(principal.location.region_coordinates.latitude)
$longitude = max(principal.location.region_coordinates.longitude)
最常連線的目的地
$event_type = metadata.event_type
$event_type >= 16000 and $event_type <= 16007
$log_type = metadata.log_type
$rule_name = security_result.rule_name
$Dest_IP = target.ip
$Dest_IP != ""
match:
$Dest_IP
outcome:
$event_count = count(metadata.id)
order: $event_count desc
limit: 10
依 IP 傳入的資料
$event_type = metadata.event_type
$event_type >= 16000 and $event_type <= 16007
$ruleN = security_result.rule_name
$IP = principal.ip
$byte = network.received_bytes
$byte != 0
$Vendor = metadata.vendor_name
$Vendor != ""
match:
$IP, $Vendor
outcome:
$byte_sum=sum($byte)
$Data_in_mb = math.round($byte_sum/1048576)
order: $Data_in_mb desc
limit: 10
依地理位置顯示的連線數
$event_type = metadata.event_type
$event_type >= 16000 and $event_type <= 16007
$log_type = metadata.log_type
$rule_name = security_result.rule_name
$rule_name !=""
$country = principal.location.country_or_region
$country != ""
$direction = network.direction
match:
$country
outcome:
$event_count = count_distinct($country)
$latitude = max(principal.location.region_coordinates.latitude)
$longitude = max(principal.location.region_coordinates.longitude)
依 IP 區分的資料流出量
$event_type = metadata.event_type
$event_type >= 16000 and $event_type <= 16007
$IP = principal.ip
$byte = network.sent_bytes
$byte != 0
$Vendor = metadata.vendor_name
metadata.vendor_name != ""
match:
$IP, $Vendor
outcome:
$byte_sum=sum($byte)
$data_in_mb = math.round($byte_sum/1048576)
order: $data_in_mb desc
limit:10
觸發罕見的防火牆規則
$event_type = metadata.event_type
$event_type >= 16000 and $event_type <= 16007
$log_type = metadata.log_type
$rule_name = security_result.rule_name
$rule_name !=""
$date = timestamp.get_date(metadata.event_timestamp.seconds)
match:
$rule_name
outcome:
$Count = count($rule_name)
order: $Count asc
limit: 10
熱門連結來源
$event_type = metadata.event_type
$event_type >= 16000 and $event_type <= 16007
$log_type = metadata.log_type
$rule_name = security_result.rule_name
$Src_IP = principal.ip
match:
$Src_IP
outcome:
$event_count = count(metadata.id)
order: $event_count desc
limit: 10
封鎖的流量與允許的流量
$event_type = metadata.event_type
$event_type >= 16000 and $event_type <= 16007
$log_type = metadata.log_type
$rule_name = security_result.rule_name
$action = security_result.action
$action = "BLOCK" OR $action = "ALLOW"
match:
$action
outcome:
$event_count = count(metadata.id)
order: $event_count desc
觸發次數最多的前 10 項防火牆規則
$event_type = metadata.event_type
$event_type >= 16000 and $event_type <= 16007
$log_type = metadata.log_type
$rule_name = security_result.rule_name
$rule_name !=""
match:
$rule_name
outcome:
$Count = count(metadata.id)
order: $Count desc
limit: 10
封鎖的流量與允許的流量
$event_type = metadata.event_type
$event_type >= 16000 and $event_type <= 16007
$log_type = metadata.log_type
$rule_name = security_result.rule_name
$action = security_result.action
$action = "BLOCK" OR $action = "ALLOW"
match:
$action
outcome:
$event_count = count(metadata.id)
order: $event_count desc
依 IP 區分的資料流出量
$event_type = metadata.event_type
$event_type >= 16000 and $event_type <= 16007
$IP = principal.ip
$byte = network.sent_bytes
$byte != 0
$Vendor = metadata.vendor_name
metadata.vendor_name != ""
match:
$IP, $Vendor
outcome:
$byte_sum=sum($byte)
$data_in_mb = math.round($byte_sum/1048576)
order: $data_in_mb desc
limit:10
依 IP 傳入的資料
$event_type = metadata.event_type
$event_type >= 16000 and $event_type <= 16007
$ruleN = security_result.rule_name
$IP = principal.ip
$byte = network.received_bytes
$byte != 0
$Vendor = metadata.vendor_name
$Vendor != ""
match:
$IP, $Vendor
outcome:
$byte_sum=sum($byte)
$Data_in_mb = math.round($byte_sum/1048576)
order: $Data_in_mb desc
limit: 10
熱門連結來源
$event_type = metadata.event_type
$event_type >= 16000 and $event_type <= 16007
$log_type = metadata.log_type
$rule_name = security_result.rule_name
$Src_IP = principal.ip
$Src_IP != ""
match:
$Src_IP
outcome:
$event_count = count(metadata.id)
order: $event_count desc
limit: 10
最常連線的目的地
$event_type = metadata.event_type
$event_type >= 16000 and $event_type <= 16007
$log_type = metadata.log_type
$rule_name = security_result.rule_name
$Dest_IP = target.ip
$Dest_IP != "EMPTY"
match:
$Dest_IP
outcome:
$event_count = count(metadata.id)
order: $event_count desc
limit: 10
前 10 大遭封鎖的 IP
$event_type = metadata.event_type
$event_type >= 16000 and $event_type <= 16007
$log_type = metadata.log_type
$rule_name = security_result.rule_name
$action = security_result.action
$action = "BLOCK"
$IP = principal.ip
match:
$IP, $action
outcome:
$event_count = count_distinct(metadata.id)
order: $event_count desc
limit: 10
前 10 大遭封鎖的 IP
$event_type = metadata.event_type
$event_type >= 16000 and $event_type <= 16007
$log_type = metadata.log_type
$rule_name = security_result.rule_name
$action = security_result.action
$action = "BLOCK"
$IP = principal.ip
match:
$IP, $action
outcome:
$event_count = count_distinct(metadata.id)
order: $event_count desc
limit: 10
GDPR 資料治理
這個資訊主頁會顯示歐盟地區的資料存取情況，包括存取趨勢、非歐盟地區的存取嘗試，以及主要地理位置。這項功能可協助監控 GDPR 法規的遵循情況、偵測未經授權的資料存取行為，並確保歐盟資料的處理方式安全無虞。
存取歐盟資源的權限帳戶
傳輸層安全標準 (TLS) 版本分布強度不足
存取歐盟資源的前 10 個非歐盟 IP
存取歐盟資源的前 10 名使用者
依來源地理位置存取歐盟資料
歐盟資源的資料刪除和清除事件 (隨時間變化)
歐盟資源的弱加密情況隨時間變化
歐盟資源的資料刪除和清除事件
存取歐盟資源的前 10 大權限帳戶
歐盟境內資料遺失防護事件
接收歐盟資料的前 10 大外部網域
惡意軟體檔案摘要
歐盟境內資料遺失防護事件歷來趨勢
一段時間內的歐盟資料存取事件
觸發次數最多的前 10 項政策
未經授權存取歐盟資源
從非歐盟國家/地區存取歐盟資源
存取歐盟資料的前 10 大非歐盟國家/地區
一段時間內對歐盟資源的特殊存取權
一段時間內的威脅偵測
機密資料存取事件
圖表名稱
查詢示例
存取歐盟資源的權限帳戶
strings.coalesce(target.location.country_or_region, target.ip_geo_artifact.location.country_or_region, target.location.name) = /Austria|Belgium|Bulgaria|Croatia|Cyprus|Czechia|Denmark|Estonia|Finland|France|Germany|Greece|Hungary|Ireland|Italy|Latvia|Lithuania|Luxembourg|Malta|Netherlands|Poland|Portugal|Romania|Slovakia|Slovenia|Spain|Sweden|eu-(west-1|west-3|central-1|north-1|south-1|south-2)|europe-(west1|west3|west4|west8|west9|west10|west12|central2|north1|north2|southwest1)|austriaeast|denmarkeast|francecentral|germanywestcentral|greececentral|italynorth|northeurope|spaincentral|swedencentral|westeurope|polandcentral/ nocase
(metadata.event_type = "RESOURCE_READ" OR metadata.event_type = "RESOURCE_WRITTEN" OR metadata.event_type = "RESOURCE_CREATION" OR metadata.event_type = "RESOURCE_DELETION" OR metadata.event_type = "RESOURCE_PERMISSIONS_CHANGE" OR metadata.event_type = "FILE_UNCATEGORIZED" OR metadata.event_type = "FILE_CREATION" OR metadata.event_type = "FILE_DELETION" OR metadata.event_type = "FILE_MODIFICATION" OR metadata.event_type = "FILE_READ" OR metadata.event_type = "FILE_COPY" OR metadata.event_type = "FILE_OPEN" OR metadata.event_type = "FILE_MOVE" OR metadata.event_type = "FILE_SYNC" OR metadata.event_type = "EVENTTYPE_UNSPECIFIED" OR metadata.event_type = "SETTING_UNCATEGORIZED" OR metadata.event_type = "USER_UNCATEGORIZED" OR metadata.event_type = "SYSTEM_AUDIT_LOG_UNCATEGORIZED" OR metadata.event_type = "SYSTEM_AUDIT_LOG_WIPE" OR metadata.event_type = "USER_RESOURCE_CREATION" OR metadata.event_type = "USER_RESOURCE_UPDATE_CONTENT" OR metadata.event_type = "USER_RESOURCE_UPDATE_PERMISSIONS" OR metadata.event_type = "USER_RESOURCE_ACCESS" OR metadata.event_type = "USER_RESOURCE_DELETION" OR metadata.log_type = "GENERIC_EVENT" OR metadata.event_type ="USER_LOGIN" or metadata.log_type = "USER_CHANGE_PERMISSIONS")
$User = strings.coalesce(principal.user.userid, principal.user.user_display_name, principal.user.email_addresses, target.user.userid,target.user.user_display_name,target.user.email_addresses)
($User = /admin|root|svc|adm|privilege/ nocase or principal.user.attribute.roles.type = "SERVICE_ACCOUNT" or principal.user.attribute.roles.type = "ADMINISTRATOR" or principal.user.account_type = "DOMAIN_ACCOUNT_TYPE" or principal.user.account_type = "SERVICE_ACCOUNT_TYPE")
$Target_EU_Country = strings.coalesce(target.location.country_or_region, target.ip_geo_artifact.location.country_or_region, target.location.name)
$Event_Type = metadata.event_type
$Source_IP = strings.coalesce(principal.ip,principal.asset.ip)
$Target_Resource = strings.coalesce(target.resource.name, target.file.full_path, target.resource.product_object_id, target.group.product_object_id, target.user.group_identifiers)
$Target_Resourcetype = target.resource.resource_type
$Action = security_result.action
match:
$Event_Type, $User,$Source_IP, $Target_EU_Country, $Target_Resource, $Target_Resourcetype, $Action
outcome:
$Count = count(metadata.id)
$Date = timestamp.get_timestamp(max(metadata.event_timestamp.seconds))
order:
$Count desc
傳輸層安全標準 (TLS) 版本分布強度不足
strings.coalesce(target.location.country_or_region, target.ip_geo_artifact.location.country_or_region, target.location.name) = /Austria|Belgium|Bulgaria|Croatia|Cyprus|Czechia|Denmark|Estonia|Finland|France|Germany|Greece|Hungary|Ireland|Italy|Latvia|Lithuania|Luxembourg|Malta|Netherlands|Poland|Portugal|Romania|Slovakia|Slovenia|Spain|Sweden|eu-(west-1|west-3|central-1|north-1|south-1|south-2)|europe-(west1|west3|west4|west8|west9|west10|west12|central2|north1|north2|southwest1)|austriaeast|denmarkeast|francecentral|germanywestcentral|greececentral|italynorth|northeurope|spaincentral|swedencentral|westeurope|polandcentral/ nocase
(metadata.event_type = "RESOURCE_READ" OR metadata.event_type = "RESOURCE_WRITTEN" OR metadata.event_type = "RESOURCE_CREATION" OR metadata.event_type = "RESOURCE_DELETION" OR metadata.event_type = "RESOURCE_PERMISSIONS_CHANGE" OR metadata.event_type = "FILE_UNCATEGORIZED" OR metadata.event_type = "FILE_CREATION" OR metadata.event_type = "FILE_DELETION" OR metadata.event_type = "FILE_MODIFICATION" OR metadata.event_type = "FILE_READ" OR metadata.event_type = "FILE_COPY" OR metadata.event_type = "FILE_OPEN" OR metadata.event_type = "FILE_MOVE" OR metadata.event_type = "FILE_SYNC" OR metadata.event_type = "EVENTTYPE_UNSPECIFIED" OR metadata.event_type = "SETTING_UNCATEGORIZED" OR metadata.event_type = "USER_UNCATEGORIZED" OR metadata.event_type = "SYSTEM_AUDIT_LOG_UNCATEGORIZED" OR metadata.event_type = "SYSTEM_AUDIT_LOG_WIPE" OR metadata.event_type = "USER_RESOURCE_CREATION" OR metadata.event_type = "USER_RESOURCE_UPDATE_CONTENT" OR metadata.event_type = "USER_RESOURCE_UPDATE_PERMISSIONS" OR metadata.event_type = "USER_RESOURCE_ACCESS" OR metadata.event_type = "USER_RESOURCE_DELETION" OR metadata.event_type = "GENERIC_EVENT")
network.tls.version != /1(\.|_)?(2|3)/ nocase
$TLS_Version = network.tls.version
$TLS_Version != ""
match:
$TLS_Version
outcome:
$Count = count(metadata.id)
存取歐盟資源的前 10 個非歐盟 IP
(strings.coalesce(target.location.country_or_region, target.ip_geo_artifact.location.country_or_region, target.location.name) = /Austria|Belgium|Bulgaria|Croatia|Cyprus|Czechia|Denmark|Estonia|Finland|France|Germany|Greece|Hungary|Ireland|Italy|Latvia|Lithuania|Luxembourg|Malta|Netherlands|Poland|Portugal|Romania|Slovakia|Slovenia|Spain|Sweden|eu-(west-1|west-3|central-1|north-1|south-1|south-2)|europe-(west1|west3|west4|west8|west9|west10|west12|central2|north1|north2|southwest1)|austriaeast|denmarkeast|francecentral|germanywestcentral|greececentral|italynorth|northeurope|spaincentral|swedencentral|westeurope|polandcentral/ nocase
and strings.coalesce(principal.location.country_or_region, principal.ip_geo_artifact.location.country_or_region, principal.location.name) != /Austria|Belgium|Bulgaria|Croatia|Cyprus|Czechia|Denmark|Estonia|Finland|France|Germany|Greece|Hungary|Ireland|Italy|Latvia|Lithuania|Luxembourg|Malta|Netherlands|Poland|Portugal|Romania|Slovakia|Slovenia|Spain|Sweden|eu-(west-1|west-3|central-1|north-1|south-1|south-2)|europe-(west1|west3|west4|west8|west9|west10|west12|central2|north1|north2|southwest1)|austriaeast|denmarkeast|francecentral|germanywestcentral|greececentral|italynorth|northeurope|spaincentral|swedencentral|westeurope|polandcentral/ nocase)
(metadata.event_type = "RESOURCE_READ" OR metadata.event_type = "RESOURCE_WRITTEN" OR metadata.event_type = "RESOURCE_CREATION" OR metadata.event_type = "RESOURCE_DELETION" OR metadata.event_type = "RESOURCE_PERMISSIONS_CHANGE" OR metadata.event_type = "FILE_UNCATEGORIZED" OR metadata.event_type = "FILE_CREATION" OR metadata.event_type = "FILE_DELETION" OR metadata.event_type = "FILE_MODIFICATION" OR metadata.event_type = "FILE_READ" OR metadata.event_type = "FILE_COPY" OR metadata.event_type = "FILE_OPEN" OR metadata.event_type = "FILE_MOVE" OR metadata.event_type = "FILE_SYNC" OR metadata.event_type = "EVENTTYPE_UNSPECIFIED" OR metadata.event_type = "SETTING_UNCATEGORIZED" OR metadata.event_type = "USER_UNCATEGORIZED" OR metadata.event_type = "SYSTEM_AUDIT_LOG_UNCATEGORIZED" OR metadata.event_type = "SYSTEM_AUDIT_LOG_WIPE" OR metadata.event_type = "USER_RESOURCE_CREATION" OR metadata.event_type = "USER_RESOURCE_UPDATE_CONTENT" OR metadata.event_type = "USER_RESOURCE_UPDATE_PERMISSIONS" OR metadata.event_type = "USER_RESOURCE_ACCESS" OR metadata.event_type = "USER_RESOURCE_DELETION" OR metadata.log_type = "GENERIC_EVENT" OR metadata.event_type ="USER_LOGIN" or metadata.log_type = "USER_CHANGE_PERMISSIONS")
$Principal_IP = strings.coalesce(principal.ip, principal.asset.ip)
$Principal_IP != ""
$Principal_Country = strings.coalesce(principal.location.country_or_region, principal.ip_geo_artifact.location.country_or_region, principal.location.name)
match:
$Principal_IP, $Principal_Country
outcome:
$Count = count(metadata.id)
order :
$Count desc
limit:
10
存取歐盟資源的前 10 名使用者
strings.coalesce(target.location.country_or_region, target.ip_geo_artifact.location.country_or_region, target.location.name) = /Austria|Belgium|Bulgaria|Croatia|Cyprus|Czechia|Denmark|Estonia|Finland|France|Germany|Greece|Hungary|Ireland|Italy|Latvia|Lithuania|Luxembourg|Malta|Netherlands|Poland|Portugal|Romania|Slovakia|Slovenia|Spain|Sweden|eu-(west-1|west-3|central-1|north-1|south-1|south-2)|europe-(west1|west3|west4|west8|west9|west10|west12|central2|north1|north2|southwest1)|austriaeast|denmarkeast|francecentral|germanywestcentral|greececentral|italynorth|northeurope|spaincentral|swedencentral|westeurope|polandcentral/ nocase
(metadata.event_type = "RESOURCE_READ" OR metadata.event_type = "RESOURCE_WRITTEN" OR metadata.event_type = "RESOURCE_CREATION" OR metadata.event_type = "RESOURCE_DELETION" OR metadata.event_type = "RESOURCE_PERMISSIONS_CHANGE" OR metadata.event_type = "FILE_UNCATEGORIZED" OR metadata.event_type = "FILE_CREATION" OR metadata.event_type = "FILE_DELETION" OR metadata.event_type = "FILE_MODIFICATION" OR metadata.event_type = "FILE_READ" OR metadata.event_type = "FILE_COPY" OR metadata.event_type = "FILE_OPEN" OR metadata.event_type = "FILE_MOVE" OR metadata.event_type = "FILE_SYNC" OR metadata.event_type = "EVENTTYPE_UNSPECIFIED" OR metadata.event_type = "SETTING_UNCATEGORIZED" OR metadata.event_type = "USER_UNCATEGORIZED" OR metadata.event_type = "SYSTEM_AUDIT_LOG_UNCATEGORIZED" OR metadata.event_type = "SYSTEM_AUDIT_LOG_WIPE" OR metadata.event_type = "USER_RESOURCE_CREATION" OR metadata.event_type = "USER_RESOURCE_UPDATE_CONTENT" OR metadata.event_type = "USER_RESOURCE_UPDATE_PERMISSIONS" OR metadata.event_type = "USER_RESOURCE_ACCESS" OR metadata.event_type = "USER_RESOURCE_DELETION" OR metadata.event_type = "GENERIC_EVENT")
$User = strings.coalesce(principal.user.user_display_name, principal.user.userid, principal.user.email_addresses,target.user.userid,target.user.user_display_name,target.user.email_addresses)
$Source_Country = strings.coalesce(principal.location.country_or_region, principal.ip_geo_artifact.location.country_or_region, principal.location.name)
$User != ""
match:
$User, $Source_Country
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
依來源地理位置存取歐盟資料
strings.coalesce(target.location.country_or_region, target.ip_geo_artifact.location.country_or_region, target.location.name) = /Austria|Belgium|Bulgaria|Croatia|Cyprus|Czechia|Denmark|Estonia|Finland|France|Germany|Greece|Hungary|Ireland|Italy|Latvia|Lithuania|Luxembourg|Malta|Netherlands|Poland|Portugal|Romania|Slovakia|Slovenia|Spain|Sweden|eu-(west-1|west-3|central-1|north-1|south-1|south-2)|europe-(west1|west3|west4|west8|west9|west10|west12|central2|north1|north2|southwest1)|austriaeast|denmarkeast|francecentral|germanywestcentral|greececentral|italynorth|northeurope|spaincentral|swedencentral|westeurope|polandcentral/ nocase
principal.ip_geo_artifact.location.region_coordinates.latitude != 0
principal.ip_geo_artifact.location.region_coordinates.longitude != 0
$Source_Country = strings.coalesce(principal.location.country_or_region, principal.ip_geo_artifact.location.country_or_region, principal.location.name)
match:
$Source_Country
outcome:
$Count = count(metadata.id)
$Latitude = max(principal.ip_geo_artifact.location.region_coordinates.latitude)
$Longitude = max(principal.ip_geo_artifact.location.region_coordinates.longitude)
歐盟資源的資料刪除和清除事件 (隨時間變化)
strings.coalesce(target.location.country_or_region, target.ip_geo_artifact.location.country_or_region, target.location.name) = /Austria|Belgium|Bulgaria|Croatia|Cyprus|Czechia|Denmark|Estonia|Finland|France|Germany|Greece|Hungary|Ireland|Italy|Latvia|Lithuania|Luxembourg|Malta|Netherlands|Poland|Portugal|Romania|Slovakia|Slovenia|Spain|Sweden|eu-(west-1|west-3|central-1|north-1|south-1|south-2)|europe-(west1|west3|west4|west8|west9|west10|west12|central2|north1|north2|southwest1)|austriaeast|denmarkeast|francecentral|germanywestcentral|greececentral|italynorth|northeurope|spaincentral|swedencentral|westeurope|polandcentral/ nocase
(metadata.event_type = "FILE_DELETION" or metadata.event_type = "RESOURCE_DELETION" OR metadata.event_type = "SYSTEM_AUDIT_LOG_WIPE" or metadata.event_type = "USER_RESOURCE_DELETION"
or metadata.product_event_type = /delete|purge/ nocase or security_result.summary = /delete|purge/ nocase or security_result.description = /delete|purge/ nocase)
security_result.action = "ALLOW"
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
$Log_Type = metadata.log_type
match:
$Date, $Log_Type
outcome:
$Count = count(metadata.id)
order:
$Date asc
歐盟資源的弱加密情況隨時間變化
strings.coalesce(target.location.country_or_region, target.ip_geo_artifact.location.country_or_region, target.location.name) = /Austria|Belgium|Bulgaria|Croatia|Cyprus|Czechia|Denmark|Estonia|Finland|France|Germany|Greece|Hungary|Ireland|Italy|Latvia|Lithuania|Luxembourg|Malta|Netherlands|Poland|Portugal|Romania|Slovakia|Slovenia|Spain|Sweden|eu-(west-1|west-3|central-1|north-1|south-1|south-2)|europe-(west1|west3|west4|west8|west9|west10|west12|central2|north1|north2|southwest1)|austriaeast|denmarkeast|francecentral|germanywestcentral|greececentral|italynorth|northeurope|spaincentral|swedencentral|westeurope|polandcentral/ nocase
(((target.resource.attribute.labels.key = "keyProperties_type" or target.resource.attribute.labels.key = "requestParameters.keySpec" or target.resource.attribute.labels.key = /key/ nocase) and target.resource.attribute.labels.value = /^(RSA-)|DES|RC4|MD5|SHA1|SHA-1/) or network.tls.cipher = /^(RSA-)|DES|RC4|MD5|SHA1|SHA-1/)
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
$Log_Type = metadata.log_type
match:
$Log_Type, $Date
outcome:
$Count = count(metadata.id)
order:
$Date asc
歐盟資源的資料刪除和清除事件
strings.coalesce(target.location.country_or_region, target.ip_geo_artifact.location.country_or_region, target.location.name) = /Austria|Belgium|Bulgaria|Croatia|Cyprus|Czechia|Denmark|Estonia|Finland|France|Germany|Greece|Hungary|Ireland|Italy|Latvia|Lithuania|Luxembourg|Malta|Netherlands|Poland|Portugal|Romania|Slovakia|Slovenia|Spain|Sweden|eu-(west-1|west-3|central-1|north-1|south-1|south-2)|europe-(west1|west3|west4|west8|west9|west10|west12|central2|north1|north2|southwest1)|austriaeast|denmarkeast|francecentral|germanywestcentral|greececentral|italynorth|northeurope|spaincentral|swedencentral|westeurope|polandcentral/ nocase
(metadata.event_type = "FILE_DELETION" or metadata.event_type = "RESOURCE_DELETION" OR metadata.event_type = "SYSTEM_AUDIT_LOG_WIPE" or metadata.event_type = "USER_RESOURCE_DELETION"
or metadata.product_event_type = /delete|purge/ nocase or security_result.summary = /delete|purge/ nocase or security_result.description = /delete|purge/ nocase)
security_result.action = "ALLOW"
$Description = strings.coalesce(security_result.summary, security_result.description, metadata.description, security_result.action_details)
$Product_Event_Type = metadata.product_event_type
$Event_Type = metadata.event_type
$Log_Type = metadata.log_type
$Target_Resource = strings.coalesce(target.resource.name, target.file.full_path, target.resource.product_object_id, target.group.product_object_id, target.user.group_identifiers)
$User = strings.coalesce(principal.user.user_display_name, principal.user.userid, principal.user.email_addresses, target.user.userid,target.user.user_display_name,target.user.email_addresses)
match:
$User, $Log_Type, $Target_Resource, $Description, $Product_Event_Type, $Event_Type
outcome:
$Date = timestamp.get_timestamp(max(metadata.event_timestamp.seconds))
$Count = count(metadata.id)
order:
$Date desc, $Count desc
存取歐盟資源的前 10 大權限帳戶
strings.coalesce(target.location.country_or_region, target.ip_geo_artifact.location.country_or_region, target.location.name) = /Austria|Belgium|Bulgaria|Croatia|Cyprus|Czechia|Denmark|Estonia|Finland|France|Germany|Greece|Hungary|Ireland|Italy|Latvia|Lithuania|Luxembourg|Malta|Netherlands|Poland|Portugal|Romania|Slovakia|Slovenia|Spain|Sweden|eu-(west-1|west-3|central-1|north-1|south-1|south-2)|europe-(west1|west3|west4|west8|west9|west10|west12|central2|north1|north2|southwest1)|austriaeast|denmarkeast|francecentral|germanywestcentral|greececentral|italynorth|northeurope|spaincentral|swedencentral|westeurope|polandcentral/ nocase
(metadata.event_type = "RESOURCE_READ" OR metadata.event_type = "RESOURCE_WRITTEN" OR metadata.event_type = "RESOURCE_CREATION" OR metadata.event_type = "RESOURCE_DELETION" OR metadata.event_type = "RESOURCE_PERMISSIONS_CHANGE" OR metadata.event_type = "FILE_UNCATEGORIZED" OR metadata.event_type = "FILE_CREATION" OR metadata.event_type = "FILE_DELETION" OR metadata.event_type = "FILE_MODIFICATION" OR metadata.event_type = "FILE_READ" OR metadata.event_type = "FILE_COPY" OR metadata.event_type = "FILE_OPEN" OR metadata.event_type = "FILE_MOVE" OR metadata.event_type = "FILE_SYNC" OR metadata.event_type = "EVENTTYPE_UNSPECIFIED" OR metadata.event_type = "SETTING_UNCATEGORIZED" OR metadata.event_type = "USER_UNCATEGORIZED" OR metadata.event_type = "SYSTEM_AUDIT_LOG_UNCATEGORIZED" OR metadata.event_type = "SYSTEM_AUDIT_LOG_WIPE" OR metadata.event_type = "USER_RESOURCE_CREATION" OR metadata.event_type = "USER_RESOURCE_UPDATE_CONTENT" OR metadata.event_type = "USER_RESOURCE_UPDATE_PERMISSIONS" OR metadata.event_type = "USER_RESOURCE_ACCESS" OR metadata.event_type = "USER_RESOURCE_DELETION" OR metadata.event_type = "GENERIC_EVENT" OR metadata.event_type ="USER_LOGIN" or metadata.event_type = "USER_CHANGE_PERMISSIONS")
$User = strings.coalesce(principal.user.userid, principal.user.user_display_name, principal.user.email_addresses, target.user.userid,target.user.user_display_name,target.user.email_addresses)
($User = /admin|root|svc|adm|privilege/ nocase or principal.user.attribute.roles.type = "SERVICE_ACCOUNT" or principal.user.attribute.roles.type = "ADMINISTRATOR" or principal.user.account_type = "DOMAIN_ACCOUNT_TYPE" or principal.user.account_type = "SERVICE_ACCOUNT_TYPE")
$Target_EU_Country = strings.coalesce(target.location.country_or_region, target.ip_geo_artifact.location.country_or_region, target.location.name)
match:
$User, $Target_EU_Country
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
歐盟境內資料遺失防護事件
strings.coalesce(target.location.country_or_region, target.ip_geo_artifact.location.country_or_region, target.location.name) = /Austria|Belgium|Bulgaria|Croatia|Cyprus|Czechia|Denmark|Estonia|Finland|France|Germany|Greece|Hungary|Ireland|Italy|Latvia|Lithuania|Luxembourg|Malta|Netherlands|Poland|Portugal|Romania|Slovakia|Slovenia|Spain|Sweden|eu-(west-1|west-3|central-1|north-1|south-1|south-2)|europe-(west1|west3|west4|west8|west9|west10|west12|central2|north1|north2|southwest1)|austriaeast|denmarkeast|francecentral|germanywestcentral|greececentral|italynorth|northeurope|spaincentral|swedencentral|westeurope|polandcentral/ nocase
(metadata.event_type = "RESOURCE_READ" OR metadata.event_type = "RESOURCE_WRITTEN" OR metadata.event_type = "RESOURCE_CREATION" OR metadata.event_type = "RESOURCE_DELETION" OR metadata.event_type = "RESOURCE_PERMISSIONS_CHANGE" OR metadata.event_type = "FILE_UNCATEGORIZED" OR metadata.event_type = "FILE_CREATION" OR metadata.event_type = "FILE_DELETION" OR metadata.event_type = "FILE_MODIFICATION" OR metadata.event_type = "FILE_READ" OR metadata.event_type = "FILE_COPY" OR metadata.event_type = "FILE_OPEN" OR metadata.event_type = "FILE_MOVE" OR metadata.event_type = "FILE_SYNC" OR metadata.event_type = "EVENTTYPE_UNSPECIFIED" OR metadata.event_type = "SETTING_UNCATEGORIZED" OR metadata.event_type = "USER_UNCATEGORIZED" OR metadata.event_type = "SYSTEM_AUDIT_LOG_UNCATEGORIZED" OR metadata.event_type = "SYSTEM_AUDIT_LOG_WIPE" OR metadata.event_type = "USER_RESOURCE_CREATION" OR metadata.event_type = "USER_RESOURCE_UPDATE_CONTENT" OR metadata.event_type = "USER_RESOURCE_UPDATE_PERMISSIONS" OR metadata.event_type = "USER_RESOURCE_ACCESS" OR metadata.event_type = "USER_RESOURCE_DELETION" OR metadata.event_type = "GENERIC_EVENT" OR metadata.event_type = "NETWORK_UNCATEGORIZED" OR metadata.event_type = "NETWORK_FLOW" OR metadata.event_type = "NETWORK_CONNECTION" OR metadata.event_type = "NETWORK_FTP" OR metadata.event_type = "NETWORK_DHCP" OR metadata.event_type = "NETWORK_DNS" OR metadata.event_type = "NETWORK_HTTP" OR metadata.event_type = "NETWORK_SMTP")
(metadata.log_type = /DLP|ACCELLION|CODE42_INCYDR|GUARDIUM|TRIPWIRE_FIM/ nocase OR metadata.product_event_type = /dlp/ nocase OR security_result.outcomes.value = /dlp/ nocase OR security_result.rule_type = /dlp/ nocase OR security_result.rule_name = /dlp/ nocase OR security_result.category_details = /dlp|data loss prevention/ nocase OR security_result.category = "DATA_EXFILTRATION" or security_result.category = "DATA_DESTRUCTION")
outcome:
$Count = count(metadata.id)
接收歐盟資料的前 10 大外部網域
strings.coalesce(principal.location.country_or_region, principal.ip_geo_artifact.location.country_or_region, principal.location.name) = /Austria|Belgium|Bulgaria|Croatia|Cyprus|Czechia|Denmark|Estonia|Finland|France|Germany|Greece|Hungary|Ireland|Italy|Latvia|Lithuania|Luxembourg|Malta|Netherlands|Poland|Portugal|Romania|Slovakia|Slovenia|Spain|Sweden|eu-(west-1|west-3|central-1|north-1|south-1|south-2)|europe-(west1|west3|west4|west8|west9|west10|west12|central2|north1|north2|southwest1)|austriaeast|denmarkeast|francecentral|germanywestcentral|greececentral|italynorth|northeurope|spaincentral|swedencentral|westeurope|polandcentral/ nocase
(metadata.event_type = "RESOURCE_READ" OR metadata.event_type = "RESOURCE_WRITTEN" OR metadata.event_type = "RESOURCE_CREATION" OR metadata.event_type = "RESOURCE_DELETION" OR metadata.event_type = "RESOURCE_PERMISSIONS_CHANGE" OR metadata.event_type = "FILE_UNCATEGORIZED" OR metadata.event_type = "FILE_CREATION" OR metadata.event_type = "FILE_DELETION" OR metadata.event_type = "FILE_MODIFICATION" OR metadata.event_type = "FILE_READ" OR metadata.event_type = "FILE_COPY" OR metadata.event_type = "FILE_OPEN" OR metadata.event_type = "FILE_MOVE" OR metadata.event_type = "FILE_SYNC" OR metadata.event_type = "EVENTTYPE_UNSPECIFIED" OR metadata.event_type = "SETTING_UNCATEGORIZED" OR metadata.event_type = "USER_UNCATEGORIZED" OR metadata.event_type = "SYSTEM_AUDIT_LOG_UNCATEGORIZED" OR metadata.event_type = "SYSTEM_AUDIT_LOG_WIPE" OR metadata.event_type = "USER_RESOURCE_CREATION" OR metadata.event_type = "USER_RESOURCE_UPDATE_CONTENT" OR metadata.event_type = "USER_RESOURCE_UPDATE_PERMISSIONS" OR metadata.event_type = "USER_RESOURCE_ACCESS" OR metadata.event_type = "USER_RESOURCE_DELETION" OR metadata.event_type = "GENERIC_EVENT" OR metadata.event_type = "NETWORK_UNCATEGORIZED" OR metadata.event_type = "NETWORK_FLOW" OR metadata.event_type = "NETWORK_CONNECTION" OR metadata.event_type = "NETWORK_FTP" OR metadata.event_type = "NETWORK_DHCP" OR metadata.event_type = "NETWORK_DNS" OR metadata.event_type = "NETWORK_HTTP"
OR metadata.event_type = "NETWORK_SMTP")
network.direction = "OUTBOUND"
network.sent_bytes > 0
$Target_Domain = re.capture(strings.coalesce(target.url, target.administrative_domain), `^(?:https?:\/\/)?(?:www\.)?([^\/:]+)`)
$Target_Domain != ""
$Target_EU_Country = strings.coalesce(target.location.country_or_region, target.ip_geo_artifact.location.country_or_region, target.location.name)
match:
$Target_Domain, $Target_EU_Country
outcome:
$Size_in_MB = math.round((sum(network.sent_bytes)/1000000), 2)
order :
$Size_in_MB desc
limit:
10
惡意軟體檔案摘要
strings.coalesce(target.location.country_or_region, target.ip_geo_artifact.location.country_or_region, target.location.name) = /Austria|Belgium|Bulgaria|Croatia|Cyprus|Czechia|Denmark|Estonia|Finland|France|Germany|Greece|Hungary|Ireland|Italy|Latvia|Lithuania|Luxembourg|Malta|Netherlands|Poland|Portugal|Romania|Slovakia|Slovenia|Spain|Sweden|eu-(west-1|west-3|central-1|north-1|south-1|south-2)|europe-(west1|west3|west4|west8|west9|west10|west12|central2|north1|north2|southwest1)|austriaeast|denmarkeast|francecentral|germanywestcentral|greececentral|italynorth|northeurope|spaincentral|swedencentral|westeurope|polandcentral/ nocase
(metadata.event_type = "RESOURCE_READ" OR metadata.event_type = "RESOURCE_WRITTEN" OR metadata.event_type = "RESOURCE_CREATION" OR metadata.event_type = "RESOURCE_DELETION" OR metadata.event_type = "RESOURCE_PERMISSIONS_CHANGE" OR metadata.event_type = "FILE_UNCATEGORIZED" OR metadata.event_type = "FILE_CREATION" OR metadata.event_type = "FILE_DELETION" OR metadata.event_type = "FILE_MODIFICATION" OR metadata.event_type = "FILE_READ" OR metadata.event_type = "FILE_COPY" OR metadata.event_type = "FILE_OPEN" OR metadata.event_type = "FILE_MOVE" OR metadata.event_type = "FILE_SYNC" OR metadata.event_type = "EVENTTYPE_UNSPECIFIED" OR metadata.event_type = "SETTING_UNCATEGORIZED" OR metadata.event_type = "USER_UNCATEGORIZED" OR metadata.event_type = "SYSTEM_AUDIT_LOG_UNCATEGORIZED" OR metadata.event_type = "SYSTEM_AUDIT_LOG_WIPE" OR metadata.event_type = "USER_RESOURCE_CREATION" OR metadata.event_type = "USER_RESOURCE_UPDATE_CONTENT" OR metadata.event_type = "USER_RESOURCE_UPDATE_PERMISSIONS" OR metadata.event_type = "USER_RESOURCE_ACCESS" OR metadata.event_type = "USER_RESOURCE_DELETION" OR metadata.event_type = "GENERIC_EVENT")
(metadata.product_event_type = /malware/ nocase or security_result.summary = /malware/ nocase or security_result.category_details = /malware/ nocase or metadata.description = /malware/ nocase or security_result.threat_name = /malware/ nocase or security_result.rule_name = /malware/ nocase or security_result.category = "SOFTWARE_MALICIOUS")
$Source_User = strings.coalesce(principal.user.user_display_name, principal.user.userid, principal.user.email_addresses)
$File_Name = strings.coalesce(target.file.full_path, about.file.full_path)
$File_Name != ""
$File_Type = target.file.file_type
$Severity = security_result.severity
$Action = security_result.action
$Hostname = strings.coalesce(principal.hostname, principal.asset.hostname)
$Threat_Name = security_result.threat_name
match :
$Hostname,$File_Name, $File_Type, $Threat_Name, $Source_User, $Severity, $Action
outcome:
$Count = count(metadata.id)
$Date = timestamp.get_timestamp(max(metadata.event_timestamp.seconds), "%F %T")
order:
$Count desc
歐盟境內資料遺失防護事件歷來趨勢
strings.coalesce(target.location.country_or_region, target.ip_geo_artifact.location.country_or_region, target.location.name) = /Austria|Belgium|Bulgaria|Croatia|Cyprus|Czechia|Denmark|Estonia|Finland|France|Germany|Greece|Hungary|Ireland|Italy|Latvia|Lithuania|Luxembourg|Malta|Netherlands|Poland|Portugal|Romania|Slovakia|Slovenia|Spain|Sweden|eu-(west-1|west-3|central-1|north-1|south-1|south-2)|europe-(west1|west3|west4|west8|west9|west10|west12|central2|north1|north2|southwest1)|austriaeast|denmarkeast|francecentral|germanywestcentral|greececentral|italynorth|northeurope|spaincentral|swedencentral|westeurope|polandcentral/ nocase
(metadata.event_type = "RESOURCE_READ" OR metadata.event_type = "RESOURCE_WRITTEN" OR metadata.event_type = "RESOURCE_CREATION" OR metadata.event_type = "RESOURCE_DELETION" OR metadata.event_type = "RESOURCE_PERMISSIONS_CHANGE" OR metadata.event_type = "FILE_UNCATEGORIZED" OR metadata.event_type = "FILE_CREATION" OR metadata.event_type = "FILE_DELETION" OR metadata.event_type = "FILE_MODIFICATION" OR metadata.event_type = "FILE_READ" OR metadata.event_type = "FILE_COPY" OR metadata.event_type = "FILE_OPEN" OR metadata.event_type = "FILE_MOVE" OR metadata.event_type = "FILE_SYNC" OR metadata.event_type = "EVENTTYPE_UNSPECIFIED" OR metadata.event_type = "SETTING_UNCATEGORIZED" OR metadata.event_type = "USER_UNCATEGORIZED" OR metadata.event_type = "SYSTEM_AUDIT_LOG_UNCATEGORIZED" OR metadata.event_type = "SYSTEM_AUDIT_LOG_WIPE" OR metadata.event_type = "USER_RESOURCE_CREATION" OR metadata.event_type = "USER_RESOURCE_UPDATE_CONTENT" OR metadata.event_type = "USER_RESOURCE_UPDATE_PERMISSIONS" OR metadata.event_type = "USER_RESOURCE_ACCESS" OR metadata.event_type = "USER_RESOURCE_DELETION" OR metadata.event_type = "GENERIC_EVENT" OR metadata.event_type = "NETWORK_UNCATEGORIZED" OR metadata.event_type = "NETWORK_FLOW" OR metadata.event_type = "NETWORK_CONNECTION" OR metadata.event_type = "NETWORK_FTP" OR metadata.event_type = "NETWORK_DHCP" OR metadata.event_type = "NETWORK_DNS" OR metadata.event_type = "NETWORK_HTTP" OR metadata.event_type = "NETWORK_SMTP")
(metadata.log_type = /DLP|ACCELLION|CODE42_INCYDR|GUARDIUM|TRIPWIRE_FIM/ nocase OR metadata.product_event_type = /dlp/ nocase OR security_result.outcomes.value = /dlp/ nocase OR security_result.rule_type = /dlp/ nocase OR security_result.rule_name = /dlp/ nocase OR security_result.category_details = /dlp|data loss prevention/ nocase OR security_result.category = "DATA_EXFILTRATION" or security_result.category = "DATA_DESTRUCTION")
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
$Log_Type = metadata.log_type
match:
$Date, $Log_Type
outcome:
$Count = count(metadata.id)
order:
$Date asc
一段時間內的歐盟資料存取事件
strings.coalesce(target.location.country_or_region, target.ip_geo_artifact.location.country_or_region, target.location.name) = /Austria|Belgium|Bulgaria|Croatia|Cyprus|Czechia|Denmark|Estonia|Finland|France|Germany|Greece|Hungary|Ireland|Italy|Latvia|Lithuania|Luxembourg|Malta|Netherlands|Poland|Portugal|Romania|Slovakia|Slovenia|Spain|Sweden|eu-(west-1|west-3|central-1|north-1|south-1|south-2)|europe-(west1|west3|west4|west8|west9|west10|west12|central2|north1|north2|southwest1)|austriaeast|denmarkeast|francecentral|germanywestcentral|greececentral|italynorth|northeurope|spaincentral|swedencentral|westeurope|polandcentral/ nocase
(metadata.event_type = "RESOURCE_READ" OR metadata.event_type = "RESOURCE_WRITTEN" OR metadata.event_type = "RESOURCE_CREATION" OR metadata.event_type = "RESOURCE_DELETION" OR metadata.event_type = "RESOURCE_PERMISSIONS_CHANGE" OR metadata.event_type = "FILE_UNCATEGORIZED" OR metadata.event_type = "FILE_CREATION" OR metadata.event_type = "FILE_DELETION" OR metadata.event_type = "FILE_MODIFICATION" OR metadata.event_type = "FILE_READ" OR metadata.event_type = "FILE_COPY" OR metadata.event_type = "FILE_OPEN" OR metadata.event_type = "FILE_MOVE" OR metadata.event_type = "FILE_SYNC" OR metadata.event_type = "EVENTTYPE_UNSPECIFIED" OR metadata.event_type = "SETTING_UNCATEGORIZED" OR metadata.event_type = "USER_UNCATEGORIZED" OR metadata.event_type = "SYSTEM_AUDIT_LOG_UNCATEGORIZED" OR metadata.event_type = "SYSTEM_AUDIT_LOG_WIPE" OR metadata.event_type = "USER_RESOURCE_CREATION" OR metadata.event_type = "USER_RESOURCE_UPDATE_CONTENT" OR metadata.event_type = "USER_RESOURCE_UPDATE_PERMISSIONS" OR metadata.event_type = "USER_RESOURCE_ACCESS" OR metadata.event_type = "USER_RESOURCE_DELETION" OR metadata.event_type = "GENERIC_EVENT")
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
$Action = security_result.action
match:
$Date, $Action
outcome:
$Count = count(metadata.id)
order:
$Date asc
觸發次數最多的前 10 項政策
strings.coalesce(target.location.country_or_region, target.ip_geo_artifact.location.country_or_region, target.location.name) = /Austria|Belgium|Bulgaria|Croatia|Cyprus|Czechia|Denmark|Estonia|Finland|France|Germany|Greece|Hungary|Ireland|Italy|Latvia|Lithuania|Luxembourg|Malta|Netherlands|Poland|Portugal|Romania|Slovakia|Slovenia|Spain|Sweden|eu-(west-1|west-3|central-1|north-1|south-1|south-2)|europe-(west1|west3|west4|west8|west9|west10|west12|central2|north1|north2|southwest1)|austriaeast|denmarkeast|francecentral|germanywestcentral|greececentral|italynorth|northeurope|spaincentral|swedencentral|westeurope|polandcentral/ nocase
(metadata.event_type = "RESOURCE_READ" OR metadata.event_type = "RESOURCE_WRITTEN" OR metadata.event_type = "RESOURCE_CREATION" OR metadata.event_type = "RESOURCE_DELETION" OR metadata.event_type = "RESOURCE_PERMISSIONS_CHANGE" OR metadata.event_type = "FILE_UNCATEGORIZED" OR metadata.event_type = "FILE_CREATION" OR metadata.event_type = "FILE_DELETION" OR metadata.event_type = "FILE_MODIFICATION" OR metadata.event_type = "FILE_READ" OR metadata.event_type = "FILE_COPY" OR metadata.event_type = "FILE_OPEN" OR metadata.event_type = "FILE_MOVE" OR metadata.event_type = "FILE_SYNC" OR metadata.event_type = "EVENTTYPE_UNSPECIFIED" OR metadata.event_type = "SETTING_UNCATEGORIZED" OR metadata.event_type = "USER_UNCATEGORIZED" OR metadata.event_type = "SYSTEM_AUDIT_LOG_UNCATEGORIZED" OR metadata.event_type = "SYSTEM_AUDIT_LOG_WIPE" OR metadata.event_type = "USER_RESOURCE_CREATION" OR metadata.event_type = "USER_RESOURCE_UPDATE_CONTENT" OR metadata.event_type = "USER_RESOURCE_UPDATE_PERMISSIONS" OR metadata.event_type = "USER_RESOURCE_ACCESS" OR metadata.event_type = "USER_RESOURCE_DELETION" OR metadata.event_type = "GENERIC_EVENT")
security_result.rule_name = /Policy/ nocase
$Policy = security_result.rule_name
$Policy != ""
$Target_EU_Country = strings.coalesce(target.location.country_or_region, target.ip_geo_artifact.location.country_or_region, target.location.name)
match:
$Policy, $Target_EU_Country
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
未經授權存取歐盟資源
strings.coalesce(target.location.country_or_region, target.ip_geo_artifact.location.country_or_region, target.location.name) = /Austria|Belgium|Bulgaria|Croatia|Cyprus|Czechia|Denmark|Estonia|Finland|France|Germany|Greece|Hungary|Ireland|Italy|Latvia|Lithuania|Luxembourg|Malta|Netherlands|Poland|Portugal|Romania|Slovakia|Slovenia|Spain|Sweden|eu-(west-1|west-3|central-1|north-1|south-1|south-2)|europe-(west1|west3|west4|west8|west9|west10|west12|central2|north1|north2|southwest1)|austriaeast|denmarkeast|francecentral|germanywestcentral|greececentral|italynorth|northeurope|spaincentral|swedencentral|westeurope|polandcentral/ nocase
(metadata.event_type = "RESOURCE_READ" OR metadata.event_type = "RESOURCE_WRITTEN" OR metadata.event_type = "RESOURCE_CREATION" OR metadata.event_type = "RESOURCE_DELETION" OR metadata.event_type = "RESOURCE_PERMISSIONS_CHANGE" OR metadata.event_type = "FILE_UNCATEGORIZED" OR metadata.event_type = "FILE_CREATION" OR metadata.event_type = "FILE_DELETION" OR metadata.event_type = "FILE_MODIFICATION" OR metadata.event_type = "FILE_READ" OR metadata.event_type = "FILE_COPY" OR metadata.event_type = "FILE_OPEN" OR metadata.event_type = "FILE_MOVE" OR metadata.event_type = "FILE_SYNC" OR metadata.event_type = "EVENTTYPE_UNSPECIFIED" OR metadata.event_type = "SETTING_UNCATEGORIZED" OR metadata.event_type = "USER_UNCATEGORIZED" OR metadata.event_type = "SYSTEM_AUDIT_LOG_UNCATEGORIZED" OR metadata.event_type = "SYSTEM_AUDIT_LOG_WIPE" OR metadata.event_type = "USER_RESOURCE_CREATION" OR metadata.event_type = "USER_RESOURCE_UPDATE_CONTENT" OR metadata.event_type = "USER_RESOURCE_UPDATE_PERMISSIONS" OR metadata.event_type = "USER_RESOURCE_ACCESS" OR metadata.event_type = "USER_RESOURCE_DELETION" OR metadata.event_type = "GENERIC_EVENT")
$User = strings.coalesce(principal.user.userid, principal.user.user_display_name, principal.user.email_addresses,target.user.userid, target.user.user_display_name, target.user.email_addresses)
$Source_IP = strings.coalesce(principal.ip, principal.asset.ip)
$Hostname = strings.coalesce(principal.hostname, principal.asset.hostname)
$Action = security_result.action
$Action != "ALLOW"
$Summary = strings.coalesce(security_result.summary, metadata.description, security_result.description)
$Severity = security_result.severity
match:
$Summary, $User, $Source_IP ,$Action , $Severity, $Hostname
outcome :
$Count = count(metadata.id)
$Date = timestamp.get_timestamp(max(metadata.event_timestamp.seconds))
order:
$Count desc
從非歐盟國家/地區存取歐盟資源
(strings.coalesce(target.location.country_or_region, target.ip_geo_artifact.location.country_or_region, target.location.name) = /Austria|Belgium|Bulgaria|Croatia|Cyprus|Czechia|Denmark|Estonia|Finland|France|Germany|Greece|Hungary|Ireland|Italy|Latvia|Lithuania|Luxembourg|Malta|Netherlands|Poland|Portugal|Romania|Slovakia|Slovenia|Spain|Sweden|eu-(west-1|west-3|central-1|north-1|south-1|south-2)|europe-(west1|west3|west4|west8|west9|west10|west12|central2|north1|north2|southwest1)|austriaeast|denmarkeast|francecentral|germanywestcentral|greececentral|italynorth|northeurope|spaincentral|swedencentral|westeurope|polandcentral/ nocase
and strings.coalesce(principal.location.country_or_region, principal.ip_geo_artifact.location.country_or_region, principal.location.name) != /Austria|Belgium|Bulgaria|Croatia|Cyprus|Czechia|Denmark|Estonia|Finland|France|Germany|Greece|Hungary|Ireland|Italy|Latvia|Lithuania|Luxembourg|Malta|Netherlands|Poland|Portugal|Romania|Slovakia|Slovenia|Spain|Sweden|eu-(west-1|west-3|central-1|north-1|south-1|south-2)|europe-(west1|west3|west4|west8|west9|west10|west12|central2|north1|north2|southwest1)|austriaeast|denmarkeast|francecentral|germanywestcentral|greececentral|italynorth|northeurope|spaincentral|swedencentral|westeurope|polandcentral/ nocase)
(metadata.event_type = "RESOURCE_READ" OR metadata.event_type = "RESOURCE_WRITTEN" OR metadata.event_type = "RESOURCE_CREATION" OR metadata.event_type = "RESOURCE_DELETION" OR metadata.event_type = "RESOURCE_PERMISSIONS_CHANGE" OR metadata.event_type = "FILE_UNCATEGORIZED" OR metadata.event_type = "FILE_CREATION" OR metadata.event_type = "FILE_DELETION" OR metadata.event_type = "FILE_MODIFICATION" OR metadata.event_type = "FILE_READ" OR metadata.event_type = "FILE_COPY" OR metadata.event_type = "FILE_OPEN" OR metadata.event_type = "FILE_MOVE" OR metadata.event_type = "FILE_SYNC" OR metadata.event_type = "EVENTTYPE_UNSPECIFIED" OR metadata.event_type = "SETTING_UNCATEGORIZED" OR metadata.event_type = "USER_UNCATEGORIZED" OR metadata.event_type = "SYSTEM_AUDIT_LOG_UNCATEGORIZED" OR metadata.event_type = "SYSTEM_AUDIT_LOG_WIPE" OR metadata.event_type = "USER_RESOURCE_CREATION" OR metadata.event_type = "USER_RESOURCE_UPDATE_CONTENT" OR metadata.event_type = "USER_RESOURCE_UPDATE_PERMISSIONS" OR metadata.event_type = "USER_RESOURCE_ACCESS" OR metadata.event_type = "USER_RESOURCE_DELETION" OR metadata.event_type = "GENERIC_EVENT")
$Source_Country = strings.coalesce(principal.location.country_or_region, principal.ip_geo_artifact.location.country_or_region, principal.location.name)
$Target_EU_Country = strings.coalesce(target.location.country_or_region, target.ip_geo_artifact.location.country_or_region, target.location.name)
$Target_EU_Resource = strings.coalesce(target.resource.name, target.file.full_path, target.resource.product_object_id, target.group.product_object_id, target.user.group_identifiers)
$Event_Type = metadata.event_type
$Description = strings.coalesce(metadata.description,security_result.description,security_result.summary,metadata.product_event_type)
$HTTP_Method = network.http.method
$Log_Type = metadata.log_type
$Action = security_result.action
$User = strings.coalesce(principal.user.user_display_name, principal.user.userid, principal.user.email_addresses,target.user.userid,target.user.user_display_name,target.user.email_addresses)
$Source_Country != ""
match:
$User, $Description, $Event_Type, $Log_Type, $Source_Country, $Target_EU_Resource, $Target_EU_Country, $HTTP_Method, $Action
outcome:
$Count = count(metadata.id)
$Date = timestamp.get_timestamp(max(metadata.event_timestamp.seconds))
order:
$Count desc
存取歐盟資料的前 10 大非歐盟國家/地區
(strings.coalesce(target.location.country_or_region, target.ip_geo_artifact.location.country_or_region, target.location.name) = /Austria|Belgium|Bulgaria|Croatia|Cyprus|Czechia|Denmark|Estonia|Finland|France|Germany|Greece|Hungary|Ireland|Italy|Latvia|Lithuania|Luxembourg|Malta|Netherlands|Poland|Portugal|Romania|Slovakia|Slovenia|Spain|Sweden|eu-(west-1|west-3|central-1|north-1|south-1|south-2)|europe-(west1|west3|west4|west8|west9|west10|west12|central2|north1|north2|southwest1)|austriaeast|denmarkeast|francecentral|germanywestcentral|greececentral|italynorth|northeurope|spaincentral|swedencentral|westeurope|polandcentral/ nocase
and strings.coalesce(principal.location.country_or_region, principal.ip_geo_artifact.location.country_or_region, principal.location.name) != /Austria|Belgium|Bulgaria|Croatia|Cyprus|Czechia|Denmark|Estonia|Finland|France|Germany|Greece|Hungary|Ireland|Italy|Latvia|Lithuania|Luxembourg|Malta|Netherlands|Poland|Portugal|Romania|Slovakia|Slovenia|Spain|Sweden|eu-(west-1|west-3|central-1|north-1|south-1|south-2)|europe-(west1|west3|west4|west8|west9|west10|west12|central2|north1|north2|southwest1)|austriaeast|denmarkeast|francecentral|germanywestcentral|greececentral|italynorth|northeurope|spaincentral|swedencentral|westeurope|polandcentral/ nocase)
(metadata.event_type = "RESOURCE_READ" OR metadata.event_type = "RESOURCE_WRITTEN" OR metadata.event_type = "RESOURCE_CREATION" OR metadata.event_type = "RESOURCE_DELETION" OR metadata.event_type = "RESOURCE_PERMISSIONS_CHANGE" OR metadata.event_type = "FILE_UNCATEGORIZED" OR metadata.event_type = "FILE_CREATION" OR metadata.event_type = "FILE_DELETION" OR metadata.event_type = "FILE_MODIFICATION" OR metadata.event_type = "FILE_READ" OR metadata.event_type = "FILE_COPY" OR metadata.event_type = "FILE_OPEN" OR metadata.event_type = "FILE_MOVE" OR metadata.event_type = "FILE_SYNC" OR metadata.event_type = "EVENTTYPE_UNSPECIFIED" OR metadata.event_type = "SETTING_UNCATEGORIZED" OR metadata.event_type = "USER_UNCATEGORIZED" OR metadata.event_type = "SYSTEM_AUDIT_LOG_UNCATEGORIZED" OR metadata.event_type = "SYSTEM_AUDIT_LOG_WIPE" OR metadata.event_type = "USER_RESOURCE_CREATION" OR metadata.event_type = "USER_RESOURCE_UPDATE_CONTENT" OR metadata.event_type = "USER_RESOURCE_UPDATE_PERMISSIONS" OR metadata.event_type = "USER_RESOURCE_ACCESS" OR metadata.event_type = "USER_RESOURCE_DELETION" OR metadata.event_type = "GENERIC_EVENT")
$Source_Country = strings.coalesce(principal.location.country_or_region, principal.ip_geo_artifact.location.country_or_region, principal.location.name)
$Log_Type = metadata.log_type
$Source_Country != ""
match:
$Source_Country, $Log_Type
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
一段時間內對歐盟資源的特殊存取權
strings.coalesce(target.location.country_or_region, target.ip_geo_artifact.location.country_or_region, target.location.name) = /Austria|Belgium|Bulgaria|Croatia|Cyprus|Czechia|Denmark|Estonia|Finland|France|Germany|Greece|Hungary|Ireland|Italy|Latvia|Lithuania|Luxembourg|Malta|Netherlands|Poland|Portugal|Romania|Slovakia|Slovenia|Spain|Sweden|eu-(west-1|west-3|central-1|north-1|south-1|south-2)|europe-(west1|west3|west4|west8|west9|west10|west12|central2|north1|north2|southwest1)|austriaeast|denmarkeast|francecentral|germanywestcentral|greececentral|italynorth|northeurope|spaincentral|swedencentral|westeurope|polandcentral/ nocase
(metadata.event_type = "RESOURCE_READ" OR metadata.event_type = "RESOURCE_WRITTEN" OR metadata.event_type = "RESOURCE_CREATION" OR metadata.event_type = "RESOURCE_DELETION" OR metadata.event_type = "RESOURCE_PERMISSIONS_CHANGE" OR metadata.event_type = "FILE_UNCATEGORIZED" OR metadata.event_type = "FILE_CREATION" OR metadata.event_type = "FILE_DELETION" OR metadata.event_type = "FILE_MODIFICATION" OR metadata.event_type = "FILE_READ" OR metadata.event_type = "FILE_COPY" OR metadata.event_type = "FILE_OPEN" OR metadata.event_type = "FILE_MOVE" OR metadata.event_type = "FILE_SYNC" OR metadata.event_type = "EVENTTYPE_UNSPECIFIED" OR metadata.event_type = "SETTING_UNCATEGORIZED" OR metadata.event_type = "USER_UNCATEGORIZED" OR metadata.event_type = "SYSTEM_AUDIT_LOG_UNCATEGORIZED" OR metadata.event_type = "SYSTEM_AUDIT_LOG_WIPE" OR metadata.event_type = "USER_RESOURCE_CREATION" OR metadata.event_type = "USER_RESOURCE_UPDATE_CONTENT" OR metadata.event_type = "USER_RESOURCE_UPDATE_PERMISSIONS" OR metadata.event_type = "USER_RESOURCE_ACCESS" OR metadata.event_type = "USER_RESOURCE_DELETION" OR metadata.event_type = "GENERIC_EVENT" OR metadata.event_type ="USER_LOGIN" or metadata.event_type = "USER_CHANGE_PERMISSIONS")
$User = strings.coalesce(principal.user.userid,principal.user.user_display_name,principal.user.email_addresses,target.user.userid,target.user.user_display_name,target.user.email_addresses)
($User = /admin|root|svc|adm|privilege/ nocase or principal.user.attribute.roles.type = "SERVICE_ACCOUNT" or principal.user.attribute.roles.type = "ADMINISTRATOR" or principal.user.account_type = "DOMAIN_ACCOUNT_TYPE" or principal.user.account_type = "SERVICE_ACCOUNT_TYPE")
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
$Target_EU_Country = strings.coalesce(target.location.country_or_region, target.ip_geo_artifact.location.country_or_region, target.location.name)
match:
$Target_EU_Country, $Date
outcome:
$Count = count(metadata.id)
order:
$Date asc
一段時間內的威脅偵測
strings.coalesce(target.location.country_or_region, target.ip_geo_artifact.location.country_or_region, target.location.name) = /Austria|Belgium|Bulgaria|Croatia|Cyprus|Czechia|Denmark|Estonia|Finland|France|Germany|Greece|Hungary|Ireland|Italy|Latvia|Lithuania|Luxembourg|Malta|Netherlands|Poland|Portugal|Romania|Slovakia|Slovenia|Spain|Sweden|eu-(west-1|west-3|central-1|north-1|south-1|south-2)|europe-(west1|west3|west4|west8|west9|west10|west12|central2|north1|north2|southwest1)|austriaeast|denmarkeast|francecentral|germanywestcentral|greececentral|italynorth|northeurope|spaincentral|swedencentral|westeurope|polandcentral/ nocase
(metadata.event_type = "RESOURCE_READ" OR metadata.event_type = "RESOURCE_WRITTEN" OR metadata.event_type = "RESOURCE_CREATION" OR metadata.event_type = "RESOURCE_DELETION" OR metadata.event_type = "RESOURCE_PERMISSIONS_CHANGE" OR metadata.event_type = "FILE_UNCATEGORIZED" OR metadata.event_type = "FILE_CREATION" OR metadata.event_type = "FILE_DELETION" OR metadata.event_type = "FILE_MODIFICATION" OR metadata.event_type = "FILE_READ" OR metadata.event_type = "FILE_COPY" OR metadata.event_type = "FILE_OPEN" OR metadata.event_type = "FILE_MOVE" OR metadata.event_type = "FILE_SYNC" OR metadata.event_type = "EVENTTYPE_UNSPECIFIED" OR metadata.event_type = "SETTING_UNCATEGORIZED" OR metadata.event_type = "USER_UNCATEGORIZED" OR metadata.event_type = "SYSTEM_AUDIT_LOG_UNCATEGORIZED" OR metadata.event_type = "SYSTEM_AUDIT_LOG_WIPE" OR metadata.event_type = "USER_RESOURCE_CREATION" OR metadata.event_type = "USER_RESOURCE_UPDATE_CONTENT" OR metadata.event_type = "USER_RESOURCE_UPDATE_PERMISSIONS" OR metadata.event_type = "USER_RESOURCE_ACCESS" OR metadata.event_type = "USER_RESOURCE_DELETION" OR metadata.event_type = "GENERIC_EVENT")
$Threat_Name = security_result.threat_name
$Threat_Name != ""
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
match:
$Threat_Name, $Date
outcome:
$Count = count(metadata.id)
order:
$Date asc
機密資料存取事件
strings.coalesce(principal.location.country_or_region, principal.ip_geo_artifact.location.country_or_region, principal.location.name) = /Austria|Belgium|Bulgaria|Croatia|Cyprus|Czechia|Denmark|Estonia|Finland|France|Germany|Greece|Hungary|Ireland|Italy|Latvia|Lithuania|Luxembourg|Malta|Netherlands|Poland|Portugal|Romania|Slovakia|Slovenia|Spain|Sweden|eu-(west-1|west-3|central-1|north-1|south-1|south-2)|europe-(west1|west3|west4|west8|west9|west10|west12|central2|north1|north2|southwest1)|austriaeast|denmarkeast|francecentral|germanywestcentral|greececentral|italynorth|northeurope|spaincentral|swedencentral|westeurope|polandcentral/ nocase
(metadata.event_type = "RESOURCE_READ" OR metadata.event_type = "RESOURCE_WRITTEN" OR metadata.event_type = "RESOURCE_CREATION" OR metadata.event_type = "RESOURCE_DELETION" OR metadata.event_type = "RESOURCE_PERMISSIONS_CHANGE" OR metadata.event_type = "FILE_UNCATEGORIZED" OR metadata.event_type = "FILE_CREATION" OR metadata.event_type = "FILE_DELETION" OR metadata.event_type = "FILE_MODIFICATION" OR metadata.event_type = "FILE_READ" OR metadata.event_type = "FILE_COPY" OR metadata.event_type = "FILE_OPEN" OR metadata.event_type = "FILE_MOVE" OR metadata.event_type = "FILE_SYNC" OR metadata.event_type = "EVENTTYPE_UNSPECIFIED" OR metadata.event_type = "SETTING_UNCATEGORIZED" OR metadata.event_type = "USER_UNCATEGORIZED" OR metadata.event_type = "SYSTEM_AUDIT_LOG_UNCATEGORIZED" OR metadata.event_type = "SYSTEM_AUDIT_LOG_WIPE" OR metadata.event_type = "USER_RESOURCE_CREATION" OR metadata.event_type = "USER_RESOURCE_UPDATE_CONTENT" OR metadata.event_type = "USER_RESOURCE_UPDATE_PERMISSIONS" OR metadata.event_type = "USER_RESOURCE_ACCESS" OR metadata.event_type = "USER_RESOURCE_DELETION" OR metadata.log_type = "GENERIC_EVENT" OR metadata.event_type ="USER_LOGIN" or metadata.log_type = "USER_CHANGE_PERMISSIONS")
(metadata.product_event_type = /SENSITIVE/ nocase OR security_result.rule_name = /SENSITIVE/ nocase OR metadata.description = /SENSITIVE/ nocase OR security_result.summary = /SENSITIVE/ nocase OR security_result.description = /SENSITIVE/ nocase)
$Description = strings.coalesce(security_result.summary, security_result.description,metadata.description)
$Source_User = strings.coalesce(principal.user.userid,principal.user.user_display_name,principal.user.email_addresses)
$Target_User = strings.coalesce(target.user.userid,target.user.user_display_name,target.user.email_addresses)
$Source_Country = strings.coalesce(principal.location.country_or_region, principal.ip_geo_artifact.location.country_or_region, principal.location.name)
$Source_IP = strings.coalesce(principal.ip, principal.asset.ip)
$Destination_IP = strings.coalesce(target.ip, target.asset.ip)
$Protocol = network.application_protocol
$Action = security_result.action
$Log_Type = metadata.log_type
match:
$Description,$Source_User, $Target_User, $Source_IP,$Source_Country, $Destination_IP ,$Protocol , $Log_Type, $Action
outcome:
$Count = count(metadata.id)
$Date = timestamp.get_timestamp(max(metadata.event_timestamp.seconds))
order:
$Count desc
Google Workspace 快訊
這個資訊主頁會顯示安全性事件和潛在威脅的總覽，
追蹤工作區中與使用者活動相關的重大快訊和趨勢。
前 10 大高嚴重性警報
前 10 大警報
一段時間內的快訊
最近的快訊詳細資料
依嚴重性分類的快訊
前 10 名使用者 (按警告數量排名)
圖表名稱
查詢示例
前 10 大高嚴重性警報
metadata.log_type = "WORKSPACE_ALERTS"
security_result.severity = "HIGH"
security_result.summary != ""
$Alert = security_result.summary
$Alert != ""
match:
$Alert
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
前 10 大警報
metadata.log_type = "WORKSPACE_ALERTS"
security_result.summary != ""
$Alert = security_result.summary
$Alert != ""
match:
$Alert
outcome:
$Count = count(security_result.summary)
order:
$Count desc
limit:
10
一段時間內的快訊
metadata.log_type = "WORKSPACE_ALERTS"
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
match:
$Date
outcome:
$Count = count(metadata.id)
order:
$Date desc
最近的快訊詳細資料
metadata.log_type = "WORKSPACE_ALERTS"
$Alert = security_result.summary
$Category_Details = security_result.category_details
$Category = security_result.category
$Severity = security_result.severity
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
match:
$Date, $Alert, $Category, $Category_Details, $Severity
outcome:
$Count = count(metadata.id)
order:
$Date desc
limit:
50
依嚴重性分類的快訊
metadata.log_type = "WORKSPACE_ALERTS"
$Severity = security_result.severity
match:
$Severity
outcome:
$Count = count(metadata.id)
order:
$Count desc
前 10 名使用者 (按警告數量排名)
metadata.log_type = "WORKSPACE_ALERTS"
target.user.userid != ""
$User = target.user.userid
match:
$User
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
Google Workspace 雲端硬碟
這個資訊主頁可全面掌握使用者活動和資源管理情況。這項功能會醒目顯示各個位置的重要安全性事件、使用者和存取模式，方便安全團隊確保法規遵循，並降低潛在風險。
注意： 套用篩選器，縮小結果範圍，取得特定洞察資料。
下載事件的資料遺失防護摘要
下載一段時間內的活動
下載事件中排名前 10 的使用者
指定時間範圍內的資源刪除事件
前 10 大活動
歷來資源建立事件
前 10 大熱門門市
來源地理位置總覽
上傳事件的資料遺失防護摘要
按動作劃分的歷來事件
存取次數前 10 名的資源
上傳事件的前 10 名使用者
前 10 位使用者
圖表名稱
查詢示例
下載事件的資料遺失防護摘要
metadata.product_event_type = "download"
target.resource.attribute.labels.key = "dlp_info"
$DLP_Signature = target.resource.attribute.labels.value
$URL = target.url
$Source_IP = principal.ip
$User = strings.coalesce(principal.user.userid, principal.user.user_display_name, principal.user.email_addresses)
match:
$DLP_Signature,$User,$Source_IP, $URL
outcome:
$Storage_Used_in_MB = max(math.round(cast.as_float(additional.fields["storage_usage_in_bytes"])/(1000*1000), 2))
$Date = timestamp.get_timestamp(max(metadata.event_timestamp.seconds), "%F %T")
$Count = count(metadata.id)
order:
$Date desc
下載一段時間內的活動
metadata.product_event_type = "download"
$User = strings.coalesce(principal.user.userid, principal.user.user_display_name, principal.user.email_addresses)
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
match:
$Date,$User
outcome:
$Count = count(metadata.id)
order:
$Date asc
下載事件中排名前 10 的使用者
metadata.product_event_type = "download"
$User = strings.coalesce(principal.user.userid, principal.user.user_display_name, principal.user.email_addresses)
match:
$User
outcome:
$Storage_Used_in_MB = sum(math.round(cast.as_float(additional.fields["storage_usage_in_bytes"])/(1000*1000), 2))
order:
$Storage_Used_in_MB desc
limit:
10
指定時間範圍內的資源刪除事件
(metadata.event_type = "RESOURCE_DELETION" or metadata.event_type = "USER_RESOURCE_DELETION")
(metadata.product_event_type = "trash" or metadata.product_event_type = "delete")
$User = strings.coalesce(principal.user.userid, principal.user.user_display_name, principal.user.email_addresses)
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
match:
$Date,$User
outcome:
$Count = count(metadata.id)
order:
$Date asc
前 10 大活動
$Security_Event_Type = metadata.product_event_type
$User = strings.coalesce(principal.user.userid, principal.user.user_display_name, principal.user.email_addresses, target.user.userid, target.user.user_display_name, target.user.email_addresses)
match:
$Security_Event_Type,$User
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
歷來資源建立事件
(metadata.event_type = "RESOURCE_CREATION" or metadata.event_type = "USER_RESOURCE_CREATION")
metadata.product_event_type = "create"
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
$User = strings.coalesce(principal.user.userid, principal.user.user_display_name, principal.user.email_addresses)
match:
$Date,$User
outcome:
$Count = count(metadata.id)
order:
$Date asc
前 10 大熱門門市
$Location = strings.coalesce(principal.location.country_or_region, principal.ip_geo_artifact.location.country_or_region)
match:
$Location
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
來源地理位置總覽
(metadata.event_type = "USER_RESOURCE_ACCESS" or metadata.event_type = "RESOURCE_READ" or metadata.event_type = "USER_RESOURCE_UPDATE_CONTENT")
$Country = principal.ip_geo_artifact.location.country_or_region
$Country !=""
match:
$Country
outcome:
$Count = count(metadata.id)
$Latitude = max(principal.ip_geo_artifact.location.region_coordinates.latitude)
$Longitude = max(principal.ip_geo_artifact.location.region_coordinates.longitude)
order:
$Count desc
上傳事件的資料遺失防護摘要
metadata.product_event_type = "upload"
target.resource.attribute.labels.key = "dlp_info"
$DLP_Signature = target.resource.attribute.labels.value
$URL = target.url
$Source_IP = principal.ip
$User = strings.coalesce(principal.user.userid, principal.user.user_display_name, principal.user.email_addresses)
match:
$DLP_Signature,$User,$Source_IP, $URL
outcome:
$Storage_Used_in_MB = max(math.round(cast.as_float(additional.fields["storage_usage_in_bytes"])/(1000*1000), 2))
$Date = timestamp.get_timestamp(max(metadata.event_timestamp.seconds), "%F %T")
$Count = count(metadata.id)
order:
$Date desc
按動作劃分的歷來事件
$Security_Event_Type = metadata.product_event_type
$Action = security_result.action
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
match:
$Date ,$Action
outcome:
$Count = count(metadata.id)
order:
$Date asc
存取次數前 10 名的資源
(metadata.event_type = "USER_RESOURCE_ACCESS" or metadata.event_type = "RESOURCE_READ" or metadata.event_type = "USER_RESOURCE_UPDATE_CONTENT")
$Security_Event_Type = metadata.product_event_type
$Resource_Id = target.resource.product_object_id
$Resource_Id != ""
$Source_User = strings.coalesce(principal.user.email_addresses, principal.user.userid, principal.user.user_display_name)
$Source_IP = strings.coalesce(principal.ip,principal.asset.ip)
$Action = security_result.action
match:
$Resource_Id,$Source_User,$Source_IP ,$Security_Event_Type, $Action
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
上傳事件的前 10 名使用者
metadata.product_event_type = "upload"
$User = strings.coalesce(principal.user.userid, principal.user.user_display_name, principal.user.email_addresses)
match:
$User
outcome:
$Storage_Used_in_MB = sum(math.round(cast.as_float(additional.fields["storage_usage_in_bytes"])/(1000*1000), 2))
order:
$Storage_Used_in_MB desc
limit:
10
前 10 位使用者
$User = strings.coalesce(principal.user.userid, principal.user.user_display_name, principal.user.email_addresses)
$Action = security_result.action
match:
$User, $Action
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
Google Workspace 身分管理
這個資訊主頁會顯示使用者和群組活動的總覽，提供登入模式、修改和權限變更的深入分析，同時追蹤一段時間內的趨勢。
歷來群組修改事件
使用者刪除事件時序
一段時間內的權限變更事件
成功登入與登入失敗
處理管理工作的管理員前 10 名
前 10 大登入失敗使用者趨勢
一段時間內的使用者建立事件
前 10 大成功登入使用者趨勢
圖表名稱
查詢示例
歷來群組修改事件
metadata.log_type = "WORKSPACE_ACTIVITY"
metadata.product_event_type = /modify_group/ nocase
$Event = metadata.product_event_type
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
match:
$Date, $Event
outcome:
$Count = count(metadata.id)
order:
$Date desc
使用者刪除事件時序
metadata.log_type = "WORKSPACE_ACTIVITY"
metadata.product_event_type = /delete_user/ nocase
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
match:
$Date
outcome:
$Count = count(target.user.email_addresses)
order:
$Count desc
一段時間內的權限變更事件
metadata.log_type = "WORKSPACE_ACTIVITY"
metadata.event_type = "RESOURCE_PERMISSIONS_CHANGE"
or metadata.event_type = "USER_CHANGE_PERMISSIONS"
or metadata.event_type = "USER_RESOURCE_UPDATE_PERMISSIONS"
$Permission = metadata.event_type
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
match:
$Permission, $Date
outcome:
$Count = count(metadata.id)
order:
$Date desc
成功登入與登入失敗
metadata.log_type = "WORKSPACE_ACTIVITY"
metadata.product_event_type = "LOGIN_SUCCESS"
or metadata.product_event_type = "LOGIN_FAILURE"
$User_Login = metadata.product_event_type
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
match:
$Date, $User_Login
outcome:
$Count = count(metadata.id)
order:
$Count desc
處理管理工作的管理員前 10 名
metadata.log_type = "WORKSPACE_ACTIVITY"
target.application = /admin/ nocase
$Event = metadata.event_type
$Admin = principal.user.email_addresses
match:
$Admin, $Event
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
前 10 大登入失敗使用者趨勢
metadata.log_type = "WORKSPACE_ACTIVITY"
metadata.product_event_type = "LOGIN_FAILURE"
principal.user.email_addresses != ""
$User_Account = principal.user.email_addresses
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
match:
$User_Account, $Date
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
一段時間內的使用者建立事件
metadata.log_type = "WORKSPACE_ACTIVITY"
metadata.product_event_type = /create_user/ nocase
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
match:
$Date
outcome:
$Count = count(target.user.email_addresses)
order:
$Count desc
前 10 大成功登入使用者趨勢
metadata.log_type = "WORKSPACE_ACTIVITY"
metadata.product_event_type = "LOGIN_SUCCESS"
principal.user.email_addresses != ""
$User_Account = principal.user.email_addresses
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
match:
$User_Account, $Date
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
群組活動摘要
這個資訊主頁會詳細顯示使用者和群組的互動情形，並追蹤不重複的使用者、群組和成員變更。這項功能會醒目顯示最活躍的使用者和群組、群組變更，並監控群組活動趨勢。
注意： 套用篩選器，縮小結果範圍，取得特定洞察資料。
隨時間建立的群組
依群組管理事件排名前 10 的主辦人
已建立的群組
已從群組中移除使用者
最近刪除的群組
歷來封鎖的群組活動
使用者已新增至管理員群組
最近從群組中移除的使用者
群組變更活動次數
群組活動中遭封鎖的使用者前 10 名
已刪除群組
最近建立的群組
前 10 大活躍主機
刪除群組次數最多的前 10 位使用者
流量最多的 10 項群組動作
登入事件前 10 名使用者
新增至群組的使用者人數
群組事件中遭封鎖的前 10 大來源 IP
登入事件中的不重複使用者
修改群組的前 10 大來源 IP
新增至管理員群組的使用者總數
群組活動變化趨勢
新增群組
最近新增至群組的使用者
隨時間變更的群組
近期修改的群組
建立群組的前 10 大使用者
修改群組次數最多的前 10 位使用者
使用者已加入群組
刪除群組的前 10 大來源 IP
不重複使用者登入次數
建立群組的前 10 大來源 IP
前 10 大活躍群組
從群組中移除的使用者人數
隨時間刪除群組
依事件計數排序的前 10 個群組
前 10 大活躍使用者登入次數
圖表名稱
查詢示例
隨時間建立的群組
metadata.event_type = "GROUP_CREATION"
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
match:
$Date
outcome:
$Count = count(metadata.id)
order:
$Count desc
依群組管理事件排名前 10 的主辦人
metadata.event_type = "GROUP_UNCATEGORIZED"
or metadata.event_type = "GROUP_CREATION"
or metadata.event_type = "GROUP_DELETION"
or metadata.event_type = "GROUP_MODIFICATION"
$Hostname = principal.hostname
$Hostname != ""
$Event_Type = metadata.event_type
match:
$Hostname, $Event_Type
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
已建立的群組
metadata.event_type = "GROUP_CREATION"
outcome:
$Count = count_distinct(target.group.group_display_name)
已從群組中移除使用者
$event.metadata.product_event_type = /4733|4729|4757/
or $event.metadata.product_event_type = /remove.*(?:user|member).*(?:from|to).*group/ nocase
$Initiator = strings.coalesce($event.principal.user.windows_sid, $event.principal.user.userid)
$AffectedUser = strings.coalesce($event.target.user.windows_sid, $event.target.user.userid)
$Group = $event.target.group.group_display_name
$Description = strings.coalesce($event.metadata.description, $event.security_result.summary)
match:
$Initiator, $Group, $AffectedUser, $Description
outcome:
$Date = timestamp.get_timestamp(max($event.metadata.event_timestamp.seconds))
order:
$Date desc
limit:
50
最近刪除的群組
metadata.event_type = "GROUP_DELETION"
or metadata.product_event_type = /delete(?:\s)?group/ nocase
security_result.action = "ALLOW"
$Log_Type = metadata.log_type
$Group = target.group.group_display_name
$Initiator = strings.coalesce(principal.user.windows_sid, principal.user.userid, principal.user.email_addresses)
$IP_Address = principal.ip
$Date = timestamp.get_timestamp(metadata.event_timestamp.seconds, "%F %T ")
match:
$Date, $Log_Type, $Initiator, $IP_Address, $Group
order:
$Date desc
歷來封鎖的群組活動
metadata.event_type = "GROUP_CREATION"
or metadata.event_type = "GROUP_DELETION"
or metadata.product_event_type = /add group/ nocase
or metadata.product_event_type = /delete group/ nocase
or metadata.event_type = "GROUP_MODIFICATION"
or metadata.product_event_type = /(RemoveUserFrom|AddUserTo|Add member to |Remove member from )|(?:group)/ nocase
security_result.action = "BLOCK"
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
match:
$Date
outcome:
$Count = count(metadata.id)
order:
$Date desc
使用者已新增至管理員群組
metadata.product_event_type = /4732|4728|4756/
or metadata.product_event_type = /add.*(?:user|member).*to.*group/ nocase
$Initiator = strings.coalesce(principal.user.user_display_name, principal.user.userid, principal.user.windows_sid, target.user.userid, re.capture(additional.fields["Message"], `Account Name:(?:\W?)([A-Za-z0-9._%+-]+)`))
$Affected_User = strings.coalesce(re.capture(additional.fields["Message"], `Member Name:(?:\W?)([A-Za-z0-9._%+-]+)`), re.capture(security_result.description, `\b[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\.[A-Za-z]+`), target.user.user_display_name, target.user.userid, target.user.windows_sid)
$Group = strings.coalesce(target.group.group_display_name, re.capture(security_result.description, `group\W([A-Za-z0-9._%+-]+\W+[A-Za-z0-9._%+-]+)`), re.capture(additional.fields["Message"], `Group Name:(?:\W?)([A-Za-z0-9._%+-]+)`))
$Group = /admin/ nocase
$Description = strings.coalesce(metadata.description, security_result.summary)
$Date = timestamp.get_timestamp((metadata.event_timestamp.seconds))
match:
$Date, $Initiator, $Group, $Affected_User, $Description
order:
$Date desc
最近從群組中移除的使用者
metadata.product_event_type = /4733|4729|4757/
or metadata.product_event_type = /remove.*(?:user|member).*(?:from|to).*group/ nocase
$Initiator = strings.coalesce(principal.user.user_display_name, principal.user.userid, principal.user.windows_sid, target.user.userid, re.capture(additional.fields["Message"], `Account Name:(?:\W?)([A-Za-z0-9._%+-]+)`))
$Affected_User = strings.coalesce(re.capture(additional.fields["Message"], `Member Name:(?:\W?)([A-Za-z0-9._%+-]+)`), re.capture(security_result.description, `\b[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\.[A-Za-z]+`), target.user.user_display_name, target.user.userid, target.user.windows_sid)
$Group = strings.coalesce(target.group.group_display_name, re.capture(security_result.description, `group\W([A-Za-z0-9._%+-]+\W+[A-Za-z0-9._%+-]+)`), re.capture(additional.fields["Message"], `Group Name:(?:\W?)([A-Za-z0-9._%+-]+)`))
$Description = strings.coalesce(metadata.description, security_result.summary)
$Date = timestamp.get_timestamp((metadata.event_timestamp.seconds))
match:
$Date, $Initiator, $Group, $Affected_User, $Description
order:
$Date desc
群組變更活動次數
metadata.event_type = "GROUP_CREATION"
or metadata.event_type = "GROUP_DELETION"
or metadata.event_type = "GROUP_MODIFICATION"
outcome:
$Count = count(metadata.id)
群組活動中遭封鎖的使用者前 10 名
metadata.event_type = "GROUP_CREATION"
or metadata.event_type = "GROUP_DELETION"
or metadata.product_event_type = /add group/ nocase
or metadata.product_event_type = /delete group/ nocase
or metadata.event_type = "GROUP_MODIFICATION"
or metadata.product_event_type = /(RemoveUserFrom|AddUserTo|Add member to |Remove member from )|(?:group)/ nocase
security_result.action = "BLOCK"
$Event_Type = metadata.event_type
$User = strings.coalesce(principal.user.windows_sid, principal.user.userid, principal.user.email_addresses)
match:
$Event_Type, $User
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
已刪除群組
$event.metadata.event_type = "GROUP_DELETION"
outcome:
$Count = count_distinct($event.target.group.group_display_name)
最近建立的群組
metadata.event_type = "GROUP_CREATION"
or metadata.product_event_type = /(?:add|create)(?:\s)?group/ nocase
security_result.action = "ALLOW"
$Log_Type = metadata.log_type
$Group = target.group.group_display_name
$Initiator = strings.coalesce(principal.user.windows_sid, principal.user.userid, principal.user.email_addresses)
$IP_Address = principal.ip
$Date = timestamp.get_timestamp(metadata.event_timestamp.seconds, "%F %T ")
match:
$Date, $Log_Type, $Initiator, $IP_Address, $Group
order:
$Date desc
前 10 大活躍主機
$event.metadata.event_type = "GROUP_UNCATEGORIZED"
or $event.metadata.event_type = "GROUP_CREATION"
or $event.metadata.event_type = "GROUP_DELETION"
or $event.metadata.event_type = "GROUP_MODIFICATION"
$Hostname = $event.principal.hostname
$Hostname != ""
$Event_Type = $event.metadata.event_type
$Log_type = $event.metadata.log_type
match:
$Hostname, $Event_Type, $Log_type
outcome:
$Count = count($event.metadata.id)
order:
$Count desc
limit:
10
刪除群組次數最多的前 10 位使用者
metadata.event_type = "GROUP_DELETION"
or metadata.product_event_type = /delete(?:\s)?group/ nocase
security_result.action = "ALLOW"
$Log_Type = metadata.log_type
$User = strings.coalesce(principal.user.windows_sid, principal.user.userid, principal.user.email_addresses)
match:
$Log_Type, $User
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
流量最多的 10 項群組動作
metadata.event_type = "GROUP_CREATION"
or metadata.event_type = "GROUP_DELETION"
or metadata.event_type = "GROUP_MODIFICATION"
$Description = strings.coalesce(metadata.description, security_result.summary)
$Description != ""
match:
$Description
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
登入事件前 10 名使用者
metadata.event_type = "USER_LOGIN"
$User = strings.concat(target.user.userid, " ")
$User != " "
match:
$User
outcome:
$Count = count(target.user.userid)
order:
$Count desc
limit:
10
新增至群組的使用者人數
$event.metadata.event_type = "GROUP_MODIFICATION"
$event.metadata.product_event_type = /4720|4728|4732|4746|4751|4756|4761|4785/
or $event.metadata.product_event_type = /add.*(?:user|member).*to.*group/ nocase
outcome:
$Count = count($event.metadata.id)
群組事件中遭封鎖的前 10 大來源 IP
metadata.event_type = "GROUP_CREATION"
or metadata.event_type = "GROUP_DELETION"
or metadata.product_event_type = /add group/ nocase
or metadata.product_event_type = /delete group/ nocase
or metadata.event_type = "GROUP_MODIFICATION"
or metadata.product_event_type = /(RemoveUserFrom|AddUserTo|Add member to |Remove member from )|(?:group)/ nocase
security_result.action = "BLOCK"
$Event_Type = metadata.event_type
$IP_Address = principal.ip
match:
$Event_Type, $IP_Address
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
登入事件中的不重複使用者
metadata.event_type = "USER_LOGIN"
outcome:
$Count = count_distinct(principal.user.userid)
修改群組的前 10 大來源 IP
metadata.event_type = "GROUP_MODIFICATION"
$Log_Type = metadata.log_type
$IP_Address = principal.ip
match:
$IP_Address, $Log_Type
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
新增至管理員群組的使用者總數
metadata.product_event_type = /4732|4728|4756/
or metadata.product_event_type = /add.*(?:user|member).*to.*group/ nocase
$Group = strings.coalesce(target.group.group_display_name, re.capture(security_result.description, `group\W([A-Za-z0-9._%+-]+\W+[A-Za-z0-9._%+-]+)`), re.capture(additional.fields["Message"], `Group Name:(?:\W?)([A-Za-z0-9._%+-]+)`))
$Group = /admin/ nocase
outcome:
$Count = count(metadata.id)
群組活動變化趨勢
$event.metadata.event_type = "GROUP_CREATION"
or $event.metadata.event_type = "GROUP_DELETION"
or $event.metadata.event_type = "GROUP_MODIFICATION"
or $event.metadata.event_type = "GROUP_UNCATEGORIZED"
$User = $event.target.user.windows_sid
$Hostname = $event.principal.hostname
$Group = $event.target.group.group_display_name
$Event = $event.metadata.event_type
$Action = $event.metadata.description
$Action != "A security-enabled local group membership was enumerated"
match:
$Event, $User, $Hostname, $Group, $Action
outcome:
$Date = timestamp.get_timestamp(max($event.metadata.event_timestamp.seconds))
order:
$Date desc
limit:
50
新增群組
$event.metadata.event_type = "GROUP_CREATION"
outcome:
$Count = count_distinct($event.target.group.group_display_name)
已刪除群組
metadata.event_type = "GROUP_DELETION"
outcome:
$Count = count_distinct(target.group.group_display_name)
最近新增至群組的使用者
metadata.product_event_type = /4732|4728|4756/
or metadata.product_event_type = /add.*(?:user|member).*to.*group/ nocase
$Initiator = strings.coalesce(principal.user.user_display_name, principal.user.userid, principal.user.windows_sid, target.user.userid, re.capture(additional.fields["Message"], `Account Name:(?:\W?)([A-Za-z0-9._%+-]+)`))
$Affected_User = strings.coalesce(re.capture(additional.fields["Message"], `Member Name:(?:\W?)([A-Za-z0-9._%+-]+)`), re.capture(security_result.description, `\b[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\.[A-Za-z]+`), target.user.user_display_name, target.user.userid, target.user.windows_sid)
$Group = strings.coalesce(target.group.group_display_name, re.capture(security_result.description, `group\W([A-Za-z0-9._%+-]+\W+[A-Za-z0-9._%+-]+)`), re.capture(additional.fields["Message"], `Group Name:(?:\W?)([A-Za-z0-9._%+-]+)`))
$Description = strings.coalesce(metadata.description, security_result.summary)
$Date = timestamp.get_timestamp((metadata.event_timestamp.seconds))
match:
$Date, $Initiator, $Group, $Affected_User, $Description
order:
$Date desc
隨時間變更的群組
metadata.event_type = "GROUP_MODIFICATION"
or metadata.product_event_type = /(RemoveUserFrom|AddUserTo|Add member to |Remove member from )|(?:group)/ nocase
security_result.action = "ALLOW"
$Log_Type = metadata.log_type
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
match:
$Log_Type, $Date
outcome:
$Count = count(metadata.id)
order:
$Date desc
近期修改的群組
metadata.event_type = "GROUP_MODIFICATION"
or metadata.product_event_type = /(RemoveUserFrom|AddUserTo|Add member to |Remove member from )|(?:group)/ nocase
security_result.action = "ALLOW"
$Log_Type = metadata.log_type
$Event = metadata.product_event_type
$Initiator = strings.coalesce(principal.user.windows_sid, principal.user.userid, principal.user.email_addresses)
$IP_Address = principal.ip
$User = strings.coalesce(target.user.userid, target.user.email_addresses)
$Group = target.group.group_display_name
$Description = strings.coalesce(metadata.description, security_result.summary)
$Date = timestamp.get_timestamp(metadata.event_timestamp.seconds, "%F %T ")
match:
$Date, $Log_Type, $Initiator, $IP_Address, $User, $Group, $Event, $Description
order:
$Date desc
已從群組中移除使用者
metadata.event_type = "GROUP_MODIFICATION"
metadata.product_event_type = /4729|4733|4747|4752|4757|4762|4786/
or metadata.product_event_type = /remove.*(?:user|member).*to.*group/ nocase
outcome:
$Count = count(metadata.id)
建立群組的前 10 大使用者
metadata.event_type = "GROUP_CREATION"
or metadata.product_event_type = /(?:add|create)(?:\s)?group/ nocase
security_result.action = "ALLOW"
$Log_Type = metadata.log_type
$User = strings.coalesce(principal.user.windows_sid, principal.user.userid, principal.user.email_addresses)
match:
$Log_Type, $User
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
修改群組次數最多的前 10 位使用者
metadata.event_type = "GROUP_MODIFICATION"
$Log_Type = metadata.log_type
$User = principal.user.userid
match:
$User, $Log_Type
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
使用者已新增至管理員群組
$event.metadata.product_event_type = /4732|4728|4756/
or $event.metadata.product_event_type = /add.*(?:user|member).*to.*group/ nocase
$Initiator = strings.coalesce($event.principal.user.windows_sid, $event.principal.user.userid)
$User = strings.coalesce($event.target.user.windows_sid, $event.target.user.userid)
$Group = $event.target.group.group_display_name
$Group = /admin/ nocase
$Description = strings.coalesce($event.metadata.description, $event.security_result.summary)
match:
$Initiator, $User, $Group, $Description
outcome:
$Date = timestamp.get_timestamp(max($event.metadata.event_timestamp.seconds))
order:
$Date desc
limit:
50
群組變更活動次數
$event.metadata.event_type = "GROUP_CREATION"
or $event.metadata.event_type = "GROUP_DELETION"
or $event.metadata.event_type = "GROUP_MODIFICATION"
outcome:
$Count = count($event.metadata.id)
使用者已加入群組
metadata.event_type = "GROUP_MODIFICATION"
metadata.product_event_type = /4720|4728|4732|4746|4751|4756|4761|4785/
or metadata.product_event_type = /add.*(?:user|member).*to.*group/ nocase
outcome:
$Count = count(metadata.id)
流量最多的 10 項群組動作
$event.metadata.event_type = "GROUP_CREATION"
or $event.metadata.event_type = "GROUP_DELETION"
or $event.metadata.event_type = "GROUP_MODIFICATION"
$Description = strings.coalesce($event.metadata.description, $event.security_result.summary)
$Group_Name = $event.target.group.group_display_name
match:
$Description, $Group_Name
outcome:
$Count = count($event.metadata.id)
order:
$Count desc
limit:
10
刪除群組的前 10 大來源 IP
metadata.event_type = "GROUP_DELETION"
or metadata.product_event_type = /delete(?:\s)?group/ nocase
security_result.action = "ALLOW"
$Log_Type = metadata.log_type
$IP_Address = principal.ip
match:
$Log_Type, $IP_Address
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
不重複使用者登入次數
$event.metadata.event_type = "USER_LOGIN"
outcome:
$Count = count_distinct($event.principal.user.userid)
建立群組的前 10 大來源 IP
metadata.event_type = "GROUP_CREATION"
or metadata.product_event_type = /(?:add|create)(?:\s)?group/ nocase
security_result.action = "ALLOW"
$Log_Type = metadata.log_type
$IP_Address = principal.ip
match:
$Log_Type, $IP_Address
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
前 10 大活躍群組
$event.metadata.event_type = "GROUP_UNCATEGORIZED"
or $event.metadata.event_type = "GROUP_CREATION"
or $event.metadata.event_type = "GROUP_DELETION"
or $event.metadata.event_type = "GROUP_MODIFICATION"
$Log_Type = $event.metadata.log_type
$Event = $event.metadata.event_type
$Group_Name = $event.target.group.group_display_name
$Group_Name != ""
match:
$Group_Name, $Event, $Log_Type
outcome:
$Count = count($event.metadata.id)
order:
$Count desc
limit:
10
從群組中移除的使用者人數
$event.metadata.event_type = "GROUP_MODIFICATION"
$event.metadata.product_event_type = /4729|4733|4747|4752|4757|4762|4786/
or $event.metadata.product_event_type = /remove.*(?:user|member).*to.*group/ nocase
outcome:
$Count = count($event.metadata.id)
隨時間刪除群組
metadata.event_type = "GROUP_DELETION"
or metadata.product_event_type = /delete(?:\s)?group/ nocase
security_result.action = "ALLOW"
$Log_Type = metadata.log_type
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
match:
$Log_Type, $Date
outcome:
$Count = count(metadata.id)
order:
$Date desc
依事件計數排序的前 10 個群組
metadata.event_type = "GROUP_UNCATEGORIZED"
or metadata.event_type = "GROUP_CREATION"
or metadata.event_type = "GROUP_DELETION"
or metadata.event_type = "GROUP_MODIFICATION"
$Event_Type = metadata.event_type
$Group_Name = target.group.group_display_name
$Group_Name != ""
match:
$Group_Name, $Event_Type
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
前 10 大活躍使用者登入次數
$event.metadata.event_type = "USER_LOGIN"
$Event_Type = $event.metadata.event_type
$User = strings.concat($event.target.user.userid, " ")
$User != " "
$Date = timestamp.get_date($event.metadata.event_timestamp.seconds)
match:
$User, $Event_Type, $Date over every day
outcome:
$Count = count($event.target.user.userid)
order:
$Date desc, $Count desc
limit:
10
使用者已加入群組
$event.metadata.product_event_type = /4732|4728|4756/
or $event.metadata.product_event_type = /add.*(?:user|member).*to.*group/ nocase
$Initiator = strings.coalesce($event.principal.user.windows_sid, $event.principal.user.userid)
$AffectedUser = strings.coalesce($event.target.user.windows_sid, $event.target.user.userid)
$Group = $event.target.group.group_display_name
$Description = strings.coalesce($event.metadata.description, $event.security_result.summary)
match:
$Initiator, $Group, $AffectedUser, $Description
outcome:
$Date = timestamp.get_timestamp(max($event.metadata.event_timestamp.seconds))
order:
$Date desc
limit:
50
群組管理稽核
這個專屬資訊主頁可供稽核使用者群組的整個生命週期。
這有助於確保群組的建立、修改和刪除作業受到妥善管理，避免大規模發生非預期的存取權問題。
建立群組的前 10 大使用者
建立群組的前 10 大來源 IP
修改群組次數最多的前 10 位使用者
近期群組修改
修改的不重複群組總數
隨時間刪除群組
隨時間建立的群組
隨時間變更的群組
歷來群組事件
刪除群組的前 10 大來源 IP
建立的群組總數
最近刪除的群組
修改群組的前 10 大來源 IP
群組活動中遭封鎖的使用者前 10 名
刪除群組次數最多的前 10 位使用者
近期建立的群組
群組事件中遭封鎖的前 10 大來源 IP
已刪除的群組總數
圖表名稱
查詢示例
建立群組的前 10 大使用者
metadata.event_type = "GROUP_CREATION"
or metadata.product_event_type = /(?:add|create)(?:\s)?group/ nocase
security_result.action = "ALLOW"
$Log_Type = metadata.log_type
$User = strings.coalesce(principal.user.windows_sid, principal.user.userid, principal.user.email_addresses)
match:
$Log_Type, $User
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
建立群組的前 10 大來源 IP
metadata.event_type = "GROUP_CREATION"
or metadata.product_event_type = /(?:add|create)(?:\s)?group/ nocase
security_result.action = "ALLOW"
$Log_Type = metadata.log_type
$IP_Address = principal.ip
match:
$Log_Type, $IP_Address
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
修改群組次數最多的前 10 位使用者
metadata.event_type = "GROUP_MODIFICATION"
or metadata.product_event_type = /(RemoveUserFrom|AddUserTo|Add member to |Remove member from )|(?:group)/ nocase
security_result.action = "ALLOW"
$Log_Type = metadata.log_type
$User = strings.coalesce(principal.user.windows_sid, principal.user.userid, principal.user.email_addresses)
match:
$Log_Type, $User
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
近期群組修改
metadata.event_type = "GROUP_MODIFICATION"
or metadata.product_event_type = /(RemoveUserFrom|AddUserTo|Add member to |Remove member from )|(?:group)/ nocase
security_result.action = "ALLOW"
$Log_Type = metadata.log_type
$Event = metadata.product_event_type
$Initiator = strings.coalesce(principal.user.windows_sid, principal.user.userid, principal.user.email_addresses)
$IP_Address = principal.ip
$User = strings.coalesce(target.user.userid, target.user.email_addresses)
$Group = target.group.group_display_name
$Description = strings.coalesce(metadata.description, security_result.summary)
$Date = timestamp.get_timestamp(metadata.event_timestamp.seconds, "%F %T ")
match:
$Date, $Log_Type, $Initiator, $IP_Address, $User, $Group, $Event, $Description
order:
$Date desc
修改的不重複群組總數
metadata.event_type = "GROUP_MODIFICATION"
or metadata.product_event_type = /(RemoveUserFrom|AddUserTo|Add member to |Remove member from )|(?:group)/ nocase
security_result.action = "ALLOW"
outcome:
$Count = count_distinct(target.group.group_display_name)
隨時間刪除群組
metadata.event_type = "GROUP_DELETION"
or metadata.product_event_type = /delete(?:\s)?group/ nocase
security_result.action = "ALLOW"
$Log_Type = metadata.log_type
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
match:
$Log_Type, $Date
outcome:
$Count = count(metadata.id)
order:
$Date desc
隨時間建立的群組
metadata.event_type = "GROUP_CREATION"
or metadata.product_event_type = /(?:add|create)(?:\s)?group/ nocase
security_result.action = "ALLOW"
$Log_Type = metadata.log_type
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
match:
$Log_Type, $Date
outcome:
$Count = count(metadata.id)
order:
$Date desc
隨時間變更的群組
metadata.event_type = "GROUP_MODIFICATION"
or metadata.product_event_type = /(RemoveUserFrom|AddUserTo|Add member to |Remove member from )|(?:group)/ nocase
security_result.action = "ALLOW"
$Log_Type = metadata.log_type
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
match:
$Log_Type, $Date
outcome:
$Count = count(metadata.id)
order:
$Date desc
歷來群組事件
metadata.event_type = "GROUP_CREATION"
or metadata.event_type = "GROUP_DELETION"
or metadata.product_event_type = /(?:add|create|delete)(?:\s)?group/ nocase
or metadata.event_type = "GROUP_MODIFICATION"
or metadata.product_event_type = /(RemoveUserFrom|AddUserTo|Add member to |Remove member from )|(?:group)/ nocase
security_result.action = "ALLOW"
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
$Event = metadata.event_type
match:
$Date, $Event
outcome:
$Count = count(metadata.id)
order:
$Date desc
刪除群組的前 10 大來源 IP
metadata.event_type = "GROUP_DELETION"
or metadata.product_event_type = /delete(?:\s)?group/ nocase
security_result.action = "ALLOW"
$Log_Type = metadata.log_type
$IP_Address = principal.ip
match:
$Log_Type, $IP_Address
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
建立的群組總數
metadata.event_type = "GROUP_CREATION"
or metadata.product_event_type = /(?:add|create)(?:\s)?group/ nocase
security_result.action = "ALLOW"
outcome:
$Count = count_distinct(target.group.group_display_name)
最近刪除的群組
metadata.event_type = "GROUP_DELETION"
or metadata.product_event_type = /delete(?:\s)?group/ nocase
security_result.action = "ALLOW"
$Log_Type = metadata.log_type
$Group = target.group.group_display_name
$Initiator = strings.coalesce(principal.user.windows_sid, principal.user.userid, principal.user.email_addresses)
$IP_Address = principal.ip
$Date = timestamp.get_timestamp(metadata.event_timestamp.seconds, "%F %T ")
match:
$Date, $Log_Type, $Initiator, $IP_Address, $Group
order:
$Date desc
修改群組的前 10 大來源 IP
metadata.event_type = "GROUP_MODIFICATION"
or metadata.product_event_type = /(RemoveUserFrom|AddUserTo|Add member to |Remove member from )|(?:group)/ nocase
security_result.action = "ALLOW"
$Log_Type = metadata.log_type
$IP_Address = principal.ip
match:
$Log_Type, $IP_Address
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
群組活動中遭封鎖的使用者前 10 名
metadata.event_type = "GROUP_CREATION"
or metadata.event_type = "GROUP_DELETION"
or metadata.product_event_type = /add group/ nocase
or metadata.product_event_type = /delete group/ nocase
or metadata.event_type = "GROUP_MODIFICATION"
or metadata.product_event_type = /(RemoveUserFrom|AddUserTo|Add member to |Remove member from )|(?:group)/ nocase
security_result.action = "BLOCK"
$Event_Type = metadata.event_type
$User = strings.coalesce(principal.user.windows_sid, principal.user.userid, principal.user.email_addresses)
match:
$Event_Type, $User
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
刪除群組次數最多的前 10 位使用者
metadata.event_type = "GROUP_DELETION"
or metadata.product_event_type = /delete(?:\s)?group/ nocase
security_result.action = "ALLOW"
$Log_Type = metadata.log_type
$User = strings.coalesce(principal.user.windows_sid, principal.user.userid, principal.user.email_addresses)
match:
$Log_Type, $User
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
近期建立的群組
metadata.event_type = "GROUP_CREATION"
or metadata.product_event_type = /(?:add|create)(?:\s)?group/ nocase
security_result.action = "ALLOW"
$Log_Type = metadata.log_type
$Group = target.group.group_display_name
$Initiator = strings.coalesce(principal.user.windows_sid, principal.user.userid, principal.user.email_addresses)
$IP_Address = principal.ip
$Date = timestamp.get_timestamp(metadata.event_timestamp.seconds, "%F %T ")
match:
$Date, $Log_Type, $Initiator, $IP_Address, $Group
order:
$Date desc
群組事件中遭封鎖的前 10 大來源 IP
metadata.event_type = "GROUP_CREATION"
or metadata.event_type = "GROUP_DELETION"
or metadata.product_event_type = /add group/ nocase
or metadata.product_event_type = /delete group/ nocase
or metadata.event_type = "GROUP_MODIFICATION"
or metadata.product_event_type = /(RemoveUserFrom|AddUserTo|Add member to |Remove member from )|(?:group)/ nocase
security_result.action = "BLOCK"
$Event_Type = metadata.event_type
$IP_Address = principal.ip
match:
$Event_Type, $IP_Address
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
已刪除的群組總數
metadata.event_type = "GROUP_DELETION"
or metadata.product_event_type = /delete group/ nocase
security_result.action = "ALLOW"
outcome:
$Count = count_distinct(target.group.group_display_name)
健康保險流通與責任法案資訊主頁
這個儀表板可即時監控安全和法規遵循指標，確保符合《健康保險流通與責任法案》規定。這項功能可讓您掌握涉及受保護健康資訊 (PHI) 的潛在風險、違規事項和資料存取活動。這有助於主動管理風險，並維護敏感健康資料的機密性、完整性和可用性。這個資訊主頁會使用 ePHI_assets.Hostname 資料表，根據《健康保險流通與責任法案》(HIPAA) 標準設定資料範圍。必須先建立必要的資料表，這個資訊主頁上的圖表才會載入。
依嚴重程度分類的安全漏洞
依記錄類型顯示一段時間內的權限變更
按動作劃分的 MFA 事件
一段時間內的登入事件 (按動作劃分)
前 10 個違反資料遺失防護政策的 ePHI 主機
一段時間內 EDR 警告的嚴重程度
備份事件 (按動作劃分)
依動作劃分的密碼變更次數
近期備份事件 (過去 24 小時)
最近的 EDR 警報 (過去 24 小時)
最近建立的使用者帳戶 (過去 24 小時)
依記錄類型劃分的加密通訊強度
使用者最近變更密碼 (過去 24 小時)
前 10 大軟體即服務 (SaaS) 應用程式
前 10 項重要作業
圖表名稱
查詢示例
依嚴重程度分類的安全漏洞
metadata.log_type = /ARMIS_VULNERABILITIES|FINGERPRINT_JS|NUCLEUS_VULNERABILITY|QUALYS_ASSET_CONTEXT|QUALYS_SCAN|QUALYS_VIRTUAL_SCANNER|QUALYS_VM|RAPID7_INSIGHT|RAPID7_NEXPOSE|SNYK_SDLC|SPUR_FEEDS|STACKHAWK|SUBLIMESECURITY|SYMANTEC_SA|TENABLE_IO|TENABLE_OT|TENABLE_SC|TRENDMICRO_VISION_ONE_CONTAINER_VULNERABILITIES|UPGUARD|URLSCAN_IO/ nocase
strings.coalesce(principal.hostname, principal.asset.hostname, target.hostname, target.asset.hostname) in %ePHI_assets.Hostname
$Severity =
if (principal.asset.vulnerabilities.severity != "UNKNOWN_SEVERITY",
principal.asset.vulnerabilities.severity,
if (target.asset.vulnerabilities.severity != "UNKNOWN_SEVERITY",
target.asset.vulnerabilities.severity,
if (extensions.vulns.vulnerabilities.severity != "UNKNOWN_SEVERITY",
extensions.vulns.vulnerabilities.severity,
"UNKNOWN_SEVERITY")))
match:
$Severity
outcome:
$Count = count(strings.coalesce(extensions.vulns.vulnerabilities.name, extensions.vulns.vulnerabilities.description, extensions.vulns.vulnerabilities.vendor_vulnerability_id,
principal.asset.vulnerabilities.name, target.asset.vulnerabilities.name, additional.fields["ScanReference"]))
order:
$Severity desc
依記錄類型顯示一段時間內的權限變更
metadata.event_type = "RESOURCE_PERMISSIONS_CHANGE"
or metadata.event_type = "USER_CHANGE_PERMISSIONS"
or metadata.event_type = "USER_RESOURCE_UPDATE_PERMISSIONS"
security_result.action = "ALLOW"
strings.coalesce(principal.hostname, principal.asset.hostname, target.hostname, target.asset.hostname) in %ePHI_assets.Hostname
$Log_Type = metadata.log_type
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
match:
$Date, $Log_Type
outcome:
$Count = count(metadata.id)
order:
$Date asc
按動作劃分的 MFA 事件
(re.regex(metadata.product_name, "MULTI-FACTOR_AUTHENTICATION") or re.regex(additional.fields["AuthenticationRequirement"], `multiFactorAuthentication`) nocase or re.regex(security_result.detection_fields.value, `MFA`) nocase )
strings.coalesce(principal.hostname, principal.asset.hostname, target.hostname,target.asset.hostname) in %ePHI_assets.Hostname
$Action = security_result.action
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
match:
$Date, $Action
outcome:
$Count = count(metadata.id)
order:
$Date asc
一段時間內的登入事件 (按動作劃分)
metadata.event_type = "USER_LOGIN"
strings.coalesce(principal.hostname, principal.asset.hostname, target.hostname, target.asset.hostname) in %ePHI_assets.Hostname
$Action = security_result.action
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
match:
$Date, $Action
outcome:
$Count = count(metadata.id)
order:
$Date asc
前 10 個違反資料遺失防護政策的 ePHI 主機
metadata.log_type = /DLP|ACCELLION|CODE42_INCYDR|GUARDIUM|TRIPWIRE_FIM/ nocase
metadata.product_event_type = /Violation/ nocase
strings.coalesce(principal.hostname, principal.asset.hostname, target.hostname, target.asset.hostname) in %ePHI_assets.Hostname
$Severity = security_result.severity
$Hostname= strings.coalesce(principal.hostname, principal.asset.hostname, target.hostname, target.asset.hostname)
match:
$Hostname, $Severity
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
一段時間內 EDR 警告的嚴重程度
metadata.log_type = /EDR|CS_ALERTS|CS_DETECTS|FIREEYE_HX|MICROSOFT_DEFENDER_ENDPOINT|MICROSOFT_DEFENDER_IDENTITY|SENTINEL_DV/ nocase
strings.coalesce(security_result.rule_name, security_result.threat_name) != ""
strings.coalesce(principal.hostname, principal.asset.hostname, target.hostname, target.asset.hostname) in %ePHI_assets.Hostname
$Severity = security_result.severity
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
match:
$Date, $Severity
outcome:
$Count = count(metadata.id)
order:
$Date asc
備份事件 (按動作劃分)
(metadata.log_type = /COHESITY|DRUVA_BACKUP|VEEAM|VERITAS_NETBACKUP/ nocase or metadata.log_type = "RUBRIK")
strings.coalesce(principal.hostname, principal.asset.hostname, target.hostname, target.asset.hostname) in %ePHI_assets.Hostname
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
$Action = security_result.action
match:
$Date, $Action
outcome:
$Count = count(metadata.id)
order:
$Date asc
依動作劃分的密碼變更次數
metadata.event_type = "USER_CHANGE_PASSWORD"
strings.coalesce(principal.hostname, principal.asset.hostname, target.hostname, target.asset.hostname) in %ePHI_assets.Hostname
$Log_Type = metadata.log_type
$Action = security_result.action
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
match :
$Date, $Action
outcome :
$Count = count(metadata.id)
order:
$Date asc
近期備份事件 (過去 24 小時)
(metadata.log_type = /COHESITY|DRUVA_BACKUP|VEEAM|VERITAS_NETBACKUP/ nocase or metadata.log_type = "RUBRIK")
strings.coalesce(principal.hostname, principal.asset.hostname, target.hostname, target.asset.hostname) in %ePHI_assets.Hostname
$Description = strings.coalesce(metadata.description, security_result.description, security_result.summary)
$Log_Type = metadata.log_type
$Event_Type = metadata.event_type
$Security_Event_Type = metadata.product_event_type
$Action = security_result.action
match:
$Description, $Security_Event_Type, $Event_Type, $Action, $Log_Type
outcome:
$Count = count(metadata.id)
$Date = timestamp.get_timestamp(max(metadata.event_timestamp.seconds), "%F %T ")
order:
$Date desc
最近的 EDR 警報 (過去 24 小時)
metadata.log_type = /EDR|CS_ALERTS|CS_DETECTS|FIREEYE_HX|MICROSOFT_DEFENDER_ENDPOINT|MICROSOFT_DEFENDER_IDENTITY|SENTINEL_DV/ nocase
strings.coalesce(principal.hostname, principal.asset.hostname, target.hostname, target.asset.hostname) in %ePHI_assets.Hostname
$Log_Type = metadata.log_type
$EDR_Alerts = strings.coalesce(security_result.rule_name, security_result.threat_name)
$EDR_Alerts != ""
$Severity = security_result.severity
$User = strings.coalesce(principal.user.user_display_name, principal.user.email_addresses, principal.user.userid, target.user.userid, target.user.user_display_name, target.user.email_addresses)
$Hostname = strings.coalesce(principal.hostname, principal.asset.hostname, target.hostname, target.asset.hostname)
match:
$EDR_Alerts, $Hostname, $User, $Severity, $Log_Type
outcome:
$Count = count(metadata.id)
$Date = timestamp.get_timestamp(max(metadata.event_timestamp.seconds), "%F %T")
order:
$Date desc
最近建立的使用者帳戶 (過去 24 小時)
metadata.event_type = "USER_CREATION"
strings.coalesce(principal.hostname, principal.asset.hostname, target.hostname, target.asset.hostname) in %ePHI_assets.Hostname
$Log_Type = metadata.log_type
$Source_IP = strings.coalesce(principal.ip, principal.asset.ip)
$Source_Hostname = strings.coalesce(principal.hostname, principal.asset.hostname)
$Initiator = strings.coalesce(principal.user.userid, principal.user.user_display_name, principal.user.email_addresses)
$User_Created = strings.coalesce(target.user.userid, target.user.user_display_name, target.user.email_addresses)
$Action = security_result.action
match:
$Initiator, $User_Created, $Source_Hostname, $Source_IP, $Action, $Log_Type
outcome:
$Count = count(metadata.id)
$Date = timestamp.get_timestamp(max(metadata.event_timestamp.seconds), "%F %T ")
order:
$Date desc
依記錄類型劃分的加密通訊強度
(((target.resource.attribute.labels.key = "keyProperties_type" or target.resource.attribute.labels.key = "requestParameters.keySpec" or target.resource.attribute.labels.key = /key/ nocase) and target.resource.attribute.labels.value = /^(RSA-)|DES|RC4|MD5|SHA1|SHA-1/) or network.tls.cipher = /^(RSA-)|DES|RC4|MD5|SHA1|SHA-1/)
strings.coalesce(principal.hostname, principal.asset.hostname, target.hostname, target.asset.hostname) in %ePHI_assets.Hostname
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
$Log_Type = metadata.log_type
match:
$Date, $Log_Type
outcome:
$Count = count(metadata.id)
order:
$Date asc
使用者最近變更密碼 (過去 24 小時)
metadata.event_type = "USER_CHANGE_PASSWORD"
strings.coalesce(principal.hostname, principal.asset.hostname, target.hostname, target.asset.hostname) in %ePHI_assets.Hostname
$Log_Type = metadata.log_type
$Security_Event_Type = metadata.product_event_type
$User = strings.coalesce(principal.user.userid, principal.user.user_display_name, principal.user.email_addresses, target.user.userid, target.user.user_display_name, target.user.email_addresses)
$Source_Hostname = strings.coalesce(principal.hostname, principal.asset.hostname)
$Source_IP = strings.coalesce(principal.ip, principal.asset.ip)
$Action = security_result.action
match :
$User, $Source_Hostname, $Source_IP, $Security_Event_Type, $Action, $Log_Type
outcome :
$Date = timestamp.get_timestamp(max(metadata.event_timestamp.seconds ), "%F %T")
$Count = count(metadata.id)
order :
$Date desc
前 10 大軟體即服務 (SaaS) 應用程式
strings.coalesce(security_result.category_details, security_result.rule_name) = /saas/ nocase
strings.coalesce(principal.hostname, principal.asset.hostname, target.hostname, target.asset.hostname) in %ePHI_assets.Hostname
$Application = target.application
$Log_Type = metadata.log_type
match:
$Application, $Log_Type
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
前 10 項重要作業
(metadata.log_type = /AZURE_KEYVAULT_AUDIT|AKEYLESS_VAULT|GCP_CLOUDAUDIT/ or target.application = "kms.amazonaws.com")
strings.coalesce(principal.hostname, principal.asset.hostname, target.hostname, target.asset.hostname) in %ePHI_assets.Hostname
$Security_Event_Type = metadata.product_event_type
$Log_Type = strings.coalesce(metadata.log_type, target.application)
match:
$Security_Event_Type, $Log_Type
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
主機調查
這個資訊主頁會全面顯示主機活動和安全事件。重要小工具會追蹤網路通訊、驗證變更、惡意軟體、熱門事件和罕見程序。此外，還會監控服務和排定工作建立情形，以及潛在的安全威脅。
注意： 圖表必須在篩選器中指定主機名稱，才能正確填入資料。
前 10 大活動
一段時間內的事件趨勢
惡意軟體和入侵
網路通訊輸出地圖
罕見程序
建立服務
網路通訊
驗證和變更
網路通訊連入對應表
建立排定的工作
圖表名稱
查詢示例
前 10 大活動
$Event_Type = metadata.event_type
$User = strings.coalesce(principal.user.userid, principal.user.user_display_name, principal.user.email_addresses)
match:
$Event_Type,$User
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
一段時間內的事件趨勢
$Event_Type = metadata.event_type
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
match:
$Date, $Event_Type
outcome:
$Count = count(metadata.id)
order:
$Date asc
惡意軟體和入侵
$Log_Type = metadata.log_type
$Category = security_result.category
($Category = "UNKNOWN_CATEGORY" or $Category = "SOFTWARE_MALICIOUS" or $Category = "SOFTWARE_SUSPICIOUS" or $Category = "SOFTWARE_PUA" or $Category = "NETWORK_MALICIOUS"or $Category = "NETWORK_SUSPICIOUS" or $Category = "NETWORK_CATEGORIZED_CONTENT" or $Category = "NETWORK_DENIAL_OF_SERVICE" or $Category = "NETWORK_RECON" or $Category = "NETWORK_COMMAND_AND_CONTROL" or $Category = "ACL_VIOLATION" or $Category = "AUTH_VIOLATION" or $Category = "EXPLOIT" or $Category = "DATA_EXFILTRATION" or $Category = "DATA_AT_REST" or $Category = "DATA_DESTRUCTION" or $Category = "TOR_EXIT_NODE" or $Category = "MAIL_SPAM" or $Category = "MAIL_PHISHING" or $Category = "MAIL_SPOOFING" or $Category = "POLICY_VIOLATION" or $Category = "SOCIAL_ENGINEERING" or $Category = "PHISHING")
$Hostname = strings.coalesce(principal.hostname,principal.asset.hostname,intermediary.hostname,target.hostname,target.asset.hostname)
$Hostname !=""
$Description = strings.coalesce(metadata.description,security_result.summary)
$Action = security_result.action
$File_Path = target.file.full_path
match:
$Hostname, $Log_Type, $Category, $Description, $Action,$File_Path
outcome:
$Count = count(metadata.id)
order:
$Count desc
網路通訊輸出地圖
(metadata.event_type = "NETWORK_UNCATEGORIZED"
or metadata.event_type = "NETWORK_FLOW"
or metadata.event_type = "NETWORK_CONNECTION"
or metadata.event_type = "NETWORK_FTP"
or metadata.event_type = "NETWORK_DHCP"
or metadata.event_type = "NETWORK_DNS"
or metadata.event_type = "NETWORK_HTTP"
or metadata.event_type = "NETWORK_SMTP")
network.direction = "OUTBOUND"
$Hostname = strings.coalesce(principal.hostname, intermediary.hostname, observer.hostname, principal.asset.hostname, principal.asset.ip)
$Country = target.ip_geo_artifact.location.country_or_region
match:
$Country
outcome:
$Latitude = max(target.ip_geo_artifact.location.region_coordinates.latitude)
$Longitude = max(target.ip_geo_artifact.location.region_coordinates.longitude)
$Count = count(metadata.id)
罕見程序
(metadata.event_type = "PROCESS_LAUNCH"
or metadata.event_type = "PROCESS_INJECTION"
or metadata.event_type = "PROCESS_PRIVILEGE_ESCALATION"
or metadata.event_type = "PROCESS_TERMINATION"
or metadata.event_type = "PROCESS_OPEN"
or metadata.event_type = "PROCESS_MODULE_LOAD")
$Process_Name = strings.coalesce(if(principal.application != "", principal.application, ""), if(re.capture(target.process.file.full_path, `.*\\(\S+\.\w+)`) != "", re.capture(target.process.file.full_path, `.*\\(\S+\.\w+)`), ""))
$Process_Name != ""
$Severity = security_result.severity
$Action = security_result.action
$User = strings.coalesce(principal.user.userid, principal.user.user_display_name, principal.user.email_addresses, target.user.userid, target.user.user_display_name, target.user.email_addresses)
match:
$Process_Name,$User,$Severity,$Action
outcome:
$Count = count(metadata.id)
order:
$Count asc
建立服務
(metadata.event_type = "SERVICE_CREATION" or metadata.event_type = "SERVICE_UNSPECIFIED")
$Username = strings.coalesce(principal.user.userid, principal.user.user_display_name, principal.user.email_addresses)
$Hostname = strings.coalesce(principal.hostname,principal.asset.hostname,intermediary.hostname,target.hostname,target.asset.hostname)
$Application = target.application
$Path = target.process.file.full_path
match:
$Hostname, $Application, $Username, $Path
outcome:
$Count = count(metadata.id)
order:
$Count desc
網路通訊
(metadata.event_type = "NETWORK_UNCATEGORIZED"
or metadata.event_type = "NETWORK_FLOW"
or metadata.event_type = "NETWORK_CONNECTION"
or metadata.event_type = "NETWORK_FTP"
or metadata.event_type = "NETWORK_DHCP"
or metadata.event_type = "NETWORK_DNS"
or metadata.event_type = "NETWORK_HTTP"
or metadata.event_type = "NETWORK_SMTP")
$Source_Port = principal.port
$Destination_Port = target.port
$Source_IP = principal.ip
$Destination_IP = target.ip
$Direction = network.direction
$Direction != "UNKNOWN_DIRECTION"
$Hostname = strings.coalesce(principal.hostname,principal.asset.hostname,intermediary.hostname,target.hostname,target.asset.hostname)
$Hostname != ""
$Bytes_Sent = network.sent_bytes
$Bytes_Received = network.received_bytes
match:
$Hostname, $Source_IP, $Source_Port, $Direction, $Destination_IP, $Destination_Port,$Bytes_Sent,$Bytes_Received
outcome:
$Count = count(metadata.id)
order:
$Count desc
驗證和變更
$Event_Type = metadata.event_type
($Event_Type = "USER_LOGIN" or $Event_Type = "USER_LOGOUT" or $Event_Type = "USER_BADGE_IN" or $Event_Type= "USER_CHANGE_PASSWORD" or $Event_Type = "USER_CHANGE_PERMISSIONS" or $Event_Type = "USER_CREATION" or $Event_Type = "USER_DELETION" or $Event_Type = "USER_RESOURCE_CREATION" or $Event_Type = "USER_RESOURCE_DELETION" or $Event_Type= "USER_RESOURCE_UPDATE_CONTENT" or $Event_Type = "USER_RESOURCE_UPDATE_PERMISSIONS" or $Event_Type = "SERVICE_CREATION" or $Event_Type = "SERVICE_DELETION" or $Event_Type = "SERVICE_MODIFICATION" or $Event_Type = "SETTING_CREATION" or $Event_Type = "SETTING_DELETION" or $Event_Type = "SETTING_MODIFICATION" or $Event_Type = "DEVICE_CONFIG_UPDATE")
$Log_Type = metadata.log_type
$Security_Event_Type = metadata.product_event_type
$Description = strings.coalesce(metadata.description,security_result.description)
$Hostname = strings.coalesce(principal.hostname,principal.asset.hostname,intermediary.hostname,target.hostname,target.asset.hostname)
$Hostname !=""
$Action = security_result.action
match:
$Hostname, $Log_Type, $Event_Type,$Security_Event_Type, $Description, $Action
outcome:
$Count = count(metadata.id)
$Date = timestamp.get_timestamp(max(metadata.event_timestamp.seconds), "%F %T")
order:
$Count desc
網路通訊連入對應表
(metadata.event_type = "NETWORK_UNCATEGORIZED"
or metadata.event_type = "NETWORK_FLOW"
or metadata.event_type = "NETWORK_CONNECTION"
or metadata.event_type = "NETWORK_FTP"
or metadata.event_type = "NETWORK_DHCP"
or metadata.event_type = "NETWORK_DNS"
or metadata.event_type = "NETWORK_HTTP"
or metadata.event_type = "NETWORK_SMTP")
network.direction = "INBOUND"
$Country = principal.ip_geo_artifact.location.country_or_region
match:
$Country
outcome:
$Latitude = max(principal.ip_geo_artifact.location.region_coordinates.latitude)
$Longitude = max(principal.ip_geo_artifact.location.region_coordinates.longitude)
$Count = count(metadata.id)
建立排定的工作
metadata.event_type = "SCHEDULED_TASK_CREATION"
$Username = strings.coalesce(principal.user.userid, principal.user.user_display_name, principal.user.email_addresses)
$Hostname = strings.coalesce(principal.hostname,principal.asset.hostname,intermediary.hostname,target.hostname,target.asset.hostname)
$Task_Name = target.resource.name
match:
$Hostname, $Task_Name, $Username
outcome:
$Count = count(metadata.id)
order:
$Count desc
身分與存取權管理安全作業
這個資訊主頁提供每日監控的概要資訊。這項服務著重於即時異常狀況、現有威脅和高風險事件，可協助您快速偵測及回應事件。
最近刪除的使用者帳戶
具有特殊權限的帳戶登入失敗和成功次數
修改帳戶的不重複使用者總數
前 10 大使用者帳戶登入次數
近期刪除的角色
使用者事件中遭封鎖的前 10 大來源 IP
首次從新來源存取
使用者存取次數前 10 名的應用程式
使用者生命週期 KPI
使用者事件中遭封鎖次數最多的前 10 名使用者
密碼變更記錄
角色事件中遭封鎖的前 10 名使用者
異常連線登入
已刪除的不重複使用者帳戶總數
建立帳戶的不重複使用者總數
圖表名稱
查詢示例
最近刪除的使用者帳戶
metadata.event_type = "USER_DELETION"
security_result.action = "ALLOW"
$Log_Type = metadata.log_type
$Initiator = strings.coalesce(principal.user.windows_sid, principal.user.userid, principal.user.email_addresses)
$User = strings.coalesce(target.user.userid, target.user.email_addresses)
$Date = timestamp.get_timestamp(metadata.event_timestamp.seconds, "%F %T ")
$IP_Address = principal.ip
match:
$Date, $Log_Type, $Initiator, $IP_Address, $User
order:
$Date desc
具有特殊權限的帳戶登入失敗和成功次數
metadata.event_type = "USER_LOGIN"
strings.coalesce(principal.user.attribute.roles.name, principal.resource.name, target.user.attribute.roles.name, target.resource.name) = /admin/ nocase
if(security_result.action = "ALLOW", "Success", if(security_result.action = "BLOCK", "Failed", "Unknown")) != ""
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
$User = if(strings.coalesce(principal.user.attribute.roles.name, principal.resource.name) = /admin/ nocase, strings.coalesce(principal.user.windows_sid, principal.user.userid, principal.user.email_addresses),
if(strings.coalesce(target.user.attribute.roles.name, target.resource.name) = /admin/ nocase, strings.coalesce(target.user.windows_sid, target.user.userid, target.user.email_addresses), ""))
$Login_Status = if(security_result.action = "ALLOW", "Success", if(security_result.action = "BLOCK", "Failed", "Unknown"))
$Hostname = strings.coalesce(principal.asset.hostname, principal.hostname)
$Privilege_Type = principal.user.attribute.roles.name
$Privilege_Type != ""
$Source_IP = strings.coalesce(principal.asset.ip, principal.ip)
match:
$Date, $User, $Login_Status, $Privilege_Type, $Hostname, $Source_IP
outcome:
$Count = count(metadata.id)
order:
$Date desc
修改帳戶的不重複使用者總數
metadata.event_type = "USER_CHANGE_PERMISSIONS"
or metadata.event_type = "USER_CHANGE_PASSWORD"
or metadata.event_type = "USER_RESOURCE_UPDATE_PERMISSIONS"
security_result.action = "ALLOW"
outcome:
$Count = count_distinct(strings.coalesce(target.user.userid, target.user.email_addresses))
前 10 大使用者帳戶登入次數
metadata.event_type = "USER_LOGIN"
security_result.action = "ALLOW"
$Log_Type = metadata.log_type
$User = target.user.userid
match:
$Log_Type, $User
outcome:
$Count = count(target.user.userid)
order:
$Count desc
limit:
10
近期刪除的角色
metadata.product_event_type = /\bDelete.?Role/ nocase
or
(security_result.category_details = /RoleManagement/ nocase
and metadata.product_event_type = /delete role definition/ nocase)
security_result.action = "ALLOW"
$Log_Type = metadata.log_type
$Initiator = strings.coalesce(principal.user.windows_sid, principal.user.userid, principal.user.email_addresses)
$Date = timestamp.get_timestamp(metadata.event_timestamp.seconds, "%F %T ")
$IP_Address = principal.ip
$Role = strings.coalesce(target.user.attribute.roles.name, target.resource.name)
match:
$Date, $Log_Type, $Initiator, $IP_Address, $Role
order:
$Date desc
使用者事件中遭封鎖的前 10 大來源 IP
metadata.event_type = "USER_CREATION"
or metadata.event_type = "USER_DELETION"
or metadata.event_type = "USER_CHANGE_PERMISSIONS"
or metadata.event_type = "USER_CHANGE_PASSWORD"
or metadata.event_type = "USER_RESOURCE_UPDATE_PERMISSIONS"
security_result.action = "BLOCK"
$Event_Type = metadata.event_type
$IP_Address = principal.ip
match:
$Event_Type, $IP_Address
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
首次從新來源存取
metadata.event_type = "USER_LOGIN"
security_result.action = "ALLOW"
$Source_IP = principal.ip
$User = target.user.userid
$Country = principal.location.country_or_region
$City = principal.location.city
$City != ""
$ASN = principal.ip_geo_artifact.network.asn
$ASN != ""
match:
$Source_IP, $User, $Country, $City, $ASN
outcome:
$Count = count(metadata.id)
$FirstTime_Access = earliest(metadata.event_timestamp)
order:
$FirstTime_Access desc
使用者存取次數前 10 名的應用程式
metadata.event_type = "USER_LOGIN"
security_result.action = "ALLOW"
$Log_Type = metadata.log_type
$Application = target.application
$Application != ""
match:
$Log_Type, $Application
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
使用者生命週期 KPI
metadata.event_type = "USER_CREATION"
or metadata.event_type = "USER_DELETION"
or metadata.event_type = "USER_RESOURCE_DELETION"
or metadata.event_type = "RESOURCE_PERMISSIONS_CHANGE"
or metadata.event_type = "USER_CHANGE_PERMISSIONS"
or metadata.event_type = "USER_RESOURCE_UPDATE_PERMISSIONS"
$User_Action = if(metadata.event_type = "USER_CREATION", "Total Creation", if(metadata.event_type = "USER_DELETION" or metadata.event_type = "USER_RESOURCE_DELETION", "Total Deletion", if(metadata.event_type = "RESOURCE_PERMISSIONS_CHANGE" or metadata.event_type = "USER_CHANGE_PERMISSIONS" or metadata.event_type = "USER_RESOURCE_UPDATE_PERMISSIONS", "Total Modification")))
match:
$User_Action
outcome:
$Count = count(metadata.id)
order:
$Count asc
使用者事件中遭封鎖次數最多的前 10 名使用者
metadata.event_type = "USER_CREATION"
or metadata.event_type = "USER_DELETION"
or metadata.event_type = "USER_CHANGE_PERMISSIONS"
or metadata.event_type = "USER_CHANGE_PASSWORD"
or metadata.event_type = "USER_RESOURCE_UPDATE_PERMISSIONS"
security_result.action = "BLOCK"
$Event_Type = metadata.event_type
$User = strings.coalesce(principal.user.windows_sid, principal.user.userid, principal.user.email_addresses)
match:
$Event_Type, $User
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
密碼變更記錄
metadata.event_type = "USER_CHANGE_PASSWORD"
security_result.action = "ALLOW"
$Log_Type = metadata.log_type
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
match:
$Log_Type, $Date
outcome:
$Count = count(metadata.id)
order:
$Date desc
角色事件中遭封鎖的前 10 名使用者
(metadata.product_event_type = /Create.?Role/ nocase
or
(security_result.category_details = /RoleManagement/ nocase
and metadata.product_event_type = /add role definition/ nocase))
or
(metadata.product_event_type = /Update.?Role/ nocase
or
(security_result.category_details = /RoleManagement/ nocase
and metadata.product_event_type = /update role definition/ nocase))
or
(metadata.product_event_type = /\bDelete.?Role/ nocase
or
(security_result.category_details = /RoleManagement/ nocase
and metadata.product_event_type = /delete role definition/ nocase))
security_result.action = "BLOCK"
$User = strings.coalesce(principal.user.windows_sid, principal.user.userid, principal.user.email_addresses)
$Event = metadata.product_event_type
match:
$User, $Event
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
異常連線登入
$first_login.metadata.event_type = "USER_LOGIN"
$first_login.security_result.action = "ALLOW"
$first_login.principal.ip_geo_artifact.location.state != "" and $Country1 = $first_login.principal.ip_geo_artifact.location.state
$Time = timestamp.get_timestamp($first_login.metadata.event_timestamp.seconds, "%F %T ")
$User = strings.coalesce($first_login.target.user.userid, $first_login.target.user.email_addresses)
$User != ""
$Latitude1 = $first_login.principal.ip_geo_artifact.location.region_coordinates.latitude
$Longitude1 = $first_login.principal.ip_geo_artifact.location.region_coordinates.longitude
$second_login.metadata.event_type = "USER_LOGIN"
$second_login.security_result.action = "ALLOW"
$second_login.principal.ip_geo_artifact.location.state != "" and $Country2 = $second_login.principal.ip_geo_artifact.location.state
$Time2 = timestamp.get_timestamp($second_login.metadata.event_timestamp.seconds, "%F %T ")
$User = strings.coalesce($second_login.target.user.userid, $second_login.target.user.email_addresses)
$User != ""
$Latitude2 = $second_login.principal.ip_geo_artifact.location.region_coordinates.latitude
$Longitude2 = $second_login.principal.ip_geo_artifact.location.region_coordinates.longitude
$first_login.metadata.event_timestamp.seconds < $second_login.metadata.event_timestamp.seconds
($Latitude1 != $Latitude2)
($Longitude1 != $Longitude2)
match:
$User, $Time, $Country1, $Time2, $Country2 over 1h
outcome:
$distance_kilometers = math.ceil(max(math.geo_distance($Latitude1, $Longitude1, $Latitude2, $Longitude2)) /1000)
condition:
$first_login and $second_login and $distance_kilometers != 0
已刪除的不重複使用者帳戶總數
metadata.event_type = "USER_DELETION"
security_result.action = "ALLOW"
outcome:
$Count = count_distinct(strings.coalesce(target.user.userid, target.user.email_addresses))
建立帳戶的不重複使用者總數
metadata.event_type = "USER_CREATION"
security_result.action = "ALLOW"
outcome:
$Count = count_distinct(strings.coalesce(target.user.userid, target.user.email_addresses))
IDS / IPS 事件總覽
這個資訊主頁會全面顯示入侵偵測和防禦系統偵測到的安全性事件。
IDS / IPS 事件 (依類別區分)
依事件計數排序的前 10 個 IP
按目的地劃分的 IDS / IPS 事件
依來源劃分的 IDS / IPS 事件
依規則和動作列出的熱門 IDS / IPS 事件
過去一段時間的 IDS / IPS 事件 (依嚴重性分組)
前 10 大 IDS / IPS 高嚴重性事件
依簽章劃分的 IDS / IPS 事件
圖表名稱
查詢示例
IDS / IPS 事件 (依類別區分)
$event_type = metadata.event_type
(($event_type = "SCAN_UNCATEGORIZED" or $event_type = "SCAN_NETWORK") or ($event_type >= 16000 and $event_type <= 16007))
$category = security_result.category
$category != "UNKNOWN_CATEGORY"
match:
$category
outcome:
$event_count = count(metadata.id)
order:
$event_count desc
依事件計數排序的前 10 個 IP
$event_type = metadata.event_type
(($event_type = "SCAN_UNCATEGORIZED" or $event_type = "SCAN_NETWORK" or $event_type = "SCAN_VULN_NETWORK") or ($event_type >= 16000 and $event_type <= 16007))
$source_ip = principal.ip
$rule_name = security_result.rule_name
$rule_name != ""
$date = timestamp.get_date(metadata.event_timestamp.seconds)
match:
$rule_name, $source_ip
outcome:
$event_count = count(metadata.id)
order:
$event_count desc
limit:
10
按目的地劃分的 IDS / IPS 事件
$event_type = metadata.event_type
(($event_type = "SCAN_UNCATEGORIZED" or $event_type = "SCAN_NETWORK" or $event_type = "SCAN_VULN_NETWORK") or ($event_type >= 16000 and $event_type <= 16007))
$vendor = metadata.vendor_name
$destination_ip = target.ip
$action = security_result.action
$rule_name = security_result.rule_name
$rule_name != ""
$security_event_type = metadata.product_event_type
$security_event_type != ""
$security_event_type != /NetworkSecurityGroupFlowEvents|fileinfo|flow/ nocase
match:
$destination_ip, $rule_name, $vendor, $action
outcome:
$event_count = count(metadata.id)
order:
$event_count desc
依來源劃分的 IDS / IPS 事件
$event_type = metadata.event_type
(($event_type = "SCAN_UNCATEGORIZED" or $event_type = "SCAN_NETWORK" or $event_type = "SCAN_VULN_NETWORK") or ($event_type >= 16000 and $event_type <= 16007))
$action = security_result.action
$action != "UNKNOWN_ACTION"
$hostname = principal.hostname
$rule_name = strings.coalesce(security_result.rule_name, metadata.description)
$rule_name != ""
$vendor = metadata.vendor_name
$security_event_type = metadata.product_event_type
$security_event_type != ""
$security_event_type != /NetworkSecurityGroupFlowEvents|fileinfo|flow/ nocase
match:
$hostname, $rule_name, $vendor, $action
outcome:
$event_count = count(metadata.id)
order:
$event_count desc
依規則和動作列出的熱門 IDS / IPS 事件
$event_type = metadata.event_type
(($event_type = "SCAN_UNCATEGORIZED" or $event_type = "SCAN_NETWORK") or ($event_type >= 16000 and $event_type <= 16007))
$rule_name = security_result.rule_name
not $rule_name in %known_signatures
$rule_name != ""
$action = security_result.action
$action != "UNKNOWN_ACTION"
match:
$rule_name, $action
outcome:
$event_count = count(metadata.id)
order:
$event_count desc
過去一段時間的 IDS / IPS 事件 (依嚴重性分組)
$event_type = metadata.event_type
(($event_type = "SCAN_UNCATEGORIZED" or $event_type = "SCAN_NETWORK") or ($event_type >= 16000 and $event_type <= 16007))
$severity = security_result.severity
$severity != "UNKNOWN_SEVERITY"
$date = timestamp.get_date(metadata.event_timestamp.seconds)
match:
$severity, $date
outcome:
$event_count = count(metadata.id)
order:
$date asc
前 10 大 IDS / IPS 高嚴重性事件
$event_type = metadata.event_type
(($event_type = "SCAN_UNCATEGORIZED" or $event_type = "SCAN_NETWORK") or ($event_type >= 16000 and $event_type <= 16007))
$action = security_result.action
$rule_name = strings.coalesce(security_result.rule_name, metadata.description)
$rule_name != ""
$severity = security_result.severity
$severity = "HIGH"
match:
$rule_name, $action
outcome:
$event_count = count(metadata.id)
order:
$event_count desc
limit:
10
依簽章劃分的 IDS / IPS 事件
$event_type = metadata.event_type
(($event_type = "SCAN_UNCATEGORIZED" or $event_type = "SCAN_NETWORK") or ($event_type >= 16000 and $event_type <= 16007))
$destination_ip = target.ip
$source_ip = principal.ip
$action = security_result.action
$rule_name = security_result.rule_name
$rule_name != ""
$date = timestamp.get_date(metadata.event_timestamp.seconds)
match:
$rule_name , $source_ip , $destination_ip , $action
outcome:
$event_count = count(metadata.id)
order:
$event_count desc
ISO27001 - 機構控制措施
這個資訊主頁會根據 ISO 27001 標準，顯示機構安全控管措施和法規遵循成效。有助於安全團隊監控控管措施的實施情況、追蹤稽核結果，以及找出需要改進的領域。集中管理重要法規遵循指標，有助於持續配合ISO 27001要求，並強化機構的整體資訊安全管理。注意：這個資訊主頁需要使用篩選器。
依嚴重性分類的資料遺失防護違規事項
前 10 項資料遺失防護規則
近期建立、修改及刪除的角色
最近的權限變更
依據原因隨時間封鎖的網路流量
使用者事件變化趨勢
存取次數最多的前 10 個應用程式
流量最高的 10 個傳出 IP
裝置變化趨勢
密碼變更記錄
圖表名稱
查詢示例
依嚴重性分類的資料遺失防護違規事項
strings.coalesce(metadata.product_event_type, security_result.rule_name, security_result.summary, metadata.description) = /Violation/ nocase
$Severity = security_result.severity
$Severity != "UNKNOWN_SEVERITY"
match:
$Severity
outcome:
$Count = count(metadata.id)
order:
$Count desc
前 10 項資料遺失防護規則
strings.coalesce(metadata.product_event_type, security_result.rule_name, security_result.summary, metadata.description) = /Violation/ nocase
$Violation = strings.coalesce(security_result.rule_name, metadata.product_event_type, security_result.summary, metadata.description)
match:
$Violation
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
近期建立、修改及刪除的角色
metadata.product_event_type = /CreateRole|add role definition/ nocase
or metadata.product_event_type = /UpdateRole|update role(?: definition)?/ nocase
or metadata.product_event_type = /DeleteRole|delete role definition/ nocase
security_result.action = "ALLOW"
$Date = timestamp.get_timestamp(metadata.event_timestamp.seconds)
$Product_Event = metadata.product_event_type
$Source_IP = strings.coalesce(principal.asset.ip, principal.ip)
$Hostname = strings.coalesce(principal.asset.hostname, principal.hostname)
$Initiator = principal.user.userid
$Role = strings.coalesce(target.user.attribute.roles.name, target.resource.product_object_id, target.resource.name)
match:
$Date, $Product_Event, $Source_IP, $Hostname, $Initiator, $Role
order:
$Date desc
最近的權限變更
metadata.event_type = "RESOURCE_PERMISSIONS_CHANGE"
or metadata.event_type = "USER_CHANGE_PERMISSIONS"
or metadata.event_type = "USER_RESOURCE_UPDATE_PERMISSIONS"
security_result.action = "ALLOW"
$Date = timestamp.get_timestamp(metadata.event_timestamp.seconds)
$Log_Source = metadata.log_type
$Source_IP = strings.coalesce(principal.asset.ip, principal.ip)
$Hostname = strings.coalesce(principal.asset.hostname, principal.hostname)
$Initiator = principal.user.userid
$Description = metadata.description
match:
$Date, $Log_Source, $Source_IP, $Hostname, $Initiator, $Description
order:
$Date desc
依據原因隨時間封鎖的網路流量
metadata.event_type = "NETWORK_UNCATEGORIZED"
or metadata.event_type = "NETWORK_FLOW"
or metadata.event_type = "NETWORK_CONNECTION"
or metadata.event_type = "NETWORK_FTP"
or metadata.event_type = "NETWORK_DHCP"
or metadata.event_type = "NETWORK_DNS"
or metadata.event_type = "NETWORK_HTTP"
or metadata.event_type = "NETWORK_SMTP"
security_result.action = "BLOCK"
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
$Reason = security_result.summary
match:
$Date, $Reason
outcome:
$Count = count(metadata.id)
order:
$Date desc
使用者事件變化趨勢
metadata.event_type = "USER_CREATION"
or metadata.event_type = "USER_DELETION"
or metadata.event_type = "USER_CHANGE_PERMISSIONS"
or metadata.event_type = "USER_CHANGE_PASSWORD"
or metadata.event_type = "USER_RESOURCE_UPDATE_PERMISSIONS"
security_result.action = "ALLOW"
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
$Event_Type = metadata.event_type
match:
$Date, $Event_Type
outcome:
$Count = count(metadata.id)
order:
$Date desc
存取次數最多的前 10 個應用程式
$Log_Type = metadata.log_type
$Application = target.application
$Application != ""
match:
$Log_Type, $Application
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
流量最高的 10 個傳出 IP
network.direction = "OUTBOUND"
$Log_Type = metadata.log_type
$Destination_IP = target.ip
match:
$Log_Type, $Destination_IP
outcome:
$Total_Bytes = sum(network.received_bytes + network.sent_bytes)/(1000*1000*1000)
order:
$Total_Bytes desc
limit:
10
裝置變化趨勢
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
$Device = group(principal.asset.hostname, principal.hostname, target.asset.hostname, target.hostname)
match:
$Date
outcome:
$Count = count_distinct($Device)
order:
$Date desc
密碼變更記錄
metadata.event_type = "USER_CHANGE_PASSWORD"
security_result.action = "ALLOW"
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
$Log_Type = metadata.log_type
match:
$Date, $Log_Type
outcome:
$Count = count(metadata.id)
order:
$Date desc
ISO27001 - 實體控制
這個資訊主頁會集中顯示實體安全類別的法規遵循資料，讓安全團隊清楚瞭解控管措施的有效性。這份報表會顯示存取控管效力和卸除式媒體事件的重要指標，有助於快速找出安全漏洞，並優先執行修正工作。您可以根據這份資訊主頁的資料做出決策，降低風險並持續改善貴機構的實體安全防護機制，確保符合 ISO 27001 標準。
依嚴重性分組的遠端存取
近期卸除式媒體事件
一段時間內的使用者刷卡次數
最近 10 位使用者徽章感應記錄
前 10 大感應器位置
感應器位置記錄
圖表名稱
查詢示例
依嚴重性分組的遠端存取
metadata.event_type = "NETWORK_CONNECTION"
target.port = 22
or target.port = 3389
$Severity = security_result.severity
$Severity != "UNKNOWN_SEVERITY"
match:
$Severity
outcome:
$Count = count(metadata.id)
order:
$Count desc
近期卸除式媒體事件
strings.coalesce(metadata.product_event_type, security_result.summary) = /\busb\b/ nocase
$Date = timestamp.get_timestamp(metadata.event_timestamp.seconds)
$USB_Event = strings.coalesce(metadata.product_event_type, security_result.summary)
$Category = strings.coalesce(security_result.category_details, security_result.detection_fields["Category"])
$Source_IP = strings.coalesce(principal.asset.ip, principal.ip)
$Hostname = strings.coalesce(principal.asset.hostname, principal.hostname)
$User = strings.coalesce(principal.user.userid, principal.user.user_display_name, principal.user.email_addresses, target.user.userid, target.user.user_display_name, target.user.email_addresses)
match:
$Date, $USB_Event, $User, $Hostname, $Source_IP, $Category
order:
$Date desc
一段時間內的使用者刷卡次數
metadata.event_type = "USER_BADGE_IN"
or metadata.event_type = "USER_RESOURCE_ACCESS"
or metadata.event_type = "USER_UNCATEGORIZED"
strings.coalesce(metadata.description, security_result.action_details, security_result.description, security_result.summary, additional.fields["plasectrxEvtypename"]) = /(?:access\sgranted|badge\sin)/ nocase
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
match:
$Date
outcome:
$Count = count(metadata.id)
order:
$Date desc
最近 10 位使用者徽章感應記錄
metadata.event_type = "USER_BADGE_IN"
or metadata.event_type = "USER_RESOURCE_ACCESS"
or metadata.event_type = "USER_UNCATEGORIZED"
strings.coalesce(metadata.description, security_result.action_details, security_result.description, security_result.summary, additional.fields["plasectrxEvtypename"]) = /(?:access\sgranted|badge\sin)/ nocase
$User = strings.coalesce(principal.user.user_display_name, principal.user.email_addresses, additional.fields["person"], principal.user.userid)
$Location = strings.coalesce(security_result.rule_labels["Place"], additional.fields["site"], target.location.name, principal.resource.name)
$Date = timestamp.get_timestamp(metadata.event_timestamp.seconds)
match:
$Date, $User, $Location
order:
$Date desc
limit:
10
前 10 大感應器位置
metadata.event_type = "USER_BADGE_IN"
or metadata.event_type = "USER_RESOURCE_ACCESS"
or metadata.event_type = "USER_UNCATEGORIZED"
$Location = strings.coalesce(security_result.rule_labels["Place"], additional.fields["site"], target.location.name, principal.resource.name)
$Location != ""
match:
$Location
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
感應器位置記錄
metadata.event_type = "USER_BADGE_IN"
or metadata.event_type = "USER_RESOURCE_ACCESS"
or metadata.event_type = "USER_UNCATEGORIZED"
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
$Location = strings.coalesce(security_result.rule_labels["Place"], additional.fields["site"], target.location.name, principal.resource.name)
$Location != ""
match:
$Date, $Location
outcome:
$Count = count(metadata.id)
order:
$Date desc
寄生攻擊活動
這個資訊主頁會提供重要洞察資訊，協助您瞭解攻擊者可能濫用受信任的系統工具和程序。這個資訊主頁會追蹤並以視覺化方式呈現與系統公用程式 (例如 rundll32、regsvr32、mshta.exe 等) 相關的活動，進階威脅通常會利用這些公用程式來規避偵測。
可疑的 msiexec 執行作業
可疑的 mshta.exe 程序建立作業
Regsvr32 的可疑執行作業
Rundll32.exe 啟動的傳出連線
可疑執行 Rundll32
可疑的 CertUtil 指令
可疑的 WMI 指令碼
可疑的 Regsvr32 網路連線
圖表名稱
查詢示例
可疑的 msiexec 執行作業
metadata.event_type = "PROCESS_UNCATEGORIZED"
or metadata.event_type = "PROCESS_LAUNCH"
or metadata.event_type = "PROCESS_INJECTION"
or metadata.event_type = "PROCESS_PRIVILEGE_ESCALATION"
or metadata.event_type = "PROCESS_TERMINATION"
or metadata.event_type = "PROCESS_OPEN"
or metadata.event_type = "PROCESS_MODULE_LOAD"
target.process.file.full_path = /msiexec/
target.process.command_line = /:\/\//
$Hostname = principal.hostname
$Parent_Process = principal.process.file.full_path
$Target_Process = target.process.file.full_path
$Command_Line = target.process.command_line
$Timestamp = timestamp.get_timestamp(metadata.event_timestamp.seconds)
match:
$Hostname, $Parent_Process, $Target_Process, $Command_Line, $Timestamp
order:
$Timestamp desc
limit:
50
可疑的 mshta.exe 程序建立作業
metadata.event_type = "PROCESS_UNCATEGORIZED"
or metadata.event_type = "PROCESS_LAUNCH"
or metadata.event_type = "PROCESS_INJECTION"
or metadata.event_type = "PROCESS_PRIVILEGE_ESCALATION"
or metadata.event_type = "PROCESS_TERMINATION"
or metadata.event_type = "PROCESS_OPEN"
or metadata.event_type = "PROCESS_MODULE_LOAD"
principal.process.file.full_path = /(cmd|cscript|powershell|pwsh|regsvr32|rundll32|wscript)\.exe/
target.process.file.full_path = /mshta.exe/
$Hostname = principal.hostname
$Parent_Process = principal.process.file.full_path
$Target_Process = target.process.file.full_path
$Command_Line = target.process.command_line
$timestamp = timestamp.get_timestamp(metadata.event_timestamp.seconds)
match:
$Hostname, $Parent_Process, $Target_Process, $Command_Line, $timestamp
order:
$timestamp desc
limit:
50
Regsvr32 的可疑執行作業
metadata.event_type = "PROCESS_UNCATEGORIZED"
or metadata.event_type = "PROCESS_LAUNCH"
or metadata.event_type = "PROCESS_INJECTION"
or metadata.event_type = "PROCESS_PRIVILEGE_ESCALATION"
or metadata.event_type = "PROCESS_TERMINATION"
or metadata.event_type = "PROCESS_OPEN"
or metadata.event_type = "PROCESS_MODULE_LOAD"
target.process.command_line = /regsvr32/ nocase
target.process.command_line = /ProgramData|Temp\b|Users\\Public|Windows\\Temp|AppData\\Local\\Temp|AppData\\Roaming/ nocase
$Hostname = principal.hostname
$Parent_Process = principal.process.file.full_path
$Target_Process = target.process.file.full_path
$Command_Line = target.process.command_line
$timestamp = timestamp.get_timestamp(metadata.event_timestamp.seconds)
match:
$Hostname, $Parent_Process, $Target_Process, $Command_Line, $timestamp
order:
$timestamp desc
limit:
50
Rundll32.exe 啟動的傳出連線
metadata.event_type = "NETWORK_CONNECTION"
principal.process.file.full_path = /rundll32/ nocase
network.direction = "OUTBOUND"
target.ip != /^(10\b|127|192\.168|172\.(1[6-9]|2[0-9]|3[01]))/
principal.process.command_line != /PcaSvc\.dll|PcaPatchSdbTask/ nocase
$Hostname = principal.hostname
$Process_Name = principal.process.file.full_path
$Destination_IP = target.ip
$Command_Line = principal.process.command_line
$timestamp = timestamp.get_timestamp(metadata.event_timestamp.seconds)
match:
$Hostname, $Process_Name, $Destination_IP, $Command_Line, $timestamp
order:
$timestamp desc
limit:
50
可疑執行 Rundll32
metadata.event_type = "PROCESS_UNCATEGORIZED"
or metadata.event_type = "PROCESS_LAUNCH"
or metadata.event_type = "PROCESS_INJECTION"
or metadata.event_type = "PROCESS_PRIVILEGE_ESCALATION"
or metadata.event_type = "PROCESS_TERMINATION"
or metadata.event_type = "PROCESS_OPEN"
or metadata.event_type = "PROCESS_MODULE_LOAD"
principal.process.command_line != /Shell32\.dll|Control_RunDLL|\.cpl/ nocase
target.process.command_line = /rundll32.*(javascript|\.RegisterXLL|OpenURL|OpenURLA|FileProtocolHandler|(url|zipfldr|shell32|mshtml|advpack|ieadvpack|ieframe|shdocvw|syssetup|setupapi|pcwutl|dfshim|scrobj|shimgvw|comsvcs)\.dll|RouteTheCall|Control_RunDLL|ShellExec_RunDLL|PrintHTML|LaunchINFSection|RegisterOCX|SetupInfObjectInstallAction|InstallHinfSection|LaunchApplication|ShOpenVerbApplication|http|ImageView_Fullscreen|MiniDump)/ nocase
$Hostname = principal.hostname
$Parent_Process = strings.coalesce(principal.process.file.full_path, principal.file.full_path)
$Target_Process = strings.coalesce(target.process.file.full_path, target.file.full_path)
$Command_Line = target.process.command_line
$timestamp = timestamp.get_timestamp(metadata.event_timestamp.seconds)
match:
$Hostname, $Parent_Process, $Target_Process, $Command_Line, $timestamp
order:
$timestamp desc
limit:
50
可疑的 CertUtil 指令
target.process.command_line = /certutil.*(decode|encode|urlcache|verifyctl|encodehex|decodehex)/
$Hostname = principal.hostname
$Parent_Process = principal.process.file.full_path
$Target_Process = target.process.file.full_path
$Command_Line = target.process.command_line
$Timestamp = timestamp.get_timestamp(metadata.event_timestamp.seconds)
match:
$Hostname, $Parent_Process, $Target_Process, $Command_Line, $Timestamp
order:
$Timestamp desc
limit:
50
可疑的 WMI 指令碼
target.process.command_line = /(jscript|vbscript)\.dll|format:/
target.process.file.full_path = /wmi.*\.exe/ nocase
$Hostname = principal.hostname
$Parent_Process = principal.process.file.full_path
$Target_Process = target.process.file.full_path
$Command_Line = target.process.command_line
$Timestamp = timestamp.get_timestamp(metadata.event_timestamp.seconds)
match:
$Hostname, $Parent_Process, $Target_Process, $Command_Line, $Timestamp
order:
$Timestamp
limit:
50
可疑的 Regsvr32 網路連線
metadata.event_type = "NETWORK_CONNECTION"
principal.process.file.full_path = /regsvr32/
target.ip != /^(10\b|127|169\.254|172\.16|224|100\.64|198\.(18|51\.100)|203\.0\.113|240|192\.(0\.2|0\.0\.(8|9|10|170|171)|0|31\.196|52\.193|168|88\.99|175\.48))/
$Hostname = principal.hostname
$Process_Name = principal.process.file.full_path
$Command_Line = principal.process.command_line
$Destination_IP = target.ip
$timestamp = timestamp.get_timestamp(metadata.event_timestamp.seconds)
match:
$Hostname, $Process_Name, $Destination_IP, $Command_Line, $timestamp
order:
$timestamp desc
limit:
50
已標記 MITRE ATT&CK 的事件
這個資訊主頁會根據 MITRE ATT&CK 架構，提供偵測活動的總覽，追蹤偵測結果並突顯趨勢，以找出新興威脅。這項服務會顯示並對應戰術、技術和程序 (TTP)，協助機構和資安團隊更瞭解自身環境，進而提升威脅偵測和應變能力，確保主動防禦網路威脅。
新策略和技術 - 過去 7 天
技術趨勢
最常見的 10 種攻擊技術
策略趨勢
依策略劃分的供應商快訊總數
使用者發現的策略
依主機名稱識別的技術
依主機名稱識別的策略
使用者識別的技術
MITRE 事件的嚴重程度分布
依策略和技術顯示事件
圖表名稱
查詢示例
新策略和技術 - 過去 7 天
strings.coalesce(security_result.attack_details.tactics.id, security_result.detection_fields["Tactic ID"]) != ""
strings.coalesce(security_result.attack_details.tactics.name, security_result.detection_fields["Tactic"]) != ""
strings.coalesce(security_result.attack_details.techniques.id, security_result.detection_fields["Technique ID"]) != ""
strings.coalesce(security_result.attack_details.techniques.name, security_result.detection_fields["Technique"]) != ""
$Tactic = strings.concat(strings.coalesce(security_result.attack_details.tactics.id, security_result.detection_fields["Tactic ID"])," - ", strings.coalesce(security_result.attack_details.tactics.name, security_result.detection_fields["Tactic"]))
$Tactic != "-"
$Technique = strings.concat(strings.coalesce(security_result.attack_details.techniques.id, security_result.detection_fields["Technique ID"])," - ", strings.coalesce(security_result.attack_details.techniques.name, security_result.detection_fields["Technique"]))
$Technique != "-"
match:
$Tactic, $Technique
outcome:
$First_Seen = timestamp.get_timestamp(min(metadata.event_timestamp.seconds), "%F %T")
$Last_Seen = timestamp.get_timestamp(max(metadata.event_timestamp.seconds), "%F %T")
$Diff_First_Seen = timestamp.diff(timestamp.current_seconds(), min(metadata.event_timestamp.seconds), "DAY")
order:
$Diff_First_Seen asc
技術趨勢
strings.coalesce(security_result.attack_details.techniques.id, security_result.detection_fields["Technique ID"]) != ""
strings.coalesce(security_result.attack_details.techniques.name, security_result.detection_fields["Technique"]) != ""
$Technique = strings.concat(strings.coalesce(security_result.attack_details.techniques.id, security_result.detection_fields["Technique ID"])," - ", strings.coalesce(security_result.attack_details.techniques.name, security_result.detection_fields["Technique"]))
$Technique != "-"
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
match:
$Date, $Technique
outcome:
$Count = count(strings.coalesce(security_result.attack_details.techniques.name, security_result.detection_fields["Technique"]))
order:
$Date asc
最常見的 10 種攻擊技術
strings.coalesce(security_result.attack_details.techniques.id, security_result.detection_fields["Technique ID"]) != ""
strings.coalesce(security_result.attack_details.techniques.name, security_result.detection_fields["Technique"]) != ""
$Technique = strings.concat(strings.coalesce(security_result.attack_details.techniques.id, security_result.detection_fields["Technique ID"])," - ", strings.coalesce(security_result.attack_details.techniques.name, security_result.detection_fields["Technique"]))
$Technique != "-"
match:
$Technique
outcome:
$Count = count(strings.concat(strings.coalesce(security_result.attack_details.techniques.id, security_result.detection_fields["Technique ID"])," - ", strings.coalesce(security_result.attack_details.techniques.name, security_result.detection_fields["Technique"])))
order:
$Count desc
limit:
10
最常見的 10 種攻擊技術
strings.coalesce(security_result.attack_details.techniques.id, security_result.detection_fields["Technique ID"]) != ""
strings.coalesce(security_result.attack_details.techniques.name, security_result.detection_fields["Technique"]) != ""
$Technique = strings.concat(strings.coalesce(security_result.attack_details.techniques.id, security_result.detection_fields["Technique ID"])," - ", strings.coalesce(security_result.attack_details.techniques.name, security_result.detection_fields["Technique"]))
$Technique != "-"
match:
$Technique
outcome:
$Count = count(strings.concat(strings.coalesce(security_result.attack_details.techniques.id, security_result.detection_fields["Technique ID"])," - ", strings.coalesce(security_result.attack_details.techniques.name, security_result.detection_fields["Technique"])))
order:
$Count desc
limit:
10
策略趨勢
strings.coalesce(security_result.attack_details.tactics.id, security_result.detection_fields["Tactic ID"]) != ""
strings.coalesce(security_result.attack_details.tactics.name, security_result.detection_fields["Tactic"]) != ""
$Tactic = strings.concat(strings.coalesce(security_result.attack_details.tactics.id, security_result.detection_fields["Tactic ID"])," - ", strings.coalesce(security_result.attack_details.tactics.name, security_result.detection_fields["Tactic"]))
$Tactic != "-"
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
match:
$Date, $Tactic
outcome:
$Count = count(strings.coalesce(security_result.attack_details.tactics.name, security_result.detection_fields["Tactic"]))
order:
$Date asc
策略趨勢
strings.coalesce(security_result.attack_details.tactics.id, security_result.detection_fields["Tactic ID"]) != ""
strings.coalesce(security_result.attack_details.tactics.name, security_result.detection_fields["Tactic"]) != ""
$Tactic = strings.concat(strings.coalesce(security_result.attack_details.tactics.id, security_result.detection_fields["Tactic ID"])," - ", strings.coalesce(security_result.attack_details.tactics.name, security_result.detection_fields["Tactic"]))
$Tactic != "-"
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
match:
$Date, $Tactic
outcome:
$Count = count(strings.coalesce(security_result.attack_details.tactics.name, security_result.detection_fields["Tactic"]))
order:
$Date asc
依策略劃分的供應商快訊總數
strings.coalesce(security_result.attack_details.tactics.id, security_result.detection_fields["Tactic ID"]) != ""
strings.coalesce(security_result.attack_details.tactics.name, security_result.detection_fields["Tactic"]) != ""
$Tactic = strings.concat(strings.coalesce(security_result.attack_details.tactics.id, security_result.detection_fields["Tactic ID"])," - ", strings.coalesce(security_result.attack_details.tactics.name, security_result.detection_fields["Tactic"]))
$Tactic != "-"
$Alert = strings.coalesce(security_result.rule_name, security_result.threat_name, security_result.summary, security_result.description)
match:
$Tactic, $Alert
outcome:
$Count = count(strings.concat(strings.coalesce(security_result.attack_details.tactics.id, security_result.detection_fields["Tactic ID"])," - ", strings.coalesce(security_result.attack_details.tactics.name, security_result.detection_fields["Tactic"])))
order:
$Tactic asc
使用者發現的策略
strings.coalesce(security_result.attack_details.tactics.id, security_result.detection_fields["Tactic ID"]) != ""
strings.coalesce(security_result.attack_details.tactics.name, security_result.detection_fields["Tactic"]) != ""
$Tactic = strings.concat(strings.coalesce(security_result.attack_details.tactics.id, security_result.detection_fields["Tactic ID"])," - ", strings.coalesce(security_result.attack_details.tactics.name, security_result.detection_fields["Tactic"]))
$Tactic != "-"
$Username = strings.coalesce(principal.user.user_display_name, principal.user.userid)
$Username != ""
$Hostname = strings.coalesce(principal.hostname, principal.asset.hostname)
$Hostname != ""
match:
$Username, $Hostname, $Tactic
outcome:
$Count = count(strings.concat(strings.coalesce(security_result.attack_details.tactics.id, security_result.detection_fields["Tactic ID"])," - ", strings.coalesce(security_result.attack_details.tactics.name, security_result.detection_fields["Tactic"])))
order:
$Count desc
依主機名稱識別的技術
strings.coalesce(security_result.attack_details.techniques.id, security_result.detection_fields["Technique ID"]) != ""
strings.coalesce(security_result.attack_details.techniques.name, security_result.detection_fields["Technique"]) != ""
$Technique = strings.concat(strings.coalesce(security_result.attack_details.techniques.id, security_result.detection_fields["Technique ID"])," - ", strings.coalesce(security_result.attack_details.techniques.name, security_result.detection_fields["Technique"]))
$Technique != "-"
$Hostname = strings.coalesce(principal.hostname, principal.asset.hostname)
$Hostname != ""
$IP_Address = strings.coalesce(principal.ip, principal.asset.ip)
match:
$Hostname, $IP_Address, $Technique
outcome:
$Count = count(strings.concat(strings.coalesce(security_result.attack_details.techniques.id, security_result.detection_fields["Technique ID"])," - ", strings.coalesce(security_result.attack_details.techniques.name, security_result.detection_fields["Technique"])))
order:
$Count desc
依主機名稱識別的技術
strings.coalesce(security_result.attack_details.techniques.id, security_result.detection_fields["Technique ID"]) != ""
strings.coalesce(security_result.attack_details.techniques.name, security_result.detection_fields["Technique"]) != ""
$Technique = strings.concat(strings.coalesce(security_result.attack_details.techniques.id, security_result.detection_fields["Technique ID"])," - ", strings.coalesce(security_result.attack_details.techniques.name, security_result.detection_fields["Technique"]))
$Technique != "-"
$Hostname = strings.coalesce(principal.hostname, principal.asset.hostname)
$Hostname != ""
$IP_Address = strings.coalesce(principal.ip, principal.asset.ip)
match:
$Hostname, $IP_Address, $Technique
outcome:
$Count = count(strings.concat(strings.coalesce(security_result.attack_details.techniques.id, security_result.detection_fields["Technique ID"])," - ", strings.coalesce(security_result.attack_details.techniques.name, security_result.detection_fields["Technique"])))
order:
$Count desc
依主機名稱識別的策略
strings.coalesce(security_result.attack_details.tactics.id, security_result.detection_fields["Tactic ID"]) != ""
strings.coalesce(security_result.attack_details.tactics.name, security_result.detection_fields["Tactic"]) != ""
$Tactic = strings.concat(strings.coalesce(security_result.attack_details.tactics.id, security_result.detection_fields["Tactic ID"])," - ", strings.coalesce(security_result.attack_details.tactics.name, security_result.detection_fields["Tactic"]))
$Tactic != "-"
$Hostname = strings.coalesce(principal.hostname, principal.asset.hostname)
$Hostname != ""
$IP_Address = strings.coalesce(principal.ip, principal.asset.ip)
match:
$Hostname, $IP_Address, $Tactic
outcome:
$Count = count(strings.concat(strings.coalesce(security_result.attack_details.tactics.id, security_result.detection_fields["Tactic ID"])," - ", strings.coalesce(security_result.attack_details.tactics.name, security_result.detection_fields["Tactic"])))
order:
$Count desc
使用者識別的技術
strings.coalesce(security_result.attack_details.techniques.id, security_result.detection_fields["Technique ID"]) != ""
strings.coalesce(security_result.attack_details.techniques.name, security_result.detection_fields["Technique"]) != ""
strings.coalesce(principal.user.user_display_name, principal.user.userid) != ""
strings.coalesce(principal.hostname, principal.asset.hostname) != ""
$Technique = strings.concat(strings.coalesce(security_result.attack_details.techniques.id, security_result.detection_fields["Technique ID"])," - ", strings.coalesce(security_result.attack_details.techniques.name, security_result.detection_fields["Technique"]))
$Technique != "-"
$Username = strings.coalesce(principal.user.user_display_name, principal.user.userid)
$Hostname = strings.coalesce(principal.hostname, principal.asset.hostname)
match:
$Username, $Hostname, $Technique
outcome:
$Count = count(strings.concat(strings.coalesce(security_result.attack_details.techniques.id, security_result.detection_fields["Technique ID"])," - ", strings.coalesce(security_result.attack_details.techniques.name, security_result.detection_fields["Technique"])))
order:
$Count desc
使用者識別的技術
strings.coalesce(security_result.attack_details.techniques.id, security_result.detection_fields["Technique ID"]) != ""
strings.coalesce(security_result.attack_details.techniques.name, security_result.detection_fields["Technique"]) != ""
strings.coalesce(principal.user.user_display_name, principal.user.userid) != ""
strings.coalesce(principal.hostname, principal.asset.hostname) != ""
$Technique = strings.concat(strings.coalesce(security_result.attack_details.techniques.id, security_result.detection_fields["Technique ID"])," - ", strings.coalesce(security_result.attack_details.techniques.name, security_result.detection_fields["Technique"]))
$Technique != "-"
$Username = strings.coalesce(principal.user.user_display_name, principal.user.userid)
$Hostname = strings.coalesce(principal.hostname, principal.asset.hostname)
match:
$Username, $Hostname, $Technique
outcome:
$Count = count(strings.concat(strings.coalesce(security_result.attack_details.techniques.id, security_result.detection_fields["Technique ID"])," - ", strings.coalesce(security_result.attack_details.techniques.name, security_result.detection_fields["Technique"])))
order:
$Count desc
依策略劃分的供應商快訊總數
strings.coalesce(security_result.attack_details.tactics.id, security_result.detection_fields["Tactic ID"]) != ""
strings.coalesce(security_result.attack_details.tactics.name, security_result.detection_fields["Tactic"]) != ""
$Tactic = strings.concat(strings.coalesce(security_result.attack_details.tactics.id, security_result.detection_fields["Tactic ID"])," - ", strings.coalesce(security_result.attack_details.tactics.name, security_result.detection_fields["Tactic"]))
$Tactic != "-"
$Alert = strings.coalesce(security_result.rule_name, security_result.threat_name, security_result.summary, security_result.description)
match:
$Tactic, $Alert
outcome:
$Count = count(strings.concat(strings.coalesce(security_result.attack_details.tactics.id, security_result.detection_fields["Tactic ID"])," - ", strings.coalesce(security_result.attack_details.tactics.name, security_result.detection_fields["Tactic"])))
order:
$Tactic asc
新策略和技術 - 過去 7 天
strings.coalesce(security_result.attack_details.tactics.id, security_result.detection_fields["Tactic ID"]) != ""
strings.coalesce(security_result.attack_details.tactics.name, security_result.detection_fields["Tactic"]) != ""
strings.coalesce(security_result.attack_details.techniques.id, security_result.detection_fields["Technique ID"]) != ""
strings.coalesce(security_result.attack_details.techniques.name, security_result.detection_fields["Technique"]) != ""
$Tactic = strings.concat(strings.coalesce(security_result.attack_details.tactics.id, security_result.detection_fields["Tactic ID"])," - ", strings.coalesce(security_result.attack_details.tactics.name, security_result.detection_fields["Tactic"]))
$Tactic != "-"
$Technique = strings.concat(strings.coalesce(security_result.attack_details.techniques.id, security_result.detection_fields["Technique ID"])," - ", strings.coalesce(security_result.attack_details.techniques.name, security_result.detection_fields["Technique"]))
$Technique != "-"
match:
$Tactic, $Technique
outcome:
$First_Seen = timestamp.get_timestamp(min(metadata.event_timestamp.seconds), "%F %T")
$Last_Seen = timestamp.get_timestamp(max(metadata.event_timestamp.seconds), "%F %T")
$First_Seen_Time = min(metadata.event_timestamp.seconds)
$Last_Seen_Time = max(metadata.event_timestamp.seconds)
$Diff_First_Seen = math.round(($Last_Seen_Time - $First_Seen_Time)/86400)
order:
$Diff_First_Seen asc
unselect:
$First_Seen_Time, $Last_Seen_Time
依主機名稱識別的策略
strings.coalesce(security_result.attack_details.tactics.id, security_result.detection_fields["Tactic ID"]) != ""
strings.coalesce(security_result.attack_details.tactics.name, security_result.detection_fields["Tactic"]) != ""
$Tactic = strings.concat(strings.coalesce(security_result.attack_details.tactics.id, security_result.detection_fields["Tactic ID"])," - ", strings.coalesce(security_result.attack_details.tactics.name, security_result.detection_fields["Tactic"]))
$Tactic != "-"
$Hostname = strings.coalesce(principal.hostname, principal.asset.hostname)
$Hostname != ""
$IP_Address = strings.coalesce(principal.ip, principal.asset.ip)
match:
$Hostname, $IP_Address, $Tactic
outcome:
$Count = count(strings.concat(strings.coalesce(security_result.attack_details.tactics.id, security_result.detection_fields["Tactic ID"])," - ", strings.coalesce(security_result.attack_details.tactics.name, security_result.detection_fields["Tactic"])))
order:
$Count desc
MITRE 事件的嚴重程度分布
strings.coalesce(security_result.attack_details.techniques.id, security_result.detection_fields["Technique ID"]) != ""
strings.coalesce(security_result.attack_details.techniques.name, security_result.detection_fields["Technique"]) != ""
$Severity = security_result.severity
match:
$Severity
outcome:
$Count = count(strings.concat(strings.coalesce(security_result.attack_details.techniques.id, security_result.detection_fields["Technique ID"])," - ", strings.coalesce(security_result.attack_details.techniques.name, security_result.detection_fields["Technique"])))
order:
$Count desc
技術趨勢
strings.coalesce(security_result.attack_details.techniques.id, security_result.detection_fields["Technique ID"]) != ""
strings.coalesce(security_result.attack_details.techniques.name, security_result.detection_fields["Technique"]) != ""
$Technique = strings.concat(strings.coalesce(security_result.attack_details.techniques.id, security_result.detection_fields["Technique ID"])," - ", strings.coalesce(security_result.attack_details.techniques.name, security_result.detection_fields["Technique"]))
$Technique != "-"
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
match:
$Date, $Technique
outcome:
$Count = count(strings.coalesce(security_result.attack_details.techniques.name, security_result.detection_fields["Technique"]))
order:
$Date asc
依策略和技術顯示事件
strings.coalesce(security_result.attack_details.tactics.id, security_result.detection_fields["Tactic ID"]) != ""
strings.coalesce(security_result.attack_details.tactics.name, security_result.detection_fields["Tactic"]) != ""
strings.coalesce(security_result.attack_details.techniques.id, security_result.detection_fields["Technique ID"]) != ""
strings.coalesce(security_result.attack_details.techniques.name, security_result.detection_fields["Technique"]) != ""
$Tactic = strings.concat(strings.coalesce(security_result.attack_details.tactics.id, security_result.detection_fields["Tactic ID"])," - ", strings.coalesce(security_result.attack_details.tactics.name, security_result.detection_fields["Tactic"]))
$Tactic != "-"
$Technique = strings.concat(strings.coalesce(security_result.attack_details.techniques.id, security_result.detection_fields["Technique ID"])," - ", strings.coalesce(security_result.attack_details.techniques.name, security_result.detection_fields["Technique"]))
$Technique != "-"
match:
$Tactic, $Technique
outcome:
$Count = count(metadata.id)
order:
$Tactic asc
使用者發現的策略
strings.coalesce(security_result.attack_details.tactics.id, security_result.detection_fields["Tactic ID"]) != ""
strings.coalesce(security_result.attack_details.tactics.name, security_result.detection_fields["Tactic"]) != ""
$Tactic = strings.concat(strings.coalesce(security_result.attack_details.tactics.id, security_result.detection_fields["Tactic ID"])," - ", strings.coalesce(security_result.attack_details.tactics.name, security_result.detection_fields["Tactic"]))
$Tactic != "-"
$Username = strings.coalesce(principal.user.user_display_name, principal.user.userid)
$Username != ""
$Hostname = strings.coalesce(principal.hostname, principal.asset.hostname)
$Hostname != ""
match:
$Username, $Hostname, $Tactic
outcome:
$Count = count(strings.concat(strings.coalesce(security_result.attack_details.tactics.id, security_result.detection_fields["Tactic ID"])," - ", strings.coalesce(security_result.attack_details.tactics.name, security_result.detection_fields["Tactic"])))
order:
$Count desc
Microsoft 365 - SharePoint 和 OneDrive
這個資訊主頁會詳細顯示兩個平台的使用者活動、資料存取權和安全性事件。可為機構提供實用洞察資訊，追蹤檔案作業、存取趨勢和使用者行為。這個資訊主頁有助於找出未經授權的存取行為或異常活動，例如非預期的登入位置或使用者模式異常。
使用者活動
修改共用政策
存取次數最多的前 10 個 SharePoint 網站
前 10 大活躍使用者
前 10 大權限帳戶活動
前 10 項檔案作業
使用者存取要求的地理位置地圖
前 10 大來源 IP 位址
活動趨勢變化
隨時間下載檔案的次數
檔案下載
圖表名稱
查詢示例
使用者活動
$Source_IP = strings.coalesce(principal.ip, principal.asset.ip)
$Security_Event_Type = metadata.product_event_type
$User = strings.coalesce(principal.user.userid,principal.user.user_display_name,principal.user.email_addresses)
$Application = strings.coalesce(principal.application, target.application, intermediary.application)
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
match:
$Date,$User,$Source_IP, $Application,$Security_Event_Type
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
修改共用政策
metadata.product_event_type = "SharingPolicyChanged"
$Application = strings.coalesce(principal.application, target.application, intermediary.application)
$User = strings.coalesce(principal.user.userid, principal.user.user_display_name, principal.user.email_addresses)
$Role = principal.user.attribute.roles.name
$Policy = target.labels.key
$Action = target.labels.value
($Action = "True" or $Action = "False")
$Date = timestamp.get_timestamp(metadata.event_timestamp.seconds, "%F %T ")
match:
$Date, $User, $Role, $Policy, $Action, $Application
outcome:
$Count = count(metadata.id)
order:
$Count desc
存取次數最多的前 10 個 SharePoint 網站
$Sites = strings.coalesce(target.url,network.http.referral_url,principal.url)
$User = strings.coalesce(principal.user.userid, principal.user.user_display_name, principal.user.email_addresses)
match:
$Sites, $User
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
前 10 大活躍使用者
$User = strings.coalesce(principal.user.userid,principal.user.user_display_name,principal.user.email_addresses)
$Application = strings.coalesce(principal.application, target.application, intermediary.application)
match:
$User, $Application
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
前 10 大權限帳戶活動
principal.user.attribute.roles.name = /Admin|DcAdmin|Administrator|Root/ nocase //It will be updated as per the client's environment.
$Role = principal.user.attribute.roles.name
$Security_Event_Type = metadata.product_event_type
$User = strings.coalesce(principal.user.userid, principal.user.user_display_name, principal.user.email_addresses)
$Resource = if(target.resource.name = "Unknown",target.url,target.resource.name)
$Application = strings.coalesce(principal.application, target.application, intermediary.application)
match:
$Role, $Security_Event_Type, $Application
outcome:
$Username = array_distinct($User)
$Count = count(metadata.id)
order:
$Count desc
limit:
10
前 10 項檔案作業
metadata.product_event_type = /File/ nocase
$Security_Event_Type = metadata.product_event_type
$Action = security_result.action
match:
$Security_Event_Type, $Action
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
使用者存取要求的地理位置地圖
$User = strings.coalesce(principal.user.userid, principal.user.user_display_name, principal.user.email_addresses)
$Country = strings.coalesce(principal.location.country_or_region, principal.ip_geo_artifact.location.country_or_region)
$Country != ""
match:
$Country
outcome:
$Count = count($User)
$Latitude = max(principal.ip_geo_artifact.location.region_latitude)
$Longitude = max(principal.ip_geo_artifact.location.region_longitude)
order:
$Count desc
前 10 大來源 IP 位址
$Source_IP = strings.coalesce(principal.ip, principal.asset.ip)
$User = strings.coalesce(principal.user.userid, principal.user.user_display_name, principal.user.email_addresses)
match:
$Source_IP, $User
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
活動趨勢變化
$Application = strings.coalesce(principal.application, target.application, intermediary.application)
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
match:
$Application, $Date
outcome:
$Count = count(metadata.id)
order:
$Date asc
隨時間下載檔案的次數
metadata.product_event_type = "FileDownloaded"
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
$User = strings.coalesce(principal.user.userid, principal.user.user_display_name, principal.user.email_addresses)
match:
$Date, $User
outcome:
$Count = count(metadata.id)
order:
$Date asc
檔案下載
metadata.product_event_type = "FileDownloaded"
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
$Downloaded_File = strings.coalesce(src.url,src.file.full_path)
$User = strings.coalesce(principal.user.userid, principal.user.user_display_name, principal.user.email_addresses)
$Role = principal.user.attribute.roles.name
match:
$Date, $User,$Role,$Downloaded_File
outcome:
$Count = count(metadata.id)
order:
$Count asc
Microsoft 365 警示
這個資訊主頁會顯示安全性事件和潛在威脅的總覽，並追蹤與使用者活動相關的重要快訊和趨勢。
依快訊數排名的前 10 名使用者
前 10 大警報
前 10 大高嚴重性警報
最近的快訊詳細資料
警示嚴重程度分布
指定期間內的警告
圖表名稱
查詢示例
依快訊數排名的前 10 名使用者
metadata.log_type = "MICROSOFT_GRAPH_ALERT"
metadata.product_name = "Office 365 Security and Compliance"
security_result.summary = /threat(?:\s)?management/ nocase
target.user.userid != ""
$User = target.user.userid
match:
$User
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
前 10 大警報
metadata.log_type = "MICROSOFT_GRAPH_ALERT"
metadata.product_name = "Office 365 Security and Compliance"
security_result.summary = /threat(?:\s)?management/ nocase
security_result.rule_name != ""
$Alert = security_result.rule_name
match:
$Alert
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
前 10 大高嚴重性警報
metadata.log_type = "MICROSOFT_GRAPH_ALERT"
metadata.product_name = "Office 365 Security and Compliance"
security_result.severity = "HIGH"
security_result.summary = /threat(?:\s)?management/ nocase
security_result.rule_name != ""
$Alert = security_result.rule_name
match:
$Alert
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
最近的快訊詳細資料
metadata.log_type = "MICROSOFT_GRAPH_ALERT"
metadata.product_name = "Office 365 Security and Compliance"
security_result.summary = /threat(?:\s)?management/ nocase
$Alert = security_result.rule_name
$Description = security_result.description
$Severity = security_result.severity
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
match:
$Date, $Alert, $Description, $Severity
outcome:
$Count = count(metadata.id)
order:
$Date desc
limit:
50
警示嚴重程度分布
metadata.log_type = "MICROSOFT_GRAPH_ALERT"
metadata.product_name = "Office 365 Security and Compliance"
security_result.summary = /threat(?:\s)?management/ nocase
$Severity = security_result.severity
match:
$Severity
outcome:
$Count = count(metadata.id)
order:
$Severity desc
指定期間內的警告
metadata.log_type = "MICROSOFT_GRAPH_ALERT"
metadata.product_name = "Office 365 Security and Compliance"
security_result.summary = /threat(?:\s)?management/ nocase
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
match:
$Date
outcome:
$Count = count(metadata.id)
order:
$Date asc
行動裝置管理
這個資訊主頁提供法規遵循、威脅趨勢、嚴重程度分布和使用者活動等深入分析，協助安全團隊監控機構的行動裝置，瞭解整體安全狀態。有助於做出明智決策，以解決安全漏洞、強制執行安全性原則，並有效防範新興威脅。
裝置的 OS 版本過舊 / 有安全漏洞
前 10 項修改過的資源
OS 發行版
前 10 大裝置威脅
裝置前 10 大熱門位置
不符規定的裝置隨時間變化
登入失敗次數前 10 名的使用者
裝置近期威脅趨勢
已修補的裝置數 (隨時間變化)
重要裝置的變化趨勢
過去一段時間內偵測到的威脅
裝置嚴重性分布
裝置加入/退出時間
歷來事件
圖表名稱
查詢示例
裝置的 OS 版本過舊 / 有安全漏洞
(principal.asset.platform_software.platform_version = /Android|IOS|Windows|mac(?:os)?/ nocase
and not principal.asset.platform_software.platform_version = /Android(?:\s|\/)1[3-6]|IOS(?:\s|\/)1[5-8]|Windows(?:\s|\/)1[0-1]|mac(?:OS)?(?:\s|\/)1[3-5]/ nocase)
or (target.resource.attribute.labels["OS"] = /Android/ nocase
and not (target.resource.attribute.labels["Version"] = /1[3-6]/
or target.resource.attribute.labels["OSversion"] = /1[3-6]/))
or (target.resource.attribute.labels["OS"] = /IOS/ nocase
and not (target.resource.attribute.labels["Version"] = /1[5-8]/
or target.resource.attribute.labels["OSversion"] = /(15|16|17|18).*/))
or (target.resource.attribute.labels["OS"] = /Windows/ nocase
and not (target.resource.attribute.labels["Version"] = /10|11/
or target.resource.attribute.labels["OSversion"] = /10|11/))
or (target.resource.attribute.labels["OS"] = /mac(?:OS)?/ nocase
and not (target.resource.attribute.labels["Version"] = /1[3-5]/
or target.resource.attribute.labels["OSversion"] = /1[3-5]/))
$Device = strings.coalesce(principal.asset.hostname, principal.hostname)
$OS = strings.coalesce(principal.asset.platform_software.platform_version, target.resource.attribute.labels["OS"])
$Version = strings.coalesce(target.resource.attribute.labels["Version"], target.resource.attribute.labels["OSversion"])
match:
$Device, $OS, $Version
前 10 項修改過的資源
metadata.event_type = "USER_RESOURCE_UPDATE_CONTENT"
or metadata.event_type = "USER_RESOURCE_UPDATE_PERMISSIONS"
metadata.product_event_type = /Patch MobileApp|Patch ManagedDevice|Patch DeviceConfiguration|(Application|Profile)Modified/ nocase
$Resource_Name = principal.hostname
$Resource_Name != ""
match:
$Resource_Name
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
OS 發行版
$Platform = principal.platform
match:
$Platform
outcome:
$Count = count(metadata.id)
order:
$Count desc
前 10 大裝置威脅
metadata.product_event_type = "THREAT_DETECTED"
or additional.fields["CompromisedStatus"] = /^Compromised/ nocase
or security_result.description = /Threat|Compromised/ nocase
$Threat_Event = strings.coalesce(metadata.product_event_type, security_result.category_details, security_result.description)
match:
$Threat_Event
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
裝置前 10 大熱門位置
$Country = principal.ip_geo_artifact.location.country_or_region
$Latitude = principal.ip_geo_artifact.location.region_coordinates.latitude
$Latitude != 0
$Longitude = principal.ip_geo_artifact.location.region_coordinates.longitude
$Longitude != 0
match:
$Country, $Latitude, $Longitude
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
不符規定的裝置隨時間變化
additional.fields["ComplianceState"] = /Not Compliant/ nocase
or target.resource.attribute.labels["Status"] = /NonCompliant/ nocase
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
match:
$Date
outcome:
$Count = count_distinct(principal.hostname)
order:
$Date desc
登入失敗次數前 10 名的使用者
(metadata.event_type = "USER_LOGIN"
or metadata.product_event_type = /user(?:\s|\S|)?login/ nocase
and security_result.action = "BLOCK" or target.resource.attribute.labels["Status"] = /Failure/ nocase)
or metadata.product_event_type = /user(?:\s|\S)?login.*(?:failed)?/ nocase
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
$User = principal.user.userid
$User != ""
match:
$User
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
裝置近期威脅趨勢
metadata.product_event_type = "THREAT_DETECTED"
or additional.fields["CompromisedStatus"] = /^Compromised/ nocase
or security_result.description = /Threat|Compromised/ nocase
$Device = principal.hostname
$Device != ""
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
match:
$Date, $Device
outcome:
$Count = count(metadata.id)
order:
$Date desc
已修補的裝置數 (隨時間變化)
metadata.event_type = "USER_RESOURCE_UPDATE_CONTENT"
or metadata.event_type = "USER_RESOURCE_UPDATE_PERMISSIONS"
metadata.product_event_type = /Patch MobileApp|Patch ManagedDevice|Patch DeviceConfiguration|(Application|Profile)Modified/ nocase
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
match:
$Date
outcome:
$Count = count(metadata.id)
order:
$Date desc
重要裝置的變化趨勢
security_result.severity = "CRITICAL"
or security_result.severity = "HIGH"
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
match:
$Date
outcome:
$Count = count_distinct(principal.hostname)
order:
$Date desc
過去一段時間內偵測到的威脅
metadata.product_event_type = "THREAT_DETECTED"
or additional.fields["CompromisedStatus"] = /^Compromised/ nocase
or security_result.description = /Threat|Compromised/ nocase
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
$Threat_Event = strings.coalesce(metadata.product_event_type, security_result.category_details, security_result.description)
match:
$Date, $Threat_Event
outcome:
$Count = count(metadata.id)
order:
$Date desc
裝置嚴重性分布
$Severity = security_result.severity
match:
$Severity
outcome:
$Count = count_distinct(principal.hostname)
order:
$Count desc
裝置加入/退出時間
metadata.event_type = "USER_RESOURCE_CREATION"
or metadata.product_event_type = /DEVICE_ENROLLMENT|DeviceEnrolled/ nocase
or metadata.event_type = "USER_RESOURCE_DELETION"
or metadata.product_event_type = /^(Deviceun(?:enrolled|enrollment)|BreakMDMConfirmed|Delete\s?(?:ManagedDevice|Device)(?:Requested)?|Retire\s?ManageDevice|DeviceWipeRequested)$/ nocase
$Enrollment = if(metadata.product_event_type = /DEVICE_ENROLLMENT|DeviceEnrolled/ nocase, "Onboard", if(metadata.product_event_type = /^(Deviceun(?:enrolled|enrollment)|BreakMDMConfirmed|Delete\s?(?:ManagedDevice|Device)(?:Requested)?|Retire\s?ManageDevice|DeviceWipeRequested)$/ nocase, "Offboard"))
$Enrollment != ""
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
match:
$Date, $Enrollment
outcome:
$Count = count_distinct(principal.hostname)
order:
$Date desc
歷來事件
$Event_Type = metadata.event_type
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
match:
$Date, $Event_Type
outcome:
$Count = count(metadata.id)
order:
$Date desc
多重驗證 (MFA) 監控
這個資訊主頁會詳細分析貴機構的 MFA 實施情況和成效，這項功能可即時提供 MFA 使用趨勢、失敗警報和註冊狀態的歷來洞察資料，透過監控這些重要層面，資訊主頁可協助機構識別潛在的安全性漏洞、追蹤驗證效能，並確保符合安全通訊協定，最終強化整體存取安全和使用者管理。
Okta MFA 繞過偵測
多重驗證失敗率
依原因封鎖的 MFA 嘗試
一段時間內的多重驗證嘗試次數
各位置的多重驗證嘗試
多重驗證失敗次數最高的前 5 位使用者
多重驗證使用趨勢
透過 MFA 存取的前 5 大應用程式
多重驗證成功率
多重驗證註冊狀態
多重驗證失敗快訊
圖表名稱
查詢示例
Okta MFA 繞過偵測
$event_type = metadata.event_type
$event_type = "USER_UNCATEGORIZED"
$vendor = metadata.vendor_name
$vendor = /Okta/ nocase
$security_event_type = metadata.product_event_type
$security_event_type = "user.mfa.attempt_bypass"
$User = principal.user.user_display_name
$Summary = security_result.summary
$Action = security_result.action
$Action != "UNKNOWN_ACTION"
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
match:
$User, $Action, $Date,$Summary, $security_event_type
outcome:
$Count = count(metadata.id)
多重驗證失敗率
$event_type = metadata.event_type
$event_type = "USER_LOGIN"
$product_name = metadata.product_name
$security_event_type = metadata.product_event_type
$requirement = additional.fields["AuthenticationRequirement"]
$result_value = security_result.detection_fields.value
(re.regex($product_name, "MULTI-FACTOR_AUTHENTICATION") or re.regex($security_event_type, `user.mfa`) or re.regex($requirement, `multiFactorAuthentication`) or re.regex($result_value, `MFA`))
$user = strings.coalesce(target.user.userid, principal.user.userid)
$user != ""
$email_id =strings.coalesce(target.user.email_addresses, principal.user.email_addresses)
$action = security_result.action
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
match:
$Date
outcome:
$total_attempts = count(metadata.id)
$failure_attempts = sum(if(any security_result.action = "BLOCK", 1, 0)) // Sums only failure MFA attempts
$failure_rate = (($failure_attempts / $total_attempts) * 100 )
order:
$Date asc
依原因封鎖的 MFA 嘗試
$product_name = metadata.product_name
$security_event_type = metadata.product_event_type
$requirement = additional.fields["AuthenticationRequirement"]
$result_value = security_result.detection_fields.value
(re.regex($product_name, "MULTI-FACTOR_AUTHENTICATION") or re.regex($security_event_type, `user.mfa`) nocase or re.regex($requirement, `multiFactorAuthentication`) nocase or re.regex($result_value, `MFA`) nocase)
$user = strings.coalesce(target.user.userid, principal.user.userid)
$user != ""
$action = security_result.action
$action = "BLOCK"
$Reason = security_result.summary
$Reason != ""
$Location = principal.location.country_or_region
match:
$Reason, $Location
outcome:
$Count = count(metadata.id)
order:
$Count desc
一段時間內的多重驗證嘗試次數
$event_type = metadata.event_type
$event_type = "USER_LOGIN"
$product_name = metadata.product_name
$security_event_type = metadata.product_event_type
$requirement = additional.fields["AuthenticationRequirement"]
$result_value = security_result.detection_fields.value
(re.regex($product_name, "MULTI-FACTOR_AUTHENTICATION") or re.regex($security_event_type, `user.mfa`) nocase or re.regex($requirement, `multiFactorAuthentication`) nocase or re.regex($result_value, `MFA`) nocase)
$user = strings.coalesce(target.user.userid, principal.user.userid)
$user != ""
$email_id = strings.coalesce(target.user.email_addresses, principal.user.email_addresses)
$action = security_result.action
$action != "UNKNOWN_ACTION"
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
$Location = principal.location.country_or_region
match:
$Date, $Location
outcome:
$Count = count(metadata.id)
order:
$Date asc
各位置的多重驗證嘗試
$event_type = metadata.event_type
$event_type = "USER_LOGIN"
$product_name = metadata.product_name
$security_event_type = metadata.product_event_type
$requirement = additional.fields["AuthenticationRequirement"]
$result_value = security_result.detection_fields.value
(re.regex($product_name, "MULTI-FACTOR_AUTHENTICATION") or re.regex($security_event_type, `user.mfa`) or re.regex($requirement, `multiFactorAuthentication`) or re.regex($result_value, `MFA`))
$User = target.user.userid
$User != ""
$Action = security_result.action
$Action !="UNKNOWN_ACTION"
$Vendor = metadata.vendor_name
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
$Latitude = principal.location.region_coordinates.latitude
$Longitude = principal.location.region_coordinates.longitude
$Location = strings.coalesce(target.location.country_or_region, principal.location.country_or_region)
match:
$Vendor, $Date, $Location, $Latitude, $Longitude
outcome:
$Count = count(metadata.id)
各位置的多重驗證嘗試
$event_type = metadata.event_type
$event_type = "USER_LOGIN"
$product_name = metadata.product_name
$security_event_type = metadata.product_event_type
$requirement = additional.fields["AuthenticationRequirement"]
$result_value = security_result.detection_fields.value
(re.regex($product_name, "MULTI-FACTOR_AUTHENTICATION") or re.regex($security_event_type, `user.mfa`) nocase or re.regex($requirement, `multiFactorAuthentication`) nocase or re.regex($result_value, `MFA`) nocase)
$User = target.user.userid
$User != ""
$Action = security_result.action
$Action !="UNKNOWN_ACTION"
$Vendor = metadata.vendor_name
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
$Latitude = principal.location.region_coordinates.latitude
$Longitude = principal.location.region_coordinates.longitude
$Location = strings.coalesce(target.location.country_or_region, principal.location.country_or_region)
match:
$Vendor, $Date, $Location, $Latitude, $Longitude
outcome:
$Count = count(metadata.id)
多重驗證失敗次數最高的前 5 位使用者
$event_type = metadata.event_type
$event_type = "USER_LOGIN"
$product_name = metadata.product_name
$security_event_type = metadata.product_event_type
$requirement = additional.fields["AuthenticationRequirement"]
$result_value = security_result.detection_fields.value
(re.regex($product_name, "MULTI-FACTOR_AUTHENTICATION") or re.regex($security_event_type, `user.mfa`) nocase or re.regex($requirement, `multiFactorAuthentication`) nocase or re.regex($result_value, `MFA`) nocase)
$User = strings.coalesce(target.user.userid, principal.user.userid)
$User != ""
$email_id = strings.coalesce(target.user.email_addresses,principal.user.email_addresses)
$Action = security_result.action
$Action = "BLOCK"
$date = timestamp.get_date(metadata.event_timestamp.seconds)
match:
$User, $Action
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:5
多重驗證使用趨勢
$event_type = metadata.event_type
$event_type = "USER_LOGIN"
$product_name = metadata.product_name
$security_event_type = metadata.product_event_type
$requirement = additional.fields["AuthenticationRequirement"]
$result_value = security_result.detection_fields.value
(re.regex($product_name, "MULTI-FACTOR_AUTHENTICATION") or re.regex($security_event_type, `user.mfa`) nocase or re.regex($requirement, `multiFactorAuthentication`) nocase or re.regex($result_value, `MFA`) nocase)
$user = strings.coalesce(target.user.userid, principal.user.userid)
$user != ""
$email_id = strings.coalesce(target.user.email_addresses, principal.user.email_addresses)
$action = security_result.action
$action != "UNKNOWN_ACTION"
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
match:
$event_type, $Date
outcome:
$Count = count($event_type)
order:
$Date asc
透過 MFA 存取的前 5 大應用程式
$event_type = metadata.event_type
$event_type = "USER_LOGIN"
$product_name = metadata.product_name
$security_event_type = metadata.product_event_type
$requirement = additional.fields["AuthenticationRequirement"]
$result_value = security_result.detection_fields.value
(re.regex($product_name, "MULTI-FACTOR_AUTHENTICATION") or re.regex($security_event_type, `user.mfa`) or re.regex($requirement, `multiFactorAuthentication`) or re.regex($result_value, `MFA`))
$user = strings.coalesce(target.user.userid, principal.user.userid)
$user != ""
$email_id = strings.coalesce(target.user.email_addresses, principal.user.email_addresses)
$Application = target.application
$Application != ""
match:
$Application
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit : 5
多重驗證成功率
$event_type = metadata.event_type
$event_type = "USER_LOGIN"
$product_name = metadata.product_name
$security_event_type = metadata.product_event_type
$requirement = additional.fields["AuthenticationRequirement"]
$result_value = security_result.detection_fields.value
(re.regex($product_name, "MULTI-FACTOR_AUTHENTICATION") or re.regex($security_event_type, `user.mfa`) nocase or re.regex($requirement, `multiFactorAuthentication`) nocase or re.regex($result_value, `MFA`) nocase)
$user = strings.coalesce(target.user.userid,principal.user.userid)
$user !=""
$email_id =strings.coalesce(target.user.email_addresses,principal.user.email_addresses)
$action = security_result.action
$vendor = metadata.vendor_name
$date = timestamp.get_date(metadata.event_timestamp.seconds)
match:
$date
outcome:
$total_attempts = count(metadata.id)
$successful_attempts = sum(if(any security_result.action = "ALLOW", 1, 0)) // Sums only successful MFA attempts
$success_rate = (($successful_attempts / $total_attempts) * 100 )
order: $date asc
多重驗證成功率
$event_type = metadata.event_type
$event_type = "USER_LOGIN"
$product_name = metadata.product_name
$security_event_type = metadata.product_event_type
$requirement = additional.fields["AuthenticationRequirement"]
$result_value = security_result.detection_fields.value
(re.regex($product_name, "MULTI-FACTOR_AUTHENTICATION") or re.regex($security_event_type, `user.mfa`) or re.regex($requirement, `multiFactorAuthentication`) or re.regex($result_value, `MFA`))
$user = strings.coalesce(target.user.userid,principal.user.userid)
$user !=""
$email_id =strings.coalesce(target.user.email_addresses,principal.user.email_addresses)
$action = security_result.action
$vendor = metadata.vendor_name
$date = timestamp.get_date(metadata.event_timestamp.seconds)
match:
$date
outcome:
$total_attempts = count(metadata.id)
$successful_attempts = sum(if(any security_result.action = "ALLOW", 1, 0)) // Sums only successful MFA attempts
$success_rate = (($successful_attempts / $total_attempts) * 100 )
order: $date asc
透過 MFA 存取的前 5 大應用程式
$event_type = metadata.event_type
$event_type = "USER_LOGIN"
$product_name = metadata.product_name
$security_event_type = metadata.product_event_type
$requirement = additional.fields["AuthenticationRequirement"]
$result_value = security_result.detection_fields.value
(re.regex($product_name, "MULTI-FACTOR_AUTHENTICATION") or re.regex($security_event_type, `user.mfa`) nocase or re.regex($requirement, `multiFactorAuthentication`) nocase or re.regex($result_value, `MFA`) nocase)
$user = strings.coalesce(target.user.userid, principal.user.userid)
$user != ""
$email_id = strings.coalesce(target.user.email_addresses, principal.user.email_addresses)
$Application = target.application
match:
$Application
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit : 5
依原因封鎖的 MFA 嘗試
$product_name = metadata.product_name
$security_event_type = metadata.product_event_type
$requirement = additional.fields["AuthenticationRequirement"]
$result_value = security_result.detection_fields.value
(re.regex($product_name, "MULTI-FACTOR_AUTHENTICATION") or re.regex($security_event_type, `user.mfa`) or re.regex($requirement, `multiFactorAuthentication`) or re.regex($result_value, `MFA`))
$user = strings.coalesce(target.user.userid, principal.user.userid)
$user != ""
$action = security_result.action
$action = "BLOCK"
$Reason = security_result.summary
$Reason != ""
$Location = principal.location.country_or_region
match:
$Reason, $Location
outcome:
$Count = count(metadata.id)
order:
$Count desc
多重驗證註冊狀態
$event_type = metadata.event_type
$event_type = "USER_CREATION"
$security_event_type = metadata.product_event_type
$security_event_type = "enrollment"
$product_name = metadata.product_name
$requirement = additional.fields["AuthenticationRequirement"]
$result_value = security_result.detection_fields.value
(re.regex($product_name, "MULTI-FACTOR_AUTHENTICATION") or re.regex($requirement, `multiFactorAuthentication`) or re.regex($result_value, `MFA`))
$summary = security_result.summary
$summary != ""
$user = strings.coalesce(target.user.userid, principal.user.userid)
$user != ""
$email_id = strings.coalesce(target.user.email_addresses, principal.user.email_addresses)
$action = security_result.action
$vendor = metadata.vendor_name
$date = timestamp.get_date(metadata.event_timestamp.seconds)
match:
$summary
outcome:
$event_count = count(metadata.id)
order:
$event_count desc
多重驗證失敗率
$event_type = metadata.event_type
$event_type = "USER_LOGIN"
$product_name = metadata.product_name
$security_event_type = metadata.product_event_type
$requirement = additional.fields["AuthenticationRequirement"]
$result_value = security_result.detection_fields.value
(re.regex($product_name, "MULTI-FACTOR_AUTHENTICATION") or re.regex($security_event_type, `user.mfa`) nocase or re.regex($requirement, `multiFactorAuthentication`) nocase or re.regex($result_value, `MFA`) nocase)
$user = strings.coalesce(target.user.userid, principal.user.userid)
$user != ""
$email_id =strings.coalesce(target.user.email_addresses, principal.user.email_addresses)
$action = security_result.action
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
match:
$Date
outcome:
$total_attempts = count(metadata.id)
$failure_attempts = sum(if(any security_result.action = "BLOCK", 1, 0)) // Sums only failure MFA attempts
$failure_rate = (($failure_attempts / $total_attempts) * 100 )
order:
$Date asc
Okta MFA 繞過偵測
$event_type = metadata.event_type
$event_type = "USER_UNCATEGORIZED"
$vendor = metadata.vendor_name
$vendor = /Okta/
$security_event_type = metadata.product_event_type
$security_event_type = "user.mfa.attempt_bypass"
$User = principal.user.user_display_name
$Summary = security_result.summary
$Action = security_result.action
$Action != "UNKNOWN_ACTION"
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
match:
$User, $Action, $Date,$Summary, $security_event_type
outcome:
$Count = count(metadata.id)
order:
$Count desc
多重驗證失敗次數最高的前 5 位使用者
$event_type = metadata.event_type
$event_type = "USER_LOGIN"
$product_name = metadata.product_name
$security_event_type = metadata.product_event_type
$requirement = additional.fields["AuthenticationRequirement"]
$result_value = security_result.detection_fields.value
(re.regex($product_name, "MULTI-FACTOR_AUTHENTICATION") or re.regex($security_event_type, `user.mfa`) or re.regex($requirement, `multiFactorAuthentication`) or re.regex($result_value, `MFA`))
$User = strings.coalesce(target.user.userid, principal.user.userid)
$User != ""
$email_id = strings.coalesce(target.user.email_addresses,principal.user.email_addresses)
$Action = security_result.action
$Action = "BLOCK"
$date = timestamp.get_date(metadata.event_timestamp.seconds)
match:
$User, $Action
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:5
一段時間內的多重驗證嘗試次數
$event_type = metadata.event_type
$event_type = "USER_LOGIN"
$product_name = metadata.product_name
$security_event_type = metadata.product_event_type
$requirement = additional.fields["AuthenticationRequirement"]
$result_value = security_result.detection_fields.value
(re.regex($product_name, "MULTI-FACTOR_AUTHENTICATION") or re.regex($security_event_type, `user.mfa`) or re.regex($requirement, `multiFactorAuthentication`) or re.regex($result_value, `MFA`))
$user = strings.coalesce(target.user.userid, principal.user.userid)
$user != ""
$email_id = strings.coalesce(target.user.email_addresses, principal.user.email_addresses)
$action = security_result.action
$action != "UNKNOWN_ACTION"
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
$Location = principal.location.country_or_region
match:
$Date, $Location
outcome:
$Count = count(metadata.id)
order:
$Date asc
多重驗證失敗快訊
$event_type = metadata.event_type
$event_type = "USER_LOGIN"
$product_name = metadata.product_name
$security_event_type = metadata.product_event_type
$requirement = additional.fields["AuthenticationRequirement"]
$result_value = security_result.detection_fields.value
(re.regex($product_name, "MULTI-FACTOR_AUTHENTICATION") or re.regex($security_event_type, `user.mfa`) or re.regex($requirement, `multiFactorAuthentication`) or re.regex($result_value, `MFA`))
$user = strings.coalesce(target.user.userid, principal.user.userid)
$user != ""
$email_id = strings.coalesce(target.user.email_addresses, principal.user.email_addresses)
$action = security_result.action
$action = "BLOCK"
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
match:
$Date
outcome:
$Count = count(metadata.id)
$Action = array_distinct($action)
order:
$Date asc
多重驗證失敗快訊
$event_type = metadata.event_type
$event_type = "USER_LOGIN"
$product_name = metadata.product_name
$security_event_type = metadata.product_event_type
$requirement = additional.fields["AuthenticationRequirement"]
$result_value = security_result.detection_fields.value
(re.regex($product_name, "MULTI-FACTOR_AUTHENTICATION") or re.regex($security_event_type, `user.mfa`) nocase or re.regex($requirement, `multiFactorAuthentication`) nocase or re.regex($result_value, `MFA`) nocase)
$user = strings.coalesce(target.user.userid, principal.user.userid)
$user != ""
$email_id = strings.coalesce(target.user.email_addresses, principal.user.email_addresses)
$action = security_result.action
$action = "BLOCK"
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
match:
$Date
outcome:
$Count = count(metadata.id)
$Action = array_distinct($action)
order:
$Date asc
多重驗證註冊狀態
$event_type = metadata.event_type
$event_type = "USER_CREATION"
$security_event_type = metadata.product_event_type
$security_event_type = "enrollment"
$product_name = metadata.product_name
$requirement = additional.fields["AuthenticationRequirement"]
$result_value = security_result.detection_fields.value
(re.regex($product_name, "MULTI-FACTOR_AUTHENTICATION") or re.regex($requirement, `multiFactorAuthentication`) nocase or re.regex($result_value, `MFA`) nocase)
$summary = security_result.summary
$summary != ""
$user = strings.coalesce(target.user.userid, principal.user.userid)
$user != ""
$email_id = strings.coalesce(target.user.email_addresses, principal.user.email_addresses)
$action = security_result.action
$vendor = metadata.vendor_name
$date = timestamp.get_date(metadata.event_timestamp.seconds)
match:
$summary
outcome:
$event_count = count(metadata.id)
order:
$event_count desc
多重驗證使用趨勢
$event_type = metadata.event_type
$event_type = "USER_LOGIN"
$product_name = metadata.product_name
$security_event_type = metadata.product_event_type
$requirement = additional.fields["AuthenticationRequirement"]
$result_value = security_result.detection_fields.value
(re.regex($product_name, "MULTI-FACTOR_AUTHENTICATION") or re.regex($security_event_type, `user.mfa`) or re.regex($requirement, `multiFactorAuthentication`) or re.regex($result_value, `MFA`))
$user = strings.coalesce(target.user.userid, principal.user.userid)
$user != ""
$email_id = strings.coalesce(target.user.email_addresses, principal.user.email_addresses)
$action = security_result.action
$action != "UNKNOWN_ACTION"
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
match:
$event_type, $Date
outcome:
$Count = count($event_type)
order:
$Date asc
NIST 800-53 - 存取控管
這個資訊主頁會顯示符合 NIST 800-53 標準的存取控管活動完整總覽。這項功能會追蹤來源、政策和地理位置的存取趨勢，以找出風險、簡化監控作業，並強化存取控管管理。這個資訊主頁會使用參照清單 nist_compliance_assets，將資料範圍限定在 NIST 環境。
注意： 必須先建立必要的參照清單，這個資訊主頁中的圖表才會載入。
使用者帳戶鎖定
最近登入失敗次數 (過去 24 小時)
圖表名稱
查詢示例
使用者帳戶鎖定
metadata.description = /locked out/ nocase
$Summary = metadata.description
$Log_Type = metadata.log_type
$Hostname = strings.coalesce(principal.hostname,principal.asset.hostname,target.hostname,target.asset.hostname)
$User = strings.coalesce(principal.user.userid, principal.user.user_display_name, principal.user.email_addresses,target.user.userid,target.user.user_display_name,target.user.email_addresses )
//If the user requires any inclusions for specific assets, these lines will need to be enabled in the query and update the NIST_Compliance_Assets reference list as needed.
//$Source_IP = strings.coalesce(principal.asset.ip, principal.ip)
//strings.coalesce($Hostname, $Source_IP) in %NIST_Compliance_Assets
match:
$Summary, $User, $Hostname, $Log_Type
outcome:
$Date = timestamp.get_timestamp(max(metadata.event_timestamp.seconds ), "%F %T")
$Count = count(metadata.id)
order:
$Count desc
最近登入失敗次數 (過去 24 小時)
metadata.event_type = "USER_LOGIN"
security_result.action = "BLOCK"
$Log_Type = metadata.log_type
$Source_IP = strings.coalesce(principal.ip, principal.asset.ip)
$Summary = strings.coalesce(security_result.summary, security_result.description, metadata.description, security_result.rule_name)
$Hostname = strings.coalesce(principal.hostname,principal.asset.hostname,target.hostname,target.asset.hostname)
$User = strings.coalesce(principal.user.userid, principal.user.user_display_name, principal.user.email_addresses,target.user.userid,target.user.user_display_name,target.user.email_addresses )
//If the user requires any inclusions for specific assets, these lines will need to be enabled in the query and update the NIST_Compliance_Assets reference list as needed.
//$Destination_IP = strings.coalesce(principal.asset.ip, principal.ip)
//strings.coalesce($Hostname, $Source_IP, $Destination_IP) in %NIST_Compliance_Assets
match:
$Summary, $User,$Hostname, $Source_IP, $Log_Type
outcome:
$Date = timestamp.get_timestamp(max(metadata.event_timestamp.seconds ), "%F %T")
$Count = count(metadata.id)
order:
$Count desc
NIST 800-53 - 稽核與當責
這個資訊主頁會提供符合 NIST 800-53 標準的記錄管理總覽，方便您有效監控及管理稽核記錄，確保安全和法規遵循。
NIST 800-53 - 識別與驗證
這個資訊主頁會顯示身分和驗證活動的完整總覽，並符合 NIST 800-53標準。這項功能會追蹤密碼變更、帳戶管理、權限更新和多重驗證 (MFA) 活動等重要指標。這項工具可協助您強制執行身分識別和驗證程序，確保機密系統和資料受到保護。
多重驗證成功率
權限隨時間的變化
建立使用者帳戶的前 10 大發起者
刪除使用者帳戶的前 10 大發起者
建立群組的前 10 名發起人
使用者事件變化趨勢
歷來事件
近期角色修改
近期建立的群組
刪除角色的前 10 大發起者
近期刪除的使用者帳戶
前 10 大群組刪除發起者
多重驗證失敗率
最近的權限變更
最近刪除的群組
前 10 大角色修改者
近期建立的使用者帳戶
近期刪除的角色
前 10 名建立角色的發起者
最近的使用者帳戶修改
密碼變更記錄
修改群組的前 10 名發起者
近期建立的角色
多重驗證註冊狀態
修改使用者帳戶的前 10 大發起者
角色事件變化趨勢
近期群組修改
歷來群組事件
圖表名稱
查詢示例
多重驗證成功率
metadata.product_name = "MULTI-FACTOR_AUTHENTICATION"
or metadata.product_event_type = /mfa(?:\S)?auth|auth(?:.*)?mfa/ nocase
$Log_Type = metadata.log_type
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
//If the user requires any inclusions for specific assets, these lines will need to be enabled in the query and update the NIST_Compliance_Assets reference list as needed.
//$Hostname = strings.coalesce(principal.asset.hostname, principal.hostname)
//$Source_IP = strings.coalesce(principal.asset.ip, principal.ip)
//strings.coalesce($Hostname, $Source_IP) in %NIST_Compliance_Assets
match:
$Date, $Log_Type
outcome:
$Count = count(metadata.id)
$Successful_Attempts = sum(if(security_result.action = "ALLOW", 1, 0))
$Success_Rate = (($Successful_Attempts / $Count) * 100)
order:
$Date desc
權限隨時間的變化
metadata.event_type = "RESOURCE_PERMISSIONS_CHANGE"
or metadata.event_type = "USER_CHANGE_PERMISSIONS"
or metadata.event_type = "USER_RESOURCE_UPDATE_PERMISSIONS"
security_result.action = "ALLOW"
$Log_Type = metadata.log_type
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
//If the user requires any inclusions for specific assets, these lines will need to be enabled in the query and update the NIST_Compliance_Assets reference list as needed.
//$Hostname = strings.coalesce(principal.asset.hostname, principal.hostname)
//$Source_IP = strings.coalesce(principal.asset.ip, principal.ip)
//strings.coalesce($Hostname, $Source_IP) in %NIST_Compliance_Assets
match:
$Date, $Log_Type
outcome:
$Count = count(metadata.id)
order:
$Date desc
建立使用者帳戶的前 10 大發起者
metadata.event_type = "USER_CREATION"
security_result.action = "ALLOW"
$Log_Source = metadata.log_type
$Initiator = principal.user.userid
//If the user requires any inclusions for specific assets, these lines will need to be enabled in the query and update the NIST_Compliance_Assets reference list as needed.
//$Source_IP = strings.coalesce(principal.asset.ip, principal.ip)
//$Hostname = strings.coalesce(principal.asset.hostname, principal.hostname)
//strings.coalesce($Hostname, $Source_IP) in %NIST_Compliance_Assets
match:
$Initiator, $Log_Source
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
刪除使用者帳戶的前 10 大發起者
metadata.event_type = "USER_DELETION"
security_result.action = "ALLOW"
$Log_Source = metadata.log_type
$Initiator = principal.user.userid
//If the user requires any inclusions for specific assets, these lines will need to be enabled in the query and update the NIST_Compliance_Assets reference list as needed.
//$Source_IP = strings.coalesce(principal.asset.ip, principal.ip)
//$Hostname = strings.coalesce(principal.asset.hostname, principal.hostname)
//strings.coalesce($Hostname, $Source_IP) in %NIST_Compliance_Assets
match:
$Initiator, $Log_Source
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
建立群組的前 10 名發起人
metadata.event_type = "GROUP_CREATION"
or metadata.product_event_type = /add group/ nocase
security_result.action = "ALLOW"
$Log_Source = metadata.log_type
$Initiator = principal.user.userid
//If the user requires any inclusions for specific assets, these lines will need to be enabled in the query and update the NIST_Compliance_Assets reference list as needed.
//$Source_IP = strings.coalesce(principal.asset.ip, principal.ip)
//$Hostname = strings.coalesce(principal.asset.hostname, principal.hostname)
//strings.coalesce($Hostname, $Source_IP) in %NIST_Compliance_Assets
match:
$Initiator, $Log_Source
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
使用者事件變化趨勢
metadata.event_type = "USER_CREATION"
or metadata.event_type = "USER_DELETION"
or metadata.event_type = "USER_CHANGE_PERMISSIONS"
or metadata.event_type = "USER_CHANGE_PASSWORD"
or metadata.event_type = "USER_RESOURCE_UPDATE_PERMISSIONS"
security_result.action = "ALLOW"
$Event_Type = metadata.event_type
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
//If the user requires any inclusions for specific assets, these lines will need to be enabled in the query and update the NIST_Compliance_Assets reference list as needed.
//$Hostname = strings.coalesce(principal.asset.hostname, principal.hostname)
//$Source_IP = strings.coalesce(principal.asset.ip, principal.ip)
//strings.coalesce($Hostname, $Source_IP) in %NIST_Compliance_Assets
match:
$Date, $Event_Type
outcome:
$Count = count(metadata.id)
order:
$Date desc
歷來事件
metadata.event_type = "USER_CREATION"
or metadata.event_type = "USER_DELETION"
or metadata.event_type = "USER_CHANGE_PERMISSIONS"
or metadata.event_type = "USER_CHANGE_PASSWORD"
or metadata.event_type = "USER_RESOURCE_UPDATE_PERMISSIONS"
or metadata.event_type = "GROUP_CREATION"
or metadata.event_type = "GROUP_DELETION"
or metadata.event_type = "GROUP_MODIFICATION"
security_result.action = "ALLOW"
$Event_Type = metadata.event_type
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
//If the user requires any inclusions for specific assets, these lines will need to be enabled in the query and update the NIST_Compliance_Assets reference list as needed.
//$Hostname = strings.coalesce(principal.asset.hostname, principal.hostname)
//$Source_IP = strings.coalesce(principal.asset.ip, principal.ip)
//strings.coalesce($Hostname, $Source_IP) in %NIST_Compliance_Assets
match:
$Date, $Event_Type
outcome:
$Count = count(metadata.id)
order:
$Date desc
近期角色修改
metadata.product_event_type = /UpdateRole|update role(?: definition)?/ nocase
security_result.action = "ALLOW"
$Date = timestamp.get_timestamp(metadata.event_timestamp.seconds, "%F %T ")
$Log_Source = metadata.log_type
$Source_IP = strings.coalesce(principal.asset.ip, principal.ip)
$Hostname = strings.coalesce(principal.asset.hostname, principal.hostname)
$Initiator = principal.user.userid
$Role_Modified = strings.coalesce(target.user.attribute.roles.name, target.resource.product_object_id, target.resource.name)
//If the user requires any inclusions for specific assets, these lines will need to be enabled in the query and update the NIST_Compliance_Assets reference list as needed.
//strings.coalesce($Hostname, $Source_IP) in %NIST_Compliance_Assets
match:
$Date, $Log_Source, $Source_IP, $Hostname, $Initiator, $Role_Modified
order:
$Date desc
近期建立的群組
metadata.event_type = "GROUP_CREATION"
or metadata.product_event_type = /add group/ nocase
security_result.action = "ALLOW"
$Date = timestamp.get_timestamp(metadata.event_timestamp.seconds, "%F %T ")
$Log_Source = metadata.log_type
$Source_IP = strings.coalesce(principal.asset.ip, principal.ip)
$Hostname = strings.coalesce(principal.asset.hostname, principal.hostname)
$Product_Event = metadata.product_event_type
$Group_Name = target.group.group_display_name
//If the user requires any inclusions for specific assets, these lines will need to be enabled in the query and update the NIST_Compliance_Assets reference list as needed.
//strings.coalesce($Hostname, $Source_IP) in %NIST_Compliance_Assets
match:
$Date, $Log_Source, $Source_IP, $Hostname, $Product_Event, $Group_Name
order:
$Date desc
刪除角色的前 10 大發起者
metadata.product_event_type = /DeleteRole|delete role definition/ nocase
security_result.action = "ALLOW"
$Log_Source = metadata.log_type
$Initiator = principal.user.userid
//If the user requires any inclusions for specific assets, these lines will need to be enabled in the query and update the NIST_Compliance_Assets reference list as needed.
//$Source_IP = strings.coalesce(principal.asset.ip, principal.ip)
//$Hostname = strings.coalesce(principal.asset.hostname, principal.hostname)
//strings.coalesce($Hostname, $Source_IP) in %NIST_Compliance_Assets
match:
$Initiator, $Log_Source
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
近期刪除的使用者帳戶
metadata.event_type = "USER_DELETION"
security_result.action = "ALLOW"
$Date = timestamp.get_timestamp(metadata.event_timestamp.seconds, "%F %T ")
$Log_Source = metadata.log_type
$Source_IP = strings.coalesce(principal.asset.ip, principal.ip)
$Hostname = strings.coalesce(principal.asset.hostname, principal.hostname)
$Initiator = principal.user.userid
$User_Deleted = target.user.userid
//If the user requires any inclusions for specific assets, these lines will need to be enabled in the query and update the NIST_Compliance_Assets reference list as needed.
//strings.coalesce($Hostname, $Source_IP) in %NIST_Compliance_Assets
match:
$Date, $Log_Source, $Source_IP, $Hostname, $Initiator, $User_Deleted
order:
$Date desc
前 10 大群組刪除發起者
metadata.event_type = "GROUP_DELETION"
or metadata.product_event_type = /delete group/ nocase
security_result.action = "ALLOW"
$Log_Source = metadata.log_type
$Initiator = principal.user.userid
//If the user requires any inclusions for specific assets, these lines will need to be enabled in the query and update the NIST_Compliance_Assets reference list as needed.
//$Source_IP = strings.coalesce(principal.asset.ip, principal.ip)
//$Hostname = strings.coalesce(principal.asset.hostname, principal.hostname)
//strings.coalesce($Hostname, $Source_IP) in %NIST_Compliance_Assets
match:
$Initiator, $Log_Source
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
多重驗證失敗率
metadata.product_name = "MULTI-FACTOR_AUTHENTICATION"
or metadata.product_event_type = /mfa(?:\S)?auth|auth(?:.*)?mfa/ nocase
$Log_Type = metadata.log_type
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
//If the user requires any inclusions for specific assets, these lines will need to be enabled in the query and update the NIST_Compliance_Assets reference list as needed.
//$Hostname = strings.coalesce(principal.asset.hostname, principal.hostname)
//$Source_IP = strings.coalesce(principal.asset.ip, principal.ip)
//strings.coalesce($Hostname, $Source_IP) in %NIST_Compliance_Assets
match:
$Date, $Log_Type
outcome:
$Count = count(metadata.id)
$Failed_Attempts = sum(if(security_result.action = "BLOCK", 1, 0))
$Failure_Rate = (($Failed_Attempts / $Count) * 100 )
order:
$Date desc
最近的權限變更
metadata.event_type = "RESOURCE_PERMISSIONS_CHANGE"
or metadata.event_type = "USER_CHANGE_PERMISSIONS"
or metadata.event_type = "USER_RESOURCE_UPDATE_PERMISSIONS"
security_result.action = "ALLOW"
$Date = timestamp.get_timestamp(metadata.event_timestamp.seconds, "%F %T ")
$Log_Source = metadata.log_type
$Source_IP = strings.coalesce(principal.asset.ip, principal.ip)
$Hostname = strings.coalesce(principal.asset.hostname, principal.hostname)
$Initiator = principal.user.userid
$Description = metadata.description
//If the user requires any inclusions for specific assets, these lines will need to be enabled in the query and update the NIST_Compliance_Assets reference list as needed.
//strings.coalesce($Hostname, $Source_IP) in %NIST_Compliance_Assets
match:
$Date, $Log_Source, $Source_IP, $Hostname, $Initiator, $Description
order:
$Date desc
最近刪除的群組
metadata.event_type = "GROUP_DELETION"
or metadata.product_event_type = /delete group/ nocase
security_result.action = "ALLOW"
$Date = timestamp.get_timestamp(metadata.event_timestamp.seconds, "%F %T ")
$Log_Source = metadata.log_type
$Source_IP = strings.coalesce(principal.asset.ip, principal.ip)
$Hostname = strings.coalesce(principal.asset.hostname, principal.hostname)
$Product_Event = metadata.product_event_type
$Group_Name = target.group.group_display_name
//If the user requires any inclusions for specific assets, these lines will need to be enabled in the query and update the NIST_Compliance_Assets reference list as needed.
//strings.coalesce($Hostname, $Source_IP) in %NIST_Compliance_Assets
match:
$Date, $Log_Source, $Source_IP, $Hostname, $Product_Event, $Group_Name
order:
$Date desc
前 10 大角色修改者
metadata.product_event_type = /UpdateRole|update role(?: definition)?/ nocase
security_result.action = "ALLOW"
$Log_Source = metadata.log_type
$Initiator = principal.user.userid
//If the user requires any inclusions for specific assets, these lines will need to be enabled in the query and update the NIST_Compliance_Assets reference list as needed.
//$Source_IP = strings.coalesce(principal.asset.ip, principal.ip)
//$Hostname = strings.coalesce(principal.asset.hostname, principal.hostname)
//strings.coalesce($Hostname, $Source_IP) in %NIST_Compliance_Assets
match:
$Initiator, $Log_Source
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
近期建立的使用者帳戶
metadata.event_type = "USER_CREATION"
security_result.action = "ALLOW"
$Date = timestamp.get_timestamp(metadata.event_timestamp.seconds, "%F %T ")
$Log_Source = metadata.log_type
$Source_IP = strings.coalesce(principal.asset.ip, principal.ip)
$Hostname = strings.coalesce(principal.asset.hostname, principal.hostname)
$Initiator = principal.user.userid
$User_Created = target.user.userid
//If the user requires any inclusions for specific assets, these lines will need to be enabled in the query and update the NIST_Compliance_Assets reference list as needed.
//strings.coalesce($Hostname, $Source_IP) in %NIST_Compliance_Assets
match:
$Date, $Log_Source, $Source_IP, $Hostname, $Initiator, $User_Created
order:
$Date desc
近期刪除的角色
metadata.product_event_type = /DeleteRole|delete role definition/ nocase
security_result.action = "ALLOW"
$Date = timestamp.get_timestamp(metadata.event_timestamp.seconds, "%F %T ")
$Log_Source = metadata.log_type
$Source_IP = strings.coalesce(principal.asset.ip, principal.ip)
$Hostname = strings.coalesce(principal.asset.hostname, principal.hostname)
$Initiator = principal.user.userid
$Role_Deleted = strings.coalesce(target.user.attribute.roles.name, target.resource.product_object_id, target.resource.name)
//If the user requires any inclusions for specific assets, these lines will need to be enabled in the query and update the NIST_Compliance_Assets reference list as needed.
//strings.coalesce($Hostname, $source_IP) in %NIST_Compliance_Assets
match:
$Date, $Log_Source, $Source_IP, $Hostname, $Initiator, $Role_Deleted
order:
$Date desc
前 10 名建立角色的發起者
metadata.product_event_type = /CreateRole|add role definition/ nocase
security_result.action = "ALLOW"
$Log_Source = metadata.log_type
$Initiator = principal.user.userid
//If the user requires any inclusions for specific assets, these lines will need to be enabled in the query and update the NIST_Compliance_Assets reference list as needed.
//$Source_IP = strings.coalesce(principal.asset.ip, principal.ip)
//$Hostname = strings.coalesce(principal.asset.hostname, principal.hostname)
//strings.coalesce($Hostname, $Source_IP) in %NIST_Compliance_Assets
match:
$Initiator, $Log_Source
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
最近的使用者帳戶修改
metadata.event_type = "USER_CHANGE_PERMISSIONS"
or metadata.event_type = "USER_CHANGE_PASSWORD"
or metadata.event_type = "USER_RESOURCE_UPDATE_PERMISSIONS"
security_result.action = "ALLOW"
$Date = timestamp.get_timestamp(metadata.event_timestamp.seconds, "%F %T ")
$Log_Source = metadata.log_type
$Source_IP = strings.coalesce(principal.asset.ip, principal.ip)
$Hostname = strings.coalesce(principal.asset.hostname, principal.hostname)
$Initiator = principal.user.userid
$User_Modified = target.user.userid
$Event_Type = metadata.event_type
//If the user requires any inclusions for specific assets, these lines will need to be enabled in the query and update the NIST_Compliance_Assets reference list as needed.
//strings.coalesce($Hostname, $Source_IP) in %NIST_Compliance_Assets
match:
$Date, $Log_Source, $Source_IP, $Hostname, $Initiator, $Event_Type, $User_Modified
order:
$Date desc
密碼變更記錄
metadata.event_type = "USER_CHANGE_PASSWORD"
security_result.action = "ALLOW"
$Log_Type = metadata.log_type
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
//If the user requires any inclusions for specific assets, these lines will need to be enabled in the query and update the NIST_Compliance_Assets reference list as needed.
//$Hostname = strings.coalesce(principal.asset.hostname, principal.hostname)
//$Source_IP = strings.coalesce(principal.asset.ip, principal.ip)
//strings.coalesce($Hostname, $Source_IP) in %NIST_Compliance_Assets
match:
$Date, $Log_Type
outcome:
$Count = count(metadata.id)
order:
$Date desc
修改群組的前 10 名發起者
metadata.event_type = "GROUP_MODIFICATION"
and metadata.product_event_type = /(RemoveUserFrom|AddUserTo|Add member to |Remove member from )|(?:group)/ nocase
security_result.action = "ALLOW"
$Log_Source = metadata.log_type
$Initiator = principal.user.userid
//If the user requires any inclusions for specific assets, these lines will need to be enabled in the query and update the NIST_Compliance_Assets reference list as needed.
//$Source_IP = strings.coalesce(principal.asset.ip, principal.ip)
//$Hostname = strings.coalesce(principal.asset.hostname, principal.hostname)
//strings.coalesce($Hostname, $Source_IP) in %NIST_Compliance_Assets
match:
$Initiator, $Log_Source
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
近期建立的角色
metadata.product_event_type = /CreateRole|add role definition/ nocase
security_result.action = "ALLOW"
$Date = timestamp.get_timestamp(metadata.event_timestamp.seconds, "%F %T ")
$Log_Source = metadata.log_type
$Source_IP = strings.coalesce(principal.asset.ip, principal.ip)
$Hostname = strings.coalesce(principal.asset.hostname, principal.hostname)
$Initiator = principal.user.userid
$Role_Created = strings.coalesce(target.user.attribute.roles.name, target.resource.product_object_id, target.resource.name)
//If the user requires any inclusions for specific assets, these lines will need to be enabled in the query and update the NIST_Compliance_Assets reference list as needed.
//strings.coalesce($Hostname, $Source_IP) in %NIST_Compliance_Assets
match:
$Date, $Log_Source, $Source_IP, $Hostname, $Initiator, $Role_Created
order:
$Date desc
多重驗證註冊狀態
metadata.product_name = "MULTI-FACTOR_AUTHENTICATION"
or strings.coalesce(additional.fields["AuthenticationRequirement"], security_result.detection_fields.value) = /mfa|multi(?:\s|\S)?factor(?:\s|\S)?authentication|/ nocase
metadata.product_event_type = "enrollment"
or target.resource_ancestors.resource_subtype = "AuthenticatorEnrollment"
$Result = security_result.summary
//If the user requires any inclusions for specific assets, these lines will need to be enabled in the query and update the NIST_Compliance_Assets reference list as needed.
//$Hostname = strings.coalesce(principal.asset.hostname, principal.hostname)
//$Source_IP = strings.coalesce(principal.asset.ip, principal.ip)
//strings.coalesce($Hostname, $Source_IP) in %NIST_Compliance_Assets
match:
$Result
outcome:
$Count = count(metadata.id)
order:
$Count desc
修改使用者帳戶的前 10 大發起者
metadata.event_type = "USER_CHANGE_PERMISSIONS"
or metadata.event_type = "USER_CHANGE_PASSWORD"
or metadata.event_type = "USER_RESOURCE_UPDATE_PERMISSIONS"
security_result.action = "ALLOW"
$Log_Source = metadata.log_type
$Initiator = principal.user.userid
//If the user requires any inclusions for specific assets, these lines will need to be enabled in the query and update the NIST_Compliance_Assets reference list as needed.
//$Source_IP = strings.coalesce(principal.asset.ip, principal.ip)
//$Hostname = strings.coalesce(principal.asset.hostname, principal.hostname)
//strings.coalesce($Hostname, $Source_IP) in %NIST_Compliance_Assets
match:
$Initiator, $Log_Source
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
角色事件變化趨勢
metadata.product_event_type = /CreateRole|add role definition/ nocase
or metadata.product_event_type = /DeleteRole|delete role definition/ nocase
or metadata.product_event_type = /UpdateRole|update role(?: definition)?/ nocase
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
$Product_Event = metadata.product_event_type
//If the user requires any inclusions for specific assets, these lines will need to be enabled in the query and update the NIST_Compliance_Assets reference list as needed.
//$Hostname = strings.coalesce(principal.asset.hostname, principal.hostname)
//$Source_IP = strings.coalesce(principal.asset.ip, principal.ip)
//strings.coalesce($Hostname, $Source_IP) in %NIST_Compliance_Assets
match:
$Date, $Product_Event
outcome:
$Count = count(metadata.id)
order:
$Date desc
近期群組修改
metadata.event_type = "GROUP_MODIFICATION"
and metadata.product_event_type = /(RemoveUserFrom|AddUserTo|Add member to |Remove member from )|(?:group)/ nocase
security_result.action = "ALLOW"
$Date = timestamp.get_timestamp(metadata.event_timestamp.seconds, "%F %T ")
$Log_Source = metadata.log_type
$Source_IP = strings.coalesce(principal.asset.ip, principal.ip)
$Hostname = strings.coalesce(principal.asset.hostname, principal.hostname)
$Product_Event = metadata.product_event_type
$Group_Name = target.group.group_display_name
//If the user requires any inclusions for specific assets, these lines will need to be enabled in the query and update the NIST_Compliance_Assets reference list as needed.
//strings.coalesce($Hostname, $Source_IP) in %NIST_Compliance_Assets
match:
$Date, $Log_Source, $Source_IP, $Hostname, $Product_Event, $Group_Name
order:
$Date desc
歷來群組事件
metadata.event_type = "GROUP_CREATION"
or metadata.event_type = "GROUP_DELETION"
or metadata.product_event_type = /add group/ nocase
or metadata.product_event_type = /delete group/ nocase
or (metadata.event_type = "GROUP_MODIFICATION"
and metadata.product_event_type = /(RemoveUserFrom|AddUserTo|Add member to |Remove member from )|(?:group)/ nocase)
$Event_Type = metadata.event_type
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
//If the user requires any inclusions for specific assets, these lines will need to be enabled in the query and update the NIST_Compliance_Assets reference list as needed.
//$Hostname = strings.coalesce(principal.asset.hostname, principal.hostname)
//$Source_IP = strings.coalesce(principal.asset.ip, principal.ip)
//strings.coalesce($Hostname, $Source_IP) in %NIST_Compliance_Assets
match:
$Date, $Event_Type
outcome:
$Count = count(metadata.id)
order:
$Date desc
這個資訊主頁會顯示媒體保護活動的完整總覽，並符合 NIST 800-53 標準。這項功能會依據動作和頻率追蹤安全性事件，並醒目顯示重要趨勢，例如經常觸發的規則、頂尖主機、IP 位址和使用者。這個工具可協助您強制執行法規遵循，保護機密媒體資產。
流量最多的 10 位使用者
流量最多的 10 個來源主機名稱 (依動作劃分)
前 10 大供應商警報位置
最近的供應商快訊
前 10 大廠商警報 (依動作區分)
依動作列出的前 10 大來源 IP
按動作劃分的歷來事件
圖表名稱
查詢示例
流量最多的 10 位使用者
strings.coalesce(metadata.product_event_type, security_result.rule_name, security_result.summary) = /\busb|removable|drive\b/ nocase
$Action = security_result.action
$User = principal.user.userid
$User != ""
//If the user requires any inclusions for specific assets, these lines will need to be enabled in the query and update the NIST_Compliance_Assets reference list as needed.
//$Hostname = strings.coalesce(principal.asset.hostname, principal.hostname)
//$Source_IP = strings.coalesce(principal.asset.ip, principal.ip)
//strings.coalesce($Hostname, $Source_IP) in %NIST_Compliance_Assets
match:
$User, $Action
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
流量最多的 10 個來源主機名稱 (依動作劃分)
strings.coalesce(metadata.product_event_type, security_result.rule_name, security_result.summary) = /\busb|removable|drive\b/ nocase
$Action = security_result.action
$Hostname = principal.hostname
$Hostname != ""
//If the user requires any inclusions for specific assets, these lines will need to be enabled in the query and update the NIST_Compliance_Assets reference list as needed.
//$Hostname = strings.coalesce(principal.asset.hostname, principal.hostname)
//$Source_IP = strings.coalesce(principal.asset.ip, principal.ip)
//strings.coalesce($Hostname, $Source_IP) in %NIST_Compliance_Assets
match:
$Hostname, $Action
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
前 10 大供應商警報位置
strings.coalesce(metadata.product_event_type, security_result.rule_name, security_result.summary) = /\busb|removable|drive\b/ nocase
$Alert = strings.coalesce(metadata.product_event_type, security_result.rule_name, security_result.summary)
$Country = target.location.country_or_region
$Latitude = target.location.region_coordinates.latitude
$Longitude = target.location.region_coordinates.longitude
//If the user requires any inclusions for specific assets, these lines will need to be enabled in the query and update the NIST_Compliance_Assets reference list as needed.
//$Hostname = strings.coalesce(principal.asset.hostname, principal.hostname)
//$Source_IP = strings.coalesce(principal.asset.ip, principal.ip)
//strings.coalesce($Hostname, $Source_IP) in %NIST_Compliance_Assets
match:
$Alert, $Country, $Latitude, $Longitude
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
最近的供應商快訊
strings.coalesce(metadata.product_event_type, security_result.rule_name, security_result.summary) = /\busb|drive\b/ nocase
$Vendor_Alert = strings.coalesce(metadata.product_event_type, security_result.rule_name, security_result.summary)
$User = strings.coalesce(principal.user.user_display_name, target.user.user_display_name)
$Source_IP = strings.coalesce(principal.asset.ip, principal.ip)
$File_Name = target.file.full_path
$Action = security_result.action
$Date = timestamp.get_timestamp(metadata.event_timestamp.seconds, "%F %T ")
//If the user requires any inclusions for specific assets, these lines will need to be enabled in the query and update the NIST_Compliance_Assets reference list as needed.
//$Hostname = strings.coalesce(principal.asset.hostname, principal.hostname)
//strings.coalesce($Hostname, $Source_IP) in %NIST_Compliance_Assets
match:
$Date, $Vendor_Alert, $Source_IP, $User, $File_Name, $Action
order:
$Date desc
前 10 大廠商警報 (依動作區分)
strings.coalesce(metadata.product_event_type, security_result.rule_name, security_result.summary) = /\busb|removable|drive\b/ nocase
$Action = security_result.action
$Alerts = strings.coalesce(metadata.product_event_type, security_result.rule_name, security_result.summary)
//If the user requires any inclusions for specific assets, these lines will need to be enabled in the query and update the NIST_Compliance_Assets reference list as needed.
//$Hostname = strings.coalesce(principal.asset.hostname, principal.hostname)
//$Source_IP = strings.coalesce(principal.asset.ip, principal.ip)
//strings.coalesce($Hostname, $Source_IP) in %NIST_Compliance_Assets
match:
$Alerts, $Action
outcome:
$Count = count_distinct(metadata.id)
order:
$Count desc
limit:
10
依動作列出的前 10 大來源 IP
strings.coalesce(metadata.product_event_type, security_result.rule_name, security_result.summary) = /\busb|removable|drive\b/ nocase
$Action = security_result.action
$IP_Address = principal.ip
$IP_Address != ""
//If the user requires any inclusions for specific assets, these lines will need to be enabled in the query and update the NIST_Compliance_Assets reference list as needed.
//$Hostname = strings.coalesce(principal.asset.hostname, principal.hostname)
//$Source_IP = strings.coalesce(principal.asset.ip, principal.ip)
//strings.coalesce($Hostname, $Source_IP) in %NIST_Compliance_Assets
match:
$IP_Address, $Action
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
按動作劃分的歷來事件
strings.coalesce(metadata.product_event_type, security_result.rule_name, security_result.summary) = /\busb|removable|drive\b/ nocase
$Action = security_result.action
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
//If the user requires any inclusions for specific assets, these lines will need to be enabled in the query and update the NIST_Compliance_Assets reference list as needed.
//$Hostname = strings.coalesce(principal.asset.hostname, principal.hostname)
//$Source_IP = strings.coalesce(principal.asset.ip, principal.ip)
//strings.coalesce($Hostname, $Source_IP) in %NIST_Compliance_Assets
match:
$Date, $Action
outcome:
$Count = count(metadata.id)
order:
$Date desc
NIST 800-53 - 系統與通訊保護
這個資訊主頁會提供系統和網路防禦的深入分析資訊，有助於提升安全性和法規遵循。這項服務會監控 EDR 感應器活動、IDS/IPS 事件、DDO 和網路流量異常情形，偵測潛在威脅，確保符合 NIST 安全標準。這份清單會使用參照清單 nist_compliance_assets，將資料範圍限定在 NIST 環境。
注意： 必須先建立必要的參照清單，這個資訊主頁中的圖表才會載入。
依類別區分的 IDS / IPS 事件
分散式阻斷服務活動
依動作劃分的網路流量變化趨勢
依地理位置封鎖的傳入流量
USB 事件
網路惡意活動
EDR 供應商警報
依記錄類型劃分的加密通訊強度
依嚴重程度排序的前 10 大 IDS / IPS 供應商快訊
依記錄類型列出的 EDR 事件前 10 大主機
按地理位置劃分的傳出封鎖流量
依方向顯示的網路流量變化趨勢
圖表名稱
查詢示例
依類別區分的 IDS / IPS 事件
metadata.event_type = "SCAN_UNCATEGORIZED"
or metadata.event_type = "SCAN_NETWORK"
or metadata.event_type = "NETWORK_UNCATEGORIZED"
or metadata.event_type = "NETWORK_FLOW"
or metadata.event_type = "NETWORK_CONNECTION"
or metadata.event_type = "NETWORK_FTP"
or metadata.event_type = "NETWORK_DHCP"
or metadata.event_type = "NETWORK_DNS"
or metadata.event_type = "NETWORK_HTTP"
or metadata.event_type = "NETWORK_SMTP"
$Category = security_result.category
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
//If the user requires any inclusions for specific assets, these lines will need to be enabled in the query and update the NIST_Compliance_Assets reference list as needed.
//$Hostname = strings.coalesce(principal.asset.hostname, principal.hostname, target.asset.hostname, target.hostname)
//$Source_IP = strings.coalesce(principal.asset.ip, principal.ip)
//$Destination_IP = strings.coalesce(target.asset.ip, target.ip)
//strings.coalesce($Hostname, $Destination_IP, $Source_IP) in %NIST_Compliance_Assets
match:
$Category
outcome:
$Count = count(metadata.id)
分散式阻斷服務活動
(metadata.log_type = /ddos/ nocase or (security_result.description = /ddos/ nocase or security_result.summary = /ddos/ nocase or metadata.description = /ddos/ nocase or security_result.rule_name = /ddos/ nocase or metadata.product_event_type = /ddos/ nocase))
$Summary = strings.coalesce(security_result.description, security_result.summary, metadata.description, security_result.rule_name, metadata.product_event_type)
$Action = security_result.action
$Log_Type = metadata.log_type
$Hostname = strings.coalesce(principal.hostname, principal.asset.hostname, target.asset.hostname, target.hostname)
$Source_IP = strings.coalesce(principal.asset.ip, principal.ip)
$Destination_IP = strings.coalesce(target.asset.ip, target.ip)
//If the user requires any inclusions for specific assets, these lines will need to be enabled in the query and update the NIST_Compliance_Assets reference list as needed.
//strings.coalesce($Hostname, $Source_IP, $Destination_IP) in %NIST_Compliance_Assets
match:
$Summary, $Hostname, $Source_IP, $Destination_IP, $Action, $Log_Type
outcome:
$Count = count(metadata.id)
$Date = timestamp.get_timestamp(max(metadata.event_timestamp.seconds), "%F %T")
order:
$Count desc
依動作劃分的網路流量變化趨勢
metadata.event_type = "NETWORK_UNCATEGORIZED"
or metadata.event_type = "NETWORK_FLOW"
or metadata.event_type = "NETWORK_CONNECTION"
or metadata.event_type = "NETWORK_FTP"
or metadata.event_type = "NETWORK_DHCP"
or metadata.event_type = "NETWORK_DNS"
or metadata.event_type = "NETWORK_HTTP"
or metadata.event_type = "NETWORK_SMTP"
$Action = security_result.action
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
//If the user requires any inclusions for specific assets, these lines will need to be enabled in the query and update the NIST_Compliance_Assets reference list as needed.
//$Hostname = strings.coalesce(principal.asset.hostname, principal.hostname,target.hostname, target.asset.hostname)
//$Source_IP = strings.coalesce(principal.asset.ip, principal.ip)
//$Destination_IP = strings.coalesce(target.asset.ip, target.ip)
//strings.coalesce($Hostname, $Source_IP) in %NIST_Compliance_Assets
match:
$Date, $Action
outcome:
$Count = count(metadata.id)
依地理位置封鎖的傳入流量
metadata.event_type = "NETWORK_UNCATEGORIZED"
or metadata.event_type = "NETWORK_FLOW"
or metadata.event_type = "NETWORK_CONNECTION"
or metadata.event_type = "NETWORK_FTP"
or metadata.event_type = "NETWORK_DHCP"
or metadata.event_type = "NETWORK_DNS"
or metadata.event_type = "NETWORK_HTTP"
or metadata.event_type = "NETWORK_SMTP"
security_result.action = "BLOCK"
network.direction = "INBOUND"
$Country = principal.location.country_or_region
$Country != ""
//If the user requires any inclusions for specific assets, these lines will need to be enabled in the query and update the NIST_Compliance_Assets reference list as needed.
//$Hostname = strings.coalesce(principal.asset.hostname, principal.hostname, target.asset.hostname, target.hostname)
//$Source_IP = strings.coalesce(principal.asset.ip, principal.ip)
//$Destination_IP = strings.coalesce(target.asset.ip, target.ip)
//strings.coalesce($Hostname, $Source_IP, $Destination_IP) in %NIST_Compliance_Assets
match:
$Country
outcome:
$Count = count(metadata.id)
$Latitude = max(principal.location.region_coordinates.latitude)
$Longitude = max(principal.location.region_coordinates.longitude)
order:
$Count desc
USB 事件
(metadata.product_event_type = /usb/ nocase or security_result.summary = /usb/ nocase )
$Log_Type = metadata.log_type
$USB_Event = strings.coalesce(metadata.product_event_type, security_result.summary)
$Category = security_result.category_details
$Source_IP = strings.coalesce(principal.ip, principal.asset.ip)
$Hostname = strings.coalesce(principal.asset.hostname, principal.hostname)
$User = strings.coalesce(principal.user.userid, principal.user.user_display_name, principal.user.email_addresses, target.user.userid, target.user.user_display_name, target.user.email_addresses)
//If the user requires any inclusions for specific assets, these lines will need to be enabled in the query and update the NIST_Compliance_Assets reference list as needed.
//strings.coalesce($Hostname, $Source_IP) in %NIST_Compliance_Assets
match:
$Log_Type, $USB_Event, $User, $Hostname, $Source_IP, $Category
outcome:
$Count = count(metadata.id)
$Date = timestamp.get_timestamp(max(metadata.event_timestamp.seconds), "%F %T")
order:
$Count desc
網路惡意活動
metadata.event_type = "NETWORK_UNCATEGORIZED"
or metadata.event_type = "NETWORK_FLOW"
or metadata.event_type = "NETWORK_CONNECTION"
or metadata.event_type = "NETWORK_FTP"
or metadata.event_type = "NETWORK_DHCP"
or metadata.event_type = "NETWORK_DNS"
or metadata.event_type = "NETWORK_HTTP"
or metadata.event_type = "NETWORK_SMTP"
(security_result.category = "NETWORK_DENIAL_OF_SERVICE" or security_result.category = "NETWORK_MALICIOUS" or security_result.category = "NETWORK_SUSPICIOUS" or security_result.category = "SOFTWARE_MALICIOUS" or security_result.category = "SOFTWARE_SUSPICIOUS" or security_result.category = "NETWORK_RECON")
$Log_Type = metadata.log_type
$Category = security_result.category
$Summary = strings.coalesce(security_result.description, security_result.summary, metadata.description, security_result.rule_name, metadata.product_event_type)
$Hostname = strings.coalesce(principal.asset.hostname, principal.hostname, target.hostname, target.asset.hostname)
//If the user requires any inclusions for specific assets, these lines will need to be enabled in the query and update the NIST_Compliance_Assets reference list as needed.
//$Source_IP = strings.coalesce(principal.asset.ip, principal.ip)
//$Destination_IP = strings.coalesce(principal.asset.ip, principal.ip)
//strings.coalesce($Hostname, $Source_IP, $Destination_IP) in %NIST_Compliance_Assets
match:
$Summary, $Category, $Hostname, $Log_Type
outcome:
$Count = count(metadata.id)
$Date = timestamp.get_timestamp(max(metadata.event_timestamp.seconds), "%F %T")
order:
$Count desc
EDR 供應商警報
$Log_Type = metadata.log_type
$Rule_Name = security_result.rule_name
$Severity = security_result.severity
$User = strings.coalesce(principal.user.user_display_name, principal.user.email_addresses, principal.user.userid, target.user.userid, target.user.user_display_name, target.user.email_addresses)
//If the user requires any inclusions for specific assets, these lines will need to be enabled in the query and update the NIST_Compliance_Assets reference list as needed.
//$Hostname = strings.coalesce(principal.asset.hostname, principal.hostname)
//$Source_IP = strings.coalesce(principal.asset.ip, principal.ip)
//strings.coalesce($Hostname, $Source_IP) in %NIST_Compliance_Assets
match:
$Rule_Name, $Severity, $User, $Log_Type
outcome:
$Count = count(metadata.id)
$Date = timestamp.get_timestamp(max(metadata.event_timestamp.seconds), "%F %T")
order:
$Count desc
依記錄類型劃分的加密通訊強度
network.tls.cipher = /RSA|DES|RC4|SHA-1|3DES|MD5/ nocase
$Log_Type = metadata.log_type
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
//If the user requires any inclusions for specific assets, these lines will need to be enabled in the query and update the NIST_Compliance_Assets reference list as needed.
//$Hostname = strings.coalesce(principal.asset.hostname, principal.hostname, target.asset.hostname, target.hostname)
//$Source_IP = strings.coalesce(principal.asset.ip, principal.ip)
//$Destination_IP = strings.coalesce(target.asset.ip, target.ip)
//strings.coalesce($Hostname, $Source_IP, Destination_IP) in %NIST_Compliance_Assets
match:
$Date, $Log_Type
outcome:
$Count = count(metadata.id)
依嚴重程度排序的前 10 大 IDS / IPS 供應商快訊
metadata.event_type = "SCAN_UNCATEGORIZED"
or metadata.event_type = "SCAN_NETWORK"
or metadata.event_type = "NETWORK_UNCATEGORIZED"
or metadata.event_type = "NETWORK_FLOW"
or metadata.event_type = "NETWORK_CONNECTION"
or metadata.event_type = "NETWORK_FTP"
or metadata.event_type = "NETWORK_DHCP"
or metadata.event_type = "NETWORK_DNS"
or metadata.event_type = "NETWORK_HTTP"
or metadata.event_type = "NETWORK_SMTP"
(security_result.severity = "HIGH" or security_result.severity = "CRITICAL")
$Rule_Name = security_result.rule_name
$Rule_Name != ""
$Severity = security_result.severity
//If the user requires any inclusions for specific assets, these lines will need to be enabled in the query and update the NIST_Compliance_Assets reference list as needed.
//$Hostname = strings.coalesce(principal.asset.hostname, principal.hostname, target.asset.hostname, target.hostname)
//$Source_IP = strings.coalesce(principal.asset.ip, principal.ip)
//$Destination_IP = strings.coalesce(target.asset.ip, target.ip)
//strings.coalesce($Hostname, $Destination_IP, $Source_IP) in %NIST_Compliance_Assets
match:
$Rule_Name, $Severity
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
依記錄類型列出的 EDR 事件前 10 大主機
$Hostname = strings.coalesce(principal.hostname, principal.asset.hostname)
$Hostname != ""
$Log_Type = metadata.log_type
//If the user requires any inclusions for specific assets, these lines will need to be enabled in the query and update the NIST_Compliance_Assets reference list as needed.
//$Source_IP = strings.coalesce(principal.asset.ip, principal.ip)
//strings.coalesce($Hostname, $Source_IP) in %NIST_Compliance_Assets
match:
$Hostname, $Log_Type
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
按地理位置劃分的傳出封鎖流量
metadata.event_type = "NETWORK_UNCATEGORIZED"
or metadata.event_type = "NETWORK_FLOW"
or metadata.event_type = "NETWORK_CONNECTION"
or metadata.event_type = "NETWORK_FTP"
or metadata.event_type = "NETWORK_DHCP"
or metadata.event_type = "NETWORK_DNS"
or metadata.event_type = "NETWORK_HTTP"
or metadata.event_type = "NETWORK_SMTP"
security_result.action = "BLOCK"
network.direction = "OUTBOUND"
$Country = principal.location.country_or_region
$Country != ""
//If the user requires any inclusions for specific assets, these lines will need to be enabled in the query and update the NIST_Compliance_Assets reference list as needed.
//$Hostname = strings.coalesce(principal.asset.hostname, principal.hostname, target.asset.hostname, target.hostname)
//$Source_IP = strings.coalesce(principal.asset.ip, principal.ip)
//$Destination_IP = strings.coalesce(target.asset.ip, target.ip)
//strings.coalesce($Hostname, $Source_IP, $Destination_IP) in %NIST_Compliance_Assets
match:
$Country
outcome:
$Count = count(metadata.id)
$Latitude = max(principal.location.region_coordinates.latitude)
$Longitude = max(principal.location.region_coordinates.longitude)
order:
$Count desc
依方向顯示的網路流量變化趨勢
metadata.event_type = "NETWORK_UNCATEGORIZED"
or metadata.event_type = "NETWORK_FLOW"
or metadata.event_type = "NETWORK_CONNECTION"
or metadata.event_type = "NETWORK_FTP"
or metadata.event_type = "NETWORK_DHCP"
or metadata.event_type = "NETWORK_DNS"
or metadata.event_type = "NETWORK_HTTP"
or metadata.event_type = "NETWORK_SMTP"
//If the user requires any inclusions for specific assets, these lines will need to be enabled in the query and update the NIST_Compliance_Assets reference list as needed.
//$Hostname = strings.coalesce(principal.asset.hostname, principal.hostname, target.asset.hostname, target.hostname)
//$Source_IP = strings.coalesce(principal.asset.ip, principal.ip)
//$Destination_IP = strings.coalesce(target.asset.ip, target.ip)
//strings.coalesce($Hostname, $Source_IP, $Destination_IP) in %NIST_Compliance_Assets
$Direction = network.direction
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
match:
$Direction, $Date
outcome:
$Total_Volume = sum(network.sent_bytes) + sum(network.received_bytes)
$Total_Volume_GB = math.round($Total_Volume/ (1000 * 1000 * 1000), 2)
網路流量總覽
這個儀表板可依 IP 位址、通訊協定、供應商、快訊和區域，即時監控雲端和地端部署網路流量，有效分析流量和潛在問題。
網路事件
供應商快訊中排名前 10 的來源 IP
前 10 名遭封鎖的使用者
傳送位元組數最多的前 10 項事件
依動作顯示的廠商快訊趨勢
依記錄類型顯示的歷來事件
流量最高的 10 個傳出 IP
一段時間內依記錄類型劃分的供應商快訊
前 10 大來源 IP 位址
前 10 大供應商快訊
不重複的目的地 IP
一段時間內使用較舊的傳輸層安全標準 (TLS) 版本
流量前 10 名的使用者
依傳送的位元組數排序前 10 名的應用程式
一段時間內的傳入與傳出流量
平均位元組數
IP 隨時間變化的流量
前 10 大流量來源位置
依嚴重程度分類的事件
傳入流量位置熱視圖
流量最多的前 10 項服務
流量領先的 10 個通訊埠 - 傳出
不同的來源 IP
各記錄類型的流量變化趨勢
傳送的位元組總數
位元組標準差
傳出流量位置熱視圖
前 10 大遭封鎖的來源 IP 至目的地 IP
依流量排序的前 10 個通訊埠 - 傳入
前 10 大封鎖國家/地區
前 10 大目的地 IP 位址
網路通訊協定隨時間的分布情形
10 大可疑目標檔案
供應商快訊中排名前 10 的使用者
前 10 個網址
允許的網路流量與封鎖的網路流量
流量大小前 10 名的主機
依通訊協定劃分的目標通訊埠
允許次數最多的 10 個連線
各動作的傳入流量變化趨勢
平均位元組數
前 10 大封鎖國家/地區
按動作劃分的傳出流量變化趨勢
前 10 大事件類別
流量最多的前 10 個連入 IP
前 10 大網路連線
前 10 大遭封鎖的來源 IP 位址
圖表名稱
查詢示例
網路事件
$event.metadata.event_type = "NETWORK_FLOW"
or $event.metadata.event_type = "NETWORK_CONNECTION"
or $event.metadata.event_type = "NETWORK_FTP"
or $event.metadata.event_type = "NETWORK_DHCP"
or $event.metadata.event_type = "NETWORK_DNS"
or $event.metadata.event_type = "NETWORK_HTTP"
or $event.metadata.event_type = "NETWORK_SMTP"
outcome:
$Count = count($event.metadata.id)
供應商快訊中排名前 10 的來源 IP
metadata.event_type = "NETWORK_UNCATEGORIZED"
or metadata.event_type = "NETWORK_FLOW"
or metadata.event_type = "NETWORK_CONNECTION"
or metadata.event_type = "NETWORK_FTP"
or metadata.event_type = "NETWORK_DHCP"
or metadata.event_type = "NETWORK_DNS"
or metadata.event_type = "NETWORK_HTTP"
or metadata.event_type = "NETWORK_SMTP"
security_result.rule_name != ""
$Source_IP = strings.coalesce(principal.ip, principal.asset.ip)
match:
$Source_IP
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
前 10 名遭封鎖的使用者
metadata.event_type = "NETWORK_UNCATEGORIZED"
or metadata.event_type = "NETWORK_FLOW"
or metadata.event_type = "NETWORK_CONNECTION"
or metadata.event_type = "NETWORK_FTP"
or metadata.event_type = "NETWORK_DHCP"
or metadata.event_type = "NETWORK_DNS"
or metadata.event_type = "NETWORK_HTTP"
or metadata.event_type = "NETWORK_SMTP"
(security_result.action = "BLOCK" or security_result.action = "FAIL" or security_result.action_details = /fail|block/ nocase)
$User = strings.coalesce(principal.user.userid, principal.user.user_display_name, principal.user.email_addresses)
match:
$User
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
傳送位元組數最多的前 10 項事件
$Source_IP = principal.ip
$Event_Type = metadata.event_type
match:
$Event_Type, $Source_IP
outcome:
$Bytes_Sent = sum(network.sent_bytes) / (1000*1000*1000)
order:
$Bytes_Sent desc
limit:
10
依動作顯示的廠商快訊趨勢
metadata.event_type = "NETWORK_UNCATEGORIZED"
or metadata.event_type = "NETWORK_FLOW"
or metadata.event_type = "NETWORK_CONNECTION"
or metadata.event_type = "NETWORK_FTP"
or metadata.event_type = "NETWORK_DHCP"
or metadata.event_type = "NETWORK_DNS"
or metadata.event_type = "NETWORK_HTTP"
or metadata.event_type = "NETWORK_SMTP"
security_result.rule_name != ""
$Action = security_result.action
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
match:
$Date, $Action
outcome:
$Count = count(metadata.id)
order:
$Count desc
依記錄類型顯示的歷來事件
metadata.event_type = "NETWORK_UNCATEGORIZED"
or metadata.event_type = "NETWORK_FLOW"
or metadata.event_type = "NETWORK_CONNECTION"
or metadata.event_type = "NETWORK_FTP"
or metadata.event_type = "NETWORK_DHCP"
or metadata.event_type = "NETWORK_DNS"
or metadata.event_type = "NETWORK_HTTP"
or metadata.event_type = "NETWORK_SMTP"
$Log_type = metadata.log_type
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
match:
$Date, $Log_type
outcome:
$Count = count(metadata.id)
order:
$Date asc
流量最高的 10 個傳出 IP
network.direction = "OUTBOUND"
$Log_Type = metadata.log_type
$Destination_IP = target.ip
match:
$Log_Type, $Destination_IP
outcome:
$Total_Bytes = sum(network.received_bytes + network.sent_bytes) / (1000*1000*1000)
order:
$Total_Bytes desc
limit:
10
一段時間內依記錄類型劃分的供應商快訊
metadata.event_type = "NETWORK_UNCATEGORIZED"
or metadata.event_type = "NETWORK_FLOW"
or metadata.event_type = "NETWORK_CONNECTION"
or metadata.event_type = "NETWORK_FTP"
or metadata.event_type = "NETWORK_DHCP"
or metadata.event_type = "NETWORK_DNS"
or metadata.event_type = "NETWORK_HTTP"
or metadata.event_type = "NETWORK_SMTP"
security_result.rule_name != ""
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
$Log_Type = metadata.log_type
match:
$Date , $Log_Type
outcome:
$Count = count(security_result.rule_name)
order:
$Date asc
前 10 大來源 IP 位址
$event.metadata.event_type = "NETWORK_FLOW"
or $event.metadata.event_type = "NETWORK_CONNECTION"
or $event.metadata.event_type = "NETWORK_FTP"
or $event.metadata.event_type = "NETWORK_DHCP"
or $event.metadata.event_type = "NETWORK_DNS"
or $event.metadata.event_type = "NETWORK_HTTP"
or $event.metadata.event_type = "NETWORK_SMTP"
$Event_Type = $event.metadata.event_type
$Source_IP = $event.principal.ip
$Source_IP != ""
match:
$Source_IP, $Event_Type
outcome:
$Count = count($event.metadata.id)
order:
$Count desc
limit:
10
前 10 大供應商快訊
metadata.event_type = "NETWORK_UNCATEGORIZED"
or metadata.event_type = "NETWORK_FLOW"
or metadata.event_type = "NETWORK_CONNECTION"
or metadata.event_type = "NETWORK_FTP"
or metadata.event_type = "NETWORK_DHCP"
or metadata.event_type = "NETWORK_DNS"
or metadata.event_type = "NETWORK_HTTP"
or metadata.event_type = "NETWORK_SMTP"
$Rule_Name = security_result.rule_name
match:
$Rule_Name
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
不重複的目的地 IP
$event.metadata.event_type = "NETWORK_FLOW"
or $event.metadata.event_type = "NETWORK_CONNECTION"
or $event.metadata.event_type = "NETWORK_FTP"
or $event.metadata.event_type = "NETWORK_DHCP"
or $event.metadata.event_type = "NETWORK_DNS"
or $event.metadata.event_type = "NETWORK_HTTP"
or $event.metadata.event_type = "NETWORK_SMTP"
outcome:
$Count = count_distinct($event.target.ip)
一段時間內使用較舊的傳輸層安全標準 (TLS) 版本
network.tls.version != /1(\.|_)?(2|3)/ nocase
$Cipher_Version = network.tls.version
$Cipher_Version != ""
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
match:
$Cipher_Version, $Date
outcome:
$Count = count(metadata.id)
order:
$Date desc
流量前 10 名的使用者
$User = principal.user.userid
match:
$User
outcome:
$Total_Bytes = sum(network.sent_bytes + network.received_bytes) / (1000*1000*1000)
order:
$Total_Bytes desc
limit:
10
依傳送的位元組數排序前 10 名的應用程式
$Source_IP = principal.ip
$Application = target.application
match:
$Application, $Source_IP
outcome:
$Total_Bytes = sum(network.sent_bytes) / (1000*1000*1000)
order:
$Total_Bytes desc
limit:
10
一段時間內的傳入與傳出流量
metadata.event_type = "NETWORK_UNCATEGORIZED"
or metadata.event_type = "NETWORK_FLOW"
or metadata.event_type = "NETWORK_CONNECTION"
or metadata.event_type = "NETWORK_FTP"
or metadata.event_type = "NETWORK_DHCP"
or metadata.event_type = "NETWORK_DNS"
or metadata.event_type = "NETWORK_HTTP"
or metadata.event_type = "NETWORK_SMTP"
$Direction = network.direction
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
match:
$Direction, $Date
outcome:
$Total_Volume = sum(network.sent_bytes) + sum(network.received_bytes)
$Total_Volume_GB = $Total_Volume/ (1000 * 1000 * 1000)
order:
$Date desc
平均位元組數
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
match:
$Date
outcome:
$Total_Bytes = sum(network.sent_bytes + network.received_bytes) / 2
$Mean_GB_Total = math.round($Total_Bytes / 1073741824, 2)
order:
$Date desc
IP 隨時間變化的流量
$IP_Address = principal.ip
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
match:
$IP_Address, $Date
outcome:
$Total_Bytes = sum(network.sent_bytes + network.received_bytes) / (1000*1000*1000)
order:
$Date desc
前 10 大流量來源位置
$Country = principal.location.country_or_region
$Country != ""
$Latitude = principal.location.region_coordinates.latitude
$Longitude = principal.location.region_coordinates.longitude
match:
$Country, $Latitude, $Longitude
outcome:
$Total_Bytes = sum(network.received_bytes + network.sent_bytes) / (1000*1000*1000)
order:
$Total_Bytes desc
limit:
10
依嚴重程度分類的事件
metadata.event_type = "NETWORK_UNCATEGORIZED"
or metadata.event_type = "NETWORK_FLOW"
or metadata.event_type = "NETWORK_CONNECTION"
or metadata.event_type = "NETWORK_FTP"
or metadata.event_type = "NETWORK_DHCP"
or metadata.event_type = "NETWORK_DNS"
or metadata.event_type = "NETWORK_HTTP"
or metadata.event_type = "NETWORK_SMTP"
$Severity = security_result.severity
match:
$Severity
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
傳入流量位置熱視圖
metadata.event_type = "NETWORK_UNCATEGORIZED"
or metadata.event_type = "NETWORK_FLOW"
or metadata.event_type = "NETWORK_CONNECTION"
or metadata.event_type = "NETWORK_FTP"
or metadata.event_type = "NETWORK_DHCP"
or metadata.event_type = "NETWORK_DNS"
or metadata.event_type = "NETWORK_HTTP"
or metadata.event_type = "NETWORK_SMTP"
network.direction = "INBOUND"
$Country = principal.ip_geo_artifact.location.country_or_region
match:
$Country
outcome:
$Count = count(metadata.id)
$Latitude = max(principal.ip_geo_artifact.location.region_coordinates.latitude)
$Longitude = max(principal.ip_geo_artifact.location.region_coordinates.longitude)
order:
$Count desc
流量最多的前 10 項服務
target.port != 0
network.ip_protocol != "UNKNOWN_IP_PROTOCOL"
$Service = strings.concat(target.port, "")
$Protocol = network.ip_protocol
match:
$Service, $Protocol
outcome:
$Total_Bytes = sum(network.received_bytes + network.sent_bytes) / (1000*1000*1000)
order:
$Total_Bytes desc
limit:
10
流量領先的 10 個通訊埠 - 傳出
metadata.event_type = "NETWORK_UNCATEGORIZED"
or metadata.event_type = "NETWORK_FLOW"
or metadata.event_type = "NETWORK_CONNECTION"
or metadata.event_type = "NETWORK_FTP"
or metadata.event_type = "NETWORK_DHCP"
or metadata.event_type = "NETWORK_DNS"
or metadata.event_type = "NETWORK_HTTP"
or metadata.event_type = "NETWORK_SMTP"
network.direction = "OUTBOUND"
$Port = strings.concat(target.port, "")
match:
$Port
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
不同的來源 IP
$event.metadata.event_type = "NETWORK_FLOW"
or $event.metadata.event_type = "NETWORK_CONNECTION"
or $event.metadata.event_type = "NETWORK_FTP"
or $event.metadata.event_type = "NETWORK_DHCP"
or $event.metadata.event_type = "NETWORK_DNS"
or $event.metadata.event_type = "NETWORK_HTTP"
or $event.metadata.event_type = "NETWORK_SMTP"
outcome:
$Count = count_distinct($event.principal.ip)
各記錄類型的流量變化趨勢
$Log_Type = metadata.log_type
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
match:
$Date, $Log_Type
outcome:
$Total_Bytes = sum(network.sent_bytes + network.received_bytes) / (1000*1000*1000)
order:
$Date desc
傳送的位元組總數
outcome:
$Total_Bytes_Sent_GB = math.round(sum(network.sent_bytes) / (1000*1000*1000), 2)
位元組標準差
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
match:
$Date
outcome:
$Stdev_Bytes = stddev(network.sent_bytes + network.received_bytes) / (1000*1000*1000)
order:
$Date desc
傳出流量位置熱視圖
metadata.event_type = "NETWORK_UNCATEGORIZED"
or metadata.event_type = "NETWORK_FLOW"
or metadata.event_type = "NETWORK_CONNECTION"
or metadata.event_type = "NETWORK_FTP"
or metadata.event_type = "NETWORK_DHCP"
or metadata.event_type = "NETWORK_DNS"
or metadata.event_type = "NETWORK_HTTP"
or metadata.event_type = "NETWORK_SMTP"
network.direction = "OUTBOUND"
$Country = target.ip_geo_artifact.location.country_or_region
match:
$Country
outcome:
$Count = count(metadata.id)
$Latitude = max(target.ip_geo_artifact.location.region_coordinates.latitude)
$Longitude = max(target.ip_geo_artifact.location.region_coordinates.longitude)
order:
$Count desc
前 10 大遭封鎖的來源 IP 至目的地 IP
$event.metadata.event_type = "NETWORK_FLOW"
or $event.metadata.event_type = "NETWORK_CONNECTION"
or $event.metadata.event_type = "NETWORK_FTP"
or $event.metadata.event_type = "NETWORK_DHCP"
or $event.metadata.event_type = "NETWORK_DNS"
or $event.metadata.event_type = "NETWORK_HTTP"
or $event.metadata.event_type = "NETWORK_SMTP"
$Event_Type = $event.metadata.event_type
$Source_IP = $event.principal.ip
$Destination_IP = $event.target.ip
$Block = $event.security_result.action
$Block = "BLOCK"
match:
$Event_Type, $Source_IP, $Block, $Destination_IP
outcome:
$Count = count($event.metadata.id)
order:
$Count desc
limit:
10
依流量排序的前 10 個通訊埠 - 傳入
metadata.event_type = "NETWORK_UNCATEGORIZED"
or metadata.event_type = "NETWORK_FLOW"
or metadata.event_type = "NETWORK_CONNECTION"
or metadata.event_type = "NETWORK_FTP"
or metadata.event_type = "NETWORK_DHCP"
or metadata.event_type = "NETWORK_DNS"
or metadata.event_type = "NETWORK_HTTP"
or metadata.event_type = "NETWORK_SMTP"
network.direction = "INBOUND"
$Port = strings.concat(target.port, "")
match:
$Port
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
前 10 大封鎖國家/地區
metadata.event_type = "NETWORK_UNCATEGORIZED"
or metadata.event_type = "NETWORK_FLOW"
or metadata.event_type = "NETWORK_CONNECTION"
or metadata.event_type = "NETWORK_FTP"
or metadata.event_type = "NETWORK_DHCP"
or metadata.event_type = "NETWORK_DNS"
or metadata.event_type = "NETWORK_HTTP"
or metadata.event_type = "NETWORK_SMTP"
security_result.action = "BLOCK"
$Country = strings.coalesce(principal.location.country_or_region, principal.ip_geo_artifact.location.country_or_region)
match:
$Country
outcome:
$Count = count($Country)
order:
$Count desc
limit:
10
前 10 大目的地 IP 位址
$event.metadata.event_type = "NETWORK_FLOW"
or $event.metadata.event_type = "NETWORK_CONNECTION"
or $event.metadata.event_type = "NETWORK_FTP"
or $event.metadata.event_type = "NETWORK_DHCP"
or $event.metadata.event_type = "NETWORK_DNS"
or $event.metadata.event_type = "NETWORK_HTTP"
or $event.metadata.event_type = "NETWORK_SMTP"
$Event_Type = $event.metadata.event_type
$Log_Type = $event.metadata.log_type
$Destination_IP = $event.target.ip
$Destination_IP != ""
match:
$Destination_IP, $Event_Type, $Log_Type
outcome:
$Count = count($event.metadata.id)
order:
$Count desc
limit:
10
網路通訊協定隨時間的分布情形
metadata.event_type = "NETWORK_UNCATEGORIZED"
or metadata.event_type = "NETWORK_FLOW"
or metadata.event_type = "NETWORK_CONNECTION"
or metadata.event_type = "NETWORK_FTP"
or metadata.event_type = "NETWORK_DHCP"
or metadata.event_type = "NETWORK_DNS"
or metadata.event_type = "NETWORK_HTTP"
or metadata.event_type = "NETWORK_SMTP"
$Protocol = network.application_protocol
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
match:
$Date, $Protocol
outcome:
$Count = count(metadata.id)
order:
$Date asc
10 大可疑目標檔案
metadata.event_type = "NETWORK_UNCATEGORIZED"
or metadata.event_type = "NETWORK_FLOW"
or metadata.event_type = "NETWORK_CONNECTION"
or metadata.event_type = "NETWORK_FTP"
or metadata.event_type = "NETWORK_DHCP"
or metadata.event_type = "NETWORK_DNS"
or metadata.event_type = "NETWORK_HTTP"
or metadata.event_type = "NETWORK_SMTP"
$Files = target.file.full_path
$Files = /\.exe|\.scr|\.com|\.pif|\.dll|\.js|\.vbs|\.ps1|\.bat|\.cmd|\.wsf|\.hta|\.docm|\.xlsm|\.pptm|\.dotm|\.pdf|\.zip|\.rar|\.iso|\.img|\.lnk|\.url/ nocase
match:
$Files
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
供應商快訊中排名前 10 的使用者
metadata.event_type = "NETWORK_UNCATEGORIZED"
or metadata.event_type = "NETWORK_FLOW"
or metadata.event_type = "NETWORK_CONNECTION"
or metadata.event_type = "NETWORK_FTP"
or metadata.event_type = "NETWORK_DHCP"
or metadata.event_type = "NETWORK_DNS"
or metadata.event_type = "NETWORK_HTTP"
or metadata.event_type = "NETWORK_SMTP"
security_result.rule_name != ""
$Source_User = strings.coalesce(principal.user.userid, principal.user.user_display_name, principal.user.email_addresses)
match:
$Source_User
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
前 10 個網址
metadata.event_type = "NETWORK_UNCATEGORIZED"
or metadata.event_type = "NETWORK_FLOW"
or metadata.event_type = "NETWORK_CONNECTION"
or metadata.event_type = "NETWORK_FTP"
or metadata.event_type = "NETWORK_DHCP"
or metadata.event_type = "NETWORK_DNS"
or metadata.event_type = "NETWORK_HTTP"
or metadata.event_type = "NETWORK_SMTP"
$URL = target.url
match:
$URL
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
允許的網路流量與封鎖的網路流量
metadata.event_type = "NETWORK_UNCATEGORIZED"
or metadata.event_type = "NETWORK_FLOW"
or metadata.event_type = "NETWORK_CONNECTION"
or metadata.event_type = "NETWORK_FTP"
or metadata.event_type = "NETWORK_DHCP"
or metadata.event_type = "NETWORK_DNS"
or metadata.event_type = "NETWORK_HTTP"
or metadata.event_type = "NETWORK_SMTP"
$Action = security_result.action
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
match:
$Action, $Date
outcome:
$Count = count(metadata.id)
order:
$Date asc
流量大小前 10 名的主機
$Hostname = principal.hostname
match:
$Hostname
outcome:
$Total_Bytes = sum(network.sent_bytes + network.received_bytes) / (1000*1000*1000)
order:
$Total_Bytes desc
limit:
10
依通訊協定劃分的目標通訊埠
metadata.event_type = "NETWORK_UNCATEGORIZED"
or metadata.event_type = "NETWORK_FLOW"
or metadata.event_type = "NETWORK_CONNECTION"
or metadata.event_type = "NETWORK_FTP"
or metadata.event_type = "NETWORK_DHCP"
or metadata.event_type = "NETWORK_DNS"
or metadata.event_type = "NETWORK_HTTP"
or metadata.event_type = "NETWORK_SMTP"
$Port = strings.concat(target.port, "")
$Protocol = network.application_protocol
match:
$Port, $Protocol
outcome:
$Count = count(metadata.id)
order:
$Count desc
允許次數最多的 10 個連線
$event.metadata.event_type = "NETWORK_FLOW"
or $event.metadata.event_type = "NETWORK_CONNECTION"
or $event.metadata.event_type = "NETWORK_FTP"
or $event.metadata.event_type = "NETWORK_DHCP"
or $event.metadata.event_type = "NETWORK_DNS"
or $event.metadata.event_type = "NETWORK_HTTP"
or $event.metadata.event_type = "NETWORK_SMTP"
$Event_Type = $event.metadata.event_type
$Hostname = $event.principal.hostname
$Asset_Type = $event.principal.asset.type
$OS_Version = $event.target.asset.platform_software.platform_version
$Source_IP = $event.principal.ip
$Mac_Add = $event.principal.mac
$Nat_IP = $event.principal.nat_ip
$Destination_IP = $event.target.ip
$Destination_IP != ""
$Connection = $event.security_result.action
$Connection = "ALLOW"
match:
$Event_Type, $Hostname, $OS_Version, $Source_IP, $Mac_Add, $Nat_IP, $Connection, $Destination_IP
outcome:
$Count = count($event.metadata.id)
order:
$Count desc
limit:
10
各動作的傳入流量變化趨勢
metadata.event_type = "NETWORK_UNCATEGORIZED"
or metadata.event_type = "NETWORK_FLOW"
or metadata.event_type = "NETWORK_CONNECTION"
or metadata.event_type = "NETWORK_FTP"
or metadata.event_type = "NETWORK_DHCP"
or metadata.event_type = "NETWORK_DNS"
or metadata.event_type = "NETWORK_HTTP"
or metadata.event_type = "NETWORK_SMTP"
network.direction = "INBOUND"
$Action = security_result.action
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
match:
$Action, $Date
outcome:
$Count = count(metadata.id)
order:
$Date asc
平均位元組數
outcome:
$Average_Bytes = sum(network.sent_bytes + network.received_bytes) / 2
$Average_Bytes_GB = math.round($Average_Bytes / (1000*1000*1000), 2)
前 10 大封鎖國家/地區
$event.metadata.event_type = "NETWORK_FLOW"
or $event.metadata.event_type = "NETWORK_CONNECTION"
or $event.metadata.event_type = "NETWORK_FTP"
or $event.metadata.event_type = "NETWORK_DHCP"
or $event.metadata.event_type = "NETWORK_DNS"
or $event.metadata.event_type = "NETWORK_HTTP"
or $event.metadata.event_type = "NETWORK_SMTP"
$event.security_result.action = "BLOCK"
$Countries = $event.principal.location.country_or_region
$Latitude = $event.principal.location.region_coordinates.latitude
$Longitude = $event.principal.location.region_coordinates.longitude
match:
$Countries, $Latitude, $Longitude
outcome:
$Count = count_distinct($Countries)
limit:
10
按動作劃分的傳出流量變化趨勢
metadata.event_type = "NETWORK_UNCATEGORIZED"
or metadata.event_type = "NETWORK_FLOW"
or metadata.event_type = "NETWORK_CONNECTION"
or metadata.event_type = "NETWORK_FTP"
or metadata.event_type = "NETWORK_DHCP"
or metadata.event_type = "NETWORK_DNS"
or metadata.event_type = "NETWORK_HTTP"
or metadata.event_type = "NETWORK_SMTP"
network.direction = "OUTBOUND"
$Action = security_result.action
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
match:
$Action, $Date
outcome:
$Count = count(metadata.id)
order:
$Date asc
前 10 大事件類別
metadata.event_type = "NETWORK_UNCATEGORIZED"
or metadata.event_type = "NETWORK_FLOW"
or metadata.event_type = "NETWORK_CONNECTION"
or metadata.event_type = "NETWORK_FTP"
or metadata.event_type = "NETWORK_DHCP"
or metadata.event_type = "NETWORK_DNS"
or metadata.event_type = "NETWORK_HTTP"
or metadata.event_type = "NETWORK_SMTP"
$Category = security_result.category
match:
$Category
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
流量最多的前 10 個連入 IP
network.direction = "INBOUND"
$Log_Type = metadata.log_type
$Source_IP = principal.ip
match:
$Log_Type, $Source_IP
outcome:
$Total_Bytes = sum(network.received_bytes + network.sent_bytes) / (1000*1000*1000)
order:
$Total_Bytes desc
limit:
10
前 10 大網路連線
$event.metadata.event_type = "NETWORK_FLOW"
or $event.metadata.event_type = "NETWORK_CONNECTION"
or $event.metadata.event_type = "NETWORK_FTP"
or $event.metadata.event_type = "NETWORK_DHCP"
or $event.metadata.event_type = "NETWORK_DNS"
or $event.metadata.event_type = "NETWORK_HTTP"
or $event.metadata.event_type = "NETWORK_SMTP"
$Source_Port = $event.principal.port
$Destination_Port = $event.target.port
$Source_IP = $event.principal.ip
$Destination_IP = $event.target.ip
$OS = $event.target.asset.platform_software.platform_version
$Direction = $event.network.direction
$Hostname = $event.principal.hostname
$Direction != "UNKNOWN_DIRECTION"
$OS != ""
$Hostname != ""
match:
$Hostname, $OS, $Source_IP, $Source_Port, $Direction, $Destination_IP, $Destination_Port
outcome:
$Time = timestamp.get_timestamp(max($event.metadata.event_timestamp.seconds))
order:
$Time desc
limit:
10
前 10 大遭封鎖的來源 IP 位址
$event.metadata.event_type = "NETWORK_FLOW"
or $event.metadata.event_type = "NETWORK_CONNECTION"
or $event.metadata.event_type = "NETWORK_FTP"
or $event.metadata.event_type = "NETWORK_DHCP"
or $event.metadata.event_type = "NETWORK_DNS"
or $event.metadata.event_type = "NETWORK_HTTP"
or $event.metadata.event_type = "NETWORK_SMTP"
$Event_Type = $event.metadata.event_type
$Source_IP = $event.principal.ip
$Source_IP != ""
$Destination_IP = $event.target.ip
$Log_Type = $event.metadata.log_type
$Block = $event.security_result.action
$Block = "BLOCK"
match:
$Source_IP, $Block, $Destination_IP, $Log_Type
outcome:
$Count = count($event.metadata.id)
order:
$Count desc
limit:
10
OT 安全性
這個資訊主頁會深入顯示 OT 環境中的安全性，方便您追蹤及評估安全性事件。這項功能會找出趨勢、重要資產、使用者和服務，同時監控網路和地理位置活動。這有助於排定威脅優先順序、調整應變策略，以及提升 OT 系統的安全性。
前 10 大非 OT 通訊協定 (依記錄類型)
使用明文通訊協定的前 10 項資產
前 10 大 CVE
OT Sniffers Over Time
外部網路鎖定的前 10 大實體
依資產顯示一段時間內的供應商快訊
明文通訊協定分配
依使用者列出的前 10 項供應商快訊
啟動外部網路的前 10 大實體
依嚴重程度排序的前 10 大供應商快訊
應用程式通訊協定隨時間變化
新 OT 資產
供應商快訊記錄
OT 新資產總數
前 10 大來源資產
依動作分類的供應商快訊
OT 資產總數
依記錄類型劃分的供應商警告趨勢
依類別列出的前 10 大供應商快訊
圖表名稱
查詢示例
前 10 大非 OT 通訊協定 (依記錄類型)
network.application_protocol != "COAP"
network.application_protocol != "DNP3"
network.application_protocol != "MODBUS"
network.application_protocol != "MQTT"
network.application_protocol != "SNMP"
$Log_Type = metadata.log_type
$Protocol = network.application_protocol
match:
$Protocol, $Log_Type
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
使用明文通訊協定的前 10 項資產
network.application_protocol = "MODBUS"
or network.application_protocol = "DNP3"
or network.application_protocol = "CIP"
or network.application_protocol = "IEC104"
or network.application_protocol = "SNMP"
or network.application_protocol = "COTP"
or network.application_protocol = "GOOSE"
or network.application_protocol = "SV"
or network.application_protocol = "DEVICE_NET"
or network.application_protocol = "PTP"
or network.application_protocol = "HTTP"
or network.application_protocol = "RLOGIN"
or network.application_protocol = "FINGER"
or network.application_protocol = "SMTP"
$Protocol = network.application_protocol
$Asset = strings.coalesce(target.asset.hostname, target.asset.ip, target.asset.mac, target.hostname)
$Asset != ""
match:
$Asset, $Protocol
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
前 10 大 CVE
$CVE = principal.asset.vulnerabilities.cve_id
$CVE != ""
$Asset = principal.asset.hostname
match:
$CVE, $Asset
outcome:
$Count = count(principal.asset.vulnerabilities.cve_id)
order:
$Count desc
limit:
10
OT Sniffers Over Time
$Log_Type = metadata.log_type
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
match:
$Date, $Log_Type
outcome:
$Count = count(observer.hostname)
order:
$Date desc
外部網路鎖定的前 10 大實體
principal.ip != /^10\..|^172\.(1[6-9]|2\d|3[0-1])\..*|^192\.168\../
principal.ip != ""
$Entity = group(target.asset.hostname, target.asset.ip, target.asset.mac, target.user.userid)
$Entity != ""
match:
$Entity
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
依資產顯示一段時間內的供應商快訊
(metadata.log_type = /CLAROTY_CTD|CLAROTY_EMC/ nocase
and security_result.threat_id != "")
or (metadata.log_type = /NOZOMI_GUARDIAN/ nocase
and additional.fields["IsSecurity"] = "true")
or (metadata.log_type = /TENABLE_OT/ nocase
and security_result.category_details = /NetworkThreats/ nocase)
metadata.product_event_type != "Event"
metadata.product_event_type != "HealthCheck"
metadata.product_event_type != "Insight"
$Device = strings.coalesce(target.asset.hostname, target.asset.ip, target.asset.mac, target.hostname)
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
$Vendor_Alert = metadata.product_event_type
match:
$Date, $Device
outcome:
$Count = count($Vendor_Alert)
order:
$Count desc
明文通訊協定分配
network.application_protocol = "MODBUS"
or network.application_protocol = "DNP3"
or network.application_protocol = "CIP"
or network.application_protocol = "IEC104"
or network.application_protocol = "SNMP"
or network.application_protocol = "COTP"
or network.application_protocol = "GOOSE"
or network.application_protocol = "SV"
or network.application_protocol = "DEVICE_NET"
or network.application_protocol = "PTP"
or network.application_protocol = "HTTP"
or network.application_protocol = "RLOGIN"
or network.application_protocol = "FINGER"
or network.application_protocol = "SMTP"
$Protocol = network.application_protocol
match:
$Protocol
outcome:
$Count = count(metadata.id)
order:
$Count desc
依使用者列出的前 10 項供應商快訊
(metadata.log_type = /CLAROTY_CTD|CLAROTY_EMC/ nocase
and security_result.threat_id != "")
or (metadata.log_type = /NOZOMI_GUARDIAN/ nocase
and additional.fields["IsSecurity"] = "true")
or (metadata.log_type = /TENABLE_OT/ nocase
and security_result.category_details = /NetworkThreats/ nocase)
metadata.product_event_type != "Event"
metadata.product_event_type != "HealthCheck"
metadata.product_event_type != "Insight"
$Event = metadata.product_event_type
$User = principal.user.user_display_name
match:
$User, $Event
outcome:
$Count = count(if((metadata.log_type = /claroty/ nocase and security_result.threat_id != "") or (metadata.log_type = /nozomi/ nocase and additional.fields["IsSecurity"] = "true") or (metadata.log_type = /TENABLE_OT/ nocase and security_result.category_details = /NetworkThreats/ nocase), 1, 0))
order:
$Count desc
limit:
10
啟動外部網路的前 10 大實體
target.ip != /^10\..|^172\.(1[6-9]|2\d|3[0-1])\..*|^192\.168\../
$Entity = group(principal.asset.hostname, principal.asset.ip, principal.asset.mac, principal.user.windows_sid, principal.user.userid)
$Entity != ""
match:
$Entity
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
依嚴重程度排序的前 10 大供應商快訊
(metadata.log_type = /CLAROTY_CTD|CLAROTY_EMC/ nocase
and security_result.threat_id != "")
or (metadata.log_type = /NOZOMI_GUARDIAN/ nocase
and additional.fields["IsSecurity"] = "true")
or (metadata.log_type = /TENABLE_OT/ nocase
and security_result.category_details = /NetworkThreats/ nocase)
metadata.product_event_type != "Event"
metadata.product_event_type != "HealthCheck"
metadata.product_event_type != "Insight"
$Vendor_Alert = metadata.product_event_type
$Severity = security_result.severity
match:
$Severity, $Vendor_Alert
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
應用程式通訊協定隨時間變化
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
$Application_Protocol = network.application_protocol
match:
$Application_Protocol, $Date
outcome:
$Count = count(metadata.id)
order:
$Count desc
新 OT 資產
metadata.product_event_type = /New Asset|SIGN:DHCP-OPERATION/ nocase
$Hostname = strings.coalesce(target.asset.hostname, target.asset.ip, target.asset.mac, target.hostname)
$Hostname != ""
match:
$Hostname
供應商快訊記錄
(metadata.log_type = /CLAROTY_CTD|CLAROTY_EMC/ nocase
and security_result.threat_id != "")
or (metadata.log_type = /NOZOMI_GUARDIAN/ nocase
and additional.fields["IsSecurity"] = "true")
or (metadata.log_type = /TENABLE_OT/ nocase
and security_result.category_details = /NetworkThreats/ nocase)
metadata.product_event_type != "Event"
metadata.product_event_type != "HealthCheck"
metadata.product_event_type != "Insight"
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
$Vendor_Alert = metadata.product_event_type
match:
$Date, $Vendor_Alert
outcome:
$Count = count(if((metadata.log_type = /claroty/ nocase and security_result.threat_id != "") or (metadata.log_type = /nozomi/ nocase and additional.fields["IsSecurity"] = "true") or (metadata.log_type = /TENABLE_OT/ nocase and security_result.category_details = /NetworkThreats/ nocase), 1, 0))
order:
$Count desc
OT 新資產總數
metadata.product_event_type = /New Asset|SIGN:DHCP-OPERATION/ nocase
strings.coalesce(target.asset.hostname, target.asset.ip, target.asset.mac, target.hostname) != ""
outcome:
$Count = count_distinct(strings.coalesce(target.asset.hostname, target.asset.ip, target.asset.mac, target.hostname))
前 10 大來源資產
$Hostname = strings.coalesce(principal.asset.hostname, principal.asset.ip, principal.asset.mac, principal.hostname)
$Hostname != ""
match:
$Hostname
outcome:
$Count = count_distinct(strings.coalesce(target.asset.ip, target.ip))
order:
$Count desc
limit:
10
依動作分類的供應商快訊
(metadata.log_type = /CLAROTY_CTD|CLAROTY_EMC/ nocase
and security_result.threat_id != "")
or (metadata.log_type = /NOZOMI_GUARDIAN/ nocase
and additional.fields["IsSecurity"] = "true")
or (metadata.log_type = /TENABLE_OT/ nocase
and security_result.category_details = /NetworkThreats/ nocase)
metadata.product_event_type != "Event"
metadata.product_event_type != "HealthCheck"
metadata.product_event_type != "Insight"
security_result.action_details = "Succeeded"
or security_result.action_details = "Failed"
$Action = security_result.action_details
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
match:
$Date, $Action
outcome:
$Count = count(if((metadata.log_type = /claroty/ nocase and security_result.threat_id != "") or (metadata.log_type = /nozomi/ nocase and additional.fields["IsSecurity"] = "true") or (metadata.log_type = /TENABLE_OT/ nocase and security_result.category_details = /NetworkThreats/ nocase), 1, 0))
order:
$Date desc
OT 資產總數
outcome:
$Count = count_distinct(strings.coalesce(target.asset.hostname, target.asset.ip, target.asset.mac, target.hostname))
依記錄類型劃分的供應商警告趨勢
(metadata.log_type = /CLAROTY_CTD|CLAROTY_EMC/ nocase
and security_result.threat_id != "")
or (metadata.log_type = /NOZOMI_GUARDIAN/ nocase
and additional.fields["IsSecurity"] = "true")
or (metadata.log_type = /TENABLE_OT/ nocase
and security_result.category_details = /NetworkThreats/ nocase)
metadata.product_event_type != "Event"
metadata.product_event_type != "HealthCheck"
metadata.product_event_type != "Insight"
$Log_Type = metadata.log_type
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
$Vendor_Alert = metadata.product_event_type
match:
$Date, $Vendor_Alert, $Log_Type
outcome:
$Count = count(if((metadata.log_type = /claroty/ nocase and security_result.threat_id != "") or (metadata.log_type = /nozomi/ nocase and additional.fields["IsSecurity"] = "true") or (metadata.log_type = /TENABLE_OT/ nocase and security_result.category_details = /NetworkThreats/ nocase), 1, 0))
order:
$Date desc
依類別列出的前 10 大供應商快訊
(metadata.log_type = /CLAROTY_CTD|CLAROTY_EMC/ nocase
and security_result.threat_id != "")
or (metadata.log_type = /NOZOMI_GUARDIAN/ nocase
and additional.fields["IsSecurity"] = "true")
or (metadata.log_type = /TENABLE_OT/ nocase
and security_result.category_details = /NetworkThreats/ nocase)
metadata.product_event_type != "Event"
metadata.product_event_type != "HealthCheck"
metadata.product_event_type != "Insight"
$Event = metadata.product_event_type
$Category = security_result.category_details
match:
$Category, $Event
outcome:
$Count = count(if((metadata.log_type = /claroty/ nocase and security_result.threat_id != "") or (metadata.log_type = /nozomi/ nocase and additional.fields["IsSecurity"] = "true") or (metadata.log_type = /TENABLE_OT/ nocase and security_result.category_details = /NetworkThreats/ nocase), 1, 0))
order:
$Count desc
limit:
10
PCI - Anti-Malware
這個資訊主頁會顯示支付卡產業 (PCI) 資產和主動偵測到的威脅。並使用參照清單 pci_assets，將資料範圍限定在 PCI 環境中。
注意：您必須先建立必要的參照清單，這個資訊主頁中的圖表才會載入。
依類型封鎖的事件
允許使用者存取的事件
依動作劃分的事件摘要
事件總數
依嚴重性劃分的 EDR 警示總數
前 10 大事件類型
EDR 警告總數
依戰術分類的 EDR 警告
一段時間內的 EDR 快訊總數
依嚴重程度分類的事件
其他活動
各類型事件的總數 (以時間為依據)
允許的事件 (依 IP 位址)
依記錄類型細分的事件動作
依 IP 位址封鎖的事件
使用者封鎖的活動
隔離的事件
依位置列出的前 10 大端點
已封鎖的事件
歷來事件總數
允許的事件類型
允許的事件
圖表名稱
查詢示例
依類型封鎖的事件
$event.metadata.log_type = /_AV|EDR|BEYONDTRUST_ENDPOINT|BITDEFENDER|CISCO_AMP|CISCO_SECURE_WORKLOAD|CS_DETECTS|CS_IDP|CYBERARK_EPM|CYNET_360_AUTOXDR|ENDPOINT_PROTECTOR_DLP|FIREEYE_HX|HALCYON|IBM_SECURITY_VERIFY|JAMF_PRO|JAMF_PROTECT|JAMF_TELEMETRY|KOLIDE|LOOKOUT_MOBILE_ENDPOINT_SECURITY|MACOS|MACOS_ENDPOINT_SECURITY|MICROSOFT_DEFENDER_ENDPOINT|MICROSOFT_DEFENDER_ENDPOINT_IOS|MICROSOFT_DEFENDER_IDENTITY|MICROSOFT_GRAPH_ALERT|MICROSOFT_IAS|MICROSOFT_SCEP|MOBILEIRON|OPENPATH|PASSWORDSTATE|SAVIYNT_EIP|SENTINEL_DV|SENTINELONE_ALERT|SEP|SEQRITE_ENDPOINT|SOPHOS_CENTRAL|SPYCLOUD|TRENDMICRO_APEX_CENTRAL|TRENDMICRO_APEX_ONE|TRENDMICRO_DEEP_SECURITY|TRENDMICRO_STELLAR|TRENDMICRO_VISION_ONE|VENAFI_ZTPKI|WINDOWS_DEFENDER_ATP|WINEVTLOG|WINEVTLOG_XML/
strings.coalesce($event.principal.asset.hostname, $event.principal.hostname) in %PCI_Assets
$event.security_result.action = "BLOCK"
$Event_Type = $event.metadata.event_type
match:
$Event_Type
outcome:
$Count = count($event.security_result.action)
order:
$Count desc
允許使用者存取的事件
$event.metadata.log_type = /_AV|EDR|BEYONDTRUST_ENDPOINT|BITDEFENDER|CISCO_AMP|CISCO_SECURE_WORKLOAD|CS_DETECTS|CS_IDP|CYBERARK_EPM|CYNET_360_AUTOXDR|ENDPOINT_PROTECTOR_DLP|FIREEYE_HX|HALCYON|IBM_SECURITY_VERIFY|JAMF_PRO|JAMF_PROTECT|JAMF_TELEMETRY|KOLIDE|LOOKOUT_MOBILE_ENDPOINT_SECURITY|MACOS|MACOS_ENDPOINT_SECURITY|MICROSOFT_DEFENDER_ENDPOINT|MICROSOFT_DEFENDER_ENDPOINT_IOS|MICROSOFT_DEFENDER_IDENTITY|MICROSOFT_GRAPH_ALERT|MICROSOFT_IAS|MICROSOFT_SCEP|MOBILEIRON|OPENPATH|PASSWORDSTATE|SAVIYNT_EIP|SENTINEL_DV|SENTINELONE_ALERT|SEP|SEQRITE_ENDPOINT|SOPHOS_CENTRAL|SPYCLOUD|TRENDMICRO_APEX_CENTRAL|TRENDMICRO_APEX_ONE|TRENDMICRO_DEEP_SECURITY|TRENDMICRO_STELLAR|TRENDMICRO_VISION_ONE|VENAFI_ZTPKI|WINDOWS_DEFENDER_ATP|WINEVTLOG|WINEVTLOG_XML/
strings.coalesce($event.principal.asset.hostname, $event.principal.hostname) in %PCI_Assets
$event.security_result.action = "ALLOW"
$Event_Type = $event.metadata.event_type
$User = strings.coalesce($event.principal.user.user_display_name, $event.principal.user.userid)
match:
$User, $Event_Type
outcome:
$Count = count($event.security_result.action)
order:
$Count desc
limit:
50
依動作劃分的事件摘要
$event.metadata.log_type = /_AV|EDR|BEYONDTRUST_ENDPOINT|BITDEFENDER|CISCO_AMP|CISCO_SECURE_WORKLOAD|CS_DETECTS|CS_IDP|CYBERARK_EPM|CYNET_360_AUTOXDR|ENDPOINT_PROTECTOR_DLP|FIREEYE_HX|HALCYON|IBM_SECURITY_VERIFY|JAMF_PRO|JAMF_PROTECT|JAMF_TELEMETRY|KOLIDE|LOOKOUT_MOBILE_ENDPOINT_SECURITY|MACOS|MACOS_ENDPOINT_SECURITY|MICROSOFT_DEFENDER_ENDPOINT|MICROSOFT_DEFENDER_ENDPOINT_IOS|MICROSOFT_DEFENDER_IDENTITY|MICROSOFT_GRAPH_ALERT|MICROSOFT_IAS|MICROSOFT_SCEP|MOBILEIRON|OPENPATH|PASSWORDSTATE|SAVIYNT_EIP|SENTINEL_DV|SENTINELONE_ALERT|SEP|SEQRITE_ENDPOINT|SOPHOS_CENTRAL|SPYCLOUD|TRENDMICRO_APEX_CENTRAL|TRENDMICRO_APEX_ONE|TRENDMICRO_DEEP_SECURITY|TRENDMICRO_STELLAR|TRENDMICRO_VISION_ONE|VENAFI_ZTPKI|WINDOWS_DEFENDER_ATP|WINEVTLOG|WINEVTLOG_XML/ nocase
strings.coalesce($event.principal.asset.hostname, $event.principal.hostname) in %PCI_Assets
$Action = $event.security_result.action
match:
$Action
outcome:
$Count = count($event.security_result.action)
order:
$Count desc
事件總數
$event.metadata.log_type = /_AV|EDR|BEYONDTRUST_ENDPOINT|BITDEFENDER|CISCO_AMP|CISCO_SECURE_WORKLOAD|CS_DETECTS|CS_IDP|CYBERARK_EPM|CYNET_360_AUTOXDR|ENDPOINT_PROTECTOR_DLP|FIREEYE_HX|HALCYON|IBM_SECURITY_VERIFY|JAMF_PRO|JAMF_PROTECT|JAMF_TELEMETRY|KOLIDE|LOOKOUT_MOBILE_ENDPOINT_SECURITY|MACOS|MACOS_ENDPOINT_SECURITY|MICROSOFT_DEFENDER_ENDPOINT|MICROSOFT_DEFENDER_ENDPOINT_IOS|MICROSOFT_DEFENDER_IDENTITY|MICROSOFT_GRAPH_ALERT|MICROSOFT_IAS|MICROSOFT_SCEP|MOBILEIRON|OPENPATH|PASSWORDSTATE|SAVIYNT_EIP|SENTINEL_DV|SENTINELONE_ALERT|SEP|SEQRITE_ENDPOINT|SOPHOS_CENTRAL|SPYCLOUD|TRENDMICRO_APEX_CENTRAL|TRENDMICRO_APEX_ONE|TRENDMICRO_DEEP_SECURITY|TRENDMICRO_STELLAR|TRENDMICRO_VISION_ONE|VENAFI_ZTPKI|WINDOWS_DEFENDER_ATP|WINEVTLOG|WINEVTLOG_XML/ nocase
strings.coalesce($event.principal.asset.hostname, $event.principal.hostname) in %PCI_Assets
outcome:
$Count = count($event.security_result.action)
依嚴重性劃分的 EDR 警示總數
$event.metadata.log_type = /EDR|CS_DETECTS|FIREEYE_HX|MICROSOFT_DEFENDER_ENDPOINT|MICROSOFT_DEFENDER_IDENTITY|SENTINEL_DV/
strings.coalesce($event.principal.asset.hostname, $event.principal.hostname) in %PCI_Assets
$Log_Type = $event.metadata.log_type
$Severity = $event.security_result.severity
$Rule_Name = strings.coalesce($event.security_result.rule_name, $event.security_result.description)
$Rule_Name != ""
$Description = $event.metadata.description
match:
$Rule_Name, $Description, $Log_Type, $Severity
outcome:
$Count = count($event.security_result.rule_name)
order:
$Severity desc
limit:
50
前 10 大事件類型
$event.metadata.log_type = /_AV|EDR|BEYONDTRUST_ENDPOINT|BITDEFENDER|CISCO_AMP|CISCO_SECURE_WORKLOAD|CS_DETECTS|CS_IDP|CYBERARK_EPM|CYNET_360_AUTOXDR|ENDPOINT_PROTECTOR_DLP|FIREEYE_HX|HALCYON|IBM_SECURITY_VERIFY|JAMF_PRO|JAMF_PROTECT|JAMF_TELEMETRY|KOLIDE|LOOKOUT_MOBILE_ENDPOINT_SECURITY|MACOS|MACOS_ENDPOINT_SECURITY|MICROSOFT_DEFENDER_ENDPOINT|MICROSOFT_DEFENDER_ENDPOINT_IOS|MICROSOFT_DEFENDER_IDENTITY|MICROSOFT_GRAPH_ALERT|MICROSOFT_IAS|MICROSOFT_SCEP|MOBILEIRON|OPENPATH|PASSWORDSTATE|SAVIYNT_EIP|SENTINEL_DV|SENTINELONE_ALERT|SEP|SEQRITE_ENDPOINT|SOPHOS_CENTRAL|SPYCLOUD|TRENDMICRO_APEX_CENTRAL|TRENDMICRO_APEX_ONE|TRENDMICRO_DEEP_SECURITY|TRENDMICRO_STELLAR|TRENDMICRO_VISION_ONE|VENAFI_ZTPKI|WINDOWS_DEFENDER_ATP|WINEVTLOG|WINEVTLOG_XML/ nocase
strings.coalesce($event.principal.asset.hostname, $event.principal.hostname) in %PCI_Assets
$Event_Type = $event.metadata.event_type
match:
$Event_Type
outcome:
$Count = count($event.security_result.action)
order:
$Count desc
limit:
10
EDR 警告總數
$event.metadata.log_type = /EDR|CS_DETECTS|FIREEYE_HX|MICROSOFT_DEFENDER_ENDPOINT|MICROSOFT_DEFENDER_IDENTITY|SENTINEL_DV/ nocase
strings.coalesce($event.principal.asset.hostname, $event.principal.hostname) in %PCI_Assets
outcome:
$Count = count($event.security_result.rule_name)
依戰術分類的 EDR 警告
$event.metadata.log_type = /EDR|CS_DETECTS|FIREEYE_HX|MICROSOFT_DEFENDER_ENDPOINT|MICROSOFT_DEFENDER_IDENTITY|SENTINEL_DV/
strings.coalesce($event.principal.asset.hostname, $event.principal.hostname) in %PCI_Assets
$Log_Type = $event.metadata.log_type
$Tactic_ID = strings.coalesce($event.security_result.attack_details.tactics.id, $event.security_result.detection_fields["Tactic ID"])
$Tactic_ID != ""
$Tactic_Name = strings.coalesce($event.security_result.attack_details.tactics.name, $event.security_result.detection_fields["Tactic"])
$Tactic_Name != ""
$Severity = $event.security_result.severity
match:
$Tactic_ID, $Tactic_Name, $Severity
outcome:
$Count = count($event.security_result.rule_name)
order:
$Severity desc
limit:
50
一段時間內的 EDR 快訊總數
$event.metadata.log_type = /EDR|CS_DETECTS|FIREEYE_HX|MICROSOFT_DEFENDER_ENDPOINT|MICROSOFT_DEFENDER_IDENTITY|SENTINEL_DV/
strings.coalesce($event.principal.asset.hostname, $event.principal.hostname) in %PCI_Assets
$Log_Type = $event.metadata.log_type
$Date = timestamp.get_date($event.metadata.event_timestamp.seconds)
match:
$Log_Type, $Date
outcome:
$Count = count($event.security_result.rule_name)
order:
$Date asc
依嚴重程度分類的事件
$event.metadata.log_type = /_AV|EDR|BEYONDTRUST_ENDPOINT|BITDEFENDER|CISCO_AMP|CISCO_SECURE_WORKLOAD|CS_DETECTS|CS_IDP|CYBERARK_EPM|CYNET_360_AUTOXDR|ENDPOINT_PROTECTOR_DLP|FIREEYE_HX|HALCYON|IBM_SECURITY_VERIFY|JAMF_PRO|JAMF_PROTECT|JAMF_TELEMETRY|KOLIDE|LOOKOUT_MOBILE_ENDPOINT_SECURITY|MACOS|MACOS_ENDPOINT_SECURITY|MICROSOFT_DEFENDER_ENDPOINT|MICROSOFT_DEFENDER_ENDPOINT_IOS|MICROSOFT_DEFENDER_IDENTITY|MICROSOFT_GRAPH_ALERT|MICROSOFT_IAS|MICROSOFT_SCEP|MOBILEIRON|OPENPATH|PASSWORDSTATE|SAVIYNT_EIP|SENTINEL_DV|SENTINELONE_ALERT|SEP|SEQRITE_ENDPOINT|SOPHOS_CENTRAL|SPYCLOUD|TRENDMICRO_APEX_CENTRAL|TRENDMICRO_APEX_ONE|TRENDMICRO_DEEP_SECURITY|TRENDMICRO_STELLAR|TRENDMICRO_VISION_ONE|VENAFI_ZTPKI|WINDOWS_DEFENDER_ATP|WINEVTLOG|WINEVTLOG_XML/ nocase
strings.coalesce($event.principal.asset.hostname, $event.principal.hostname) in %PCI_Assets
$Event_Type = $event.metadata.event_type
$Log_Type = $event.metadata.log_type
$Severity = $event.security_result.severity
match:
$Event_Type, $Log_Type, $Severity
outcome:
$Count = count($event.security_result.action)
order:
$Severity desc
limit:
50
其他活動
$event.metadata.log_type = /_AV|EDR|BEYONDTRUST_ENDPOINT|BITDEFENDER|CISCO_AMP|CISCO_SECURE_WORKLOAD|CS_DETECTS|CS_IDP|CYBERARK_EPM|CYNET_360_AUTOXDR|ENDPOINT_PROTECTOR_DLP|FIREEYE_HX|HALCYON|IBM_SECURITY_VERIFY|JAMF_PRO|JAMF_PROTECT|JAMF_TELEMETRY|KOLIDE|LOOKOUT_MOBILE_ENDPOINT_SECURITY|MACOS|MACOS_ENDPOINT_SECURITY|MICROSOFT_DEFENDER_ENDPOINT|MICROSOFT_DEFENDER_ENDPOINT_IOS|MICROSOFT_DEFENDER_IDENTITY|MICROSOFT_GRAPH_ALERT|MICROSOFT_IAS|MICROSOFT_SCEP|MOBILEIRON|OPENPATH|PASSWORDSTATE|SAVIYNT_EIP|SENTINEL_DV|SENTINELONE_ALERT|SEP|SEQRITE_ENDPOINT|SOPHOS_CENTRAL|SPYCLOUD|TRENDMICRO_APEX_CENTRAL|TRENDMICRO_APEX_ONE|TRENDMICRO_DEEP_SECURITY|TRENDMICRO_STELLAR|TRENDMICRO_VISION_ONE|VENAFI_ZTPKI|WINDOWS_DEFENDER_ATP|WINEVTLOG|WINEVTLOG_XML/ nocase
strings.coalesce($event.principal.asset.hostname, $event.principal.hostname) in %PCI_Assets
outcome:
$Count = sum(if($event.security_result.action = "UNKNOWN_ACTION", 1, 0) + if($event.security_result.action = "FAIL", 1, 0) + if($event.security_result.action = "CHALLENGE", 1, 0))
各類型事件的總數 (以時間為依據)
$event.metadata.log_type = /_AV|EDR|BEYONDTRUST_ENDPOINT|BITDEFENDER|CISCO_AMP|CISCO_SECURE_WORKLOAD|CS_DETECTS|CS_IDP|CYBERARK_EPM|CYNET_360_AUTOXDR|ENDPOINT_PROTECTOR_DLP|FIREEYE_HX|HALCYON|IBM_SECURITY_VERIFY|JAMF_PRO|JAMF_PROTECT|JAMF_TELEMETRY|KOLIDE|LOOKOUT_MOBILE_ENDPOINT_SECURITY|MACOS|MACOS_ENDPOINT_SECURITY|MICROSOFT_DEFENDER_ENDPOINT|MICROSOFT_DEFENDER_ENDPOINT_IOS|MICROSOFT_DEFENDER_IDENTITY|MICROSOFT_GRAPH_ALERT|MICROSOFT_IAS|MICROSOFT_SCEP|MOBILEIRON|OPENPATH|PASSWORDSTATE|SAVIYNT_EIP|SENTINEL_DV|SENTINELONE_ALERT|SEP|SEQRITE_ENDPOINT|SOPHOS_CENTRAL|SPYCLOUD|TRENDMICRO_APEX_CENTRAL|TRENDMICRO_APEX_ONE|TRENDMICRO_DEEP_SECURITY|TRENDMICRO_STELLAR|TRENDMICRO_VISION_ONE|VENAFI_ZTPKI|WINDOWS_DEFENDER_ATP|WINEVTLOG|WINEVTLOG_XML/ nocase
strings.coalesce($event.principal.asset.hostname, $event.principal.hostname) in %PCI_Assets
$Event_Type = $event.metadata.event_type
$Date = timestamp.get_date($event.metadata.event_timestamp.seconds)
match:
$Event_Type, $Date
outcome:
$Count = count($event.security_result.action)
order:
$Date asc
允許的事件 (依 IP 位址)
$event.metadata.log_type = /_AV|EDR|BEYONDTRUST_ENDPOINT|BITDEFENDER|CISCO_AMP|CISCO_SECURE_WORKLOAD|CS_DETECTS|CS_IDP|CYBERARK_EPM|CYNET_360_AUTOXDR|ENDPOINT_PROTECTOR_DLP|FIREEYE_HX|HALCYON|IBM_SECURITY_VERIFY|JAMF_PRO|JAMF_PROTECT|JAMF_TELEMETRY|KOLIDE|LOOKOUT_MOBILE_ENDPOINT_SECURITY|MACOS|MACOS_ENDPOINT_SECURITY|MICROSOFT_DEFENDER_ENDPOINT|MICROSOFT_DEFENDER_ENDPOINT_IOS|MICROSOFT_DEFENDER_IDENTITY|MICROSOFT_GRAPH_ALERT|MICROSOFT_IAS|MICROSOFT_SCEP|MOBILEIRON|OPENPATH|PASSWORDSTATE|SAVIYNT_EIP|SENTINEL_DV|SENTINELONE_ALERT|SEP|SEQRITE_ENDPOINT|SOPHOS_CENTRAL|SPYCLOUD|TRENDMICRO_APEX_CENTRAL|TRENDMICRO_APEX_ONE|TRENDMICRO_DEEP_SECURITY|TRENDMICRO_STELLAR|TRENDMICRO_VISION_ONE|VENAFI_ZTPKI|WINDOWS_DEFENDER_ATP|WINEVTLOG|WINEVTLOG_XML/
strings.coalesce($event.principal.asset.hostname, $event.principal.hostname) in %PCI_Assets
$event.security_result.action = "ALLOW"
$Event_Type = $event.metadata.event_type
$IP = $event.principal.ip
match:
$IP, $Event_Type
outcome:
$Count = count($event.security_result.action)
order:
$Count desc
limit:
50
依記錄類型細分的事件動作
$event.metadata.log_type = /_AV|EDR|BEYONDTRUST_ENDPOINT|BITDEFENDER|CISCO_AMP|CISCO_SECURE_WORKLOAD|CS_DETECTS|CS_IDP|CYBERARK_EPM|CYNET_360_AUTOXDR|ENDPOINT_PROTECTOR_DLP|FIREEYE_HX|HALCYON|IBM_SECURITY_VERIFY|JAMF_PRO|JAMF_PROTECT|JAMF_TELEMETRY|KOLIDE|LOOKOUT_MOBILE_ENDPOINT_SECURITY|MACOS|MACOS_ENDPOINT_SECURITY|MICROSOFT_DEFENDER_ENDPOINT|MICROSOFT_DEFENDER_ENDPOINT_IOS|MICROSOFT_DEFENDER_IDENTITY|MICROSOFT_GRAPH_ALERT|MICROSOFT_IAS|MICROSOFT_SCEP|MOBILEIRON|OPENPATH|PASSWORDSTATE|SAVIYNT_EIP|SENTINEL_DV|SENTINELONE_ALERT|SEP|SEQRITE_ENDPOINT|SOPHOS_CENTRAL|SPYCLOUD|TRENDMICRO_APEX_CENTRAL|TRENDMICRO_APEX_ONE|TRENDMICRO_DEEP_SECURITY|TRENDMICRO_STELLAR|TRENDMICRO_VISION_ONE|VENAFI_ZTPKI|WINDOWS_DEFENDER_ATP|WINEVTLOG|WINEVTLOG_XML/ nocase
strings.coalesce($event.principal.asset.hostname, $event.principal.hostname) in %PCI_Assets
$Log_Type = $event.metadata.log_type
$Action = $event.security_result.action
match:
$Action, $Log_Type
outcome:
$Count = count($event.security_result.action)
order:
$Count desc
limit:
10
依 IP 位址封鎖的事件
$event.metadata.log_type = /_AV|EDR|BEYONDTRUST_ENDPOINT|BITDEFENDER|CISCO_AMP|CISCO_SECURE_WORKLOAD|CS_DETECTS|CS_IDP|CYBERARK_EPM|CYNET_360_AUTOXDR|ENDPOINT_PROTECTOR_DLP|FIREEYE_HX|HALCYON|IBM_SECURITY_VERIFY|JAMF_PRO|JAMF_PROTECT|JAMF_TELEMETRY|KOLIDE|LOOKOUT_MOBILE_ENDPOINT_SECURITY|MACOS|MACOS_ENDPOINT_SECURITY|MICROSOFT_DEFENDER_ENDPOINT|MICROSOFT_DEFENDER_ENDPOINT_IOS|MICROSOFT_DEFENDER_IDENTITY|MICROSOFT_GRAPH_ALERT|MICROSOFT_IAS|MICROSOFT_SCEP|MOBILEIRON|OPENPATH|PASSWORDSTATE|SAVIYNT_EIP|SENTINEL_DV|SENTINELONE_ALERT|SEP|SEQRITE_ENDPOINT|SOPHOS_CENTRAL|SPYCLOUD|TRENDMICRO_APEX_CENTRAL|TRENDMICRO_APEX_ONE|TRENDMICRO_DEEP_SECURITY|TRENDMICRO_STELLAR|TRENDMICRO_VISION_ONE|VENAFI_ZTPKI|WINDOWS_DEFENDER_ATP|WINEVTLOG|WINEVTLOG_XML/
strings.coalesce($event.principal.asset.hostname, $event.principal.hostname) in %PCI_Assets
$event.security_result.action = "BLOCK"
$Event_Type = $event.metadata.event_type
$IP = $event.principal.ip
match:
$IP, $Event_Type
outcome:
$Count = count($event.security_result.action)
order:
$Count desc
limit:
50
使用者封鎖的活動
$event.metadata.log_type = /_AV|EDR|BEYONDTRUST_ENDPOINT|BITDEFENDER|CISCO_AMP|CISCO_SECURE_WORKLOAD|CS_DETECTS|CS_IDP|CYBERARK_EPM|CYNET_360_AUTOXDR|ENDPOINT_PROTECTOR_DLP|FIREEYE_HX|HALCYON|IBM_SECURITY_VERIFY|JAMF_PRO|JAMF_PROTECT|JAMF_TELEMETRY|KOLIDE|LOOKOUT_MOBILE_ENDPOINT_SECURITY|MACOS|MACOS_ENDPOINT_SECURITY|MICROSOFT_DEFENDER_ENDPOINT|MICROSOFT_DEFENDER_ENDPOINT_IOS|MICROSOFT_DEFENDER_IDENTITY|MICROSOFT_GRAPH_ALERT|MICROSOFT_IAS|MICROSOFT_SCEP|MOBILEIRON|OPENPATH|PASSWORDSTATE|SAVIYNT_EIP|SENTINEL_DV|SENTINELONE_ALERT|SEP|SEQRITE_ENDPOINT|SOPHOS_CENTRAL|SPYCLOUD|TRENDMICRO_APEX_CENTRAL|TRENDMICRO_APEX_ONE|TRENDMICRO_DEEP_SECURITY|TRENDMICRO_STELLAR|TRENDMICRO_VISION_ONE|VENAFI_ZTPKI|WINDOWS_DEFENDER_ATP|WINEVTLOG|WINEVTLOG_XML/
strings.coalesce($event.principal.asset.hostname, $event.principal.hostname) in %PCI_Assets
$event.security_result.action = "BLOCK"
$Event_Type = $event.metadata.event_type
$User = strings.coalesce($event.principal.user.user_display_name, $event.principal.user.userid)
match:
$User, $Event_Type
outcome:
$Count = count($event.security_result.action)
order:
$Count desc
limit:
50
隔離的事件
$event.metadata.log_type = /_AV|EDR|BEYONDTRUST_ENDPOINT|BITDEFENDER|CISCO_AMP|CISCO_SECURE_WORKLOAD|CS_DETECTS|CS_IDP|CYBERARK_EPM|CYNET_360_AUTOXDR|ENDPOINT_PROTECTOR_DLP|FIREEYE_HX|HALCYON|IBM_SECURITY_VERIFY|JAMF_PRO|JAMF_PROTECT|JAMF_TELEMETRY|KOLIDE|LOOKOUT_MOBILE_ENDPOINT_SECURITY|MACOS|MACOS_ENDPOINT_SECURITY|MICROSOFT_DEFENDER_ENDPOINT|MICROSOFT_DEFENDER_ENDPOINT_IOS|MICROSOFT_DEFENDER_IDENTITY|MICROSOFT_GRAPH_ALERT|MICROSOFT_IAS|MICROSOFT_SCEP|MOBILEIRON|OPENPATH|PASSWORDSTATE|SAVIYNT_EIP|SENTINEL_DV|SENTINELONE_ALERT|SEP|SEQRITE_ENDPOINT|SOPHOS_CENTRAL|SPYCLOUD|TRENDMICRO_APEX_CENTRAL|TRENDMICRO_APEX_ONE|TRENDMICRO_DEEP_SECURITY|TRENDMICRO_STELLAR|TRENDMICRO_VISION_ONE|VENAFI_ZTPKI|WINDOWS_DEFENDER_ATP|WINEVTLOG|WINEVTLOG_XML/ nocase
strings.coalesce($event.principal.asset.hostname, $event.principal.hostname) in %PCI_Assets
$event.security_result.action = "QUARANTINE"
outcome:
$Count = count($event.security_result.action)
依位置列出的前 10 大端點
$event.metadata.log_type = /_AV|EDR|BEYONDTRUST_ENDPOINT|BITDEFENDER|CISCO_AMP|CISCO_SECURE_WORKLOAD|CS_DETECTS|CS_IDP|CYBERARK_EPM|CYNET_360_AUTOXDR|ENDPOINT_PROTECTOR_DLP|FIREEYE_HX|HALCYON|IBM_SECURITY_VERIFY|JAMF_PRO|JAMF_PROTECT|JAMF_TELEMETRY|KOLIDE|LOOKOUT_MOBILE_ENDPOINT_SECURITY|MACOS|MACOS_ENDPOINT_SECURITY|MICROSOFT_DEFENDER_ENDPOINT|MICROSOFT_DEFENDER_ENDPOINT_IOS|MICROSOFT_DEFENDER_IDENTITY|MICROSOFT_GRAPH_ALERT|MICROSOFT_IAS|MICROSOFT_SCEP|MOBILEIRON|OPENPATH|PASSWORDSTATE|SAVIYNT_EIP|SENTINEL_DV|SENTINELONE_ALERT|SEP|SEQRITE_ENDPOINT|SOPHOS_CENTRAL|SPYCLOUD|TRENDMICRO_APEX_CENTRAL|TRENDMICRO_APEX_ONE|TRENDMICRO_DEEP_SECURITY|TRENDMICRO_STELLAR|TRENDMICRO_VISION_ONE|VENAFI_ZTPKI|WINDOWS_DEFENDER_ATP|WINEVTLOG|WINEVTLOG_XML/ nocase
strings.coalesce($event.principal.asset.hostname, $event.principal.hostname) in %PCI_Assets
$Countries = $event.principal.location.country_or_region
$Countries != ""
$Latitude = $event.principal.location.region_coordinates.latitude
$Longitude = $event.principal.location.region_coordinates.longitude
$Hostname = $event.target.asset.hostname
match:
$Countries, $Latitude, $Longitude, $Hostname
outcome:
$Count = count($event.principal.location.country_or_region)
limit:
10
已封鎖的事件
$event.metadata.log_type = /_AV|EDR|BEYONDTRUST_ENDPOINT|BITDEFENDER|CISCO_AMP|CISCO_SECURE_WORKLOAD|CS_DETECTS|CS_IDP|CYBERARK_EPM|CYNET_360_AUTOXDR|ENDPOINT_PROTECTOR_DLP|FIREEYE_HX|HALCYON|IBM_SECURITY_VERIFY|JAMF_PRO|JAMF_PROTECT|JAMF_TELEMETRY|KOLIDE|LOOKOUT_MOBILE_ENDPOINT_SECURITY|MACOS|MACOS_ENDPOINT_SECURITY|MICROSOFT_DEFENDER_ENDPOINT|MICROSOFT_DEFENDER_ENDPOINT_IOS|MICROSOFT_DEFENDER_IDENTITY|MICROSOFT_GRAPH_ALERT|MICROSOFT_IAS|MICROSOFT_SCEP|MOBILEIRON|OPENPATH|PASSWORDSTATE|SAVIYNT_EIP|SENTINEL_DV|SENTINELONE_ALERT|SEP|SEQRITE_ENDPOINT|SOPHOS_CENTRAL|SPYCLOUD|TRENDMICRO_APEX_CENTRAL|TRENDMICRO_APEX_ONE|TRENDMICRO_DEEP_SECURITY|TRENDMICRO_STELLAR|TRENDMICRO_VISION_ONE|VENAFI_ZTPKI|WINDOWS_DEFENDER_ATP|WINEVTLOG|WINEVTLOG_XML/
strings.coalesce($event.principal.asset.hostname, $event.principal.hostname) in %PCI_Assets
$event.security_result.action = "BLOCK"
outcome:
$Count = count($event.security_result.action)
歷來事件總數
$event.metadata.log_type = /_AV|EDR|BEYONDTRUST_ENDPOINT|BITDEFENDER|CISCO_AMP|CISCO_SECURE_WORKLOAD|CS_DETECTS|CS_IDP|CYBERARK_EPM|CYNET_360_AUTOXDR|ENDPOINT_PROTECTOR_DLP|FIREEYE_HX|HALCYON|IBM_SECURITY_VERIFY|JAMF_PRO|JAMF_PROTECT|JAMF_TELEMETRY|KOLIDE|LOOKOUT_MOBILE_ENDPOINT_SECURITY|MACOS|MACOS_ENDPOINT_SECURITY|MICROSOFT_DEFENDER_ENDPOINT|MICROSOFT_DEFENDER_ENDPOINT_IOS|MICROSOFT_DEFENDER_IDENTITY|MICROSOFT_GRAPH_ALERT|MICROSOFT_IAS|MICROSOFT_SCEP|MOBILEIRON|OPENPATH|PASSWORDSTATE|SAVIYNT_EIP|SENTINEL_DV|SENTINELONE_ALERT|SEP|SEQRITE_ENDPOINT|SOPHOS_CENTRAL|SPYCLOUD|TRENDMICRO_APEX_CENTRAL|TRENDMICRO_APEX_ONE|TRENDMICRO_DEEP_SECURITY|TRENDMICRO_STELLAR|TRENDMICRO_VISION_ONE|VENAFI_ZTPKI|WINDOWS_DEFENDER_ATP|WINEVTLOG|WINEVTLOG_XML/ nocase
strings.coalesce($event.principal.asset.hostname, $event.principal.hostname) in %PCI_Assets
$Log_Type = $event.metadata.log_type
$Date = timestamp.get_date($event.metadata.event_timestamp.seconds)
match:
$Log_Type, $Date
outcome:
$Count = count($event.security_result.action)
order:
$Date asc
允許的事件類型
$event.metadata.log_type = /_AV|EDR|BEYONDTRUST_ENDPOINT|BITDEFENDER|CISCO_AMP|CISCO_SECURE_WORKLOAD|CS_DETECTS|CS_IDP|CYBERARK_EPM|CYNET_360_AUTOXDR|ENDPOINT_PROTECTOR_DLP|FIREEYE_HX|HALCYON|IBM_SECURITY_VERIFY|JAMF_PRO|JAMF_PROTECT|JAMF_TELEMETRY|KOLIDE|LOOKOUT_MOBILE_ENDPOINT_SECURITY|MACOS|MACOS_ENDPOINT_SECURITY|MICROSOFT_DEFENDER_ENDPOINT|MICROSOFT_DEFENDER_ENDPOINT_IOS|MICROSOFT_DEFENDER_IDENTITY|MICROSOFT_GRAPH_ALERT|MICROSOFT_IAS|MICROSOFT_SCEP|MOBILEIRON|OPENPATH|PASSWORDSTATE|SAVIYNT_EIP|SENTINEL_DV|SENTINELONE_ALERT|SEP|SEQRITE_ENDPOINT|SOPHOS_CENTRAL|SPYCLOUD|TRENDMICRO_APEX_CENTRAL|TRENDMICRO_APEX_ONE|TRENDMICRO_DEEP_SECURITY|TRENDMICRO_STELLAR|TRENDMICRO_VISION_ONE|VENAFI_ZTPKI|WINDOWS_DEFENDER_ATP|WINEVTLOG|WINEVTLOG_XML/
strings.coalesce($event.principal.asset.hostname, $event.principal.hostname) in %PCI_Assets
$event.security_result.action = "ALLOW"
or $event.security_result.action = "ALLOW_WITH_MODIFICATION"
$Event_Type = $event.metadata.event_type
match:
$Event_Type
outcome:
$Count = count($event.security_result.action)
order:
$Count desc
允許的事件
$event.metadata.log_type = /_AV|EDR|BEYONDTRUST_ENDPOINT|BITDEFENDER|CISCO_AMP|CISCO_SECURE_WORKLOAD|CS_DETECTS|CS_IDP|CYBERARK_EPM|CYNET_360_AUTOXDR|ENDPOINT_PROTECTOR_DLP|FIREEYE_HX|HALCYON|IBM_SECURITY_VERIFY|JAMF_PRO|JAMF_PROTECT|JAMF_TELEMETRY|KOLIDE|LOOKOUT_MOBILE_ENDPOINT_SECURITY|MACOS|MACOS_ENDPOINT_SECURITY|MICROSOFT_DEFENDER_ENDPOINT|MICROSOFT_DEFENDER_ENDPOINT_IOS|MICROSOFT_DEFENDER_IDENTITY|MICROSOFT_GRAPH_ALERT|MICROSOFT_IAS|MICROSOFT_SCEP|MOBILEIRON|OPENPATH|PASSWORDSTATE|SAVIYNT_EIP|SENTINEL_DV|SENTINELONE_ALERT|SEP|SEQRITE_ENDPOINT|SOPHOS_CENTRAL|SPYCLOUD|TRENDMICRO_APEX_CENTRAL|TRENDMICRO_APEX_ONE|TRENDMICRO_DEEP_SECURITY|TRENDMICRO_STELLAR|TRENDMICRO_VISION_ONE|VENAFI_ZTPKI|WINDOWS_DEFENDER_ATP|WINEVTLOG|WINEVTLOG_XML/
strings.coalesce($event.principal.asset.hostname, $event.principal.hostname) in %PCI_Assets
$event.security_result.action = "ALLOW"
or $event.security_result.action = "ALLOW_WITH_MODIFICATION"
outcome:
$Count = count($event.security_result.action)
PCI - 資料加密
這個資訊主頁會顯示 PCI 資產的加密做法總覽。這個資訊主頁可讓您進一步瞭解加密金鑰的使用情形，並提供 Key Management Service (KMS) 活動、Azure 金鑰保存庫記錄和 Akeyless 金鑰保存庫記錄的深入分析。並使用參照清單 pci_network_ranges 將資料範圍限定在 PCI 環境。
注意： 必須先建立必要的參照清單，這個資訊主頁中的圖表才會載入。
金鑰輪替時間超過 30 天
金鑰解密失敗
金鑰刪除
加密強度較弱 / 未加密的通訊
通訊埠採用弱加密/ 未加密通訊
金鑰已輪替
已啟用金鑰
金鑰解密成功
新金鑰
一段時間內加密 / 未加密的通訊
金鑰停用超過 30 天
加密強度較弱/ 未加密的通訊 (前 10 名使用者)
前 10 項重要作業
加密強度較弱 / 未加密的通訊前 10 大主機
圖表名稱
查詢示例
金鑰輪替時間超過 30 天
$log_type = metadata.log_type
$app = target.application
($log_type = /AZURE_KEYVAULT_AUDIT|AKEYLESS_VAULT/ or $app = "kms.amazonaws.com")
principal.ip in cidr %PCI_Network_Ranges
$IP = principal.ip
$security_event_type = metadata.product_event_type
($security_event_type = "RotateKeyOnDemand" or $security_event_type = "RotateKey" or $security_event_type = "KeyRotate" or $security_event_type = /KeyRotationPolicy/ nocase or $security_event_type = "KeyRotateIfDue")
$difference = timestamp.diff(timestamp.current_seconds(), metadata.ingested_timestamp.seconds, "DAY")
$difference > 30
$label = principal.user.attribute.labels.key
$value = principal.user.attribute.labels.value
$user = strings.coalesce(principal.user.userid,principal.user.user_display_name,principal.user.email_addresses)
$key = target.resource.name
$target_key = target.resource.attribute.labels.key
$target_key = "Recipient Account Id"
$account_Id = target.resource.attribute.labels.value
$date = timestamp.get_date(metadata.ingested_timestamp.seconds)
match:
$date, $account_Id, $user, $IP, $key, $label, $value
outcome:
$age = max($difference)
order:
$age desc
金鑰解密失敗
$log_type = metadata.log_type
$app = target.application
($log_type = /AZURE_KEYVAULT_AUDIT|AKEYLESS_VAULT/ or $app = "kms.amazonaws.com")
principal.ip in cidr %PCI_Network_Ranges
$IP = principal.ip
$security_event_type = metadata.product_event_type
($security_event_type = "Decrypt" or $security_event_type = "KeyDecrypt")
$summary = security_result.summary
$description = metadata.description
$result_type = additional.fields["resultType"]
(re.regex($summary, `Fail`) nocase or re.regex($result_type, `Fail`) nocase)
$message = strings.coalesce(security_result.summary, metadata.description)
$key = target.resource.name
$label = principal.user.attribute.labels.key
$label = "principalId"
$value = principal.user.attribute.labels.value
$role = principal.user.role_name
$user = strings.coalesce(principal.user.userid,principal.user.user_display_name,principal.user.email_addresses)
match:
$user, $IP, $key, $role, $message, $label, $value
outcome:
$event_count = count(metadata.id)
order:
$event_count desc
金鑰刪除
$log_type = metadata.log_type
$app = target.application
($log_type = /AZURE_KEYVAULT_AUDIT|AKEYLESS_VAULT/ or $app = "kms.amazonaws.com")
principal.ip in cidr %PCI_Network_Ranges
$IP = principal.ip
$security_event_type = metadata.product_event_type
($security_event_type = "KeyDelete" or $security_event_type = "ScheduleKeyDeletion" or $security_event_type = "Delete")
$label = principal.user.attribute.labels.key
$user = strings.coalesce(principal.user.attribute.labels.value, principal.user.userid, principal.user.user_display_name,principal.user.email_addresses)
$key = target.resource.name
$date = timestamp.get_date(metadata.event_timestamp.seconds)
match:
$user, $IP, $key, $label, $date
outcome:
$event_count = count(metadata.id)
order:
$date, $event_count desc
加密強度較弱 / 未加密的通訊
$log_type = metadata.log_type
$app = target.application
($log_type = /AZURE_KEYVAULT_AUDIT|AKEYLESS_VAULT/ or $app = "kms.amazonaws.com")
principal.ip in cidr %PCI_Network_Ranges
$IP = principal.ip
$target_key = target.resource.attribute.labels.key
($target_key = "keyProperties_type" or $target_key = "requestParameters.keySpec")
$target_value = target.resource.attribute.labels.value
$target_value != /RSA|AES_256/ nocase
outcome:
$event_count = count_distinct(metadata.id)
通訊埠採用弱加密/ 未加密通訊
$IP = principal.ip
principal.ip in cidr %PCI_Network_Ranges
$event_type = metadata.event_type
($event_type >= 16000 and $event_type <= 16007)
$port = strings.concat(target.port, "")
$port = /(80|69|23|21|110|143|161|79|88)/
$direction = network.direction
match:
$port, $direction, $event_type
outcome:
$event_count = count(metadata.id)
order:
$event_count desc
limit:
10
金鑰已輪替
principal.ip in cidr %PCI_Network_Ranges
($log_type = /AZURE_KEYVAULT_AUDIT|AKEYLESS_VAULT/ or $app = "kms.amazonaws.com")
$log_type = metadata.log_type
$app = target.application
$IP = principal.ip
$security_event_type = metadata.product_event_type
($security_event_type = "RotateKeyOnDemand" or $security_event_type = "RotateKey" or $security_event_type = "KeyRotate" or $security_event_type = /KeyRotationPolicy/ nocase or $security_event_type = "KeyRotateIfDue")
$label = principal.user.attribute.labels.key
$value = principal.user.attribute.labels.value
$user = strings.coalesce(principal.user.userid, principal.user.user_display_name, principal.user.email_addresses)
$key = target.resource.name
match:
$user, $IP, $key, $label, $value
outcome:
$event_count = count(metadata.id)
order:
$event_count desc
已啟用金鑰
$log_type = metadata.log_type
$app = target.application
($log_type = /AZURE_KEYVAULT_AUDIT|AKEYLESS_VAULT/ or $app = "kms.amazonaws.com")
principal.ip in cidr %PCI_Network_Ranges
$IP = principal.ip
$security_event_type = metadata.product_event_type
($security_event_type = "EnableKey" or $security_event_type = "KeyEnable")
outcome:
$event_count = count(metadata.id)
金鑰解密成功
$log_type = metadata.log_type
$app = target.application
($log_type = /AZURE_KEYVAULT_AUDIT|AKEYLESS_VAULT/ or $app = "kms.amazonaws.com")
principal.ip in cidr %PCI_Network_Ranges
$IP = principal.ip
$security_event_type = metadata.product_event_type
($security_event_type = "Decrypt" or $security_event_type = "KeyDecrypt")
$summary = security_result.summary
$description = metadata.description
$result_type = additional.fields["resultType"]
(re.regex($summary, `Success`) nocase or re.regex($result_type, `Success`) nocase)
$message = strings.coalesce(security_result.summary, metadata.description)
$key = target.resource.name
$label = principal.user.attribute.labels.key
$value = principal.user.attribute.labels.value
$role = principal.user.role_name
$user = strings.coalesce(principal.user.userid,principal.user.user_display_name,principal.user.email_addresses)
match:
$user, $IP, $key, $role, $message, $label, $value
outcome:
$event_count = count(metadata.id)
order:
$event_count desc
limit:
50
新金鑰
$log_type = metadata.log_type
$app = target.application
($log_type = /AZURE_KEYVAULT_AUDIT|AKEYLESS_VAULT/ or $app = "kms.amazonaws.com")
principal.ip in cidr %PCI_Network_Ranges
$IP = principal.ip
$security_event_type = metadata.product_event_type
($security_event_type = "CreateKey" or $security_event_type = "KeyCreate")
outcome:
$event_count = count(metadata.id)
一段時間內加密 / 未加密的通訊
$log_type = metadata.log_type
$app = target.application
($log_type = /AZURE_KEYVAULT_AUDIT|AKEYLESS_VAULT/ or $app = "kms.amazonaws.com")
principal.ip in cidr %PCI_Network_Ranges
$IP = principal.ip
$target_key = target.resource.attribute.labels.key
($target_key = "keyProperties_type" or $target_key = "requestParameters.keySpec")
$target_value = target.resource.attribute.labels.value
$target_value != /RSA|AES_256/ nocase
$date = timestamp.get_date(metadata.event_timestamp.seconds)
match:
$date
outcome:
$event_count = count(metadata.id)
order:
$date asc
金鑰停用超過 30 天
$log_type = metadata.log_type
$app = target.application
($log_type = /AZURE_KEYVAULT_AUDIT|AKEYLESS_VAULT/ or $app = "kms.amazonaws.com")
principal.ip in cidr %PCI_Network_Ranges
$IP = principal.ip
$security_event_type = metadata.product_event_type
($security_event_type = "DisableKey" or $security_event_type = "Disable")
$difference = timestamp.diff(timestamp.current_seconds(), metadata.ingested_timestamp.seconds, "DAY")
$difference > 30
$account_id = target.resource.attribute.labels.value
$user = strings.coalesce(principal.user.userid, principal.user.user_display_name, principal.user.email_addresses)
$key = target.resource.name
match:
$account_id, $user, $IP, $key
outcome:
$age = max($difference)
order:
$age desc
加密強度較弱/ 未加密的通訊 (前 10 名使用者)
$log_type = metadata.log_type
$app = target.application
($log_type = /AZURE_KEYVAULT_AUDIT|AKEYLESS_VAULT/ or $app = "kms.amazonaws.com")
principal.ip in cidr %PCI_Network_Ranges
$IP = principal.ip
$target_key = target.resource.attribute.labels.key
($target_key = "keyProperties_type" or $target_key = "requestParameters.keySpec")
$target_value = target.resource.attribute.labels.value
$target_value != /RSA|AES_256/ nocase
$user = strings.coalesce(principal.user.attribute.labels.value, principal.user.userid, principal.user.user_display_name,principal.user.email_addresses)
match:
$user
outcome:
$event_count = count(metadata.id)
order:
$event_count desc
limit :
10
前 10 項重要作業
$log_type = metadata.log_type
$app = target.application
($log_type = /AZURE_KEYVAULT_AUDIT|AKEYLESS_VAULT/ or $app = "kms.amazonaws.com")
principal.ip in cidr %PCI_Network_Ranges
$IP = principal.ip
$security_event_type = metadata.product_event_type
match:
$security_event_type
outcome:
$event_count = count(metadata.id)
order:
$event_count desc
limit:
10
加密強度較弱 / 未加密的通訊前 10 大主機
$log_type = metadata.log_type
$app = target.application
($log_type = /AZURE_KEYVAULT_AUDIT|AKEYLESS_VAULT/ or $app = "kms.amazonaws.com")
principal.ip in cidr %PCI_Network_Ranges
$IP = principal.ip
$target_key = target.resource.attribute.labels.key
($target_key = "keyProperties_type" or $target_key = "requestParameters.keySpec")
$target_value = target.resource.attribute.labels.value
$target_value != /RSA|AES_256/
$hostname = strings.coalesce(principal.hostname, principal.asset.hostname)
$hostname != ""
match:
$hostname
outcome:
$event_count = count(metadata.id)
order:
$event_count desc
limit:
10
PCI - EDR 快訊總覽
這個資訊主頁會詳細顯示重要元素，例如資產、事件和偵測到的現有威脅。並使用參照清單 pci_assets，將資料範圍限定在 PCI 環境。
注意： 必須先建立必要的參照清單，這個資訊主頁中的圖表才會載入。
EDR 感應器數量
前 10 項技術
根據 EDR 警告判斷嚴重程度
一段時間內的 EDR 快訊總數
根據 EDR 快訊列出的前 10 位使用者
10 大策略
前 10 大 EDR 快訊
根據 EDR 警告排名前 10 的主機
作用中的 EDR 感應器
EDR 警告總數
圖表名稱
查詢示例
EDR 感應器數量
$event.metadata.log_type = /EDR|CS_DETECTS|FIREEYE_HX|MICROSOFT_DEFENDER_ENDPOINT|MICROSOFT_DEFENDER_IDENTITY|SENTINEL_DV/ nocase
strings.coalesce($event.principal.asset.hostname, $event.principal.hostname) in %PCI_Assets
outcome:
$Count = count_distinct($event.principal.asset.hostname)
前 10 項技術
$event.metadata.log_type = /EDR|CS_DETECTS|FIREEYE_HX|MICROSOFT_DEFENDER_ENDPOINT|MICROSOFT_DEFENDER_IDENTITY|SENTINEL_DV/ nocase
strings.coalesce($event.principal.asset.hostname, $event.principal.hostname) in %PCI_Assets
$Technique_ID = strings.coalesce($event.security_result.attack_details.techniques.id, $event.security_result.detection_fields["Technique ID"])
$Technique_Name = strings.coalesce($event.security_result.attack_details.techniques.name, $event.security_result.detection_fields["Technique"])
$Technique_ID != ""
$Technique_Name != ""
match:
$Technique_Name
outcome:
$Count = count($event.security_result.summary)
order:
$Count desc
limit:
107
根據 EDR 警告判斷嚴重程度
$event.metadata.log_type = /EDR|CS_DETECTS|FIREEYE_HX|MICROSOFT_DEFENDER_ENDPOINT|MICROSOFT_DEFENDER_IDENTITY|SENTINEL_DV/ nocase
strings.coalesce($event.principal.asset.hostname, $event.principal.hostname) in %PCI_Assets
$event.security_result.summary != ""
$Severity = $event.security_result.severity
match:
$Severity
outcome:
$Count = count($event.security_result.summary)
order:
$Severity asc
limit:
10
一段時間內的 EDR 快訊總數
$event.metadata.log_type = /EDR|CS_DETECTS|FIREEYE_HX|MICROSOFT_DEFENDER_ENDPOINT|MICROSOFT_DEFENDER_IDENTITY|SENTINEL_DV/ nocase
strings.coalesce($event.principal.asset.hostname, $event.principal.hostname) in %PCI_Assets
$Log_Type = $event.metadata.log_type
$Date = timestamp.get_date($event.metadata.event_timestamp.seconds)
match:
$Date, $Log_Type
outcome:
$Count = count($event.security_result.summary)
order:
$Date asc
根據 EDR 快訊列出的前 10 位使用者
$event.metadata.log_type = /EDR|CS_DETECTS|FIREEYE_HX|MICROSOFT_DEFENDER_ENDPOINT|MICROSOFT_DEFENDER_IDENTITY|SENTINEL_DV/ nocase
strings.coalesce($event.principal.asset.hostname, $event.principal.hostname) in %PCI_Assets
$User = $event.principal.user.user_display_name
$User != ""
match:
$User
outcome:
$Count = count($event.security_result.summary)
order:
$Count desc
limit:
10
10 大策略
$event.metadata.log_type = /EDR|CS_DETECTS|FIREEYE_HX|MICROSOFT_DEFENDER_ENDPOINT|MICROSOFT_DEFENDER_IDENTITY|SENTINEL_DV/ nocase
strings.coalesce($event.principal.asset.hostname, $event.principal.hostname) in %PCI_Assets
$Tactic_ID = strings.coalesce($event.security_result.attack_details.tactics.id, $event.security_result.detection_fields["Tactic ID"])
$Tactic_Name = strings.coalesce($event.security_result.attack_details.tactics.name, $event.security_result.detection_fields["Tactic"])
$Tactic_ID != ""
$Tactic_Name != ""
match:
$Tactic_Name
outcome:
$Count = count($event.security_result.summary)
order:
$Count desc
limit:
10
前 10 大 EDR 快訊
$event.metadata.log_type = /EDR|CS_DETECTS|FIREEYE_HX|MICROSOFT_DEFENDER_ENDPOINT|MICROSOFT_DEFENDER_IDENTITY|SENTINEL_DV/ nocase
strings.coalesce($event.principal.asset.hostname, $event.principal.hostname) in %PCI_Assets
$Log_Type = $event.metadata.log_type
$Detection = $event.security_result.summary
$Detection != ""
match:
$Detection, $Log_Type
outcome:
$Count = count($event.security_result.summary)
order:
$Count desc
limit:
10
根據 EDR 警告排名前 10 的主機
$event.metadata.log_type = /EDR|CS_DETECTS|FIREEYE_HX|MICROSOFT_DEFENDER_ENDPOINT|MICROSOFT_DEFENDER_IDENTITY|SENTINEL_DV/ nocase
strings.coalesce($event.principal.asset.hostname, $event.principal.hostname) in %PCI_Assets
$Hostname = strings.coalesce($event.principal.asset.hostname, $event.principal.hostname)
$Hostname != ""
match:
$Hostname
outcome:
$Count = count($event.security_result.summary)
order:
$Count desc
limit:
10
作用中的 EDR 感應器
$event.metadata.log_type = /EDR|CS_DETECTS|FIREEYE_HX|MICROSOFT_DEFENDER_ENDPOINT|MICROSOFT_DEFENDER_IDENTITY|SENTINEL_DV/ nocase
strings.coalesce($event.principal.asset.hostname, $event.principal.hostname) in %PCI_Assets
$EDR_Asset = strings.coalesce($event.principal.asset.hostname, $event.principal.hostname)
match:
$EDR_Asset
limit:
50
EDR 警告總數
$event.metadata.log_type = /EDR|CS_DETECTS|FIREEYE_HX|MICROSOFT_DEFENDER_ENDPOINT|MICROSOFT_DEFENDER_IDENTITY|SENTINEL_DV/ nocase
strings.coalesce($event.principal.asset.hostname, $event.principal.hostname) in %PCI_Assets
outcome:
$Count = count($event.security_result.summary)
PCI - Identity and Access
這個資訊主頁提供存取權管理和身分相關活動的詳細即時總覽，有助於遵守 PCI-DSS 規範。這份報表會彙整重要指標和洞察資料，包括使用者存取權、密碼變更和驗證事件。並使用參照清單 pci_assets，將資料範圍限定在 PCI 環境。
注意： 必須先建立必要的參照清單，這個資訊主頁中的圖表才會載入。
密碼永不到期的帳戶
變更使用者帳戶權限
已建立使用者帳戶
已刪除使用者帳戶
前 10 位使用者嘗試變更密碼的次數
密碼變更記錄
圖表名稱
查詢示例
密碼永不到期的帳戶
$event_type = metadata.event_type
$event_type >= 15000 and $event_type <= 15014
(principal.hostname in %PCI_Assets or principal.asset.hostname in %PCI_Assets or target.hostname in %PCI_Assets or target.asset.hostname in %PCI_Assets)
$hostname = strings.coalesce(principal.hostname,principal.asset.hostname,target.hostname,target.asset.hostname)
$vendor = metadata.vendor_name
$security_event_type = metadata.product_event_type
$key = principal.user.attribute.labels.key
$value = principal.user.attribute.labels.value
($key = /Password Never Expires/ nocase and $value = /true/ nocase)
$user = strings.coalesce(principal.user.userid,principal.user.user_display_name,principal.user.email_addresses)
$action = security_result.action
match:
$user, $hostname, $vendor, $action, $security_event_type
outcome:
$event_count = count_distinct(metadata.id)
order:
$event_count desc
變更使用者帳戶權限
$event_type = metadata.event_type
$event_type = "USER_CHANGE_PERMISSIONS"
(principal.hostname in %PCI_Assets or principal.asset.hostname in %PCI_Assets or target.hostname in %PCI_Assets or target.asset.hostname in %PCI_Assets)
$hostname = strings.coalesce(principal.hostname,principal.asset.hostname,target.hostname,target.asset.hostname)
$vendor = metadata.vendor_name
$user = strings.coalesce(principal.user.userid,principal.user.user_display_name,principal.user.email_addresses)
$action = security_result.action
match:
$user, $hostname, $vendor, $action
outcome:
$event_count = count(metadata.id)
order:
$event_count desc
已建立使用者帳戶
$event_type = metadata.event_type
$event_type = "USER_CREATION"
(principal.hostname in %PCI_Assets or principal.asset.hostname in %PCI_Assets or target.hostname in %PCI_Assets or target.asset.hostname in %PCI_Assets)
outcome:
$event_count = count(metadata.id)
已建立使用者帳戶
$event_type = metadata.event_type
$event_type = "USER_CREATION"
(principal.hostname in %PCI_Assets or principal.asset.hostname in %PCI_Assets or target.hostname in %PCI_Assets or target.asset.hostname in %PCI_Assets)
$hostname = strings.coalesce(principal.hostname,principal.asset.hostname,target.hostname,target.asset.hostname)
$vendor = metadata.vendor_name
$user = strings.coalesce(principal.user.userid,principal.user.user_display_name,principal.user.email_addresses)
$action = security_result.action
match:
$user, $hostname, $vendor, $action
outcome:
$event_count = count(metadata.id)
order:
$event_count desc
已刪除使用者帳戶
$event_type = metadata.event_type
$event_type = "USER_DELETION"
(principal.hostname in %PCI_Assets or principal.asset.hostname in %PCI_Assets or target.hostname in %PCI_Assets or target.asset.hostname in %PCI_Assets)
$hostname = strings.coalesce(principal.hostname,principal.asset.hostname,target.hostname,target.asset.hostname)
$vendor = metadata.vendor_name
$user = strings.coalesce(principal.user.userid,principal.user.user_display_name,principal.user.email_addresses)
$action = security_result.action
match:
$user, $hostname, $vendor, $action
outcome:
$event_count = count(metadata.id)
order:
$event_count desc
前 10 位使用者嘗試變更密碼的次數
$event_type = metadata.event_type
$event_type = "USER_CHANGE_PASSWORD"
(principal.hostname in %PCI_Assets or principal.asset.hostname in %PCI_Assets or target.hostname in %PCI_Assets or target.asset.hostname in %PCI_Assets)
$hostname = strings.coalesce(principal.hostname,principal.asset.hostname,target.hostname,target.asset.hostname)
$vendor = metadata.vendor_name
$user = strings.coalesce(principal.user.userid,principal.user.user_display_name,principal.user.email_addresses)
$action = security_result.action
match:
$user, $hostname, $vendor, $action
outcome:
$event_count = count(metadata.id)
order:
$event_count desc
limit:
10
已刪除使用者帳戶
$event_type = metadata.event_type
$event_type = "USER_DELETION"
(principal.hostname in %PCI_Assets or principal.asset.hostname in %PCI_Assets or target.hostname in %PCI_Assets or target.asset.hostname in %PCI_Assets)
outcome:
$event_count = count(metadata.id)
變更使用者帳戶權限
$event_type = metadata.event_type
$event_type = "USER_CHANGE_PERMISSIONS"
(principal.hostname in %PCI_Assets or principal.asset.hostname in %PCI_Assets or target.hostname in %PCI_Assets or target.asset.hostname in %PCI_Assets)
outcome:
$event_count = count(metadata.id)
密碼變更記錄
$event_type = metadata.event_type
$event_type = "USER_CHANGE_PASSWORD"
(principal.hostname in %PCI_Assets or principal.asset.hostname in %PCI_Assets or target.hostname in %PCI_Assets or target.asset.hostname in %PCI_Assets)
$hostname = strings.coalesce(principal.hostname,principal.asset.hostname,target.hostname,target.asset.hostname)
$date = timestamp.get_date(metadata.event_timestamp.seconds)
match:
$date
outcome:
$event_count = count(metadata.id)
order:
$date asc
PCI - 監控與測試
這個資訊主頁可監控及追蹤 PCI 環境中支付卡持卡人資料的存取情形。這項功能會使用參照清單 pci_assets 和 default_users 來設定資料範圍。
注意： 必須先建立必要的參照清單，這個資訊主頁中的圖表才會載入。
依事件類型劃分的歷來事件
依來源列出的熱門資源存取權
稽核記錄存取權
系統管理員存取權
流量最多的 10 位使用者
閒置使用者 (過去 7 天)
記錄清除偵測 (Windows 事件)
稽核政策變更
失敗的事件
依來源 IP 位址劃分的失敗事件總數
依事件類型劃分的事件總數
圖表名稱
查詢示例
依事件類型劃分的歷來事件
(metadata.event_type = "USER_UNCATEGORIZED"
or metadata.event_type = "USER_LOGIN"
or metadata.event_type = "USER_LOGOUT"
or metadata.event_type = "USER_CREATION"
or metadata.event_type = "USER_CHANGE_PASSWORD"
or metadata.event_type = "USER_CHANGE_PERMISSIONS"
or metadata.event_type = "USER_BADGE_IN"
or metadata.event_type = "USER_DELETION"
or metadata.event_type = "USER_RESOURCE_CREATION"
or metadata.event_type = "USER_RESOURCE_UPDATE_CONTENT"
or metadata.event_type = "USER_RESOURCE_UPDATE_PERMISSIONS"
or metadata.event_type = "USER_COMMUNICATION"
or metadata.event_type = "USER_RESOURCE_ACCESS"
or metadata.event_type = "USER_RESOURCE_DELETION")
(principal.hostname in %PCI_Assets or principal.asset.hostname in %PCI_Assets or target.hostname in %PCI_Assets or target.asset.hostname in %PCI_Assets)
$Event_Type = metadata.event_type
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
match:
$Date, $Event_Type
outcome:
$Count = count(metadata.id)
order:
$Date asc
依來源列出的熱門資源存取權
(metadata.event_type = "USER_UNCATEGORIZED"
or metadata.event_type = "USER_LOGIN"
or metadata.event_type = "USER_LOGOUT"
or metadata.event_type = "USER_CREATION"
or metadata.event_type = "USER_CHANGE_PASSWORD"
or metadata.event_type = "USER_CHANGE_PERMISSIONS"
or metadata.event_type = "USER_BADGE_IN"
or metadata.event_type = "USER_DELETION"
or metadata.event_type = "USER_RESOURCE_CREATION"
or metadata.event_type = "USER_RESOURCE_UPDATE_CONTENT"
or metadata.event_type = "USER_RESOURCE_UPDATE_PERMISSIONS"
or metadata.event_type = "USER_COMMUNICATION"
or metadata.event_type = "USER_RESOURCE_ACCESS"
or metadata.event_type = "USER_RESOURCE_DELETION")
(principal.hostname in %PCI_Assets or principal.asset.hostname in %PCI_Assets or target.hostname in %PCI_Assets or target.asset.hostname in %PCI_Assets)
$Source_IP = strings.coalesce(principal.ip, principal.asset.ip)
$Hostname = strings.coalesce(principal.hostname, principal.asset.hostname, target.hostname, target.asset.hostname)
$Vendor = metadata.vendor_name
$Action = security_result.action
$Source_User = strings.coalesce(principal.user.userid, principal.user.user_display_name, principal.user.email_addresses)
$Destination_User = strings.coalesce(target.user.userid, target.user.user_display_name, target.user.email_addresses)
match:
$Source_IP, $Hostname, $Source_User, $Destination_User, $Vendor, $Action
outcome:
$Count = count(metadata.id)
$Date = timestamp.get_timestamp(max(metadata.event_timestamp.seconds), "%F %T")
order:
$Count desc
稽核記錄存取權
(metadata.event_type = "SYSTEM_AUDIT_LOG_UNCATEGORIZED" or metadata.event_type = "SYSTEM_AUDIT_LOG_WIPE")
(principal.hostname in %PCI_Assets or principal.asset.hostname in %PCI_Assets or target.hostname in %PCI_Assets or target.asset.hostname in %PCI_Assets)
$Vendor = metadata.vendor_name
$Source_User = strings.coalesce(principal.user.userid, principal.user.user_display_name, principal.user.email_addresses)
$Destination_User = strings.coalesce(target.user.userid, target.user.user_display_name, target.user.email_addresses)
match:
$Source_User, $Destination_User, $Vendor
outcome:
$Count = count(metadata.id)
$Date = timestamp.get_timestamp(max(metadata.event_timestamp.seconds ), "%F %T")
order:
$Count desc
系統管理員存取權
(principal.hostname in %PCI_Assets or principal.asset.hostname in %PCI_Assets or target.hostname in %PCI_Assets or target.asset.hostname in %PCI_Assets)
$Event_Type = metadata.event_type
$Hostname = strings.coalesce(principal.hostname, principal.asset.hostname, target.hostname, target.asset.hostname)
$Vendor = metadata.vendor_name
$User = strings.coalesce(principal.user.userid, principal.user.user_display_name, principal.user.email_addresses, target.user.userid, target.user.user_display_name, target.user.email_addresses)
$User in %Default_Users
match:
$User, $Hostname, $Vendor, $Event_Type
outcome:
$Count = count(metadata.id)
$Date = timestamp.get_timestamp(max(metadata.event_timestamp.seconds ), "%F %T")
order:
$Count desc
流量最多的 10 位使用者
(metadata.event_type = "USER_UNCATEGORIZED"
or metadata.event_type = "USER_LOGIN"
or metadata.event_type = "USER_LOGOUT"
or metadata.event_type = "USER_CREATION"
or metadata.event_type = "USER_CHANGE_PASSWORD"
or metadata.event_type = "USER_CHANGE_PERMISSIONS"
or metadata.event_type = "USER_BADGE_IN"
or metadata.event_type = "USER_DELETION"
or metadata.event_type = "USER_RESOURCE_CREATION"
or metadata.event_type = "USER_RESOURCE_UPDATE_CONTENT"
or metadata.event_type = "USER_RESOURCE_UPDATE_PERMISSIONS"
or metadata.event_type = "USER_COMMUNICATION"
or metadata.event_type = "USER_RESOURCE_ACCESS"
or metadata.event_type = "USER_RESOURCE_DELETION")
(principal.hostname in %PCI_Assets or principal.asset.hostname in %PCI_Assets or target.hostname in %PCI_Assets or target.asset.hostname in %PCI_Assets)
$User = strings.coalesce(principal.user.userid, principal.user.user_display_name, principal.user.email_addresses, target.user.userid, target.user.user_display_name, target.user.email_addresses)
$Action = security_result.action
match:
$User, $Action
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
閒置使用者 (過去 7 天)
(metadata.event_type = "USER_UNCATEGORIZED"
or metadata.event_type = "USER_LOGIN"
or metadata.event_type = "USER_LOGOUT"
or metadata.event_type = "USER_CREATION"
or metadata.event_type = "USER_CHANGE_PASSWORD"
or metadata.event_type = "USER_CHANGE_PERMISSIONS"
or metadata.event_type = "USER_BADGE_IN"
or metadata.event_type = "USER_DELETION"
or metadata.event_type = "USER_RESOURCE_CREATION"
or metadata.event_type = "USER_RESOURCE_UPDATE_CONTENT"
or metadata.event_type = "USER_RESOURCE_UPDATE_PERMISSIONS"
or metadata.event_type = "USER_COMMUNICATION"
or metadata.event_type = "USER_RESOURCE_ACCESS"
or metadata.event_type = "USER_RESOURCE_DELETION")
(principal.hostname in %PCI_Assets or principal.asset.hostname in %PCI_Assets or target.hostname in %PCI_Assets or target.asset.hostname in %PCI_Assets)
principal.user.last_login_time.seconds > 0
$Event_Type = metadata.event_type
$User = strings.coalesce(principal.user.userid, principal.user.user_display_name, principal.user.email_addresses, target.user.userid, target.user.user_display_name, target.user.email_addresses)
$Time_Difference = cast.as_int((metadata.event_timestamp.seconds-principal.user.last_login_time.seconds)/86400)
match:
$User, $Time_Difference
outcome:
$Logtime = timestamp.get_timestamp(max(metadata.event_timestamp.seconds), "%F %T")
$Lastime = timestamp.get_timestamp(max(principal.user.last_login_time.seconds), "%F %T")
order:
$Time_Difference desc
記錄清除偵測 (Windows 事件)
metadata.log_type = "WINEVTLOG"
(metadata.product_event_type = "1102" or metadata.product_event_type = "104" or metadata.event_type = "SYSTEM_AUDIT_LOG_WIPE")
(principal.hostname in %PCI_Assets or principal.asset.hostname in %PCI_Assets or target.hostname in %PCI_Assets or target.asset.hostname in %PCI_Assets)
$Event_Type = metadata.event_type
$Security_Event_Type = metadata.product_event_type
$Hostname = strings.coalesce(principal.hostname,principal.asset.hostname,target.hostname,target.asset.hostname)
$Summary = strings.coalesce(metadata.description, security_result.summary, security_result.description)
match:
$Hostname, $Event_Type, $Security_Event_Type, $Summary
outcome:
$Count = count(metadata.id)
$Date = timestamp.get_timestamp(max(metadata.event_timestamp.seconds ), "%F %T")
order:
$Count desc
稽核政策變更
metadata.event_type = "SYSTEM_AUDIT_LOG_UNCATEGORIZED" or metadata.event_type = "STATUS_UPDATE"
(security_result.category_details = /AuditPolicyChanges/ nocase or strings.coalesce(metadata.description, security_result.description, security_result.summary, metadata.product_event_type) = /policy change/ nocase)
(principal.hostname in %PCI_Assets or principal.asset.hostname in %PCI_Assets or target.hostname in %PCI_Assets or target.asset.hostname in %PCI_Assets)
$Security_Event_Type = metadata.product_event_type
$Policy_Change = strings.coalesce(metadata.description, security_result.description, security_result.summary, security_result.category_details)
$Source_User = strings.coalesce(principal.user.userid, principal.user.user_display_name, principal.user.email_addresses)
$Destination_User = strings.coalesce(target.user.userid, target.user.user_display_name, target.user.email_addresses)
match:
$Source_User, $Destination_User, $Security_Event_Type, $Policy_Change
outcome:
$Count = count(metadata.id)
$Date = timestamp.get_timestamp(max(metadata.event_timestamp.seconds ), "%F %T")
order:
$Count desc
稽核政策變更
(metadata.event_type = "SYSTEM_AUDIT_LOG_UNCATEGORIZED" or metadata.event_type = "STATUS_UPDATE")
(security_result.category_details = /AuditPolicyChanges/ nocase or strings.coalesce(metadata.description, security_result.description, security_result.summary, metadata.product_event_type) = /policy change/ nocase)
(principal.hostname in %PCI_Assets or principal.asset.hostname in %PCI_Assets or target.hostname in %PCI_Assets or target.asset.hostname in %PCI_Assets)
outcome:
$Count = count(metadata.id)
失敗的事件
(metadata.event_type = "USER_UNCATEGORIZED"
or metadata.event_type = "USER_LOGIN"
or metadata.event_type = "USER_LOGOUT"
or metadata.event_type = "USER_CREATION"
or metadata.event_type = "USER_CHANGE_PASSWORD"
or metadata.event_type = "USER_CHANGE_PERMISSIONS"
or metadata.event_type = "USER_BADGE_IN"
or metadata.event_type = "USER_DELETION"
or metadata.event_type = "USER_RESOURCE_CREATION"
or metadata.event_type = "USER_RESOURCE_UPDATE_CONTENT"
or metadata.event_type = "USER_RESOURCE_UPDATE_PERMISSIONS"
or metadata.event_type = "USER_COMMUNICATION"
or metadata.event_type = "USER_RESOURCE_ACCESS"
or metadata.event_type = "USER_RESOURCE_DELETION")
security_result.action = "BLOCK"
(principal.hostname in %PCI_Assets or principal.asset.hostname in %PCI_Assets or target.hostname in %PCI_Assets or target.asset.hostname in %PCI_Assets)
outcome:
$Count = count(metadata.id)
依來源 IP 位址劃分的失敗事件總數
(metadata.event_type = "USER_UNCATEGORIZED"
or metadata.event_type = "USER_LOGIN"
or metadata.event_type = "USER_LOGOUT"
or metadata.event_type = "USER_CREATION"
or metadata.event_type = "USER_CHANGE_PASSWORD"
or metadata.event_type = "USER_CHANGE_PERMISSIONS"
or metadata.event_type = "USER_BADGE_IN"
or metadata.event_type = "USER_DELETION"
or metadata.event_type = "USER_RESOURCE_CREATION"
or metadata.event_type = "USER_RESOURCE_UPDATE_CONTENT"
or metadata.event_type = "USER_RESOURCE_UPDATE_PERMISSIONS"
or metadata.event_type = "USER_COMMUNICATION"
or metadata.event_type = "USER_RESOURCE_ACCESS"
or metadata.event_type = "USER_RESOURCE_DELETION")
security_result.action = "BLOCK"
(principal.hostname in %PCI_Assets or principal.asset.hostname in %PCI_Assets or target.hostname in %PCI_Assets or target.asset.hostname in %PCI_Assets)
$Hostname = strings.coalesce(principal.hostname, principal.asset.hostname, target.hostname, target.asset.hostname)
$Vendor = metadata.vendor_name
$Source_IP = strings.coalesce(principal.ip, principal.asset.ip)
$Source_User = strings.coalesce(principal.user.userid, principal.user.user_display_name, principal.user.email_addresses)
$Destination_User = strings.coalesce(target.user.userid, target.user.user_display_name, target.user.email_addresses)
match:
$Source_IP, $Source_User, $Destination_User, $Hostname, $Vendor, metadata.event_type
outcome:
$Count = count(metadata.id)
$Date = timestamp.get_timestamp(max(metadata.event_timestamp.seconds ), "%F %T")
order:
$Count desc
依事件類型劃分的事件總數
(metadata.event_type = "USER_UNCATEGORIZED"
or metadata.event_type = "USER_LOGIN"
or metadata.event_type = "USER_LOGOUT"
or metadata.event_type = "USER_CREATION"
or metadata.event_type = "USER_CHANGE_PASSWORD"
or metadata.event_type = "USER_CHANGE_PERMISSIONS"
or metadata.event_type = "USER_BADGE_IN"
or metadata.event_type = "USER_DELETION"
or metadata.event_type = "USER_RESOURCE_CREATION"
or metadata.event_type = "USER_RESOURCE_UPDATE_CONTENT"
or metadata.event_type = "USER_RESOURCE_UPDATE_PERMISSIONS"
or metadata.event_type = "USER_COMMUNICATION"
or metadata.event_type = "USER_RESOURCE_ACCESS"
or metadata.event_type = "USER_RESOURCE_DELETION")
(principal.hostname in %PCI_Assets or principal.asset.hostname in %PCI_Assets or target.hostname in %PCI_Assets or target.asset.hostname in %PCI_Assets)
$Event_Type = metadata.event_type
$Vendor = metadata.vendor_name
$Action = security_result.action
match:
$Event_Type, $Vendor, $Action
outcome:
$Count = count(metadata.id)
order:
$Count desc
PCI - 網路
這個資訊主頁提供特定介面 (來源或目的地) 的網路效能深入分析、熱門網路活動的即時資訊，以及流量趨勢和分析。並使用參照清單 pci_network_ranges 將資料範圍限定在 PCI 環境。
注意： 必須先建立必要的參照清單，這個資訊主頁中的圖表才會載入。
流量總數
依位置劃分的前 10 大目的地流量
前 10 大目的地的流量
觸發次數最多的前 10 項網路規則
前 10 大目的地通訊埠的流量
前 10 大網路活動
港口活動摘要
前 10 大通訊協定的流量
隨時間處理的網路資料 (傳送的位元組)
隨時間處理的網路資料 (接收的位元組)
網路流量變化趨勢
前 10 大來源通訊埠的流量
網路資產數量
依通訊協定劃分的流量變化趨勢
依動作劃分的流量變化趨勢
前 10 大來源的流量
圖表名稱
查詢示例
流量總數
$event.metadata.log_type = /ROUTER|SWITCH|DHCP|PROXY|NETWORK|VPN|FIREWALL|_FLOW|VPC|WIRELESS|IPS|IDS|ARUBA_EDGECONNECT_SDWAN|ARUBA_SWITCH|CISCO_APIC|CISCO_CALL_MANAGER|CISCO_DNAC|CISCO_ESTREAMER|CISCO_IOS|CISCO_PRIME|EFFICIENTIP_DDI|EXTREME_SWITCH|FORTINET_FORTIDDOS|FORTINET_FORTIMANAGER|ARUBA_CENTRAL|JUNIPER_JUNOS|JUNIPER_MIST|JUNIPER_SDWAN|NAGIOS|ARBOR_EDGE_DEFENSE|MICROSOFT_NPS|STEELHEAD|SHRUBBERY_TACACS|TRENDMICRO_DDI|VMWARE_NSX|WINDOWS_NET_POLICY_SERVER|ZYWALL|IMPERVA_FLEXPROTECT|PAN_IOT|NOZOMI_GUARDIAN|SURICATA_EVE|UMBRELLA_DNS|WINDOWS_SYSMON|COHESITY|RUBRIK|CISCO_MERAKI|CLAROTY_EMC|CLAROTY_CTD|HONEYD|AIRWATCH|IMPERVA_SECURESPHERE|SECURELINK|WALLIX_BASTION|CHECKPOINT_HARMONY|UNIFI_AP|DIGI_MODEMS|DESYNOVA_CONTIDO|CLOUDGENIX_SDWAN|JUNIPER_MX|SAP_WEBDISP|ADVA_FSP|HP_PROCURVE|VYOS|RSA_SECURID|HCNET_ACCOUNT_ADAPTER|INFOBLOX|VITALQIP|ASSET_STATIC_IP|BLUECAT_DDI|TWINGATE|SYMANTEC_VIP_AUTHHUB|ZSCALER_DECEPTION|BROCADE_SERVERIRON|KEMP_LOADBALANCER|A10_LOAD_BALANCER|AWS_ELB|F5_BIGIP_LTM|RADWARE_ALTEON|CITRIX_NETSCALER|AKAMAI_CLOUD_MONITOR|CISCO_ACE|GCP_LOADBALANCING|KERIOCONTROL|EXTRAHOP|NETFILTER_IPTABLES|CISCO_UMBRELLA_AUDIT|F5_AFM|NUTANIX_PRISM|SANGFOR_NGAF|VERCEL_WAF|PEPLINK_FW|NETDOCUMENTS|PAN_PANORAMA|PFSENSE|AZION|FIREEYE_PX|OPNSENSE|CISCO_FWSM|FORTINET_FORTIWEB|BARRACUDA_WAF|SYMANTEC_WSS|MENLO_SECURITY|DIGITALARTS_IFILTER|WEBMARSHAL|UMBRELLA_IP|AWS_SECURITY_HUB|EXTRAHOP|GUARDDUTY|MICROSOFT_ATA|ORCA|OSSEC|SURICATA_EVE|VMWARE_TANZU/ nocase
$event.principal.ip in cidr %PCI_Network_Ranges
or $event.principal.asset.ip in cidr %PCI_Network_Ranges
outcome:
$Count = count($event.network.direction)
依位置劃分的前 10 大目的地流量
$event.metadata.log_type = /ROUTER|SWITCH|DHCP|PROXY|NETWORK|VPN|FIREWALL|_FLOW|VPC|WIRELESS|IPS|IDS|ARUBA_EDGECONNECT_SDWAN|ARUBA_SWITCH|CISCO_APIC|CISCO_CALL_MANAGER|CISCO_DNAC|CISCO_ESTREAMER|CISCO_IOS|CISCO_PRIME|EFFICIENTIP_DDI|EXTREME_SWITCH|FORTINET_FORTIDDOS|FORTINET_FORTIMANAGER|ARUBA_CENTRAL|JUNIPER_JUNOS|JUNIPER_MIST|JUNIPER_SDWAN|NAGIOS|ARBOR_EDGE_DEFENSE|MICROSOFT_NPS|STEELHEAD|SHRUBBERY_TACACS|TRENDMICRO_DDI|VMWARE_NSX|WINDOWS_NET_POLICY_SERVER|ZYWALL|IMPERVA_FLEXPROTECT|PAN_IOT|NOZOMI_GUARDIAN|SURICATA_EVE|UMBRELLA_DNS|WINDOWS_SYSMON|COHESITY|RUBRIK|CISCO_MERAKI|CLAROTY_EMC|CLAROTY_CTD|HONEYD|AIRWATCH|IMPERVA_SECURESPHERE|SECURELINK|WALLIX_BASTION|CHECKPOINT_HARMONY|UNIFI_AP|DIGI_MODEMS|DESYNOVA_CONTIDO|CLOUDGENIX_SDWAN|JUNIPER_MX|SAP_WEBDISP|ADVA_FSP|HP_PROCURVE|VYOS|RSA_SECURID|HCNET_ACCOUNT_ADAPTER|INFOBLOX|VITALQIP|ASSET_STATIC_IP|BLUECAT_DDI|TWINGATE|SYMANTEC_VIP_AUTHHUB|ZSCALER_DECEPTION|BROCADE_SERVERIRON|KEMP_LOADBALANCER|A10_LOAD_BALANCER|AWS_ELB|F5_BIGIP_LTM|RADWARE_ALTEON|CITRIX_NETSCALER|AKAMAI_CLOUD_MONITOR|CISCO_ACE|GCP_LOADBALANCING|KERIOCONTROL|EXTRAHOP|NETFILTER_IPTABLES|CISCO_UMBRELLA_AUDIT|F5_AFM|NUTANIX_PRISM|SANGFOR_NGAF|VERCEL_WAF|PEPLINK_FW|NETDOCUMENTS|PAN_PANORAMA|PFSENSE|AZION|FIREEYE_PX|OPNSENSE|CISCO_FWSM|FORTINET_FORTIWEB|BARRACUDA_WAF|SYMANTEC_WSS|MENLO_SECURITY|DIGITALARTS_IFILTER|WEBMARSHAL|UMBRELLA_IP|AWS_SECURITY_HUB|EXTRAHOP|GUARDDUTY|MICROSOFT_ATA|ORCA|OSSEC|SURICATA_EVE|VMWARE_TANZU/ nocase
$event.principal.ip in cidr %PCI_Network_Ranges
or $event.principal.asset.ip in cidr %PCI_Network_Ranges
$event.target.ip != ""
$Countries = $event.target.location.country_or_region
$Latitude = $event.target.location.region_coordinates.latitude
$Longitude = $event.target.location.region_coordinates.longitude
$Countries != ""
match:
$Countries, $Latitude, $Longitude
outcome:
$Count = count($event.target.ip)
limit:
10
前 10 大目的地的流量
$event.metadata.log_type = /ROUTER|SWITCH|DHCP|PROXY|NETWORK|VPN|FIREWALL|_FLOW|VPC|WIRELESS|IPS|IDS|ARUBA_EDGECONNECT_SDWAN|ARUBA_SWITCH|CISCO_APIC|CISCO_CALL_MANAGER|CISCO_DNAC|CISCO_ESTREAMER|CISCO_IOS|CISCO_PRIME|EFFICIENTIP_DDI|EXTREME_SWITCH|FORTINET_FORTIDDOS|FORTINET_FORTIMANAGER|ARUBA_CENTRAL|JUNIPER_JUNOS|JUNIPER_MIST|JUNIPER_SDWAN|NAGIOS|ARBOR_EDGE_DEFENSE|MICROSOFT_NPS|STEELHEAD|SHRUBBERY_TACACS|TRENDMICRO_DDI|VMWARE_NSX|WINDOWS_NET_POLICY_SERVER|ZYWALL|IMPERVA_FLEXPROTECT|PAN_IOT|NOZOMI_GUARDIAN|SURICATA_EVE|UMBRELLA_DNS|WINDOWS_SYSMON|COHESITY|RUBRIK|CISCO_MERAKI|CLAROTY_EMC|CLAROTY_CTD|HONEYD|AIRWATCH|IMPERVA_SECURESPHERE|SECURELINK|WALLIX_BASTION|CHECKPOINT_HARMONY|UNIFI_AP|DIGI_MODEMS|DESYNOVA_CONTIDO|CLOUDGENIX_SDWAN|JUNIPER_MX|SAP_WEBDISP|ADVA_FSP|HP_PROCURVE|VYOS|RSA_SECURID|HCNET_ACCOUNT_ADAPTER|INFOBLOX|VITALQIP|ASSET_STATIC_IP|BLUECAT_DDI|TWINGATE|SYMANTEC_VIP_AUTHHUB|ZSCALER_DECEPTION|BROCADE_SERVERIRON|KEMP_LOADBALANCER|A10_LOAD_BALANCER|AWS_ELB|F5_BIGIP_LTM|RADWARE_ALTEON|CITRIX_NETSCALER|AKAMAI_CLOUD_MONITOR|CISCO_ACE|GCP_LOADBALANCING|KERIOCONTROL|EXTRAHOP|NETFILTER_IPTABLES|CISCO_UMBRELLA_AUDIT|F5_AFM|NUTANIX_PRISM|SANGFOR_NGAF|VERCEL_WAF|PEPLINK_FW|NETDOCUMENTS|PAN_PANORAMA|PFSENSE|AZION|FIREEYE_PX|OPNSENSE|CISCO_FWSM|FORTINET_FORTIWEB|BARRACUDA_WAF|SYMANTEC_WSS|MENLO_SECURITY|DIGITALARTS_IFILTER|WEBMARSHAL|UMBRELLA_IP|AWS_SECURITY_HUB|EXTRAHOP|GUARDDUTY|MICROSOFT_ATA|ORCA|OSSEC|SURICATA_EVE|VMWARE_TANZU/ nocase
$event.principal.ip in cidr %PCI_Network_Ranges
or $event.principal.asset.ip in cidr %PCI_Network_Ranges
$IP_Address = $event.target.ip
match:
$IP_Address
outcome:
$Count = count($event.metadata.id)
order:
$Count desc
limit:
10
觸發次數最多的前 10 項網路規則
$event.metadata.log_type = /ROUTER|SWITCH|DHCP|PROXY|NETWORK|VPN|FIREWALL|_FLOW|VPC|WIRELESS|IPS|IDS|ARUBA_EDGECONNECT_SDWAN|ARUBA_SWITCH|CISCO_APIC|CISCO_CALL_MANAGER|CISCO_DNAC|CISCO_ESTREAMER|CISCO_IOS|CISCO_PRIME|EFFICIENTIP_DDI|EXTREME_SWITCH|FORTINET_FORTIDDOS|FORTINET_FORTIMANAGER|ARUBA_CENTRAL|JUNIPER_JUNOS|JUNIPER_MIST|JUNIPER_SDWAN|NAGIOS|ARBOR_EDGE_DEFENSE|MICROSOFT_NPS|STEELHEAD|SHRUBBERY_TACACS|TRENDMICRO_DDI|VMWARE_NSX|WINDOWS_NET_POLICY_SERVER|ZYWALL|IMPERVA_FLEXPROTECT|PAN_IOT|NOZOMI_GUARDIAN|SURICATA_EVE|UMBRELLA_DNS|WINDOWS_SYSMON|COHESITY|RUBRIK|CISCO_MERAKI|CLAROTY_EMC|CLAROTY_CTD|HONEYD|AIRWATCH|IMPERVA_SECURESPHERE|SECURELINK|WALLIX_BASTION|CHECKPOINT_HARMONY|UNIFI_AP|DIGI_MODEMS|DESYNOVA_CONTIDO|CLOUDGENIX_SDWAN|JUNIPER_MX|SAP_WEBDISP|ADVA_FSP|HP_PROCURVE|VYOS|RSA_SECURID|HCNET_ACCOUNT_ADAPTER|INFOBLOX|VITALQIP|ASSET_STATIC_IP|BLUECAT_DDI|TWINGATE|SYMANTEC_VIP_AUTHHUB|ZSCALER_DECEPTION|BROCADE_SERVERIRON|KEMP_LOADBALANCER|A10_LOAD_BALANCER|AWS_ELB|F5_BIGIP_LTM|RADWARE_ALTEON|CITRIX_NETSCALER|AKAMAI_CLOUD_MONITOR|CISCO_ACE|GCP_LOADBALANCING|KERIOCONTROL|EXTRAHOP|NETFILTER_IPTABLES|CISCO_UMBRELLA_AUDIT|F5_AFM|NUTANIX_PRISM|SANGFOR_NGAF|VERCEL_WAF|PEPLINK_FW|NETDOCUMENTS|PAN_PANORAMA|PFSENSE|AZION|FIREEYE_PX|OPNSENSE|CISCO_FWSM|FORTINET_FORTIWEB|BARRACUDA_WAF|SYMANTEC_WSS|MENLO_SECURITY|DIGITALARTS_IFILTER|WEBMARSHAL|UMBRELLA_IP|AWS_SECURITY_HUB|EXTRAHOP|GUARDDUTY|MICROSOFT_ATA|ORCA|OSSEC|SURICATA_EVE|VMWARE_TANZU/ nocase
$event.principal.ip in cidr %PCI_Network_Ranges
or $event.principal.asset.ip in cidr %PCI_Network_Ranges
$event.metadata.event_type = "NETWORK_UNCATEGORIZED"
or $event.metadata.event_type = "NETWORK_FLOW"
or $event.metadata.event_type = "NETWORK_CONNECTION"
or $event.metadata.event_type = "NETWORK_FTP"
or $event.metadata.event_type = "NETWORK_DHCP"
or $event.metadata.event_type = "NETWORK_DNS"
or $event.metadata.event_type = "NETWORK_HTTP"
or $event.metadata.event_type = "NETWORK_SMTP"
or $event.metadata.event_type = "SCAN_NETWORK"
$Log_Type = $event.metadata.log_type
$Event_Type = $event.metadata.event_type
$Product_Network_Event = $event.security_result.rule_name
$Direction = $event.network.direction
$Product_Network_Event != ""
match:
$Event_Type, $Log_Type, $Direction, $Product_Network_Event
outcome:
$Count = count_distinct($event.metadata.id)
order:
$Count desc
limit:
10
前 10 大目的地通訊埠的流量
$event.metadata.log_type = /ROUTER|SWITCH|DHCP|PROXY|NETWORK|VPN|FIREWALL|_FLOW|VPC|WIRELESS|IPS|IDS|ARUBA_EDGECONNECT_SDWAN|ARUBA_SWITCH|CISCO_APIC|CISCO_CALL_MANAGER|CISCO_DNAC|CISCO_ESTREAMER|CISCO_IOS|CISCO_PRIME|EFFICIENTIP_DDI|EXTREME_SWITCH|FORTINET_FORTIDDOS|FORTINET_FORTIMANAGER|ARUBA_CENTRAL|JUNIPER_JUNOS|JUNIPER_MIST|JUNIPER_SDWAN|NAGIOS|ARBOR_EDGE_DEFENSE|MICROSOFT_NPS|STEELHEAD|SHRUBBERY_TACACS|TRENDMICRO_DDI|VMWARE_NSX|WINDOWS_NET_POLICY_SERVER|ZYWALL|IMPERVA_FLEXPROTECT|PAN_IOT|NOZOMI_GUARDIAN|SURICATA_EVE|UMBRELLA_DNS|WINDOWS_SYSMON|COHESITY|RUBRIK|CISCO_MERAKI|CLAROTY_EMC|CLAROTY_CTD|HONEYD|AIRWATCH|IMPERVA_SECURESPHERE|SECURELINK|WALLIX_BASTION|CHECKPOINT_HARMONY|UNIFI_AP|DIGI_MODEMS|DESYNOVA_CONTIDO|CLOUDGENIX_SDWAN|JUNIPER_MX|SAP_WEBDISP|ADVA_FSP|HP_PROCURVE|VYOS|RSA_SECURID|HCNET_ACCOUNT_ADAPTER|INFOBLOX|VITALQIP|ASSET_STATIC_IP|BLUECAT_DDI|TWINGATE|SYMANTEC_VIP_AUTHHUB|ZSCALER_DECEPTION|BROCADE_SERVERIRON|KEMP_LOADBALANCER|A10_LOAD_BALANCER|AWS_ELB|F5_BIGIP_LTM|RADWARE_ALTEON|CITRIX_NETSCALER|AKAMAI_CLOUD_MONITOR|CISCO_ACE|GCP_LOADBALANCING|KERIOCONTROL|EXTRAHOP|NETFILTER_IPTABLES|CISCO_UMBRELLA_AUDIT|F5_AFM|NUTANIX_PRISM|SANGFOR_NGAF|VERCEL_WAF|PEPLINK_FW|NETDOCUMENTS|PAN_PANORAMA|PFSENSE|AZION|FIREEYE_PX|OPNSENSE|CISCO_FWSM|FORTINET_FORTIWEB|BARRACUDA_WAF|SYMANTEC_WSS|MENLO_SECURITY|DIGITALARTS_IFILTER|WEBMARSHAL|UMBRELLA_IP|AWS_SECURITY_HUB|EXTRAHOP|GUARDDUTY|MICROSOFT_ATA|ORCA|OSSEC|SURICATA_EVE|VMWARE_TANZU/ nocase
$event.principal.ip in cidr %PCI_Network_Ranges
or $event.principal.asset.ip in cidr %PCI_Network_Ranges
$Ports = strings.concat($event.target.port, " ")
match:
$Ports
outcome:
$Count = count($event.metadata.id)
order:
$Count desc
limit:
10
前 10 大網路活動
$event.metadata.log_type = /ROUTER|SWITCH|DHCP|PROXY|NETWORK|VPN|FIREWALL|_FLOW|VPC|WIRELESS|IPS|IDS|ARUBA_EDGECONNECT_SDWAN|ARUBA_SWITCH|CISCO_APIC|CISCO_CALL_MANAGER|CISCO_DNAC|CISCO_ESTREAMER|CISCO_IOS|CISCO_PRIME|EFFICIENTIP_DDI|EXTREME_SWITCH|FORTINET_FORTIDDOS|FORTINET_FORTIMANAGER|ARUBA_CENTRAL|JUNIPER_JUNOS|JUNIPER_MIST|JUNIPER_SDWAN|NAGIOS|ARBOR_EDGE_DEFENSE|MICROSOFT_NPS|STEELHEAD|SHRUBBERY_TACACS|TRENDMICRO_DDI|VMWARE_NSX|WINDOWS_NET_POLICY_SERVER|ZYWALL|IMPERVA_FLEXPROTECT|PAN_IOT|NOZOMI_GUARDIAN|SURICATA_EVE|UMBRELLA_DNS|WINDOWS_SYSMON|COHESITY|RUBRIK|CISCO_MERAKI|CLAROTY_EMC|CLAROTY_CTD|HONEYD|AIRWATCH|IMPERVA_SECURESPHERE|SECURELINK|WALLIX_BASTION|CHECKPOINT_HARMONY|UNIFI_AP|DIGI_MODEMS|DESYNOVA_CONTIDO|CLOUDGENIX_SDWAN|JUNIPER_MX|SAP_WEBDISP|ADVA_FSP|HP_PROCURVE|VYOS|RSA_SECURID|HCNET_ACCOUNT_ADAPTER|INFOBLOX|VITALQIP|ASSET_STATIC_IP|BLUECAT_DDI|TWINGATE|SYMANTEC_VIP_AUTHHUB|ZSCALER_DECEPTION|BROCADE_SERVERIRON|KEMP_LOADBALANCER|A10_LOAD_BALANCER|AWS_ELB|F5_BIGIP_LTM|RADWARE_ALTEON|CITRIX_NETSCALER|AKAMAI_CLOUD_MONITOR|CISCO_ACE|GCP_LOADBALANCING|KERIOCONTROL|EXTRAHOP|NETFILTER_IPTABLES|CISCO_UMBRELLA_AUDIT|F5_AFM|NUTANIX_PRISM|SANGFOR_NGAF|VERCEL_WAF|PEPLINK_FW|NETDOCUMENTS|PAN_PANORAMA|PFSENSE|AZION|FIREEYE_PX|OPNSENSE|CISCO_FWSM|FORTINET_FORTIWEB|BARRACUDA_WAF|SYMANTEC_WSS|MENLO_SECURITY|DIGITALARTS_IFILTER|WEBMARSHAL|UMBRELLA_IP|AWS_SECURITY_HUB|EXTRAHOP|GUARDDUTY|MICROSOFT_ATA|ORCA|OSSEC|SURICATA_EVE|VMWARE_TANZU/ nocase
$event.principal.ip in cidr %PCI_Network_Ranges
or $event.principal.asset.ip in cidr %PCI_Network_Ranges
$Log_Type = $event.metadata.log_type
$Event_Type = $event.metadata.event_type
$Security_Action = $event.security_result.action
match:
$Event_Type, $Log_Type, $Security_Action
outcome:
$Count = count($event.metadata.event_type)
order:
$Count desc
limit:
10
港口活動摘要
$event.metadata.log_type = /ROUTER|SWITCH|DHCP|PROXY|NETWORK|VPN|FIREWALL|_FLOW|VPC|WIRELESS|IPS|IDS|ARUBA_EDGECONNECT_SDWAN|ARUBA_SWITCH|CISCO_APIC|CISCO_CALL_MANAGER|CISCO_DNAC|CISCO_ESTREAMER|CISCO_IOS|CISCO_PRIME|EFFICIENTIP_DDI|EXTREME_SWITCH|FORTINET_FORTIDDOS|FORTINET_FORTIMANAGER|ARUBA_CENTRAL|JUNIPER_JUNOS|JUNIPER_MIST|JUNIPER_SDWAN|NAGIOS|ARBOR_EDGE_DEFENSE|MICROSOFT_NPS|STEELHEAD|SHRUBBERY_TACACS|TRENDMICRO_DDI|VMWARE_NSX|WINDOWS_NET_POLICY_SERVER|ZYWALL|IMPERVA_FLEXPROTECT|PAN_IOT|NOZOMI_GUARDIAN|SURICATA_EVE|UMBRELLA_DNS|WINDOWS_SYSMON|COHESITY|RUBRIK|CISCO_MERAKI|CLAROTY_EMC|CLAROTY_CTD|HONEYD|AIRWATCH|IMPERVA_SECURESPHERE|SECURELINK|WALLIX_BASTION|CHECKPOINT_HARMONY|UNIFI_AP|DIGI_MODEMS|DESYNOVA_CONTIDO|CLOUDGENIX_SDWAN|JUNIPER_MX|SAP_WEBDISP|ADVA_FSP|HP_PROCURVE|VYOS|RSA_SECURID|HCNET_ACCOUNT_ADAPTER|INFOBLOX|VITALQIP|ASSET_STATIC_IP|BLUECAT_DDI|TWINGATE|SYMANTEC_VIP_AUTHHUB|ZSCALER_DECEPTION|BROCADE_SERVERIRON|KEMP_LOADBALANCER|A10_LOAD_BALANCER|AWS_ELB|F5_BIGIP_LTM|RADWARE_ALTEON|CITRIX_NETSCALER|AKAMAI_CLOUD_MONITOR|CISCO_ACE|GCP_LOADBALANCING|KERIOCONTROL|EXTRAHOP|NETFILTER_IPTABLES|CISCO_UMBRELLA_AUDIT|F5_AFM|NUTANIX_PRISM|SANGFOR_NGAF|VERCEL_WAF|PEPLINK_FW|NETDOCUMENTS|PAN_PANORAMA|PFSENSE|AZION|FIREEYE_PX|OPNSENSE|CISCO_FWSM|FORTINET_FORTIWEB|BARRACUDA_WAF|SYMANTEC_WSS|MENLO_SECURITY|DIGITALARTS_IFILTER|WEBMARSHAL|UMBRELLA_IP|AWS_SECURITY_HUB|EXTRAHOP|GUARDDUTY|MICROSOFT_ATA|ORCA|OSSEC|SURICATA_EVE|VMWARE_TANZU/ nocase
$event.principal.ip in cidr %PCI_Network_Ranges
or $event.principal.asset.ip in cidr %PCI_Network_Ranges
$Source_Port = $event.principal.port
$Target_Port = $event.target.port
$Direction = $event.network.direction
$Event_Type = $event.metadata.event_type
match:
$Source_Port, $Direction, $Target_Port, $Event_Type
outcome:
$Count = count($event.metadata.id)
order:
$Count desc
limit:
50
前 10 大通訊協定的流量
$event.metadata.log_type = /ROUTER|SWITCH|DHCP|PROXY|NETWORK|VPN|FIREWALL|_FLOW|VPC|WIRELESS|IPS|IDS|ARUBA_EDGECONNECT_SDWAN|ARUBA_SWITCH|CISCO_APIC|CISCO_CALL_MANAGER|CISCO_DNAC|CISCO_ESTREAMER|CISCO_IOS|CISCO_PRIME|EFFICIENTIP_DDI|EXTREME_SWITCH|FORTINET_FORTIDDOS|FORTINET_FORTIMANAGER|ARUBA_CENTRAL|JUNIPER_JUNOS|JUNIPER_MIST|JUNIPER_SDWAN|NAGIOS|ARBOR_EDGE_DEFENSE|MICROSOFT_NPS|STEELHEAD|SHRUBBERY_TACACS|TRENDMICRO_DDI|VMWARE_NSX|WINDOWS_NET_POLICY_SERVER|ZYWALL|IMPERVA_FLEXPROTECT|PAN_IOT|NOZOMI_GUARDIAN|SURICATA_EVE|UMBRELLA_DNS|WINDOWS_SYSMON|COHESITY|RUBRIK|CISCO_MERAKI|CLAROTY_EMC|CLAROTY_CTD|HONEYD|AIRWATCH|IMPERVA_SECURESPHERE|SECURELINK|WALLIX_BASTION|CHECKPOINT_HARMONY|UNIFI_AP|DIGI_MODEMS|DESYNOVA_CONTIDO|CLOUDGENIX_SDWAN|JUNIPER_MX|SAP_WEBDISP|ADVA_FSP|HP_PROCURVE|VYOS|RSA_SECURID|HCNET_ACCOUNT_ADAPTER|INFOBLOX|VITALQIP|ASSET_STATIC_IP|BLUECAT_DDI|TWINGATE|SYMANTEC_VIP_AUTHHUB|ZSCALER_DECEPTION|BROCADE_SERVERIRON|KEMP_LOADBALANCER|A10_LOAD_BALANCER|AWS_ELB|F5_BIGIP_LTM|RADWARE_ALTEON|CITRIX_NETSCALER|AKAMAI_CLOUD_MONITOR|CISCO_ACE|GCP_LOADBALANCING|KERIOCONTROL|EXTRAHOP|NETFILTER_IPTABLES|CISCO_UMBRELLA_AUDIT|F5_AFM|NUTANIX_PRISM|SANGFOR_NGAF|VERCEL_WAF|PEPLINK_FW|NETDOCUMENTS|PAN_PANORAMA|PFSENSE|AZION|FIREEYE_PX|OPNSENSE|CISCO_FWSM|FORTINET_FORTIWEB|BARRACUDA_WAF|SYMANTEC_WSS|MENLO_SECURITY|DIGITALARTS_IFILTER|WEBMARSHAL|UMBRELLA_IP|AWS_SECURITY_HUB|EXTRAHOP|GUARDDUTY|MICROSOFT_ATA|ORCA|OSSEC|SURICATA_EVE|VMWARE_TANZU/ nocase
$event.principal.ip in cidr %PCI_Network_Ranges
or $event.principal.asset.ip in cidr %PCI_Network_Ranges
$Log_Type = $event.metadata.log_type
$Protocol = $event.network.ip_protocol
$Direction = $event.network.direction
match:
$Protocol, $Direction
outcome:
$Count = count($event.metadata.id)
order:
$Count desc
limit:
10
隨時間處理的網路資料 (傳送的位元組)
$event.metadata.log_type = /ROUTER|SWITCH|DHCP|PROXY|NETWORK|VPN|FIREWALL|_FLOW|VPC|WIRELESS|IPS|IDS|ARUBA_EDGECONNECT_SDWAN|ARUBA_SWITCH|CISCO_APIC|CISCO_CALL_MANAGER|CISCO_DNAC|CISCO_ESTREAMER|CISCO_IOS|CISCO_PRIME|EFFICIENTIP_DDI|EXTREME_SWITCH|FORTINET_FORTIDDOS|FORTINET_FORTIMANAGER|ARUBA_CENTRAL|JUNIPER_JUNOS|JUNIPER_MIST|JUNIPER_SDWAN|NAGIOS|ARBOR_EDGE_DEFENSE|MICROSOFT_NPS|STEELHEAD|SHRUBBERY_TACACS|TRENDMICRO_DDI|VMWARE_NSX|WINDOWS_NET_POLICY_SERVER|ZYWALL|IMPERVA_FLEXPROTECT|PAN_IOT|NOZOMI_GUARDIAN|SURICATA_EVE|UMBRELLA_DNS|WINDOWS_SYSMON|COHESITY|RUBRIK|CISCO_MERAKI|CLAROTY_EMC|CLAROTY_CTD|HONEYD|AIRWATCH|IMPERVA_SECURESPHERE|SECURELINK|WALLIX_BASTION|CHECKPOINT_HARMONY|UNIFI_AP|DIGI_MODEMS|DESYNOVA_CONTIDO|CLOUDGENIX_SDWAN|JUNIPER_MX|SAP_WEBDISP|ADVA_FSP|HP_PROCURVE|VYOS|RSA_SECURID|HCNET_ACCOUNT_ADAPTER|INFOBLOX|VITALQIP|ASSET_STATIC_IP|BLUECAT_DDI|TWINGATE|SYMANTEC_VIP_AUTHHUB|ZSCALER_DECEPTION|BROCADE_SERVERIRON|KEMP_LOADBALANCER|A10_LOAD_BALANCER|AWS_ELB|F5_BIGIP_LTM|RADWARE_ALTEON|CITRIX_NETSCALER|AKAMAI_CLOUD_MONITOR|CISCO_ACE|GCP_LOADBALANCING|KERIOCONTROL|EXTRAHOP|NETFILTER_IPTABLES|CISCO_UMBRELLA_AUDIT|F5_AFM|NUTANIX_PRISM|SANGFOR_NGAF|VERCEL_WAF|PEPLINK_FW|NETDOCUMENTS|PAN_PANORAMA|PFSENSE|AZION|FIREEYE_PX|OPNSENSE|CISCO_FWSM|FORTINET_FORTIWEB|BARRACUDA_WAF|SYMANTEC_WSS|MENLO_SECURITY|DIGITALARTS_IFILTER|WEBMARSHAL|UMBRELLA_IP|AWS_SECURITY_HUB|EXTRAHOP|GUARDDUTY|MICROSOFT_ATA|ORCA|OSSEC|SURICATA_EVE|VMWARE_TANZU/ nocase
$event.principal.ip in cidr %PCI_Network_Ranges
or $event.principal.asset.ip in cidr %PCI_Network_Ranges
$Log_Type = $event.metadata.log_type
$Date = timestamp.get_date($event.metadata.event_timestamp.seconds)
match:
$Date, $Log_Type
outcome:
$Total_Bytes = sum($event.network.sent_bytes)
$GB = math.ceil($Total_Bytes / 1073741824)
order:
$Date asc
limit:
50
隨時間處理的網路資料 (接收的位元組)
$event.metadata.log_type = /ROUTER|SWITCH|DHCP|PROXY|NETWORK|VPN|FIREWALL|_FLOW|VPC|WIRELESS|IPS|IDS|ARUBA_EDGECONNECT_SDWAN|ARUBA_SWITCH|CISCO_APIC|CISCO_CALL_MANAGER|CISCO_DNAC|CISCO_ESTREAMER|CISCO_IOS|CISCO_PRIME|EFFICIENTIP_DDI|EXTREME_SWITCH|FORTINET_FORTIDDOS|FORTINET_FORTIMANAGER|ARUBA_CENTRAL|JUNIPER_JUNOS|JUNIPER_MIST|JUNIPER_SDWAN|NAGIOS|ARBOR_EDGE_DEFENSE|MICROSOFT_NPS|STEELHEAD|SHRUBBERY_TACACS|TRENDMICRO_DDI|VMWARE_NSX|WINDOWS_NET_POLICY_SERVER|ZYWALL|IMPERVA_FLEXPROTECT|PAN_IOT|NOZOMI_GUARDIAN|SURICATA_EVE|UMBRELLA_DNS|WINDOWS_SYSMON|COHESITY|RUBRIK|CISCO_MERAKI|CLAROTY_EMC|CLAROTY_CTD|HONEYD|AIRWATCH|IMPERVA_SECURESPHERE|SECURELINK|WALLIX_BASTION|CHECKPOINT_HARMONY|UNIFI_AP|DIGI_MODEMS|DESYNOVA_CONTIDO|CLOUDGENIX_SDWAN|JUNIPER_MX|SAP_WEBDISP|ADVA_FSP|HP_PROCURVE|VYOS|RSA_SECURID|HCNET_ACCOUNT_ADAPTER|INFOBLOX|VITALQIP|ASSET_STATIC_IP|BLUECAT_DDI|TWINGATE|SYMANTEC_VIP_AUTHHUB|ZSCALER_DECEPTION|BROCADE_SERVERIRON|KEMP_LOADBALANCER|A10_LOAD_BALANCER|AWS_ELB|F5_BIGIP_LTM|RADWARE_ALTEON|CITRIX_NETSCALER|AKAMAI_CLOUD_MONITOR|CISCO_ACE|GCP_LOADBALANCING|KERIOCONTROL|EXTRAHOP|NETFILTER_IPTABLES|CISCO_UMBRELLA_AUDIT|F5_AFM|NUTANIX_PRISM|SANGFOR_NGAF|VERCEL_WAF|PEPLINK_FW|NETDOCUMENTS|PAN_PANORAMA|PFSENSE|AZION|FIREEYE_PX|OPNSENSE|CISCO_FWSM|FORTINET_FORTIWEB|BARRACUDA_WAF|SYMANTEC_WSS|MENLO_SECURITY|DIGITALARTS_IFILTER|WEBMARSHAL|UMBRELLA_IP|AWS_SECURITY_HUB|EXTRAHOP|GUARDDUTY|MICROSOFT_ATA|ORCA|OSSEC|SURICATA_EVE|VMWARE_TANZU/ nocase
$event.principal.ip in cidr %PCI_Network_Ranges
or $event.principal.asset.ip in cidr %PCI_Network_Ranges
$Log_Type = $event.metadata.log_type
$Date = timestamp.get_date($event.metadata.event_timestamp.seconds)
match:
$Date, $Log_Type
outcome:
$Total_Bytes = sum($event.network.received_bytes)
$GB = math.ceil($Total_Bytes / 1073741824)
order:
$Date asc
limit:
50
網路流量變化趨勢
$event.metadata.log_type = /ROUTER|SWITCH|DHCP|PROXY|NETWORK|VPN|FIREWALL|_FLOW|VPC|WIRELESS|IPS|IDS|ARUBA_EDGECONNECT_SDWAN|ARUBA_SWITCH|CISCO_APIC|CISCO_CALL_MANAGER|CISCO_DNAC|CISCO_ESTREAMER|CISCO_IOS|CISCO_PRIME|EFFICIENTIP_DDI|EXTREME_SWITCH|FORTINET_FORTIDDOS|FORTINET_FORTIMANAGER|ARUBA_CENTRAL|JUNIPER_JUNOS|JUNIPER_MIST|JUNIPER_SDWAN|NAGIOS|ARBOR_EDGE_DEFENSE|MICROSOFT_NPS|STEELHEAD|SHRUBBERY_TACACS|TRENDMICRO_DDI|VMWARE_NSX|WINDOWS_NET_POLICY_SERVER|ZYWALL|IMPERVA_FLEXPROTECT|PAN_IOT|NOZOMI_GUARDIAN|SURICATA_EVE|UMBRELLA_DNS|WINDOWS_SYSMON|COHESITY|RUBRIK|CISCO_MERAKI|CLAROTY_EMC|CLAROTY_CTD|HONEYD|AIRWATCH|IMPERVA_SECURESPHERE|SECURELINK|WALLIX_BASTION|CHECKPOINT_HARMONY|UNIFI_AP|DIGI_MODEMS|DESYNOVA_CONTIDO|CLOUDGENIX_SDWAN|JUNIPER_MX|SAP_WEBDISP|ADVA_FSP|HP_PROCURVE|VYOS|RSA_SECURID|HCNET_ACCOUNT_ADAPTER|INFOBLOX|VITALQIP|ASSET_STATIC_IP|BLUECAT_DDI|TWINGATE|SYMANTEC_VIP_AUTHHUB|ZSCALER_DECEPTION|BROCADE_SERVERIRON|KEMP_LOADBALANCER|A10_LOAD_BALANCER|AWS_ELB|F5_BIGIP_LTM|RADWARE_ALTEON|CITRIX_NETSCALER|AKAMAI_CLOUD_MONITOR|CISCO_ACE|GCP_LOADBALANCING|KERIOCONTROL|EXTRAHOP|NETFILTER_IPTABLES|CISCO_UMBRELLA_AUDIT|F5_AFM|NUTANIX_PRISM|SANGFOR_NGAF|VERCEL_WAF|PEPLINK_FW|NETDOCUMENTS|PAN_PANORAMA|PFSENSE|AZION|FIREEYE_PX|OPNSENSE|CISCO_FWSM|FORTINET_FORTIWEB|BARRACUDA_WAF|SYMANTEC_WSS|MENLO_SECURITY|DIGITALARTS_IFILTER|WEBMARSHAL|UMBRELLA_IP|AWS_SECURITY_HUB|EXTRAHOP|GUARDDUTY|MICROSOFT_ATA|ORCA|OSSEC|SURICATA_EVE|VMWARE_TANZU/ nocase
$event.principal.ip in cidr %PCI_Network_Ranges
or $event.principal.asset.ip in cidr %PCI_Network_Ranges
$Direction = $event.network.direction
$Date = timestamp.get_date($event.metadata.event_timestamp.seconds)
match:
$Date, $Direction
outcome:
$Count = count($event.metadata.id)
order:
$Date asc
前 10 大來源通訊埠的流量
$event.metadata.log_type = /ROUTER|SWITCH|DHCP|PROXY|NETWORK|VPN|FIREWALL|_FLOW|VPC|WIRELESS|IPS|IDS|ARUBA_EDGECONNECT_SDWAN|ARUBA_SWITCH|CISCO_APIC|CISCO_CALL_MANAGER|CISCO_DNAC|CISCO_ESTREAMER|CISCO_IOS|CISCO_PRIME|EFFICIENTIP_DDI|EXTREME_SWITCH|FORTINET_FORTIDDOS|FORTINET_FORTIMANAGER|ARUBA_CENTRAL|JUNIPER_JUNOS|JUNIPER_MIST|JUNIPER_SDWAN|NAGIOS|ARBOR_EDGE_DEFENSE|MICROSOFT_NPS|STEELHEAD|SHRUBBERY_TACACS|TRENDMICRO_DDI|VMWARE_NSX|WINDOWS_NET_POLICY_SERVER|ZYWALL|IMPERVA_FLEXPROTECT|PAN_IOT|NOZOMI_GUARDIAN|SURICATA_EVE|UMBRELLA_DNS|WINDOWS_SYSMON|COHESITY|RUBRIK|CISCO_MERAKI|CLAROTY_EMC|CLAROTY_CTD|HONEYD|AIRWATCH|IMPERVA_SECURESPHERE|SECURELINK|WALLIX_BASTION|CHECKPOINT_HARMONY|UNIFI_AP|DIGI_MODEMS|DESYNOVA_CONTIDO|CLOUDGENIX_SDWAN|JUNIPER_MX|SAP_WEBDISP|ADVA_FSP|HP_PROCURVE|VYOS|RSA_SECURID|HCNET_ACCOUNT_ADAPTER|INFOBLOX|VITALQIP|ASSET_STATIC_IP|BLUECAT_DDI|TWINGATE|SYMANTEC_VIP_AUTHHUB|ZSCALER_DECEPTION|BROCADE_SERVERIRON|KEMP_LOADBALANCER|A10_LOAD_BALANCER|AWS_ELB|F5_BIGIP_LTM|RADWARE_ALTEON|CITRIX_NETSCALER|AKAMAI_CLOUD_MONITOR|CISCO_ACE|GCP_LOADBALANCING|KERIOCONTROL|EXTRAHOP|NETFILTER_IPTABLES|CISCO_UMBRELLA_AUDIT|F5_AFM|NUTANIX_PRISM|SANGFOR_NGAF|VERCEL_WAF|PEPLINK_FW|NETDOCUMENTS|PAN_PANORAMA|PFSENSE|AZION|FIREEYE_PX|OPNSENSE|CISCO_FWSM|FORTINET_FORTIWEB|BARRACUDA_WAF|SYMANTEC_WSS|MENLO_SECURITY|DIGITALARTS_IFILTER|WEBMARSHAL|UMBRELLA_IP|AWS_SECURITY_HUB|EXTRAHOP|GUARDDUTY|MICROSOFT_ATA|ORCA|OSSEC|SURICATA_EVE|VMWARE_TANZU/ nocase
$event.principal.ip in cidr %PCI_Network_Ranges
or $event.principal.asset.ip in cidr %PCI_Network_Ranges
$Ports = strings.concat($event.principal.port, " ")
match:
$Ports
outcome:
$Count = count($event.metadata.id)
order:
$Count desc
limit:
10
網路資產數量
$event.metadata.log_type = /ROUTER|SWITCH|DHCP|PROXY|NETWORK|VPN|FIREWALL|_FLOW|VPC|WIRELESS|IPS|IDS|ARUBA_EDGECONNECT_SDWAN|ARUBA_SWITCH|CISCO_APIC|CISCO_CALL_MANAGER|CISCO_DNAC|CISCO_ESTREAMER|CISCO_IOS|CISCO_PRIME|EFFICIENTIP_DDI|EXTREME_SWITCH|FORTINET_FORTIDDOS|FORTINET_FORTIMANAGER|ARUBA_CENTRAL|JUNIPER_JUNOS|JUNIPER_MIST|JUNIPER_SDWAN|NAGIOS|ARBOR_EDGE_DEFENSE|MICROSOFT_NPS|STEELHEAD|SHRUBBERY_TACACS|TRENDMICRO_DDI|VMWARE_NSX|WINDOWS_NET_POLICY_SERVER|ZYWALL|IMPERVA_FLEXPROTECT|PAN_IOT|NOZOMI_GUARDIAN|SURICATA_EVE|UMBRELLA_DNS|WINDOWS_SYSMON|COHESITY|RUBRIK|CISCO_MERAKI|CLAROTY_EMC|CLAROTY_CTD|HONEYD|AIRWATCH|IMPERVA_SECURESPHERE|SECURELINK|WALLIX_BASTION|CHECKPOINT_HARMONY|UNIFI_AP|DIGI_MODEMS|DESYNOVA_CONTIDO|CLOUDGENIX_SDWAN|JUNIPER_MX|SAP_WEBDISP|ADVA_FSP|HP_PROCURVE|VYOS|RSA_SECURID|HCNET_ACCOUNT_ADAPTER|INFOBLOX|VITALQIP|ASSET_STATIC_IP|BLUECAT_DDI|TWINGATE|SYMANTEC_VIP_AUTHHUB|ZSCALER_DECEPTION|BROCADE_SERVERIRON|KEMP_LOADBALANCER|A10_LOAD_BALANCER|AWS_ELB|F5_BIGIP_LTM|RADWARE_ALTEON|CITRIX_NETSCALER|AKAMAI_CLOUD_MONITOR|CISCO_ACE|GCP_LOADBALANCING|KERIOCONTROL|EXTRAHOP|NETFILTER_IPTABLES|CISCO_UMBRELLA_AUDIT|F5_AFM|NUTANIX_PRISM|SANGFOR_NGAF|VERCEL_WAF|PEPLINK_FW|NETDOCUMENTS|PAN_PANORAMA|PFSENSE|AZION|FIREEYE_PX|OPNSENSE|CISCO_FWSM|FORTINET_FORTIWEB|BARRACUDA_WAF|SYMANTEC_WSS|MENLO_SECURITY|DIGITALARTS_IFILTER|WEBMARSHAL|UMBRELLA_IP|AWS_SECURITY_HUB|EXTRAHOP|GUARDDUTY|MICROSOFT_ATA|ORCA|OSSEC|SURICATA_EVE|VMWARE_TANZU/ nocase
$event.principal.ip in cidr %PCI_Network_Ranges
or $event.principal.asset.ip in cidr %PCI_Network_Ranges
$Network_Asset = strings.coalesce($event.principal.ip, $event.principal.asset.ip)
outcome:
$Count = count_distinct(strings.coalesce($event.principal.ip, $event.principal.asset.ip))
依通訊協定劃分的流量變化趨勢
$event.metadata.log_type = /ROUTER|SWITCH|DHCP|PROXY|NETWORK|VPN|FIREWALL|_FLOW|VPC|WIRELESS|IPS|IDS|ARUBA_EDGECONNECT_SDWAN|ARUBA_SWITCH|CISCO_APIC|CISCO_CALL_MANAGER|CISCO_DNAC|CISCO_ESTREAMER|CISCO_IOS|CISCO_PRIME|EFFICIENTIP_DDI|EXTREME_SWITCH|FORTINET_FORTIDDOS|FORTINET_FORTIMANAGER|ARUBA_CENTRAL|JUNIPER_JUNOS|JUNIPER_MIST|JUNIPER_SDWAN|NAGIOS|ARBOR_EDGE_DEFENSE|MICROSOFT_NPS|STEELHEAD|SHRUBBERY_TACACS|TRENDMICRO_DDI|VMWARE_NSX|WINDOWS_NET_POLICY_SERVER|ZYWALL|IMPERVA_FLEXPROTECT|PAN_IOT|NOZOMI_GUARDIAN|SURICATA_EVE|UMBRELLA_DNS|WINDOWS_SYSMON|COHESITY|RUBRIK|CISCO_MERAKI|CLAROTY_EMC|CLAROTY_CTD|HONEYD|AIRWATCH|IMPERVA_SECURESPHERE|SECURELINK|WALLIX_BASTION|CHECKPOINT_HARMONY|UNIFI_AP|DIGI_MODEMS|DESYNOVA_CONTIDO|CLOUDGENIX_SDWAN|JUNIPER_MX|SAP_WEBDISP|ADVA_FSP|HP_PROCURVE|VYOS|RSA_SECURID|HCNET_ACCOUNT_ADAPTER|INFOBLOX|VITALQIP|ASSET_STATIC_IP|BLUECAT_DDI|TWINGATE|SYMANTEC_VIP_AUTHHUB|ZSCALER_DECEPTION|BROCADE_SERVERIRON|KEMP_LOADBALANCER|A10_LOAD_BALANCER|AWS_ELB|F5_BIGIP_LTM|RADWARE_ALTEON|CITRIX_NETSCALER|AKAMAI_CLOUD_MONITOR|CISCO_ACE|GCP_LOADBALANCING|KERIOCONTROL|EXTRAHOP|NETFILTER_IPTABLES|CISCO_UMBRELLA_AUDIT|F5_AFM|NUTANIX_PRISM|SANGFOR_NGAF|VERCEL_WAF|PEPLINK_FW|NETDOCUMENTS|PAN_PANORAMA|PFSENSE|AZION|FIREEYE_PX|OPNSENSE|CISCO_FWSM|FORTINET_FORTIWEB|BARRACUDA_WAF|SYMANTEC_WSS|MENLO_SECURITY|DIGITALARTS_IFILTER|WEBMARSHAL|UMBRELLA_IP|AWS_SECURITY_HUB|EXTRAHOP|GUARDDUTY|MICROSOFT_ATA|ORCA|OSSEC|SURICATA_EVE|VMWARE_TANZU/ nocase
$event.principal.ip in cidr %PCI_Network_Ranges
or $event.principal.asset.ip in cidr %PCI_Network_Ranges
$Protocol = $event.network.ip_protocol
$Date = timestamp.get_date($event.metadata.event_timestamp.seconds)
match:
$Date, $Protocol
outcome:
$Count = count_distinct($event.metadata.id)
order:
$Date asc
依動作劃分的流量變化趨勢
$event.metadata.log_type = /ROUTER|SWITCH|DHCP|PROXY|NETWORK|VPN|FIREWALL|_FLOW|VPC|WIRELESS|IPS|IDS|ARUBA_EDGECONNECT_SDWAN|ARUBA_SWITCH|CISCO_APIC|CISCO_CALL_MANAGER|CISCO_DNAC|CISCO_ESTREAMER|CISCO_IOS|CISCO_PRIME|EFFICIENTIP_DDI|EXTREME_SWITCH|FORTINET_FORTIDDOS|FORTINET_FORTIMANAGER|ARUBA_CENTRAL|JUNIPER_JUNOS|JUNIPER_MIST|JUNIPER_SDWAN|NAGIOS|ARBOR_EDGE_DEFENSE|MICROSOFT_NPS|STEELHEAD|SHRUBBERY_TACACS|TRENDMICRO_DDI|VMWARE_NSX|WINDOWS_NET_POLICY_SERVER|ZYWALL|IMPERVA_FLEXPROTECT|PAN_IOT|NOZOMI_GUARDIAN|SURICATA_EVE|UMBRELLA_DNS|WINDOWS_SYSMON|COHESITY|RUBRIK|CISCO_MERAKI|CLAROTY_EMC|CLAROTY_CTD|HONEYD|AIRWATCH|IMPERVA_SECURESPHERE|SECURELINK|WALLIX_BASTION|CHECKPOINT_HARMONY|UNIFI_AP|DIGI_MODEMS|DESYNOVA_CONTIDO|CLOUDGENIX_SDWAN|JUNIPER_MX|SAP_WEBDISP|ADVA_FSP|HP_PROCURVE|VYOS|RSA_SECURID|HCNET_ACCOUNT_ADAPTER|INFOBLOX|VITALQIP|ASSET_STATIC_IP|BLUECAT_DDI|TWINGATE|SYMANTEC_VIP_AUTHHUB|ZSCALER_DECEPTION|BROCADE_SERVERIRON|KEMP_LOADBALANCER|A10_LOAD_BALANCER|AWS_ELB|F5_BIGIP_LTM|RADWARE_ALTEON|CITRIX_NETSCALER|AKAMAI_CLOUD_MONITOR|CISCO_ACE|GCP_LOADBALANCING|KERIOCONTROL|EXTRAHOP|NETFILTER_IPTABLES|CISCO_UMBRELLA_AUDIT|F5_AFM|NUTANIX_PRISM|SANGFOR_NGAF|VERCEL_WAF|PEPLINK_FW|NETDOCUMENTS|PAN_PANORAMA|PFSENSE|AZION|FIREEYE_PX|OPNSENSE|CISCO_FWSM|FORTINET_FORTIWEB|BARRACUDA_WAF|SYMANTEC_WSS|MENLO_SECURITY|DIGITALARTS_IFILTER|WEBMARSHAL|UMBRELLA_IP|AWS_SECURITY_HUB|EXTRAHOP|GUARDDUTY|MICROSOFT_ATA|ORCA|OSSEC|SURICATA_EVE|VMWARE_TANZU/ nocase
$event.principal.ip in cidr %PCI_Network_Ranges
or $event.principal.asset.ip in cidr %PCI_Network_Ranges
$Date = timestamp.get_date($event.metadata.event_timestamp.seconds)
$Security_Result = $event.security_result.action
match:
$Date, $Security_Result
outcome:
$Count = count($event.security_result.action)
order:
$Date asc
前 10 大來源的流量
$event.metadata.log_type = /ROUTER|SWITCH|DHCP|PROXY|NETWORK|VPN|FIREWALL|_FLOW|VPC|WIRELESS|IPS|IDS|ARUBA_EDGECONNECT_SDWAN|ARUBA_SWITCH|CISCO_APIC|CISCO_CALL_MANAGER|CISCO_DNAC|CISCO_ESTREAMER|CISCO_IOS|CISCO_PRIME|EFFICIENTIP_DDI|EXTREME_SWITCH|FORTINET_FORTIDDOS|FORTINET_FORTIMANAGER|ARUBA_CENTRAL|JUNIPER_JUNOS|JUNIPER_MIST|JUNIPER_SDWAN|NAGIOS|ARBOR_EDGE_DEFENSE|MICROSOFT_NPS|STEELHEAD|SHRUBBERY_TACACS|TRENDMICRO_DDI|VMWARE_NSX|WINDOWS_NET_POLICY_SERVER|ZYWALL|IMPERVA_FLEXPROTECT|PAN_IOT|NOZOMI_GUARDIAN|SURICATA_EVE|UMBRELLA_DNS|WINDOWS_SYSMON|COHESITY|RUBRIK|CISCO_MERAKI|CLAROTY_EMC|CLAROTY_CTD|HONEYD|AIRWATCH|IMPERVA_SECURESPHERE|SECURELINK|WALLIX_BASTION|CHECKPOINT_HARMONY|UNIFI_AP|DIGI_MODEMS|DESYNOVA_CONTIDO|CLOUDGENIX_SDWAN|JUNIPER_MX|SAP_WEBDISP|ADVA_FSP|HP_PROCURVE|VYOS|RSA_SECURID|HCNET_ACCOUNT_ADAPTER|INFOBLOX|VITALQIP|ASSET_STATIC_IP|BLUECAT_DDI|TWINGATE|SYMANTEC_VIP_AUTHHUB|ZSCALER_DECEPTION|BROCADE_SERVERIRON|KEMP_LOADBALANCER|A10_LOAD_BALANCER|AWS_ELB|F5_BIGIP_LTM|RADWARE_ALTEON|CITRIX_NETSCALER|AKAMAI_CLOUD_MONITOR|CISCO_ACE|GCP_LOADBALANCING|KERIOCONTROL|EXTRAHOP|NETFILTER_IPTABLES|CISCO_UMBRELLA_AUDIT|F5_AFM|NUTANIX_PRISM|SANGFOR_NGAF|VERCEL_WAF|PEPLINK_FW|NETDOCUMENTS|PAN_PANORAMA|PFSENSE|AZION|FIREEYE_PX|OPNSENSE|CISCO_FWSM|FORTINET_FORTIWEB|BARRACUDA_WAF|SYMANTEC_WSS|MENLO_SECURITY|DIGITALARTS_IFILTER|WEBMARSHAL|UMBRELLA_IP|AWS_SECURITY_HUB|EXTRAHOP|GUARDDUTY|MICROSOFT_ATA|ORCA|OSSEC|SURICATA_EVE|VMWARE_TANZU/ nocase
$event.principal.ip in cidr %PCI_Network_Ranges
or $event.principal.asset.ip in cidr %PCI_Network_Ranges
$IP_Address = $event.principal.ip
match:
$IP_Address
outcome:
$Count = count_distinct($event.metadata.id)
order:
$Count desc
limit:
10
PCI - 修補程式管理
這個資訊主頁會全面顯示修補程式管理生命週期，讓機構有效監控及管理系統更新。並使用參照清單 patch_updates 和 pci_assets，將資料範圍限定在 PCI 環境。
注意： 必須先建立必要的參照清單，這個資訊主頁中的圖表才會載入。
主機安裝成功次數前 10 名
一段時間內的安裝失敗次數
有可用更新的系統
隨時間變化的取消安裝次數
一段時間內的下載失敗次數
一段時間內的成功下載次數
一段時間內開始下載的次數
已安裝最新更新
一段時間內的安裝次數
依主機列出的前 10 個安裝失敗案例
圖表名稱
查詢示例
主機安裝成功次數前 10 名
strings.coalesce($event.principal.asset.hostname, $event.principal.hostname) in %PCI_Assets
$event.metadata.product_event_type = "19"
$Date = timestamp.get_date($event.metadata.event_timestamp.seconds)
$Hostname = strings.coalesce($event.principal.asset.hostname, $event.principal.hostname)
match:
$Date, $Hostname
outcome:
$Count = count($event.metadata.id)
order:
$Date desc
limit:
10
一段時間內的安裝失敗次數
strings.coalesce($event.principal.asset.hostname, $event.principal.hostname) in %PCI_Assets
$event.metadata.product_event_type = "20"
$Date = timestamp.get_date($event.metadata.event_timestamp.seconds)
$Event = $event.metadata.product_event_type
match:
$Event, $Date
outcome:
$Count = count($event.metadata.id)
order:
$Date asc
有可用更新的系統
strings.coalesce($event.principal.asset.hostname, $event.principal.hostname) in %PCI_Assets
$event.metadata.product_event_type = "40"
$Date = timestamp.get_date($event.metadata.event_timestamp.seconds)
$Hostname = strings.coalesce($event.principal.asset.hostname, $event.principal.hostname)
match:
$Hostname, $Date
outcome:
$Count = count($event.metadata.id)
order:
$Date asc
limit:
10
隨時間變化的取消安裝次數
strings.coalesce($event.principal.asset.hostname, $event.principal.hostname) in %PCI_Assets
$event.metadata.product_event_type = "21"
$Date = timestamp.get_date($event.metadata.event_timestamp.seconds)
$Hostname = strings.coalesce($event.principal.asset.hostname, $event.principal.hostname)
match:
$Hostname, $Date
outcome:
$Count = count($event.metadata.id)
order:
$Date asc
一段時間內的下載失敗次數
strings.coalesce($event.principal.asset.hostname, $event.principal.hostname) in %PCI_Assets
$event.metadata.product_event_type = "31"
$Date = timestamp.get_date($event.metadata.event_timestamp.seconds)
$Hostname = strings.coalesce($event.principal.asset.hostname, $event.principal.hostname)
match:
$Hostname, $Date
outcome:
$Count = count($event.metadata.id)
order:
$Date asc
一段時間內的成功下載次數
strings.coalesce($event.principal.asset.hostname, $event.principal.hostname) in %PCI_Assets
$event.metadata.product_event_type = "16"
$Date = timestamp.get_date($event.metadata.event_timestamp.seconds)
$Hostname = strings.coalesce($event.principal.asset.hostname, $event.principal.hostname)
match:
$Hostname, $Date
outcome:
$Count = count($event.metadata.id)
order:
$Date asc
一段時間內開始下載的次數
strings.coalesce($event.principal.asset.hostname, $event.principal.hostname) in %PCI_Assets
$event.metadata.product_event_type = "41"
$Date = timestamp.get_date($event.metadata.event_timestamp.seconds)
$Hostname = strings.coalesce($event.principal.asset.hostname, $event.principal.hostname)
match:
$Hostname, $Date
outcome:
$Count = count($event.metadata.id)
order:
$Date asc
已安裝最新更新
strings.coalesce($event.principal.asset.hostname, $event.principal.hostname) in %PCI_Assets
$event.metadata.description in regex %Patch_Updates
$event.metadata.product_event_type = "19"
$Hostname = strings.coalesce($event.principal.asset.hostname, $event.principal.hostname)
$Hostname != ""
$Update = $event.metadata.description
match:
$Hostname, $Update
limit:
50
一段時間內的安裝次數
strings.coalesce($event.principal.asset.hostname, $event.principal.hostname) in %PCI_Assets
$event.metadata.product_event_type = "19"
$Event = $event.metadata.product_event_type
$Date = timestamp.get_date($event.metadata.event_timestamp.seconds)
match:
$Event, $Date
outcome:
$Count = count($event.metadata.id)
order:
$Date asc
依主機列出的前 10 個安裝失敗案例
strings.coalesce($event.principal.asset.hostname, $event.principal.hostname) in %PCI_Assets
$event.metadata.product_event_type = "20"
$Date = timestamp.get_date($event.metadata.event_timestamp.seconds)
$Hostname = strings.coalesce($event.principal.asset.hostname, $event.principal.hostname)
match:
$Date, $Hostname
outcome:
$Count = count($event.metadata.id)
order:
$Date desc
limit:
10
PCI - 安全設定
這個資訊主頁可即時監控安全設定做法。這項工具會追蹤重要指標、突顯風險，並協助維護重要設定。並使用參照清單 pci_assets 和 default_users，將資料範圍限定在 PCI 環境。
注意： 必須先建立必要的參照清單，這個資訊主頁中的圖表才會載入。
登入失敗次數
政策異動總數
預設帳戶使用情況 (一段時間內)
前 10 大預設使用者名稱
指定期間內登入失敗次數
使用者變更政策
前 10 大主機的登入失敗次數
使用者嘗試登入失敗次數
依主機名稱列出的預設帳戶用量
預設使用者名稱驗證總次數
依記錄來源分類的政策變更
政策變更記錄
預設使用者名稱驗證摘要
圖表名稱
查詢示例
登入失敗次數
$event_type = metadata.event_type
$event_type = "USER_LOGIN"
(principal.hostname in %PCI_Assets or principal.asset.hostname in %PCI_Assets or target.hostname in %PCI_Assets or target.asset.hostname in %PCI_Assets)
$action = security_result.action
$action = "BLOCK"
outcome:
$event_count = count(metadata.id)
order:
$event_count desc
政策異動總數
$event_type = metadata.event_type
($event_type = "SYSTEM_AUDIT_LOG_UNCATEGORIZED" or $event_type = "STATUS_UPDATE")
(principal.hostname in %PCI_Assets or principal.asset.hostname in %PCI_Assets or target.hostname in %PCI_Assets or target.asset.hostname in %PCI_Assets)
$policy_change = strings.coalesce(security_result.description,metadata.product_event_type,security_result.about.registry.registry_key)
$policy_change = /policy change/ nocase
outcome:
$event_count = count(metadata.id)
預設帳戶使用情況 (一段時間內)
$date = timestamp.get_date(metadata.event_timestamp.seconds)
(principal.hostname in %PCI_Assets or principal.asset.hostname in %PCI_Assets or target.hostname in %PCI_Assets or target.asset.hostname in %PCI_Assets)
$user = strings.coalesce(principal.user.userid,principal.user.user_display_name,principal.user.email_addresses)
$user in %Default_Users
match:
$date, $user
outcome:
$event_count = count(metadata.id)
order:
$date asc
前 10 大預設使用者名稱
(principal.hostname in %PCI_Assets or principal.asset.hostname in %PCI_Assets or target.hostname in %PCI_Assets or target.asset.hostname in %PCI_Assets)
$user = strings.coalesce(principal.user.userid,principal.user.user_display_name,principal.user.email_addresses)
$user in %Default_Users
$event_type = metadata.event_type
match:
$user
outcome:
$event_types = array_distinct(metadata.event_type)
$event_count = count(metadata.id)
order:
$event_count desc
limit:
10
指定期間內登入失敗次數
$date = timestamp.get_date(metadata.event_timestamp.seconds)
$event_type = metadata.event_type
$event_type = "USER_LOGIN"
(principal.hostname in %PCI_Assets or principal.asset.hostname in %PCI_Assets or target.hostname in %PCI_Assets or target.asset.hostname in %PCI_Assets)
$action = security_result.action
$action = "BLOCK"
match:
$date,$action
outcome:
$event_count = count(metadata.id)
order:
$date asc
使用者變更政策
$event_type = metadata.event_type
($event_type = "SYSTEM_AUDIT_LOG_UNCATEGORIZED" or $event_type = "STATUS_UPDATE")
(principal.hostname in %PCI_Assets or principal.asset.hostname in %PCI_Assets or target.hostname in %PCI_Assets or target.asset.hostname in %PCI_Assets)
$policy_change = strings.coalesce(security_result.description,metadata.product_event_type,security_result.about.registry.registry_key)
$policy_change = /policy change/ nocase
$user = strings.coalesce(principal.user.userid,principal.user.user_display_name,principal.user.email_addresses)
match:
$user
outcome:
$event_count = count(metadata.id)
order:
$event_count desc
前 10 大主機的登入失敗次數
$event_type = metadata.event_type
$event_type = "USER_LOGIN"
(principal.hostname in %PCI_Assets or principal.asset.hostname in %PCI_Assets or target.hostname in %PCI_Assets or target.asset.hostname in %PCI_Assets)
$hostname = strings.coalesce(principal.hostname,principal.asset.hostname,target.hostname,target.asset.hostname)
$hostname != ""
$action = security_result.action
$action = "BLOCK"
match:
$hostname
outcome:
$event_count = count(metadata.id)
order:
$event_count desc
limit:
10
使用者嘗試登入失敗次數
$vendor = metadata.vendor_name
$event_type = metadata.event_type
$event_type = "USER_LOGIN"
(principal.hostname in %PCI_Assets or principal.asset.hostname in %PCI_Assets or target.hostname in %PCI_Assets or target.asset.hostname in %PCI_Assets)
$hostname = strings.coalesce(principal.hostname,principal.asset.hostname,target.hostname,target.asset.hostname)
$action = security_result.action
$action = "BLOCK"
$user = strings.coalesce(principal.user.userid,principal.user.user_display_name,principal.user.email_addresses)
$user != ""
match:
$user, $hostname, $vendor
outcome:
$event_count = count(metadata.id)
order:
$event_count desc
依主機名稱列出的預設帳戶用量
(principal.hostname in %PCI_Assets or principal.asset.hostname in %PCI_Assets or target.hostname in %PCI_Assets or target.asset.hostname in %PCI_Assets)
$hostname = strings.coalesce(principal.hostname, principal.asset.hostname,target.hostname,target.asset.hostname)
$user = strings.coalesce(principal.user.userid,principal.user.user_display_name,principal.user.email_addresses)
$user in %Default_Users
match:
$hostname
outcome:
$event_count = count(metadata.id)
order:
$event_count desc
預設使用者名稱驗證總次數
$event_type = metadata.event_type
$event_type = "USER_LOGIN"
(principal.hostname in %PCI_Assets or principal.asset.hostname in %PCI_Assets or target.hostname in %PCI_Assets or target.asset.hostname in %PCI_Assets)
$user = strings.coalesce(principal.user.userid,principal.user.user_display_name,principal.user.email_addresses)
$user in %Default_Users
outcome:
$event_count = count(metadata.id)
依記錄來源分類的政策變更
$event_type = metadata.event_type
($event_type = "SYSTEM_AUDIT_LOG_UNCATEGORIZED" or $event_type = "STATUS_UPDATE")
(principal.hostname in %PCI_Assets or principal.asset.hostname in %PCI_Assets or target.hostname in %PCI_Assets or target.asset.hostname in %PCI_Assets)
$policy_change = strings.coalesce(security_result.description,metadata.product_event_type,security_result.about.registry.registry_key)
$policy_change = /policy change/ nocase
$log_source = metadata.log_type
match:
$log_source
outcome:
$event_count = count(metadata.id)
order:
$event_count desc
政策變更記錄
$event_type = metadata.event_type
($event_type = "SYSTEM_AUDIT_LOG_UNCATEGORIZED" or $event_type = "STATUS_UPDATE")
(principal.hostname in %PCI_Assets or principal.asset.hostname in %PCI_Assets or target.hostname in %PCI_Assets or target.asset.hostname in %PCI_Assets)
$policy_change = strings.coalesce(security_result.description,metadata.product_event_type,security_result.about.registry.registry_key)
$policy_change = /policy change/ nocase
$date = timestamp.get_date(metadata.event_timestamp.seconds)
match:
$date, $policy_change
outcome:
$event_count = count(metadata.id)
order:
$event_count desc
預設使用者名稱驗證摘要
$event_type = metadata.event_type
$event_type = "USER_LOGIN"
$log_type = metadata.log_type
(principal.hostname in %PCI_Assets or principal.asset.hostname in %PCI_Assets or target.hostname in %PCI_Assets or target.asset.hostname in %PCI_Assets)
$hostname = strings.coalesce(principal.hostname, principal.asset.hostname,target.hostname,target.asset.hostname)
$action = security_result.action
$user = strings.coalesce(principal.user.userid,principal.user.user_display_name,principal.user.email_addresses)
$user in %Default_Users
match:
$user, $hostname, $log_type, $action
outcome:
$event_count = count(metadata.id)
order:
$event_count desc
PCI - 安全漏洞管理
這個儀表板可即時監控及追蹤安全漏洞。這項功能可支援更廣泛的法規遵循工作，協助您識別、評估及管理風險，以維護安全的付款環境，同時簡化報表作業。並使用參照清單 pci_assets 和 pci_network_ranges，將資料範圍限定在 PCI 環境。
注意： 必須先建立必要的參照清單，這個資訊主頁中的圖表才會載入。
依年齡層區分的安全漏洞
前 10 大易受攻擊的主機
前 10 大安全漏洞
新安全漏洞
安全漏洞總數
易受攻擊的系統
依嚴重程度分類的安全漏洞
易受攻擊的系統 (百分比)
每個系統的安全漏洞
圖表名稱
查詢示例
依年齡層區分的安全漏洞
$event_type = metadata.event_type
($event_type = "SCAN_VULN_HOST" or $event_type = "SCAN_VULN_NETWORK")
(principal.hostname in %PCI_Assets) or (principal.asset.hostname in %PCI_Assets) or (principal.ip in cidr %PCI_Network_Ranges) or (principal.asset.ip in cidr %PCI_Network_Ranges)
$vulnerability = extensions.vulns.vulnerabilities.description
$First_Found = timestamp.get_date(extensions.vulns.vulnerabilities.first_found.seconds)
$date = timestamp.get_date(metadata.event_timestamp.seconds)
$Time_difference = timestamp.diff(metadata.event_timestamp.seconds, extensions.vulns.vulnerabilities.first_found.seconds, "DAY")
match:
$Time_difference,$vulnerability
outcome:
$Range = if(max($Time_difference) <= 30, "0-30Days", if(max($Time_difference) <= 60, "31-60Days", if(max($Time_difference) <= 90, "61-90Days", ">90Days")))
$event_count = count(metadata.id)
order:
$Time_difference desc
前 10 大易受攻擊的主機
$event_type = metadata.event_type
($event_type = "SCAN_VULN_HOST" or $event_type = "SCAN_VULN_NETWORK")
$asset = strings.coalesce(principal.hostname,principal.asset.hostname,principal.ip,principal.asset.ip)
(principal.hostname in %PCI_Assets) or (principal.asset.hostname in %PCI_Assets) or (principal.ip in cidr %PCI_Network_Ranges) or (principal.asset.ip in cidr %PCI_Network_Ranges)
$platform = principal.platform
match:
$asset, $platform
outcome:
$event_count = count(metadata.id)
order:
$event_count desc
limit:
10
前 10 大安全漏洞
$event_type = metadata.event_type
($event_type = "SCAN_VULN_HOST" or $event_type = "SCAN_VULN_NETWORK")
(principal.hostname in %PCI_Assets) or (principal.asset.hostname in %PCI_Assets) or (principal.ip in cidr %PCI_Network_Ranges) or (principal.asset.ip in cidr %PCI_Network_Ranges)
$vulnerability = extensions.vulns.vulnerabilities.description
$platform = principal.platform
match:
$vulnerability,$platform
outcome:
$event_count = count(metadata.id)
order:
$event_count desc
limit:
10
新安全漏洞
$event_type = metadata.event_type
($event_type = "SCAN_VULN_HOST" or $event_type = "SCAN_VULN_NETWORK")
(principal.hostname in %PCI_Assets) or (principal.asset.hostname in %PCI_Assets) or (principal.ip in cidr %PCI_Network_Ranges) or (principal.asset.ip in cidr %PCI_Network_Ranges)
$date = timestamp.get_date(metadata.event_timestamp.seconds)
$First_Found = timestamp.get_date(extensions.vulns.vulnerabilities.first_found.seconds)
$vulnerability = extensions.vulns.vulnerabilities.description
$severity = extensions.vulns.vulnerabilities.severity
$Time_difference = timestamp.diff(metadata.event_timestamp.seconds, extensions.vulns.vulnerabilities.first_found.seconds, "DAY")
$Time_difference < 30
match:
$vulnerability, $severity
outcome:
$event_count = count(metadata.id)
$age = max($Time_difference)
order:
$severity desc
安全漏洞總數
$event_type = metadata.event_type
($event_type = "SCAN_VULN_HOST" or $event_type = "SCAN_VULN_NETWORK")
(principal.hostname in %PCI_Assets) or (principal.asset.hostname in %PCI_Assets) or (principal.ip in cidr %PCI_Network_Ranges) or (principal.asset.ip in cidr %PCI_Network_Ranges)
outcome:
$event_count = count(metadata.id)
易受攻擊的系統
$event_type = metadata.event_type
($event_type = "SCAN_VULN_HOST" or $event_type = "SCAN_VULN_NETWORK")
(principal.hostname in %PCI_Assets) or (principal.asset.hostname in %PCI_Assets) or (principal.ip in cidr %PCI_Network_Ranges) or (principal.asset.ip in cidr %PCI_Network_Ranges)
$asset = strings.coalesce(principal.hostname,principal.asset.hostname,principal.ip,principal.asset.ip)
outcome:
$event_count = count_distinct($asset)
依嚴重程度分類的安全漏洞
$event_type = metadata.event_type
($event_type = "SCAN_VULN_HOST" or $event_type = "SCAN_VULN_NETWORK")
(principal.hostname in %PCI_Assets) or (principal.asset.hostname in %PCI_Assets) or (principal.ip in cidr %PCI_Network_Ranges) or (principal.asset.ip in cidr %PCI_Network_Ranges)
$severity = extensions.vulns.vulnerabilities.severity
match:
$severity
outcome:
$event_count = count(metadata.id)
order:
$severity desc
易受攻擊的系統 (百分比)
$event_type = metadata.event_type
($event_type = "SCAN_VULN_HOST" or $event_type = "SCAN_VULN_NETWORK")
(principal.hostname in %PCI_Assets) or (principal.asset.hostname in %PCI_Assets) or (principal.ip in cidr %PCI_Network_Ranges) or (principal.asset.ip in cidr %PCI_Network_Ranges)
$platform = principal.platform
match:
$platform
outcome:
$event_count = count($platform)
每個系統的安全漏洞
$event_type = metadata.event_type
($event_type = "SCAN_VULN_HOST" or $event_type = "SCAN_VULN_NETWORK")
$asset = strings.coalesce(principal.hostname,principal.asset.hostname,principal.ip,principal.asset.ip)
(principal.hostname in %PCI_Assets) or (principal.asset.hostname in %PCI_Assets) or (principal.ip in cidr %PCI_Network_Ranges) or (principal.asset.ip in cidr %PCI_Network_Ranges)
$platform = principal.platform
match:
$asset
outcome:
$operating_system = array_distinct($platform)
$event_count = count(metadata.id)
order:
$event_count desc
密碼變更監控資訊主頁
這個資訊主頁會追蹤及記錄密碼變更，並提供密碼變更事件的完整檢視畫面，包括密碼變更的日期和時間。這項功能會以視覺化方式呈現趨勢、找出可疑 IP 位址、使用者和位置等風險，並協助偵測及應對未經授權的密碼變更等潛在安全事件。
使用者前 10 大來源 IP
前 10 大密碼重設
依記錄類型顯示的歷來事件
依動作顯示事件
來源地理位置熱視圖
依動作列出的前 10 名使用者
10 大活動說明
使用者最近變更密碼 (24 小時內)
依嚴重程度分類的事件
圖表名稱
查詢示例
使用者前 10 大來源 IP
metadata.event_type = "USER_CHANGE_PASSWORD"
$Source_IP = strings.coalesce(principal.ip, principal.asset.ip)
$Source_IP != ""
$User = strings.coalesce(principal.user.userid, principal.user.user_display_name, principal.user.email_addresses,target.user.userid,target.user.user_display_name,target.user.email_addresses )
match :
$Source_IP,$User
outcome :
$Count = count(metadata.id)
order :
$Count desc
limit:10
前 10 大密碼重設
metadata.event_type = "USER_CHANGE_PASSWORD"
$Log_Type = metadata.log_type
$Password_Event_Type = metadata.product_event_type
$Description = metadata.description
($Password_Event_Type = /Reset/ nocase OR $Description = /Reset/ nocase)
$User = strings.coalesce(principal.user.userid, principal.user.user_display_name, principal.user.email_addresses,target.user.userid,target.user.user_display_name,target.user.email_addresses )
match :
$User
outcome :
$Count = count(metadata.id)
order :
$Count desc
limit: 10
依記錄類型顯示的歷來事件
metadata.event_type = "USER_CHANGE_PASSWORD"
$Log_Type = metadata.log_type
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
match :
$Date,$Log_Type
outcome :
$Count = count(metadata.id)
依動作顯示事件
metadata.event_type = "USER_CHANGE_PASSWORD"
$Action = security_result.action
match :
$Action
outcome :
$Count = count(metadata.id)
來源地理位置熱視圖
metadata.event_type = "USER_CHANGE_PASSWORD"
$Country = principal.ip_geo_artifact.location.country_or_region
match :
$Country
outcome :
$Count = count(metadata.id)
$Latitude = max(principal.ip_geo_artifact.location.region_coordinates.latitude)
$Longitude = max(principal.ip_geo_artifact.location.region_coordinates.longitude)
order :
$Count desc
依動作列出的前 10 名使用者
metadata.event_type = "USER_CHANGE_PASSWORD"
$User = strings.coalesce(principal.user.userid, principal.user.user_display_name, principal.user.email_addresses,target.user.userid,target.user.user_display_name,target.user.email_addresses )
$Action = security_result.action
match :
$User,$Action
outcome :
$Count = count(metadata.id)
order :
$Count desc
limit :
10
10 大活動說明
metadata.event_type = "USER_CHANGE_PASSWORD"
$Description = strings.coalesce(metadata.description,security_result.description,metadata.product_event_type)
match :
$Description
outcome :
$Count = count(metadata.id)
order :
$Count desc
limit :
10
使用者最近變更密碼 (24 小時內)
metadata.event_type = "USER_CHANGE_PASSWORD"
$Log_Type = metadata.log_type
$Password_Event_Type = metadata.product_event_type
$User = strings.coalesce(principal.user.userid, principal.user.user_display_name, principal.user.email_addresses,target.user.userid,target.user.user_display_name,target.user.email_addresses )
$Hostname = strings.coalesce(principal.hostname,principal.asset.hostname)
$Source_IP = strings.coalesce(principal.ip, principal.asset.ip)
match :
$User,$Hostname,$Source_IP,$Password_Event_Type,$Log_Type
outcome :
$Date = timestamp.get_timestamp(max(metadata.event_timestamp.seconds ), "%F %T")
$Count = count(metadata.id)
order :
$Count desc
依嚴重程度分類的事件
metadata.event_type = "USER_CHANGE_PASSWORD"
$Severity = security_result.severity
match :
$Severity
outcome :
$Count = count(metadata.id)
網路釣魚監控
這個資訊主頁提供網路釣魚威脅、電子郵件安全和攻擊趨勢的洞察資料。資安團隊可透過這項功能掌握網路釣魚嘗試，監控惡意電子郵件活動、找出可疑寄件者和目標使用者，以及標記可能有害的指標。
注意： 根據特定記錄類型套用篩選器，即可在資訊主頁上顯示相關結果。
供應商快訊中的前 10 名使用者
存取次數最多的前 10 個網路釣魚網址
前 10 大網路釣魚電子郵件主旨
依動作劃分的事件
依記錄類型顯示的歷來事件
偵測到的網路釣魚事件總數
前 10 大相關網域
依動作顯示的廠商快訊趨勢
近期網路釣魚事件
前 10 大供應商快訊
前 10 大威脅名稱
按動作劃分的歷來事件
前 10 大網路釣魚電子郵件寄件者
網路釣魚檔案詳細資料
依檔案類型細分的事件資料
依記錄類型劃分的供應商警告趨勢
前 10 個網路釣魚網址
前 10 大網路釣魚電子郵件收件者
來源地理位置總覽
依嚴重程度分類的事件
圖表名稱
查詢示例
供應商快訊中的前 10 名使用者
(security_result.category = "MAIL_PHISHING" or re.regex(security_result.threat_name,`Phish`) nocase or re.regex(security_result.category_details,`Phish`)nocase)
security_result.threat_name != "NOT_PHISHING"
security_result.rule_name != ""
$User = strings.coalesce(network.email.from, principal.user.userid, principal.user.user_display_name, principal.user.email_addresses, target.user.userid, target.user.user_display_name, target.user.email_addresses)
match:
$User
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
存取次數最多的前 10 個網路釣魚網址
(security_result.category = "MAIL_PHISHING" or re.regex(security_result.threat_name,`Phish`) nocase or re.regex(security_result.category_details,`Phish`) nocase)
security_result.threat_name!= "NOT_PHISHING"
metadata.product_event_type = /permit/ nocase
$URL = strings.coalesce (target.url, principal.process.file.embedded_urls, security_result.about.url, network.http.referral_url, principal.url)
$URL != ""
$User = strings.coalesce(network.email.from, principal.user.userid, principal.user.user_display_name, principal.user.email_addresses, target.user.userid, target.user.user_display_name, target.user.email_addresses)
$Action = security_result.action
match:
$URL, $Action
outcome:
$User_List = array_distinct($User)
$Count = count($URL)
order:
$URL desc
//limit:
//10
前 10 大網路釣魚電子郵件主旨
(security_result.category = "MAIL_PHISHING" or re.regex(security_result.threat_name,`Phish`) nocase or re.regex(security_result.category_details,`Phish`) nocase)
security_result.threat_name!= "NOT_PHISHING"
$Subject = network.email.subject
$Action = security_result.action
match:
$Subject, $Action
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
依動作劃分的事件
(security_result.category = "MAIL_PHISHING" or re.regex(security_result.threat_name,`Phish`) nocase or re.regex(security_result.category_details,`Phish`) nocase)
security_result.threat_name != "NOT_PHISHING"
$Action = security_result.action
match:
$Action
outcome:
$Count = count(metadata.id)
order:
$Action desc
依記錄類型顯示的歷來事件
(security_result.category = "MAIL_PHISHING" or re.regex(security_result.threat_name,`Phish`) nocase or re.regex(security_result.category_details,`Phish`)nocase)
security_result.threat_name!= "NOT_PHISHING"
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
$Log_Type = metadata.log_type
match:
$Date, $Log_Type
outcome:
$Count = count(metadata.id)
order:
$Date asc
偵測到的網路釣魚事件總數
(security_result.category = "MAIL_PHISHING" or re.regex(security_result.threat_name,`Phish`) nocase or re.regex(security_result.category_details,`Phish`) nocase)
security_result.threat_name != "NOT_PHISHING"
outcome:
$Count = count(metadata.id)
前 10 大相關網域
(security_result.category = "MAIL_PHISHING" or re.regex(security_result.threat_name,`Phish`) nocase or re.regex(security_result.category_details,`Phish`) nocase)
security_result.threat_name!= "NOT_PHISHING"
$Domain = strings.coalesce(principal.administrative_domain, target.administrative_domain, about.administrative_domain)
$Action = security_result.action
match:
$Domain, $Action
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
依動作顯示的廠商快訊趨勢
(security_result.category = "MAIL_PHISHING" or re.regex(security_result.threat_name,`Phish`) nocase or re.regex(security_result.category_details,`Phish`)nocase)
security_result.threat_name != "NOT_PHISHING"
security_result.rule_name != ""
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
$Action = security_result.action
match:
$Date, $Action
outcome:
$Count = count(metadata.id)
order:
$Date asc
近期網路釣魚事件
(security_result.category = "MAIL_PHISHING" or re.regex(security_result.threat_name,`Phish`) nocase or re.regex(security_result.category_details,`Phish`)nocase)
security_result.threat_name!= "NOT_PHISHING"
$Security_Event_Type = metadata.product_event_type
$Summary = strings.coalesce(security_result.summary, metadata.description, security_result.description)
$Sender = strings.coalesce(network.email.from, principal.user.email_addresses)
$Subject = network.email.subject
match:
$Security_Event_Type, $Summary, $Subject, $Sender
outcome:
$Count = count(metadata.id)
$Receiver_Count = count_distinct(strings.coalesce(network.email.to, network.email.reply_to, target.user.email_addresses))
$Date = timestamp.get_timestamp(max(metadata.event_timestamp.seconds), "%F %T")
order:
$Count desc
前 10 大供應商快訊
(security_result.category = "MAIL_PHISHING" or re.regex(security_result.threat_name,`Phish`) nocase or re.regex(security_result.category_details,`Phish`)nocase)
security_result.threat_name != "NOT_PHISHING"
security_result.rule_name != ""
$Rule_Name = security_result.rule_name
match:
$Rule_Name
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
前 10 大威脅名稱
(security_result.category = "MAIL_PHISHING" or re.regex(security_result.threat_name,`Phish`) nocase or re.regex(security_result.category_details,`Phish`) nocase)
security_result.threat_name!= "NOT_PHISHING"
$Threat_Name = strings.coalesce(security_result.threat_name,security_result.category_details)
$Log_Type = metadata.log_type
match:
$Threat_Name, $Log_Type
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
按動作劃分的歷來事件
(security_result.category = "MAIL_PHISHING" or re.regex(security_result.threat_name,`Phish`) nocase or re.regex(security_result.category_details,`Phish`) nocase)
security_result.threat_name != "NOT_PHISHING"
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
$Action = security_result.action
match:
$Date, $Action
outcome:
$Count = count(metadata.id)
order:
$Action asc
前 10 大網路釣魚電子郵件寄件者
(security_result.category = "MAIL_PHISHING" or re.regex(security_result.threat_name,`Phish`) nocase or re.regex(security_result.category_details,`Phish`) nocase)
security_result.threat_name != "NOT_PHISHING"
$Sender = strings.coalesce(network.email.from,principal.user.email_addresses)
$Action = security_result.action
match:
$Sender, $Action
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
網路釣魚檔案詳細資料
(security_result.category = "MAIL_PHISHING" or re.regex(security_result.threat_name,`Phish`) nocase or re.regex(security_result.category_details,`Phish`) nocase)
security_result.threat_name!= "NOT_PHISHING"
strings.coalesce(target.file.full_path, about.file.full_path, target.file.names) != ""
$File_Path = strings.coalesce(target.file.full_path, about.file.full_path, target.file.names)
$File_Type = strings.coalesce(about.file.mime_type, target.file.mime_type)
$Action = security_result.action
$Receiver = strings.coalesce(network.email.to, network.email.reply_to,target.user.email_addresses)
$Sender = strings.coalesce(network.email.from,principal.user.email_addresses)
$File_Hash = strings.coalesce(about.file.md5, about.file.sha256, security_result.about.file.sha256)
match:
$File_Path, $File_Type, $File_Hash, $Sender, $Receiver, $Action
outcome:
$Count = count(metadata.id)
$Date = timestamp.get_timestamp(max(metadata.event_timestamp.seconds), "%F %T")
order:
$Count desc
依檔案類型細分的事件資料
(security_result.category = "MAIL_PHISHING" or re.regex(security_result.threat_name,`Phish`) nocase or re.regex(security_result.category_details,`Phish`) nocase)
security_result.threat_name!= "NOT_PHISHING"
$File_Type = strings.coalesce(about.file.mime_type, target.file.mime_type)
match:
$File_Type
outcome:
$Count = count(metadata.id)
order:
$File_Type desc
依記錄類型劃分的供應商警告趨勢
(security_result.category = "MAIL_PHISHING" or re.regex(security_result.threat_name,`Phish`) nocase or re.regex(security_result.category_details,`Phish`)nocase)
security_result.threat_name != "NOT_PHISHING"
security_result.rule_name != ""
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
$Log_Type = metadata.log_type
match:
$Date, $Log_Type
outcome:
$Count = count(metadata.id)
order:
$Date asc
前 10 個網路釣魚網址
(security_result.category = "MAIL_PHISHING" or re.regex(security_result.threat_name,`Phish`) nocase or re.regex(security_result.category_details,`Phish`) nocase)
security_result.threat_name!= "NOT_PHISHING"
$URL = strings.coalesce(target.url, security_result.about.url, network.http.referral_url, principal.process.file.embedded_urls, principal.url)
$URL != ""
match:
$URL
outcome:
$Threat_Names = array_distinct(strings.coalesce(security_result.threat_name,security_result.category_details))
$Categories = array_distinct(security_result.category)
$Count = count($URL)
order:
$Count desc
limit:
10
前 10 大網路釣魚電子郵件收件者
(security_result.category = "MAIL_PHISHING" or re.regex(security_result.threat_name,`Phish`) nocase or re.regex(security_result.category_details,`Phish`) nocase)
security_result.threat_name!= "NOT_PHISHING"
$Receiver = strings.coalesce(network.email.to, network.email.reply_to, target.user.email_addresses)
$Action = security_result.action
match:
$Receiver, $Action
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
來源地理位置總覽
(security_result.category = "MAIL_PHISHING" or re.regex(security_result.threat_name,`Phish`) nocase or re.regex(security_result.category_details,`Phish`) nocase)
security_result.threat_name != "NOT_PHISHING"
$Country = principal.ip_geo_artifact.location.country_or_region
$Country != ""
match:
$Country
outcome:
$Count = count(metadata.id)
$Latitude = max(principal.ip_geo_artifact.location.region_coordinates.latitude)
$Longitude = max(principal.ip_geo_artifact.location.region_coordinates.longitude)
order:
$Count desc
依嚴重程度分類的事件
(security_result.category = "MAIL_PHISHING" or re.regex(security_result.threat_name,`Phish`) nocase or re.regex(security_result.category_details,`Phish`) nocase)
security_result.threat_name != "NOT_PHISHING"
$Severity = security_result.severity
match:
$Severity
outcome:
$Count = count(metadata.id)
order:
$Severity desc
通訊埠掃描偵測
這個資訊主頁會深入分析連接埠掃描活動和其他相關的網路偵察技術，這些活動可能代表網路基礎架構中存在潛在威脅或惡意活動。追蹤並以視覺化方式呈現這類行為，有助於偵測、調查及防範任何未經授權或可疑的網路存取嘗試。
依記錄類型顯示的歷來事件
近期嘗試連線至標準通訊埠失敗的記錄
嚴重程度分布
使用者隨時間變化的連接埠掃描事件
前 10 大目的地 IP
近期連接埠掃描事件
前 10 大來源國家/地區
前 10 大目標內部子網路
最近嘗試連線至非標準通訊埠時失敗
前 10 大目標連接埠
前 10 大通訊埠掃描來源
前 10 大來源 IP
通訊埠/IP 比例
通訊協定分配
一段時間內的通訊埠掃描事件 (依主機名稱劃分)
圖表名稱
查詢示例
依記錄類型顯示的歷來事件
metadata.event_type = "SCAN_NETWORK"
or strings.coalesce(security_result.threat_name, security_result.rule_name, security_result.description, security_result.summary, metadata.product_event_type, metadata.description) = /port(?:\s|\_)?scan(?:ning|ner)?/ nocase
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
$Log_Type = metadata.log_type
match:
$Date, $Log_Type
outcome:
$Count = count(metadata.id)
order:
$Date desc
近期嘗試連線至標準通訊埠失敗的記錄
metadata.event_type = "NETWORK_UNCATEGORIZED"
or metadata.event_type = "NETWORK_FLOW"
or metadata.event_type = "NETWORK_CONNECTION"
or metadata.event_type = "NETWORK_FTP"
or metadata.event_type = "NETWORK_DHCP"
or metadata.event_type = "NETWORK_DNS"
or metadata.event_type = "NETWORK_HTTP"
or metadata.event_type = "NETWORK_SMTP"
security_result.action = "BLOCK"
target.port > 19
target.port < 1025
$Date = timestamp.get_timestamp(metadata.event_timestamp.seconds, "%F %T ")
$Principal_IP = principal.ip
$Target_IP = target.ip
$Protocol = network.ip_protocol
$Port = target.port
match:
$Date, $Principal_IP, $Protocol, $Port, $Target_IP
order:
$Date desc
嚴重程度分布
metadata.event_type = "SCAN_NETWORK"
or strings.coalesce(security_result.threat_name, security_result.rule_name, security_result.description, security_result.summary, metadata.product_event_type, metadata.description) = /port(?:\s|\_)?scan(?:ning|ner)?/ nocase
$Severity = security_result.severity
match:
$Severity
outcome:
$Count = count(metadata.id)
order:
$Count desc
使用者隨時間變化的連接埠掃描事件
metadata.event_type = "SCAN_NETWORK"
or strings.coalesce(security_result.threat_name, security_result.rule_name, security_result.description, security_result.summary, metadata.product_event_type, metadata.description) = /port(?:\s|\_)?scan(?:ning|ner)?/ nocase
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
$User = group(principal.user.userid, principal.user.email_addresses, target.user.userid, target.user.email_addresses)
match:
$Date, $User
outcome:
$Count = count(metadata.id)
order:
$Date desc
前 10 大目的地 IP
metadata.event_type = "SCAN_NETWORK"
or strings.coalesce(security_result.threat_name, security_result.rule_name, security_result.description, security_result.summary, metadata.product_event_type, metadata.description) = /port(?:\s|\_)?scan(?:ning|ner)?/ nocase
$IP_Address = target.ip
$Log_Type = metadata.log_type
match:
$IP_Address, $Log_Type
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
近期連接埠掃描事件
metadata.event_type = "SCAN_NETWORK"
or strings.coalesce(security_result.threat_name, security_result.rule_name, security_result.description, security_result.summary, metadata.product_event_type, metadata.description) = /port(?:\s|\_)?scan(?:ning|ner)?/ nocase
principal.ip != ""
target.ip != ""
$Date = timestamp.get_timestamp(metadata.event_timestamp.seconds, "%F %T ")
$Description = strings.coalesce(security_result.threat_name, security_result.rule_name, security_result.description, security_result.summary, metadata.product_event_type, metadata.description)
$Source_IP = principal.ip
$Target_IP = target.ip
match:
$Date, $Source_IP, $Description, $Target_IP
outcome:
$Port = array_distinct(target.port)
order:
$Date desc
前 10 大來源國家/地區
metadata.event_type = "SCAN_NETWORK"
or strings.coalesce(security_result.threat_name, security_result.rule_name, security_result.description, security_result.summary, metadata.product_event_type, metadata.description) = /port(?:\s|\_)?scan(?:ning|ner)?/ nocase
$Country = principal.location.country_or_region
$Country != ""
match:
$Country
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
前 10 大目標內部子網路
metadata.event_type = "SCAN_NETWORK"
or strings.coalesce(security_result.threat_name, security_result.rule_name, security_result.description, security_result.summary, metadata.product_event_type, metadata.description) = /port(?:\s|\_)?scan(?:ning|ner)?/ nocase
net.ip_in_range_cidr(target.ip, "10.0.0.0/8")
or net.ip_in_range_cidr(target.ip, "172.16.0.0/12")
or net.ip_in_range_cidr(target.ip, "192.168.0.0/16")
or net.ip_in_range_cidr(target.ip, "fc00::/7")
$IP_Range = if(net.ip_in_range_cidr(target.ip, "192.168.0.0/16"), strings.concat(re.capture(target.ip, /^\d+\.\d+\.\d+\./), "0/16"),
if(net.ip_in_range_cidr(target.ip, "172.16.0.0/12"), strings.concat(re.capture(target.ip, /^\d+\.\d+\./), "0.0/12"),
if(net.ip_in_range_cidr(target.ip, "10.0.0.0/8"), strings.concat(re.capture(target.ip, /^\d+\./), "0.0.0/8"),
if(net.ip_in_range_cidr(target.ip, "fc00::/7"), strings.concat(re.capture(target.ip, /^(?:[0-9A-Fa-f]{1,4}:){3}[0-9A-Fa-f]{1,4}/), "/64"), "Unknown IP address range"))))
match:
$IP_Range
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
最近嘗試連線至非標準通訊埠時失敗
metadata.event_type = "NETWORK_UNCATEGORIZED"
or metadata.event_type = "NETWORK_FLOW"
or metadata.event_type = "NETWORK_CONNECTION"
security_result.action = "BLOCK"
target.port < 19
or target.port > 1025
$Date = timestamp.get_timestamp(metadata.event_timestamp.seconds, "%F %T ")
$Principal_IP = principal.ip
$Target_IP = target.ip
$Protocol = network.ip_protocol
$Port = target.port
match:
$Date, $Principal_IP, $Protocol, $Port, $Target_IP
order:
$Date desc
前 10 大目標連接埠
metadata.event_type = "SCAN_NETWORK"
or strings.coalesce(security_result.threat_name, security_result.rule_name, security_result.description, security_result.summary, metadata.product_event_type, metadata.description) = /port(?:\s|\_)?scan(?:ning|ner)?/ nocase
$Port = strings.concat(target.port, " ")
$Log_Type = metadata.log_type
match:
$Port, $Log_Type
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
前 10 大通訊埠掃描來源
metadata.event_type = "SCAN_NETWORK"
or strings.coalesce(security_result.threat_name, security_result.rule_name, security_result.description, security_result.summary, metadata.product_event_type, metadata.description) = /port(?:\s|\_)?scan(?:ning|ner)?/ nocase
$Country = principal.location.country_or_region
$Latitude = principal.location.region_coordinates.latitude
$Latitude != 0
$Longitude = principal.location.region_coordinates.longitude
$Longitude != 0
match:
$Country, $Latitude, $Longitude
outcome:
$Count = count(metadata.id)
order:
$Count desc
前 10 大來源 IP
metadata.event_type = "SCAN_NETWORK"
or strings.coalesce(security_result.threat_name, security_result.rule_name, security_result.description, security_result.summary, metadata.product_event_type, metadata.description) = /port(?:\s|\_)?scan(?:ning|ner)?/ nocase
$IP_Address = principal.ip
$Log_Type = metadata.log_type
match:
$IP_Address, $Log_Type
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
通訊埠/IP 比例
metadata.event_type = "SCAN_NETWORK"
or strings.coalesce(security_result.threat_name, security_result.rule_name, security_result.description, security_result.summary, metadata.product_event_type, metadata.description) = /port(?:\s|\_)?scan(?:ning|ner)?/ nocase
$Port = target.port
$Source_IP = principal.ip
outcome:
$Ratio = math.round(count_distinct(target.port) / count_distinct(principal.ip), 2)
通訊協定分配
metadata.event_type = "SCAN_NETWORK"
or strings.coalesce(security_result.threat_name, security_result.rule_name, security_result.description, security_result.summary, metadata.product_event_type, metadata.description) = /port(?:\s|\_)?scan(?:ning|ner)?/ nocase
$Protocol = network.ip_protocol
match:
$Protocol
outcome:
$Count = count(metadata.id)
order:
$Count desc
一段時間內的通訊埠掃描事件 (依主機名稱劃分)
metadata.event_type = "SCAN_NETWORK"
or strings.coalesce(security_result.threat_name, security_result.rule_name, security_result.description, security_result.summary, metadata.product_event_type, metadata.description) = /port(?:\s|\_)?scan(?:ning|ner)?/ nocase
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
$Hostname = group(principal.hostname, target.hostname)
match:
$Date, $Hostname
outcome:
$Count = count(metadata.id)
order:
$Date desc
通訊埠和通訊協定總覽
這個儀表板提供網路連接埠活動和通訊協定使用情形的即時和歷史深入分析資料。這項服務可識別啟用和停用的通訊埠、潛在安全漏洞，並協助提升網路安全和效能，同時確保符合政策規定。
新通訊埠活動 - 傳入
允許的通訊埠流量與封鎖的通訊埠流量
流量領先的 10 個通訊埠 - 傳出
通訊協定分配
常用禁止通訊埠的流量
依流量排序的前 10 個通訊埠 - 傳入
圖表名稱
查詢示例
新通訊埠活動 - 傳入
$event_type = metadata.event_type
$event_type >= 16000 and $event_type <= 16007
$Direction = network.direction
$Direction = "INBOUND"
$policy = security_result.rule_name
$port = strings.concat(target.port, "")
$port != /(40202|40203|40462|41611|41612|41620|41629|41674|41684|41685|41694|41703|41712|41721|41730|41747|43448|44924|44925|45071|52818|53025|54736|443|57903|58254|62977|80|88)/
$source_ip = principal.ip
$location = principal.ip_geo_artifact.location.country_or_region
$action = security_result.action
$action != "BLOCK"
match:
$port, $action
outcome:
$Source_IP = array_distinct($source_ip)
$event_count = count(metadata.id)
order:
$event_count desc
允許的通訊埠流量與封鎖的通訊埠流量
$event_type = metadata.event_type
$event_type >= 16000 and $event_type <= 16007
$action = security_result.action
$action != "UNKNOWN_ACTION"
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
match:
$action, $Date
outcome:
$Event_Count = count(metadata.id)
order:
$Date asc
流量領先的 10 個通訊埠 - 傳出
$event_type = metadata.event_type
$event_type >= 16000 and $event_type <= 16007
$Logtype = metadata.log_type
$Direction = network.direction
$Direction = "OUTBOUND"
$Port = target.port
match:
$Port
outcome:
$event_count = count(metadata.id)
$logtype = array_distinct($Logtype)
order:
$event_count desc
limit:
10
通訊協定分配
$event_type = metadata.event_type
$event_type >= 16000 and $event_type <= 16007
$Protocol = network.ip_protocol
$Protocol != "UNKNOWN_IP_PROTOCOL"
match:
$Protocol
outcome:
$Event_Count = count(metadata.id)
通訊協定分配
$event_type = metadata.event_type
$event_type >= 16000 and $event_type <= 16007
$Protocol = network.ip_protocol
$Protocol != "UNKNOWN_IP_PROTOCOL"
match:
$Protocol
outcome:
$Event_Count = count(metadata.id)
常用禁止通訊埠的流量
$event_type = metadata.event_type
$event_type >= 16000 and $event_type <= 16007
$policy = security_result.rule_name
$port = strings.concat(target.port, "")
$port != /(443|53|8080|8081|34622|34756|35406|35466|35546|36602|37276|38976|41394|41672|41926|45432|46354|47416|48678|51664|51824|52086|52818|54052|54958|55276|55890|57488|57666|58546|58914|59388|60388|61000|64450|64482|64498|64598|64674|64707|64735|64739|64740|64795|64828|64880|64905|64945|64962|65004|65019|65050|65094|65114|65169|65202|65223|65264|65287|65323|65346|65378|65392|65456|8728|3389|6379|5555|2222|5060|3128|8888|27017|8088|1080)/
match:
$port
outcome:
$event_count = count(metadata.id)
order:
$event_count desc
limit:
20
依流量排序的前 10 個通訊埠 - 傳入
$event_type = metadata.event_type
$event_type >= 16000 and $event_type <= 16007
$Direction = network.direction
$Direction = "INBOUND"
$Port = target.port
$Logtype = metadata.log_type
match:
$Port
outcome:
$event_count = count(metadata.id)
$logtype = array_distinct($Logtype)
order:
$event_count desc
limit:
10
常用禁止通訊埠的流量
$event_type = metadata.event_type
$event_type >= 16000 and $event_type <= 16007
$policy = security_result.rule_name
$port = strings.concat(target.port, "")
$port != /(443|53|8080|8081|34622|34756|35406|35466|35546|36602|37276|38976|41394|41672|41926|45432|46354|47416|48678|51664|51824|52086|52818|54052|54958|55276|55890|57488|57666|58546|58914|59388|60388|61000|64450|64482|64498|64598|64674|64707|64735|64739|64740|64795|64828|64880|64905|64945|64962|65004|65019|65050|65094|65114|65169|65202|65223|65264|65287|65323|65346|65378|65392|65456|8728|3389|6379|5555|2222|5060|3128|8888|27017|8088|1080)/
match:
$port
outcome:
$event_count = count(metadata.id)
order:
$event_count desc
limit:
20
流量領先的 10 個通訊埠 - 傳出
$event_type = metadata.event_type
$event_type >= 16000 and $event_type <= 16007
$Logtype = metadata.log_type
$Direction = network.direction
$Direction = "OUTBOUND"
$Port = target.port
match:
$Port
outcome:
$event_count = count(metadata.id)
$logtype = array_distinct($Logtype)
order:
$event_count desc
limit:
10
允許的通訊埠流量與封鎖的通訊埠流量
$event_type = metadata.event_type
$event_type >= 16000 and $event_type <= 16007
$action = security_result.action
$action != "UNKNOWN_ACTION"
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
match:
$action, $Date
outcome:
$Event_Count = count(metadata.id)
order:
$Date asc
依流量排序的前 10 個通訊埠 - 傳入
$event_type = metadata.event_type
$event_type >= 16000 and $event_type <= 16007
$Direction = network.direction
$Direction = "INBOUND"
$Port = target.port
$Logtype = metadata.log_type
match:
$Port
outcome:
$event_count = count(metadata.id)
$logtype = array_distinct($Logtype)
order:
$event_count desc
limit:
10
新通訊埠活動 - 傳入
$event_type = metadata.event_type
$event_type >= 16000 and $event_type <= 16007
$Direction = network.direction
$Direction = "INBOUND"
$policy = security_result.rule_name
$port = strings.concat(target.port, "")
$port != /(40202|40203|40462|41611|41612|41620|41629|41674|41684|41685|41694|41703|41712|41721|41730|41747|43448|44924|44925|45071|52818|53025|54736|443|57903|58254|62977|80|88)/
$source_ip = principal.ip
$location = principal.ip_geo_artifact.location.country_or_region
$action = security_result.action
$action != "BLOCK"
match:
$port, $action
outcome:
$Source_IP = array_distinct($source_ip)
$event_count = count(metadata.id)
order:
$event_count desc
PowerShell
這個資訊主頁旨在分析及監控貴機構的 PowerShell 活動。可深入瞭解指令執行情況、使用者互動和潛在安全風險。資訊主頁會匯總並顯示這類資料，協助您找出潛在問題、追蹤威脅，以及提升整體安全性。
依程序事件類型執行的 Powershell
最少用的檔案路徑
最不常見的主機
最少用的指令列
前 10 位使用者
依安全性結果動作分類的 PowerShell 事件
最少見的使用者
PowerShell 傳出網路連線
PowerShell 活動摘要
前 10 大指令列
依嚴重程度分類的 PowerShell 事件
字元變數模糊處理
前 10 大主機
透過 PowerShell 下載檔案
包含 PowerShell 的前 10 大事件類型
前 10 大檔案路徑
圖表名稱
查詢示例
依程序事件類型執行的 Powershell
$event.metadata.event_type = "PROCESS_UNCATEGORIZED"
or $event.metadata.event_type = "PROCESS_LAUNCH"
or $event.metadata.event_type = "PROCESS_INJECTION"
or $event.metadata.event_type = "PROCESS_PRIVILEGE_ESCALATION"
or $event.metadata.event_type = "PROCESS_TERMINATION"
or $event.metadata.event_type = "PROCESS_OPEN"
or $event.metadata.event_type = "PROCESS_MODULE_LOAD"
$Command_Line = group($event.principal.process.command_line, $event.target.process.command_line)
$Command_Line = /(?:pwsh|powershell(?:_ise)?)\.exe/ nocase
$Event_Type = $event.metadata.event_type
$Date = timestamp.get_date($event.metadata.event_timestamp.seconds)
match:
$Event_Type, $Date
outcome:
$Count = count($event.metadata.id)
order:
$Count desc
limit:
10
最少用的檔案路徑
$event.principal.process.file.full_path = /(?:pwsh|powershell(?:_ise)?)\.exe/ nocase
$Full_Path = group($event.principal.process.file.full_path, $event.target.process.file.full_path)
$Full_Path != ""
match:
$Full_Path
outcome:
$Count = count($event.metadata.id)
order:
$Count asc
limit:
100
最不常見的主機
$Command_Line = group($event.principal.process.command_line, $event.target.process.command_line)
$Command_Line = /(?:pwsh|powershell(?:_ise)?)\.exe/ nocase
$Hostname = $event.principal.hostname
match:
$Hostname
outcome:
$Count = count($event.metadata.id)
order:
$Count asc
limit:
100
最少用的指令列
$Command_Line = group($event.principal.process.command_line, $event.target.process.command_line)
$Command_Line = /(?:pwsh|powershell(?:_ise)?)\.exe/ nocase
match:
$Command_Line
outcome:
$Count = count($event.metadata.id)
order:
$Count asc
limit:
10
最少用的指令列
$Command_Line = group($event.principal.process.command_line, $event.target.process.command_line)
$Command_Line = /(?:pwsh|powershell(?:_ise)?)\.exe/ nocase
match:
$Command_Line
outcome:
$Count = count($event.metadata.id)
order:
$Count asc
limit:
10
前 10 位使用者
$event.principal.user.userid != /\$$/
$Command_Line = group($event.principal.process.command_line, $event.target.process.command_line)
$Command_Line = /(?:pwsh|powershell(?:_ise)?)\.exe/ nocase
$User = $event.principal.user.userid
$User != ""
match:
$User
outcome:
$Count = count($event.metadata.id)
order:
$Count desc
limit:
10
PowerShell Events by Security Result Action
$Powershell = group($event.principal.process.command_line, $event.target.process.command_line)
$Powershell = /(?:pwsh|powershell(?:_ise)?)\.exe/ nocase
$Action = $event.security_result.action
match:
$Action
outcome:
$Count = count($event.security_result.action)
order:
$Count desc
PowerShell Events by Security Result Action
$Powershell = group($event.principal.process.command_line, $event.target.process.command_line)
$Powershell = /(?:pwsh|powershell(?:_ise)?)\.exe/ nocase
$Action = $event.security_result.action
match:
$Action
outcome:
$Count = count($event.security_result.action)
order:
$Count desc
Least Common Users
$event.principal.user.userid != /\$$/
$Command_Line = group($event.principal.process.command_line, $event.target.process.command_line)
$Command_Line = /(?:pwsh|powershell(?:_ise)?)\.exe/ nocase
$User = $event.principal.user.userid
match:
$User
outcome:
$Count = count($event.metadata.id)
order:
$Count asc
limit:
100
PowerShell 傳出網路連線
$event.metadata.event_type = "NETWORK_CONNECTION"
$event.network.direction = "OUTBOUND"
$Command_Line = group($event.principal.process.command_line, $event.target.process.command_line)
$Command_Line = /(?:pwsh|powershell(?:_ise)?)\.exe/ nocase
$Destination_IP = $event.target.ip
$Source_IP = $event.principal.ip
$Direction = $event.network.direction
match:
$Source_IP, $Direction, $Destination_IP, $Command_Line
outcome:
$Count = count($event.metadata.id)
order:
$Count desc
limit:
50
PowerShell 傳出網路連線
$event.metadata.event_type = "NETWORK_CONNECTION"
$event.network.direction = "OUTBOUND"
$Command_Line = group($event.principal.process.command_line, $event.target.process.command_line)
$Command_Line = /(?:pwsh|powershell(?:_ise)?)\.exe/ nocase
$Destination_IP = $event.target.ip
$Source_IP = $event.principal.ip
$Direction = $event.network.direction
match:
$Source_IP, $Direction, $Destination_IP, $Command_Line
outcome:
$Count = count($event.metadata.id)
order:
$Count desc
limit:
50
PowerShell 活動摘要
$Command_Line = group($event.principal.process.command_line, $event.target.process.command_line)
$Command_Line = /(?:pwsh|powershell(?:_ise)?)\.exe/ nocase
$Event_Type = $event.metadata.event_type
$Log_Type = $event.metadata.log_type
$Direction = $event.network.direction
match:
$Event_Type, $Log_Type, $Direction, $Command_Line
outcome:
$Count = count($event.metadata.id)
order:
$Count desc
limit:
50
前 10 大指令列
$Command_Line = group($event.principal.process.command_line, $event.target.process.command_line)
$Command_Line = /(?:pwsh|powershell(?:_ise)?)\.exe/ nocase
match:
$Command_Line
outcome:
$Count = count($event.metadata.id)
order:
$Count desc
limit:
10
依嚴重程度分類的 PowerShell 事件
$Powershell = group($event.principal.process.command_line, $event.target.process.command_line)
$Powershell = /(?:pwsh|powershell(?:_ise)?)\.exe/ nocase
$Severity = $event.security_result.severity
match:
$Severity
outcome:
$Count = count($event.security_result.severity)
order:
$Count desc
依程序事件類型執行的 Powershell
$event.metadata.event_type = "PROCESS_UNCATEGORIZED"
or $event.metadata.event_type = "PROCESS_LAUNCH"
or $event.metadata.event_type = "PROCESS_INJECTION"
or $event.metadata.event_type = "PROCESS_PRIVILEGE_ESCALATION"
or $event.metadata.event_type = "PROCESS_TERMINATION"
or $event.metadata.event_type = "PROCESS_OPEN"
or $event.metadata.event_type = "PROCESS_MODULE_LOAD"
$Command_Line = group($event.principal.process.command_line, $event.target.process.command_line)
$Command_Line = /(?:pwsh|powershell(?:_ise)?)\.exe/ nocase
$Event_Type = $event.metadata.event_type
match:
$Event_Type
outcome:
$Count = count($event.metadata.id)
order:
$Count desc
字元變數模糊處理
$Command_Line = group($event.principal.process.command_line, $event.target.process.command_line)
$Command_Line = /(?:powershell(?:\.exe)?).*\[char(?:\]|\[)/ nocase
or $Command_Line = /(?:powershell(?:\.exe)?).*(?:iex|invoke-expression)/ nocase
or $Command_Line = /(?:powershell(?:\.exe)?).*(?:tochararray)/ nocase
$Registry_Value = $event.target.registry.registry_value_data
match:
$Command_Line, $Registry_Value
outcome:
$Count = count($event.metadata.id)
limit:
50
Top 10 Hosts
$Command_Line = group($event.principal.process.command_line, $event.target.process.command_line)
$Command_Line = /(?:pwsh|powershell(?:_ise)?)\.exe/ nocase
$Hostname = $event.principal.hostname
$Hostname != ""
match:
$Hostname
outcome:
$Count = count($event.metadata.id)
order:
$Count desc
limit:
10
Top 10 Users
$event.principal.user.userid != /\$$/
$Command_Line = group($event.principal.process.command_line, $event.target.process.command_line)
$Command_Line = /(?:pwsh|powershell(?:_ise)?)\.exe/ nocase
$User = $event.principal.user.userid
match:
$User
outcome:
$Count = count($event.metadata.id)
order:
$Count desc
limit:
10
File Downloads via PowerShell
$Command_Line = group($event.principal.process.command_line, $event.target.process.command_line)
$Command_Line = /(?:powershell(?:\.exe)?).*?(?:Invoke\-(?:WebRequest|RestMethod)|Start\-BitsTransfer)/ nocase
or $Command_Line = /(?:powershell(?:\.exe)?).*?(?:system\.net\.(?:http\.httpclient|webclient).*?(?:downloadfile|writeallbytes))/ nocase
match:
$Command_Line
outcome:
$Count = count($event.metadata.id)
limit:
50
Top 10 Event Types Containing PowerShell
$Command_Line = group($event.principal.process.command_line, $event.target.process.command_line)
$Command_Line = /(?:pwsh|powershell(?:_ise)?)\.exe/ nocase
$Event_Type = $event.metadata.event_type
match:
$Event_Type
outcome:
$Count = count($event.metadata.id)
order:
$Count desc
limit:
10
Powershell Activity Summary
$Command_Line = group($event.principal.process.command_line, $event.target.process.command_line)
$Command_Line = /(?:pwsh|powershell(?:_ise)?)\.exe/ nocase
$Event_Type = $event.metadata.event_type
$Log_Type = $event.metadata.log_type
$Direction = $event.network.direction
match:
$Event_Type, $Log_Type, $Direction, $Command_Line
outcome:
$Count = count($event.metadata.id)
order:
$Count desc
limit:
50
Top 10 Command Lines
$Command_Line = group($event.principal.process.command_line, $event.target.process.command_line)
$Command_Line = /(?:pwsh|powershell(?:_ise)?)\.exe/ nocase
match:
$Command_Line
outcome:
$Count = count($event.metadata.id)
order:
$Count desc
limit:
10
Least Common Users
$event.principal.user.userid != /\$$/
$Command_Line = group($event.principal.process.command_line, $event.target.process.command_line)
$Command_Line = /(?:pwsh|powershell(?:_ise)?)\.exe/ nocase
$User = $event.principal.user.userid
match:
$User
outcome:
$Count = count($event.metadata.id)
order:
$Count asc
limit:
100
Top 10 Hosts
$Command_Line = group($event.principal.process.command_line, $event.target.process.command_line)
$Command_Line = /(?:pwsh|powershell(?:_ise)?)\.exe/ nocase
$Hostname = $event.principal.hostname
match:
$Hostname
outcome:
$Count = count($event.metadata.id)
order:
$Count desc
limit:
10
Top 10 Event Types Containing PowerShell
$Command_Line = group($event.principal.process.command_line, $event.target.process.command_line)
$Command_Line = /(?:pwsh|powershell(?:_ise)?)\.exe/ nocase
$Event_Type = $event.metadata.event_type
match:
$Event_Type
outcome:
$Count = count($event.metadata.id)
order:
$Count desc
limit:
10
Least Common File Paths
$event.principal.process.file.full_path = /(?:pwsh|powershell(?:_ise)?)\.exe/ nocase
$Full_Path = group($event.principal.process.file.full_path, $event.target.process.file.full_path)
$Full_Path != ""
match:
$Full_Path
outcome:
$Count = count($event.metadata.id)
order:
$Count asc
limit:
100
Powershell Execution by Process Event Type
$event.metadata.event_type = "PROCESS_UNCATEGORIZED"
or $event.metadata.event_type = "PROCESS_LAUNCH"
or $event.metadata.event_type = "PROCESS_INJECTION"
or $event.metadata.event_type = "PROCESS_PRIVILEGE_ESCALATION"
or $event.metadata.event_type = "PROCESS_TERMINATION"
or $event.metadata.event_type = "PROCESS_OPEN"
or $event.metadata.event_type = "PROCESS_MODULE_LOAD"
$Command_Line = group($event.principal.process.command_line, $event.target.process.command_line)
$Command_Line = /(?:pwsh|powershell(?:_ise)?)\.exe/ nocase
$Event_Type = $event.metadata.event_type
$Date = timestamp.get_date($event.metadata.event_timestamp.seconds)
match:
$Event_Type, $Date
outcome:
$Count = count($event.metadata.id)
order:
$Count desc
limit:
10
Top 10 File Paths
$event.principal.process.file.full_path = /(?:pwsh|powershell(?:_ise)?)\.exe/ nocase
$Full_Path = group($event.principal.process.file.full_path, $event.target.process.file.full_path)
$Full_Path != ""
match:
$Full_Path
outcome:
$Count = count($event.metadata.id)
order:
$Count desc
limit:
10
Char Variable Obfuscation
$Command_Line = group($event.principal.process.command_line, $event.target.process.command_line)
$Command_Line = /(?:powershell(?:\.exe)?).*\[char(?:\]|\[)/ nocase
or $Command_Line = /(?:powershell(?:\.exe)?).*(?:iex|invoke-expression)/ nocase
or $Command_Line = /(?:powershell(?:\.exe)?).*(?:tochararray)/ nocase
$Registry_Value = $event.target.registry.registry_value_data
match:
$Command_Line, $Registry_Value
outcome:
$Count = count($event.metadata.id)
limit:
50
透過 PowerShell 下載檔案
$Command_Line = group($event.principal.process.command_line, $event.target.process.command_line)
$Command_Line = /(?:powershell(?:\.exe)?).*?(?:Invoke\-(?:WebRequest|RestMethod)|Start\-BitsTransfer)/ nocase
or $Command_Line = /(?:powershell(?:\.exe)?).*?(?:system\.net\.(?:http\.httpclient|webclient).*?(?:downloadfile|writeallbytes))/ nocase
match:
$Command_Line
outcome:
$Count = count($event.metadata.id)
limit:
50
依程序事件類型執行的 Powershell
$event.metadata.event_type = "PROCESS_UNCATEGORIZED"
or $event.metadata.event_type = "PROCESS_LAUNCH"
or $event.metadata.event_type = "PROCESS_INJECTION"
or $event.metadata.event_type = "PROCESS_PRIVILEGE_ESCALATION"
or $event.metadata.event_type = "PROCESS_TERMINATION"
or $event.metadata.event_type = "PROCESS_OPEN"
or $event.metadata.event_type = "PROCESS_MODULE_LOAD"
$Command_Line = group($event.principal.process.command_line, $event.target.process.command_line)
$Command_Line = /(?:pwsh|powershell(?:_ise)?)\.exe/ nocase
$Event_Type = $event.metadata.event_type
match:
$Event_Type
outcome:
$Count = count($event.metadata.id)
order:
$Count desc
依嚴重程度分類的 PowerShell 事件
$Powershell = group($event.principal.process.command_line, $event.target.process.command_line)
$Powershell = /(?:pwsh|powershell(?:_ise)?)\.exe/ nocase
$Severity = $event.security_result.severity
match:
$Severity
outcome:
$Count = count($event.security_result.severity)
order:
$Count desc
前 10 大檔案路徑
$event.principal.process.file.full_path = /(?:pwsh|powershell(?:_ise)?)\.exe/ nocase
$Full_Path = group($event.principal.process.file.full_path, $event.target.process.file.full_path)
$Full_Path != ""
match:
$Full_Path
outcome:
$Count = count($event.metadata.id)
order:
$Count desc
limit:
10
最不常見的主機
$Command_Line = group($event.principal.process.command_line, $event.target.process.command_line)
$Command_Line = /(?:pwsh|powershell(?:_ise)?)\.exe/ nocase
$Hostname = $event.principal.hostname
match:
$Hostname
outcome:
$Count = count($event.metadata.id)
order:
$Count asc
limit:
100
特殊存取權管理
這個資訊主頁會追蹤具備特殊權限的存取活動，找出使用者、主機名稱和 IP 位址等來源，同時醒目顯示重要資產。有助於安全團隊監控存取趨勢及管理風險，確保只有獲得授權的人員才能存取機密系統和資料。
注意： 套用篩選條件，即可在資訊主頁上顯示相關結果。
前 10 位管理員
前 10 大資產
歷來事件
前 10 大使用者帳戶
事件類型分布
前 10 大目標主機名稱
前 10 大來源 IP
前 10 名來源使用者名稱
圖表名稱
查詢示例
前 10 位管理員
principal.user.attribute.roles.type = "ADMINISTRATOR"
$Admin = principal.user.userid
match:
$Admin
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
前 10 大資產
$Asset = target.asset.hostname
$Asset != ""
match:
$Asset
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
歷來事件
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
match:
$Date
outcome:
$Count = count(metadata.id)
order:
$Date desc
前 10 大使用者帳戶
$Account = target.user.userid
$Account != ""
match:
$Account
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
事件類型分布
$Event_Type = metadata.event_type
match:
$Event_Type
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
50
前 10 大目標主機名稱
$Hostname = target.hostname
$Hostname != ""
match:
$Hostname
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
前 10 大來源 IP
$Source_IP = principal.ip
$Source_IP != ""
match:
$Source_IP
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
前 10 名來源使用者名稱
$Username = principal.user.userid
$Username != ""
match:
$Username
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
程序事件摘要
這個資訊主頁會收集並以視覺化方式呈現各種程序發生情形、主機、使用者和事件的資料，讓您全面掌握網路活動。並醒目顯示重要指標、圖表和異常狀況，提供事件頻率和程序效能的深入分析資料。這項功能有助於主動監控系統健康狀態、透過異常行為偵測潛在安全威脅，以及找出需要提升效率的領域。
Powershell 事件總數
前 10 個父項程序
前 10 位使用者
指令殼層事件總數
不重複使用者總數
遭封鎖的事件總數
前 10 大 PowerShell 事件
前 10 大雜湊
處理事件
使用者最常執行的 10 大 Shell 指令
處理歷來事件
前 10 大主機名稱
一段時間內的程序終止事件
處理事件總數
前 10 大主機
不重複主機總數
不重複主機名稱總數
事件類型分布情形
近期程序事件
前 10 大命令殼層事件
圖表名稱
查詢示例
Powershell 事件總數
$event.metadata.event_type = "PROCESS_UNCATEGORIZED"
or $event.metadata.event_type = "PROCESS_LAUNCH"
or $event.metadata.event_type = "PROCESS_INJECTION"
or $event.metadata.event_type = "PROCESS_PRIVILEGE_ESCALATION"
or $event.metadata.event_type = "PROCESS_TERMINATION"
or $event.metadata.event_type = "PROCESS_OPEN"
or $event.metadata.event_type = "PROCESS_MODULE_LOAD"
$Powershell = group($event.principal.process.command_line, $event.target.process.command_line)
$Powershell = /(?:pwsh|powershell(?:_ise)?)\.exe/ nocase
outcome:
$Count = count($Powershell)
前 10 個父項程序
metadata.event_type = "PROCESS_UNCATEGORIZED"
or metadata.event_type = "PROCESS_LAUNCH"
or metadata.event_type = "PROCESS_INJECTION"
or metadata.event_type = "PROCESS_PRIVILEGE_ESCALATION"
or metadata.event_type = "PROCESS_TERMINATION"
or metadata.event_type = "PROCESS_OPEN"
or metadata.event_type = "PROCESS_MODULE_LOAD"
$Event_Type = metadata.event_type
$Parent_Process = re.capture(principal.process.file.full_path, `\w+.exe$`)
$Parent_Process != ""
match:
$Parent_Process, $Event_Type
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
前 10 位使用者
$event.metadata.event_type = "PROCESS_UNCATEGORIZED"
or $event.metadata.event_type = "PROCESS_LAUNCH"
or $event.metadata.event_type = "PROCESS_INJECTION"
or $event.metadata.event_type = "PROCESS_PRIVILEGE_ESCALATION"
or $event.metadata.event_type = "PROCESS_TERMINATION"
or $event.metadata.event_type = "PROCESS_OPEN"
or $event.metadata.event_type = "PROCESS_MODULE_LOAD"
$Event_Type = $event.metadata.event_type
$User = strings.concat($event.principal.user.userid, " ")
match:
$User, $Event_Type
outcome:
$Count = count($event.metadata.id)
order:
$Count desc
limit:
10
指令殼層事件總數
metadata.event_type = "PROCESS_UNCATEGORIZED"
or metadata.event_type = "PROCESS_LAUNCH"
or metadata.event_type = "PROCESS_INJECTION"
or metadata.event_type = "PROCESS_PRIVILEGE_ESCALATION"
or metadata.event_type = "PROCESS_TERMINATION"
or metadata.event_type = "PROCESS_OPEN"
or metadata.event_type = "PROCESS_MODULE_LOAD"
$Command_Shell = principal.process.command_line
$Command_Shell = /(?:cmd|shell)\.exe/ nocase or $Command_Shell = /\/(bash|sh|zsh)/ nocase
outcome:
$Count = count($Command_Shell)
不重複使用者總數
$event.metadata.event_type = "PROCESS_UNCATEGORIZED"
or $event.metadata.event_type = "PROCESS_LAUNCH"
or $event.metadata.event_type = "PROCESS_INJECTION"
or $event.metadata.event_type = "PROCESS_PRIVILEGE_ESCALATION"
or $event.metadata.event_type = "PROCESS_TERMINATION"
or $event.metadata.event_type = "PROCESS_OPEN"
or $event.metadata.event_type = "PROCESS_MODULE_LOAD"
outcome:
$Count = count_distinct($event.principal.user.userid)
遭封鎖的事件總數
$event.metadata.event_type = "PROCESS_UNCATEGORIZED"
or $event.metadata.event_type = "PROCESS_LAUNCH"
or $event.metadata.event_type = "PROCESS_INJECTION"
or $event.metadata.event_type = "PROCESS_PRIVILEGE_ESCALATION"
or $event.metadata.event_type = "PROCESS_TERMINATION"
or $event.metadata.event_type = "PROCESS_OPEN"
or $event.metadata.event_type = "PROCESS_MODULE_LOAD"
$event.security_result.action = "BLOCK"
outcome:
$Count = count($event.metadata.id)
Powershell 事件總數
metadata.event_type = "PROCESS_UNCATEGORIZED"
or metadata.event_type = "PROCESS_LAUNCH"
or metadata.event_type = "PROCESS_INJECTION"
or metadata.event_type = "PROCESS_PRIVILEGE_ESCALATION"
or metadata.event_type = "PROCESS_TERMINATION"
or metadata.event_type = "PROCESS_OPEN"
or metadata.event_type = "PROCESS_MODULE_LOAD"
$Powershell = group(principal.process.command_line, target.process.command_line)
$Powershell = /(?:pwsh|powershell(?:_ise)?)\.exe/ nocase
outcome:
$Count = count($Powershell)
前 10 大 PowerShell 事件
$event.metadata.event_type = "PROCESS_UNCATEGORIZED"
or $event.metadata.event_type = "PROCESS_LAUNCH"
or $event.metadata.event_type = "PROCESS_INJECTION"
or $event.metadata.event_type = "PROCESS_PRIVILEGE_ESCALATION"
or $event.metadata.event_type = "PROCESS_TERMINATION"
or $event.metadata.event_type = "PROCESS_OPEN"
or $event.metadata.event_type = "PROCESS_MODULE_LOAD"
$Powershell = group($event.principal.process.command_line, $event.target.process.command_line)
$Powershell = /(?:pwsh|powershell(?:_ise)?)\.exe/ nocase
match:
$Powershell
outcome:
$Count = count($event.metadata.id)
order:
$Count desc
limit:
10
前 10 大雜湊
metadata.event_type = "PROCESS_UNCATEGORIZED"
or metadata.event_type = "PROCESS_LAUNCH"
or metadata.event_type = "PROCESS_INJECTION"
or metadata.event_type = "PROCESS_PRIVILEGE_ESCALATION"
or metadata.event_type = "PROCESS_TERMINATION"
or metadata.event_type = "PROCESS_OPEN"
or metadata.event_type = "PROCESS_MODULE_LOAD"
$Event_Type = metadata.event_type
$Hash = group(principal.process.file.md5, principal.process.file.sha1, principal.process.file.sha256, target.process.file.md5, target.process.file.sha1, target.process.file.sha256)
$Hash != ""
match:
$Hash, $Event_Type
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
處理事件
$event.metadata.event_type = "PROCESS_UNCATEGORIZED"
or $event.metadata.event_type = "PROCESS_LAUNCH"
or $event.metadata.event_type = "PROCESS_INJECTION"
or $event.metadata.event_type = "PROCESS_PRIVILEGE_ESCALATION"
or $event.metadata.event_type = "PROCESS_TERMINATION"
or $event.metadata.event_type = "PROCESS_OPEN"
or $event.metadata.event_type = "PROCESS_MODULE_LOAD"
$Hostname = $event.principal.hostname
$User = $event.principal.user.userid
$Parent_Process = $event.principal.process.file.full_path
$Parent_Command_Line = $event.principal.process.command_line
$Target_Process = $event.target.process.file.full_path
$Target_Command_Line = $event.target.process.command_line
match:
$Hostname, $User, $Parent_Process, $Parent_Command_Line, $Target_Process, $Target_Command_Line
outcome:
$Time = timestamp.get_timestamp(max($event.metadata.event_timestamp.seconds))
order:
$Time desc
limit:
50
使用者最常執行的 10 大 Shell 指令
metadata.event_type = "PROCESS_UNCATEGORIZED"
or metadata.event_type = "PROCESS_LAUNCH"
or metadata.event_type = "PROCESS_INJECTION"
or metadata.event_type = "PROCESS_PRIVILEGE_ESCALATION"
or metadata.event_type = "PROCESS_TERMINATION"
or metadata.event_type = "PROCESS_OPEN"
or metadata.event_type = "PROCESS_MODULE_LOAD"
$Shell = principal.process.command_line
$Shell = /(?:pwsh|powershell(?:_ise)?)\.exe/ nocase
or $Shell = /(?:cmd|shell)\.exe/ nocase
or $Shell = /\/(bash|sh|zsh)/ nocase
$User = principal.user.userid
match:
$Shell, $User
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
處理歷來事件
metadata.event_type = "PROCESS_UNCATEGORIZED"
or metadata.event_type = "PROCESS_LAUNCH"
or metadata.event_type = "PROCESS_INJECTION"
or metadata.event_type = "PROCESS_PRIVILEGE_ESCALATION"
or metadata.event_type = "PROCESS_TERMINATION"
or metadata.event_type = "PROCESS_OPEN"
or metadata.event_type = "PROCESS_MODULE_LOAD"
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
match:
$Date
outcome:
$Count = count(metadata.id)
order:
$Date desc
前 10 大主機名稱
metadata.event_type = "PROCESS_UNCATEGORIZED"
or metadata.event_type = "PROCESS_LAUNCH"
or metadata.event_type = "PROCESS_INJECTION"
or metadata.event_type = "PROCESS_PRIVILEGE_ESCALATION"
or metadata.event_type = "PROCESS_TERMINATION"
or metadata.event_type = "PROCESS_OPEN"
or metadata.event_type = "PROCESS_MODULE_LOAD"
$Event_Type = metadata.event_type
$Hostname = principal.hostname
match:
$Hostname, $Event_Type
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
前 10 位使用者
metadata.event_type = "PROCESS_UNCATEGORIZED"
or metadata.event_type = "PROCESS_LAUNCH"
or metadata.event_type = "PROCESS_INJECTION"
or metadata.event_type = "PROCESS_PRIVILEGE_ESCALATION"
or metadata.event_type = "PROCESS_TERMINATION"
or metadata.event_type = "PROCESS_OPEN"
or metadata.event_type = "PROCESS_MODULE_LOAD"
$Event_Type = metadata.event_type
$User = strings.concat(principal.user.userid, " ")
match:
$User, $Event_Type
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
一段時間內的程序終止事件
metadata.event_type = "PROCESS_TERMINATION"
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
match:
$Date
outcome:
$Count = count(metadata.id)
order:
$Date desc
遭封鎖的事件總數
metadata.event_type = "PROCESS_UNCATEGORIZED"
or metadata.event_type = "PROCESS_LAUNCH"
or metadata.event_type = "PROCESS_INJECTION"
or metadata.event_type = "PROCESS_PRIVILEGE_ESCALATION"
or metadata.event_type = "PROCESS_TERMINATION"
or metadata.event_type = "PROCESS_OPEN"
or metadata.event_type = "PROCESS_MODULE_LOAD"
security_result.action = "BLOCK"
outcome:
$Count = count(metadata.id)
不重複使用者總數
metadata.event_type = "PROCESS_UNCATEGORIZED"
or metadata.event_type = "PROCESS_LAUNCH"
or metadata.event_type = "PROCESS_INJECTION"
or metadata.event_type = "PROCESS_PRIVILEGE_ESCALATION"
or metadata.event_type = "PROCESS_TERMINATION"
or metadata.event_type = "PROCESS_OPEN"
or metadata.event_type = "PROCESS_MODULE_LOAD"
outcome:
$Count = count_distinct(principal.user.userid)
處理事件總數
metadata.event_type = "PROCESS_UNCATEGORIZED"
or metadata.event_type = "PROCESS_LAUNCH"
or metadata.event_type = "PROCESS_INJECTION"
or metadata.event_type = "PROCESS_PRIVILEGE_ESCALATION"
or metadata.event_type = "PROCESS_TERMINATION"
or metadata.event_type = "PROCESS_OPEN"
or metadata.event_type = "PROCESS_MODULE_LOAD"
outcome:
$Count = count(metadata.id)
前 10 大主機
$event.metadata.event_type = "PROCESS_UNCATEGORIZED"
or $event.metadata.event_type = "PROCESS_LAUNCH"
or $event.metadata.event_type = "PROCESS_INJECTION"
or $event.metadata.event_type = "PROCESS_PRIVILEGE_ESCALATION"
or $event.metadata.event_type = "PROCESS_TERMINATION"
or $event.metadata.event_type = "PROCESS_OPEN"
or $event.metadata.event_type = "PROCESS_MODULE_LOAD"
$Event_Type = $event.metadata.event_type
$Hostname = $event.principal.hostname
match:
$Hostname, $Event_Type
outcome:
$Count = count($event.metadata.id)
order:
$Count desc
limit:
10
處理事件總數
$event.metadata.event_type = "PROCESS_UNCATEGORIZED"
or $event.metadata.event_type = "PROCESS_LAUNCH"
or $event.metadata.event_type = "PROCESS_INJECTION"
or $event.metadata.event_type = "PROCESS_PRIVILEGE_ESCALATION"
or $event.metadata.event_type = "PROCESS_TERMINATION"
or $event.metadata.event_type = "PROCESS_OPEN"
or $event.metadata.event_type = "PROCESS_MODULE_LOAD"
outcome:
$Count = count($event.metadata.id)
不重複主機總數
$event.metadata.event_type = "PROCESS_UNCATEGORIZED"
or $event.metadata.event_type = "PROCESS_LAUNCH"
or $event.metadata.event_type = "PROCESS_INJECTION"
or $event.metadata.event_type = "PROCESS_PRIVILEGE_ESCALATION"
or $event.metadata.event_type = "PROCESS_TERMINATION"
or $event.metadata.event_type = "PROCESS_OPEN"
or $event.metadata.event_type = "PROCESS_MODULE_LOAD"
outcome:
$Count = count_distinct($event.principal.hostname)
不重複主機名稱總數
metadata.event_type = "PROCESS_UNCATEGORIZED"
or metadata.event_type = "PROCESS_LAUNCH"
or metadata.event_type = "PROCESS_INJECTION"
or metadata.event_type = "PROCESS_PRIVILEGE_ESCALATION"
or metadata.event_type = "PROCESS_TERMINATION"
or metadata.event_type = "PROCESS_OPEN"
or metadata.event_type = "PROCESS_MODULE_LOAD"
outcome:
$Count = count_distinct(principal.hostname)
指令殼層事件總數
$event.metadata.event_type = "PROCESS_UNCATEGORIZED"
or $event.metadata.event_type = "PROCESS_LAUNCH"
or $event.metadata.event_type = "PROCESS_INJECTION"
or $event.metadata.event_type = "PROCESS_PRIVILEGE_ESCALATION"
or $event.metadata.event_type = "PROCESS_TERMINATION"
or $event.metadata.event_type = "PROCESS_OPEN"
or $event.metadata.event_type = "PROCESS_MODULE_LOAD"
$Command_Shell = $event.principal.process.command_line
$Command_Shell = /(?:cmd|shell)\.exe/ nocase or $Command_Shell = /\/(bash|sh|zsh)/ nocase
outcome:
$Count = count($Command_Shell)
事件類型分布情形
metadata.event_type = "PROCESS_UNCATEGORIZED"
or metadata.event_type = "PROCESS_LAUNCH"
or metadata.event_type = "PROCESS_INJECTION"
or metadata.event_type = "PROCESS_PRIVILEGE_ESCALATION"
or metadata.event_type = "PROCESS_TERMINATION"
or metadata.event_type = "PROCESS_OPEN"
or metadata.event_type = "PROCESS_MODULE_LOAD"
$Event_Type = metadata.event_type
match:
$Event_Type
outcome:
$Count = count(metadata.id)
order:
$Count desc
近期程序事件
metadata.event_type = "PROCESS_UNCATEGORIZED"
or metadata.event_type = "PROCESS_LAUNCH"
or metadata.event_type = "PROCESS_INJECTION"
or metadata.event_type = "PROCESS_PRIVILEGE_ESCALATION"
or metadata.event_type = "PROCESS_TERMINATION"
or metadata.event_type = "PROCESS_OPEN"
or metadata.event_type = "PROCESS_MODULE_LOAD"
$Hostname = principal.hostname
$User = principal.user.userid
$Parent_Process = principal.process.file.full_path
$Parent_Command_Line = principal.process.command_line
$Target_Process = target.process.file.full_path
$Target_Command_Line = target.process.command_line
match:
$Hostname, $User, $Parent_Process, $Parent_Command_Line, $Target_Process, $Target_Command_Line
outcome:
$Time = timestamp.get_timestamp(max(metadata.event_timestamp.seconds), "%F %T")
order:
$Time desc
前 10 大命令殼層事件
$event.metadata.event_type = "PROCESS_UNCATEGORIZED"
or $event.metadata.event_type = "PROCESS_LAUNCH"
or $event.metadata.event_type = "PROCESS_INJECTION"
or $event.metadata.event_type = "PROCESS_PRIVILEGE_ESCALATION"
or $event.metadata.event_type = "PROCESS_TERMINATION"
or $event.metadata.event_type = "PROCESS_OPEN"
or $event.metadata.event_type = "PROCESS_MODULE_LOAD"
$Command_Shell = $event.principal.process.command_line
$Command_Shell = /(?:cmd|shell)\.exe/ nocase or $Command_Shell = /\/(bash|sh|zsh)/ nocase
match:
$Command_Shell
outcome:
$Count = count($event.metadata.id)
order:
$Count desc
limit:
10
勒索軟體焦點監控
這個資訊主頁會全面顯示各種安全工具和資料來源偵測到的勒索軟體相關活動。這項功能會醒目顯示近期事件、受影響的裝置和偵測來源，協助資安團隊迅速找出並應對勒索軟體威脅。
依網址/附件列出的近期勒索軟體電子郵件事件
近期勒索軟體 VM 事件
近期勒索軟體資料遺失防護事件
最近的端點勒索軟體事件
前 10 大勒索軟體記錄來源
按產品劃分的勒索軟體事件
近期勒索軟體 NDR 事件
依主機名稱列出的近期勒索軟體事件
圖表名稱
查詢示例
依網址/附件列出的近期勒索軟體電子郵件事件
security_result.summary = /ransom/ nocase
$Subject = network.email.subject
$Sender = network.email.from
$Receiver = network.email.to
$Log_Type = metadata.log_type
$Attachments = strings.coalesce(about.file.full_path, security_result.detection_fields["attachmentNames"])
$Summary = security_result.summary
$Url = target.url
$Action = security_result.action
$Severity = security_result.severity
match:
$Sender, $Receiver, $Subject, $Summary, $Url , $Attachments, $Action, $Severity, $Log_Type
outcome:
$Date = timestamp.get_timestamp(max(metadata.event_timestamp.seconds), "%F %T")
$Count = count(metadata.id)
order:
$Count desc
近期勒索軟體 VM 事件
extensions.vulns.vulnerabilities.description = /ransom/ nocase
$Log_Type = metadata.log_type
$Summary = extensions.vulns.vulnerabilities.description
$Hostname = strings.coalesce(principal.hostname, principal.asset.hostname, target.hostname, target.asset.hostname)
match:
$Summary, $Hostname, $Log_Type
outcome:
$Date = timestamp.get_timestamp(max(metadata.event_timestamp.seconds), "%F %T")
$Count = count(metadata.id)
order:
$Count desc
近期勒索軟體資料遺失防護事件
(security_result.rule_name = /ransom/ nocase or security_result.category_details = /ransom/ nocase or security_result.threat_name = /ransom/ nocase or security_result.summary = /ransom/ nocase
or security_result.description = /ransom/ nocase or metadata.description = /ransom/ nocase or metadata.product_event_type = /ransom/ nocase)
$Log_Type = metadata.log_type
$Summary = strings.coalesce(metadata.description, metadata.product_event_type, security_result.summary, security_result.rule_name, security_result.description, security_result.threat_name, security_result.category_details)
$Hostname = strings.coalesce(principal.hostname, principal.asset.hostname, target.hostname, target.asset.hostname)
$File = strings.coalesce(target.file.full_path, about.file.full_path, target.url)
$Action = security_result.action
$Severity = security_result.severity
match:
$Summary, $File, $Hostname, $Action, $Severity, $Log_Type
outcome:
$Date = timestamp.get_timestamp(max(metadata.event_timestamp.seconds), "%F %T")
$Count = count(metadata.id)
order:
$Count desc
最近的端點勒索軟體事件
(security_result.rule_name = /ransom/ nocase or security_result.category_details = /ransom/ nocase or security_result.threat_name = /ransom/ nocase or security_result.summary = /ransom/ nocase or security_result.description = /ransom/ nocase or metadata.description = /ransom/ nocase or metadata.product_event_type = /ransom/ nocase)
$Log_Type = metadata.log_type
$Summary = strings.coalesce(security_result.description, security_result.rule_name, security_result.threat_name, security_result.category_details, security_result.summary, metadata.description, metadata.product_event_type)
$Hostname = strings.coalesce(principal.hostname, principal.asset.hostname, target.hostname, target.asset.hostname)
$IP = strings.coalesce(principal.ip, principal.asset.ip, target.ip, target.asset.ip)
$File = strings.coalesce(target.file.full_path, about.file.full_path, target.url)
$Action = security_result.action
$Severity = security_result.severity
match:
$Summary, $File, $Hostname, $IP, $Action, $Severity, $Log_Type
outcome:
$Date = timestamp.get_timestamp(max(metadata.event_timestamp.seconds), "%F %T")
$Count = count(metadata.id)
order:
$Count desc
前 10 大勒索軟體記錄來源
(security_result.rule_name = /ransom/ nocase or security_result.category_details = /ransom/ nocase or security_result.threat_name = /ransom/ nocase or extensions.vulns.vulnerabilities.description = /ransom/ nocase or metadata.product_event_type = /ransom/ nocase or security_result.summary = /ransom/ nocase or metadata.description = /ransom/ nocase or security_result.description = /ransom/ nocase)
$Log_Type = metadata.log_type
match:
$Log_Type
outcome:
$Date = timestamp.get_timestamp(max(metadata.event_timestamp.seconds), "%F %T")
$Count = count(metadata.id)
order:
$Count desc
limit:
10
按產品劃分的勒索軟體事件
(security_result.rule_name = /ransom/ nocase or security_result.category_details = /ransom/ nocase or security_result.threat_name = /ransom/ nocase or extensions.vulns.vulnerabilities.description = /ransom/ nocase or metadata.product_event_type = /ransom/ nocase or security_result.summary = /ransom/ nocase or metadata.description = /ransom/ nocase or security_result.description = /ransom/ nocase)
$Product = metadata.product_name
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
match:
$Product, $Date
outcome:
$Count = count(metadata.id)
order:
$Date asc
近期勒索軟體 NDR 事件
(metadata.event_type = "NETWORK_CONNECTION"
or metadata.event_type = "NETWORK_DHCP"
or metadata.event_type = "NETWORK_DNS"
or metadata.event_type = "NETWORK_FLOW"
or metadata.event_type = "NETWORK_FTP"
or metadata.event_type = "NETWORK_HTTP"
or metadata.event_type = "NETWORK_SMTP"
or metadata.event_type = "NETWORK_UNCATEGORIZED")
(security_result.rule_name = /ransom/ nocase or security_result.category_details = /ransom/ nocase or security_result.threat_name = /ransom/ nocase or security_result.summary = /ransom/ nocase
or security_result.description = /ransom/ nocase or metadata.description = /ransom/ nocase or metadata.product_event_type = /ransom/ nocase)
$Log_Type = metadata.log_type
$Summary = strings.coalesce(metadata.product_event_type, metadata.description, security_result.summary, security_result.description, security_result.rule_name, security_result.category_details, security_result.threat_name)
$Threat_Name = security_result.threat_name
$Category = security_result.category_details
$Hostname = strings.coalesce(principal.hostname, principal.asset.hostname, target.hostname, target.asset.hostname)
$File = strings.coalesce(target.file.full_path, about.file.full_path, target.url)
$Action = security_result.action
$Severity = security_result.severity
match:
$Summary, $File, $Threat_Name, $Category, $Hostname, $Action, $Severity, $Log_Type
outcome:
$Date = timestamp.get_timestamp(max(metadata.event_timestamp.seconds), "%F %T")
$Count = count(metadata.id)
order:
$Count desc
依主機名稱列出的近期勒索軟體事件
(security_result.rule_name = /ransom/ nocase or security_result.category_details = /ransom/ nocase or security_result.threat_name = /ransom/ nocase or extensions.vulns.vulnerabilities.description = /ransom/ nocase or metadata.product_event_type = /ransom/ nocase or security_result.summary = /ransom/ nocase or metadata.description = /ransom/ nocase or security_result.description = /ransom/ nocase)
$Log_Type = metadata.log_type
$Summary = strings.coalesce(security_result.summary, security_result.description, metadata.description, metadata.product_event_type, security_result.rule_name , extensions.vulns.vulnerabilities.description, security_result.threat_name, security_result.category_details)
$Hostname = strings.coalesce(principal.hostname, principal.asset.hostname, target.hostname, target.asset.hostname)
$User = strings.coalesce(principal.user.userid, principal.user.email_addresses, principal.user.user_display_name, target.user.userid, target.user.email_addresses, target.user.user_display_name)
$File = strings.coalesce(target.file.full_path, about.file.full_path, target.url)
$Action = security_result.action
$Severity = security_result.severity
match:
$Summary, $File, $Hostname, $User, $Action, $Severity, $Log_Type
outcome:
$Date = timestamp.get_timestamp(max(metadata.event_timestamp.seconds), "%F %T")
$Count = count(metadata.id)
order:
$Count desc
角色和權限稽核
這個資訊主頁是深入分析的資訊主頁，可稽核角色和直接資源權限的管理作業。
注意： 套用篩選條件，即可在資訊主頁上顯示相關結果。
建立角色的前 10 位使用者
變更資源權限的前 10 位使用者
修改角色次數最多的前 10 位使用者
最近建立的角色
權限變更的前 10 項資源
角色事件中遭封鎖的前 10 大來源 IP
資源權限隨時間變更
一段時間內的 IAM 動作
修改的角色總數
前 10 個修改角色的來源 IP
隨時間刪除的角色
Critical Role 的活動
建立的角色總數
一段時間內建立的角色
近期修改的角色
建立角色的前 10 大來源 IPS
角色生命週期 KPI
隨時間變更的角色
變更資源權限的前 10 大來源 IP
已刪除的角色總數
刪除角色的前 10 大來源 IP
刪除角色次數最多的前 10 位使用者
圖表名稱
查詢示例
建立角色的前 10 位使用者
metadata.product_event_type = /Create.?Role/ nocase
or
(security_result.category_details = /RoleManagement/ nocase
and metadata.product_event_type = /add role definition/ nocase)
security_result.action = "ALLOW"
$Log_Type = metadata.log_type
$Initiator = strings.coalesce(principal.user.windows_sid, principal.user.userid, principal.user.email_addresses)
match:
$Log_Type, $Initiator
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
變更資源權限的前 10 位使用者
metadata.event_type = "RESOURCE_PERMISSIONS_CHANGE"
security_result.action = "ALLOW"
$Initiator = strings.coalesce(principal.user.windows_sid, principal.user.userid, principal.user.email_addresses)
$Log_Type = metadata.log_type
match:
$Log_Type, $Initiator
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
修改角色次數最多的前 10 位使用者
metadata.product_event_type = /Update.?Role/ nocase
or
(security_result.category_details = /RoleManagement/ nocase
and metadata.product_event_type = /update role definition/ nocase)
security_result.action = "ALLOW"
$Log_Type = metadata.log_type
$Initiator = strings.coalesce(principal.user.windows_sid, principal.user.userid, principal.user.email_addresses)
match:
$Log_Type, $Initiator
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
最近建立的角色
metadata.product_event_type = /Create.?Role/ nocase
or
(security_result.category_details = /RoleManagement/ nocase
and metadata.product_event_type = /add role definition/ nocase)
security_result.action = "ALLOW"
$Log_Type = metadata.log_type
$Initiator = strings.coalesce(principal.user.windows_sid, principal.user.userid, principal.user.email_addresses)
$IP_Address = principal.ip
$Date = timestamp.get_timestamp(metadata.event_timestamp.seconds, "%F %T ")
$Role = strings.coalesce(target.user.attribute.roles.name, target.resource.name)
match:
$Date, $Log_Type, $Initiator, $IP_Address, $Role
order:
$Date desc
權限變更的前 10 項資源
metadata.event_type = "RESOURCE_PERMISSIONS_CHANGE"
security_result.action = "ALLOW"
$Log_Type = metadata.log_type
$Resource_Name = target.resource.name
match:
$Log_Type, $Resource_Name
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
角色事件中遭封鎖的前 10 大來源 IP
(metadata.product_event_type = /Create.?Role/ nocase
or
(security_result.category_details = /RoleManagement/ nocase
and metadata.product_event_type = /add role definition/ nocase))
or
(metadata.product_event_type = /Update.?Role/ nocase
or
(security_result.category_details = /RoleManagement/ nocase
and metadata.product_event_type = /update role definition/ nocase))
or
(metadata.product_event_type = /Delete.?Role/ nocase
or
(security_result.category_details = /RoleManagement/ nocase
and metadata.product_event_type = /delete role definition/ nocase))
security_result.action = "BLOCK"
$IP_Address = principal.ip
$Event = metadata.product_event_type
match:
$IP_Address, $Event
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
資源權限隨時間變更
metadata.event_type = "RESOURCE_PERMISSIONS_CHANGE"
security_result.action = "ALLOW"
$Log_Type = metadata.log_type
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
match:
$Log_Type, $Date
outcome:
$Count = count(metadata.id)
order:
$Date desc
一段時間內的 IAM 動作
metadata.event_type = "RESOURCE_PERMISSIONS_CHANGE"
or metadata.event_type = "USER_UNCATEGORIZED"
or metadata.event_type = "USER_BADGE_IN"
or metadata.event_type = "USER_COMMUNICATION"
or metadata.event_type = "USER_CHANGE_PASSWORD"
or metadata.event_type = "USER_LOGIN"
or metadata.event_type = "USER_LOGOUT"
or metadata.event_type = "USER_CREATION"
or metadata.event_type = "USER_DELETION"
or metadata.event_type = "USER_CHANGE_PERMISSIONS"
or metadata.event_type = "USER_RESOURCE_UPDATE_PERMISSIONS"
or metadata.event_type = "USER_RESOURCE_ACCESS"
or metadata.event_type = "USER_RESOURCE_CREATION"
or metadata.event_type = "USER_RESOURCE_DELETION"
or metadata.event_type = "USER_RESOURCE_UPDATE_CONTENT"
or metadata.event_type = "GROUP_UNCATEGORIZED"
or metadata.event_type = "GROUP_CREATION"
or metadata.event_type = "GROUP_DELETION"
or metadata.product_event_type = /(add|delete) group/ nocase
or metadata.event_type = "GROUP_MODIFICATION"
or metadata.product_event_type = /(RemoveUserFrom|AddUserTo|Add member to |Remove member from )|(?:group)/ nocase
or metadata.product_event_type = /(Create|Update|\bDelete).?Role/ nocase
or (security_result.category_details = /RoleManagement/ nocase
and metadata.product_event_type = /(add|update|delete) role definition/ nocase)
security_result.action = "ALLOW"
$Event = metadata.event_type
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
match:
$Date, $Event
outcome:
$Count = count(metadata.id)
order:
$Date desc
修改的角色總數
metadata.product_event_type = /Update.?Role/ nocase
or
(security_result.category_details = /RoleManagement/ nocase
and metadata.product_event_type = /update role definition/ nocase)
security_result.action = "ALLOW"
outcome:
$Count = count_distinct(strings.coalesce(target.user.attribute.roles.name, target.resource.name))
前 10 個修改角色的來源 IP
metadata.product_event_type = /Update.?Role/ nocase
or
(security_result.category_details = /RoleManagement/ nocase
and metadata.product_event_type = /update role definition/ nocase)
security_result.action = "ALLOW"
$Log_Type = metadata.log_type
$IP_Address = principal.ip
match:
$Log_Type, $IP_Address
outcome:
$Count = count(metadata.id)
order:
$Count
limit:
10
隨時間刪除的角色
metadata.product_event_type = /Delete.?Role/ nocase
or
(security_result.category_details = /RoleManagement/ nocase
and metadata.product_event_type = /delete role definition/ nocase)
security_result.action = "ALLOW"
$Log_Type = metadata.log_type
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
match:
$Date, $Log_Type
outcome:
$Count = count(metadata.id)
order:
$Date desc
Critical Role 的活動
metadata.product_event_type = /Create|Remove|Add|Update/ nocase
strings.coalesce(principal.user.attribute.roles.name, principal.resource.name, target.user.attribute.roles.name, target.resource.name) = /admin/ nocase
security_result.action = "ALLOW"
$Log_Type = metadata.log_type
$Role = strings.coalesce(principal.user.attribute.roles.name, principal.resource.name, target.user.attribute.roles.name, target.resource.name)
$Event = metadata.product_event_type
$User = if(strings.coalesce(principal.user.attribute.roles.name, principal.resource.name) = /admin/ nocase, strings.coalesce(principal.user.windows_sid, principal.user.userid, principal.user.email_addresses),
if(strings.coalesce(target.user.attribute.roles.name, target.resource.name) = /admin/ nocase, strings.coalesce(target.user.windows_sid, target.user.userid, target.user.email_addresses), ""))
$IP = principal.ip
match:
$Role, $Event, $Log_Type, $User, $IP
outcome:
$Date = latest(metadata.event_timestamp)
dedup:
$Role
order:
$Date desc
建立的角色總數
metadata.product_event_type = /Create.?Role/ nocase
or
(security_result.category_details = /RoleManagement/ nocase
and metadata.product_event_type = /add role definition/ nocase)
security_result.action = "ALLOW"
outcome:
$Count = count_distinct(strings.coalesce(target.user.attribute.roles.name, target.resource.name))
一段時間內建立的角色
metadata.product_event_type = /Create.?Role/ nocase
or
(security_result.category_details = /RoleManagement/ nocase
and metadata.product_event_type = /add role definition/ nocase)
security_result.action = "ALLOW"
$Log_Type = metadata.log_type
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
match:
$Log_Type, $Date
outcome:
$Count = count(metadata.id)
order:
$Date desc
近期修改的角色
(metadata.event_type = "RESOURCE_WRITTEN"
and metadata.product_event_type = /UpdateRole/ nocase)
or
(security_result.category_details = /RoleManagement/ nocase
and metadata.product_event_type = /update role(?: definition)?/ nocase)
security_result.action = "ALLOW"
$Log_Type = metadata.log_type
$Initiator = strings.coalesce(principal.user.windows_sid, principal.user.userid, principal.user.email_addresses)
$Date = timestamp.get_timestamp(metadata.event_timestamp.seconds, "%F %T ")
$IP_Address = principal.ip
$Role = strings.coalesce(target.user.attribute.roles.name, target.resource.name)
match:
$Date, $Log_Type, $Initiator, $IP_Address, $Role
order:
$Date desc
建立角色的前 10 大來源 IPS
metadata.product_event_type = /Create.?Role/ nocase
or
(security_result.category_details = /RoleManagement/ nocase
and metadata.product_event_type = /add role definition/ nocase)
security_result.action = "ALLOW"
$Log_Type = metadata.log_type
$IP_Address = principal.ip
match:
$Log_Type, $IP_Address
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
角色生命週期 KPI
(metadata.product_event_type = /Create.?Role/ nocase
or
(security_result.category_details = /RoleManagement/ nocase and metadata.product_event_type = /add role definition/ nocase)
and security_result.action = "ALLOW")
or
(metadata.product_event_type = /Update.?Role/ nocase
or
(security_result.category_details = /RoleManagement/ nocase and metadata.product_event_type = /update role definition/ nocase)
and security_result.action = "ALLOW")
or
(metadata.product_event_type = /Delete.?Role/ nocase
or (security_result.category_details = /RoleManagement/ nocase and metadata.product_event_type = /delete role definition/ nocase)
and security_result.action = "ALLOW")
$Event = if((metadata.product_event_type = /Create.?Role/ nocase or (security_result.category_details = /RoleManagement/ nocase and metadata.product_event_type = /add role definition/ nocase)), "Total Creation",
if (metadata.product_event_type = /Update.?Role/ nocase or (security_result.category_details = /RoleManagement/ nocase and metadata.product_event_type = /update role definition/ nocase), "Total Modification", "Total Deletion"))
match:
$Event
outcome:
$Count = count_distinct(strings.coalesce(target.user.attribute.roles.name, target.resource.name))
order:
$Count desc
隨時間變更的角色
metadata.product_event_type = /Update.?Role/ nocase
or
(security_result.category_details = /RoleManagement/ nocase
and metadata.product_event_type = /update role definition/ nocase)
security_result.action = "ALLOW"
$Log_Type = metadata.log_type
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
match:
$Log_Type, $Date
outcome:
$Count = count(metadata.id)
order:
$Date desc
變更資源權限的前 10 大來源 IP
metadata.event_type = "RESOURCE_PERMISSIONS_CHANGE"
security_result.action = "ALLOW"
$Log_Type = metadata.log_type
$IP_Address = principal.ip
match:
$Log_Type, $IP_Address
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
已刪除的角色總數
metadata.product_event_type = /Delete.?Role/ nocase
or
(security_result.category_details = /RoleManagement/ nocase
and metadata.product_event_type = /delete role definition/ nocase)
security_result.action = "ALLOW"
outcome:
$Count = count_distinct(strings.coalesce(target.user.attribute.roles.name, target.resource.name))
刪除角色的前 10 大來源 IP
metadata.product_event_type = /Delete.?Role/ nocase
or
(security_result.category_details = /RoleManagement/ nocase
and metadata.product_event_type = /delete role definition/ nocase)
security_result.action = "ALLOW"
$Log_Type = metadata.log_type
$IP_Address = principal.ip
match:
$Log_Type, $IP_Address
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
刪除角色次數最多的前 10 位使用者
metadata.product_event_type = /Delete.?Role/ nocase
or
(security_result.category_details = /RoleManagement/ nocase
and metadata.product_event_type = /delete role definition/ nocase)
security_result.action = "ALLOW"
$Log_Type = metadata.log_type
$Initiator = strings.coalesce(principal.user.windows_sid, principal.user.userid, principal.user.email_addresses)
match:
$Log_Type, $Initiator
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
SMB 列舉
這個資訊主頁會提供 SMB 相關活動的實用洞察資料，包括列舉趨勢、驗證嘗試，以及使用者和 IP 位址的存取模式。這項功能可識別可疑行為和潛在威脅，有助於有效降低風險。
使用者嘗試列舉 SMB 的次數前 10 名
最近 SMB 驗證嘗試失敗
SMB 列舉嘗試通訊協定分配
偵測到列舉工具的散布情形
SMB 列舉中的前 10 個目標 IP
SMB 列舉狀態分布
來源 IP 隨時間變化
歷來 SMB 指令
前 10 大來源 IP
平均列舉率
SMB 列舉作業最常使用的 10 大指令
一段時間內的 SMB 列舉偵測
中小企業驗證狀態分布
圖表名稱
查詢示例
使用者嘗試列舉 SMB 的次數前 10 名
security_result.rule_name = /smb.*enumeration/ nocase
or (target.process.command_line = /(?:nmap.*(?:\-p(?:\s)?(?:137|138|139|445|139,445)?)(?:(?:\s)?--script smb)?|smbmap|smbclient --list|enum4linux)/ nocase
and (target.port = 137
or target.port = 138
or target.port = 139
or target.port = 445))
$Command_Line = target.process.command_line
$User = target.user.userid
match:
$User, $Command_Line
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
最近 SMB 驗證嘗試失敗
metadata.event_type = "NETWORK_CONNECTION"
or metadata.product_event_type = /5157/
target.port = 137
or target.port = 138
or target.port = 139
or target.port = 445
security_result.action = "BLOCK"
or security_result.summary = /failed/ nocase
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
$Hostname = principal.hostname
$Source_IP = principal.ip
$User = strings.coalesce(principal.user.userid, target.user.userid)
$Port = target.port
match:
$Date, $Hostname, $Source_IP, $Port, $User
order:
$Date desc
SMB 列舉嘗試通訊協定分配
security_result.rule_name = /smb.*enumeration/ nocase
or (target.process.command_line = /(?:nmap.*(?:\-p(?:\s)?(?:137|138|139|445|139,445)?)(?:(?:\s)?--script smb)?|smbmap|smbclient --list|enum4linux)/ nocase
and (target.port = 137
or target.port = 138
or target.port = 139
or target.port = 445))
$Protocol = network.ip_protocol
match:
$Protocol
outcome:
$Count = count(network.ip_protocol)
order:
$Count desc
偵測到列舉工具的散布情形
security_result.rule_name = /smb.*enumeration/ nocase
or (target.process.command_line = /(?:\bnmap\b.*(?:\-p(?:\s)?(?:137|138|139|445|139,445)?)(?:(?:\s)?--script smb)?|smbmap|smbclient --list|enum4linux)/ nocase
and (target.port = 137
or target.port = 138
or target.port = 139
or target.port = 445))
$Tool = re.capture(target.process.command_line, `^\w+`)
match:
$Tool
outcome:
$Count = count(metadata.id)
order:
$Count desc
SMB 列舉中的前 10 個目標 IP
security_result.rule_name = /smb.*enumeration/ nocase
or (target.process.command_line = /(?:nmap.*(?:\-p(?:\s)?(?:137|138|139|445|139,445)?)(?:(?:\s)?--script smb)?|smbmap|smbclient --list|enum4linux)/ nocase
and (target.port = 137
or target.port = 138
or target.port = 139
or target.port = 445))
$Hostname = principal.hostname
$Target_IP = target.ip
match:
$Target_IP, $Hostname
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
SMB 列舉狀態分布
security_result.rule_name = /smb.*enumeration/ nocase
or (target.process.command_line = /(?:nmap.*(?:\-p(?:\s)?(?:137|138|139|445|139,445)?)(?:(?:\s)?--script smb)?|smbmap|smbclient --list|enum4linux)/ nocase
and (target.port = 137
or target.port = 138
or target.port = 139
or target.port = 445))
$Status = if(security_result.action = "ALLOW", security_result.action, "BLOCK")
match:
$Status
outcome:
$Count = count(metadata.id)
order:
$Count desc
來源 IP 隨時間變化
target.port = 137
or target.port = 138
or target.port = 139
or target.port = 445
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
match:
$Date
outcome:
$Count = count_distinct(principal.ip)
order:
$Date desc
歷來 SMB 指令
target.process.command_line = /(?:nmap.*(?:\-p(?:\s)?(?:137|138|139|445|139,445)?)(?:(?:\s)?--script smb)?|smb(?:client|map|status)|enum4linux|(?:get|new|remove|set|close)\-smb)|\bnet\s+(?:use|view|share|session|file|user|group|localgroup|accounts|config|start|stop)\b/ nocase
target.port = 137
or target.port = 138
or target.port = 139
or target.port = 445
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
match:
$Date
outcome:
$Count = count(metadata.id)
order:
$Date desc
前 10 大來源 IP
target.port = 137
or target.port = 138
or target.port = 139
or target.port = 445
$Hostname = principal.hostname
$Source_IP = principal.ip
$Source_IP != ""
match:
$Source_IP, $Hostname
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
平均列舉率
stage Enumeration{
security_result.rule_name = /smb.*enumeration/ nocase
or (target.process.command_line = /(?:nmap.*(?:\-p(?:\s)?(?:137|138|139|445|139,445)?)(?:(?:\s)?--script smb)?|smbmap|smbclient --list|enum4linux)/ nocase
and (target.port = 137
or target.port = 138
or target.port = 139
or target.port = 445))
$Target_IP = target.ip
$Hour_Bucket = timestamp.get_hour(metadata.event_timestamp.seconds)
match:
$Hour_Bucket
outcome:
$Ip_Count = count_distinct($Target_IP)
}
outcome:
$Avg_Enumeration_Rate = math.round(avg($Enumeration.Ip_Count), 2)
SMB 列舉作業最常使用的 10 大指令
security_result.rule_name = /smb.*enumeration/ nocase
or (target.process.command_line = /(?:nmap.*(?:\-p(?:\s)?(?:137|138|139|445|139,445)?)(?:(?:\s)?--script smb)?|smbmap|smbclient --list|enum4linux)/ nocase
and (target.port = 137
or target.port = 138
or target.port = 139
or target.port = 445))
$Command_Line = target.process.command_line
match:
$Command_Line
outcome:
$Count = count(target.process.command_line)
order:
$Count desc
limit:
10
一段時間內的 SMB 列舉偵測
security_result.rule_name = /smb.*enumeration/ nocase
or (target.process.command_line = /(?:nmap.*(?:\-p(?:\s)?(?:137|138|139|445|139,445)?)(?:(?:\s)?--script smb)?|smbmap|smbclient --list|enum4linux)/ nocase
and (target.port = 137
or target.port = 138
or target.port = 139
or target.port = 445))
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
match:
$Date
outcome:
$Count = count(metadata.id)
order:
$Date desc
中小企業驗證狀態分布
metadata.event_type = "NETWORK_CONNECTION"
or metadata.product_event_type = /5156|5157/
target.port = 137
or target.port = 138
or target.port = 139
or target.port = 445
$Status = if(security_result.summary = /failed/, "BLOCK", security_result.action)
match:
$Status
outcome:
$Count = count(metadata.id)
order:
$Count desc
安全運作稽核與活動監控
這個資訊主頁提供安全狀態的重要洞察資料，並追蹤 Chronicle Google API 內的事件、使用者活動和遭封鎖的動作。
歷來事件
前 10 大事件類型
近期遭封鎖的動作
依事件類型列出的前 10 大來源 IP
歷來封鎖的事件
非上班時間的異常事件
近期高風險操作
依風險動作排名的前 10 名使用者
依事件類型列出的前 10 名使用者
依位置封鎖的 SecOps 事件
依事件類型執行的動作：允許或封鎖
非營業時間的異常動作 (依類別區分)
圖表名稱
查詢示例
歷來事件
target.application = /(?:chronicle|backstory).googleapis\.com/ nocase
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
match:
$Date
outcome:
$Count = count(metadata.id)
order:
$Date desc
前 10 大事件類型
target.application = /(?:chronicle|backstory).googleapis\.com/ nocase
$Event_Type = metadata.event_type
match:
$Event_Type
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
近期遭封鎖的動作
target.application = /(?:chronicle|backstory).googleapis.com/ nocase
security_result.action = "BLOCK"
$Date = timestamp.get_timestamp((metadata.event_timestamp.seconds), "%F %T ")
$Description = metadata.description
$Event_Type = metadata.event_type
$User = principal.user.userid
match:
$Date, $Event_Type, $Description, $User
order:
$Date desc
依事件類型列出的前 10 大來源 IP
target.application = /(?:chronicle|backstory).googleapis\.com/ nocase
$Event_Type = metadata.event_type
$Source_IP = principal.ip
match:
$Event_Type, $Source_IP
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
歷來封鎖的事件
target.application = /(?:chronicle|backstory).googleapis.com/ nocase
security_result.action = "BLOCK"
$Date = timestamp.get_date((metadata.event_timestamp.seconds))
$Event_Type = re.capture(metadata.product_event_type, `\b[A-Za-z]+$`)
match:
$Date, $Event_Type
outcome:
$Count = count(metadata.id)
order:
$Date desc
非上班時間的異常事件
target.application = /(?:chronicle|backstory).googleapis.com/ nocase
(
(timestamp.get_day_of_week(metadata.event_timestamp.seconds, "UTC") = 1 or timestamp.get_day_of_week(metadata.event_timestamp.seconds, "UTC") = 7)
or
((timestamp.get_day_of_week(metadata.event_timestamp.seconds, "UTC") >= 2 and timestamp.get_day_of_week(metadata.event_timestamp.seconds, "UTC") <= 6)
and
((timestamp.get_hour(metadata.event_timestamp.seconds, "UTC") >= 0 and timestamp.get_hour(metadata.event_timestamp.seconds, "UTC") <= 8) or timestamp.get_hour(metadata.event_timestamp.seconds, "UTC") > 19))
)
$Event_Type = metadata.event_type
$Product_Event = metadata.product_event_type
match:
$Event_Type, $Product_Event
outcome:
$Count = count(metadata.id)
$Date = timestamp.get_timestamp(max(metadata.event_timestamp.seconds), "%F %T ")
order:
$Date desc
近期高風險操作
target.application = /(?:chronicle|backstory).googleapis.com/ nocase
metadata.product_event_type = /\b(?:Delete|Remove|Disable|Update)/ nocase
$Date = timestamp.get_timestamp(metadata.event_timestamp.seconds)
$Event_Type = re.capture(metadata.product_event_type, `\b(?:Delete|Remove|Disable|Update)[A-Za-z]+`)
$Description = metadata.description
$User = re.capture(principal.user.userid, `subject\/([^\/]+)`)
match:
$Date, $Event_Type, $Description, $User
order:
$Date desc
依風險動作排名的前 10 名使用者
target.application = /(?:chronicle|backstory).googleapis.com/ nocase
metadata.product_event_type = /\b(?:Delete|Remove|Disable|Update)/ nocase
$Event_Type = re.capture(metadata.product_event_type, `\b(?:Delete|Remove|Disable|Update)[A-Za-z]+`)
$User = re.capture(principal.user.userid, `subject\/([^\/]+)`)
match:
$User, $Event_Type
outcome:
$Count = count(metadata.id)
order:
$Count desc
依事件類型列出的前 10 名使用者
target.application = /(?:chronicle|backstory).googleapis\.com/ nocase
$Event_Type = metadata.event_type
$User = principal.user.userid
match:
$User, $Event_Type
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
依位置封鎖的 SecOps 事件
target.application = /(?:chronicle|backstory).googleapis.com/ nocase
security_result.action = "BLOCK"
$Countries = principal.location.country_or_region
$Latitude = principal.location.region_coordinates.latitude
$Longitude = principal.location.region_coordinates.longitude
match:
$Countries, $Latitude, $Longitude
outcome:
$Count = count(metadata.id)
order:
$Count desc
依事件類型執行的動作：允許或封鎖
target.application = /(?:chronicle|backstory).googleapis\.com/ nocase
security_result.action = "ALLOW"
or security_result.action = "BLOCK"
$Event_Type = metadata.event_type
$Action = security_result.action
match:
$Event_Type, $Action
outcome:
$Count = count(metadata.id)
order:
$Count desc
非營業時間的異常動作 (依類別區分)
target.application = /(?:chronicle|backstory).googleapis.com/ nocase
(
(timestamp.get_day_of_week(metadata.event_timestamp.seconds, "UTC") = 1 or timestamp.get_day_of_week(metadata.event_timestamp.seconds, "UTC") = 7)
or
((timestamp.get_day_of_week(metadata.event_timestamp.seconds, "UTC") >= 2 and timestamp.get_day_of_week(metadata.event_timestamp.seconds, "UTC") <= 6)
and
((timestamp.get_hour(metadata.event_timestamp.seconds, "UTC") >= 0 and timestamp.get_hour(metadata.event_timestamp.seconds, "UTC") <= 8) or timestamp.get_hour(metadata.event_timestamp.seconds, "UTC") > 19))
)
$Event_Type = metadata.event_type
$Product_Event = metadata.product_event_type
$Service = re.capture(metadata.product_event_type, `([A-Za-z]+Service)`)
match:
$Product_Event, $Service
outcome:
$Date = timestamp.get_timestamp(max(metadata.event_timestamp.seconds), "%F %T ")
$Count = count(metadata.id)
order:
$Date desc
SecOps 記錄監控
這個資訊主頁提供記錄檔資料管理深入分析資訊，並醒目顯示擷取延遲和元件狀態。有助於提升效能、減少資料遺失，並加強安全監控。
安全防護措施管理
這個資訊主頁會即時顯示貴機構的安全狀態，並醒目顯示威脅、事件和安全漏洞。包括偵測、安全性、系統更新摘要和資產監控，有助於安全團隊評估風險和威脅狀態，並有效實作補救策略。集中檢視有助於提升整體安全防護機制，並簡化事件應變程序。
服務帳戶總覽
這個資訊主頁可提供使用模式、登入嘗試和帳戶修改等深入分析資訊，協助安全團隊和管理員監控服務帳戶活動。有助於做出明智決策，以找出安全風險、解決漏洞並確保系統完整性。注意：視需要使用篩選器縮小結果範圍。
流量最多的 10 項動作
最近修改的權限
指定期間內成功登入次數
前 10 項修改過的使用者權限
最近變更密碼
一段時間後刪除服務帳戶
登入失敗次數 (指定時間範圍)
一段時間內的用量
最近刪除的服務帳戶
登入次數前 10 名的服務帳戶
最近建立的服務帳戶
前 10 大服務帳戶
一段時間內建立的服務帳戶
大量 Kerberos 服務票證要求
登入失敗次數前 10 名的來源 IP
依互動式登入次數排序的前 10 大來源 IP
一段時間內的互動式登入次數
密碼變更記錄
圖表名稱
查詢示例
流量最多的 10 項動作
principal.user.account_type = "SERVICE_ACCOUNT_TYPE"
or principal.resource.resource_type = "SERVICE_ACCOUNT"
or principal.user.attribute.roles.type = "SERVICE_ACCOUNT"
or target.user.account_type = "SERVICE_ACCOUNT_TYPE"
or target.resource.resource_type = "SERVICE_ACCOUNT"
or target.user.attribute.roles.type = "SERVICE_ACCOUNT"
or strings.coalesce(principal.resource.type, principal.user.attribute.roles.name, principal.resource.resource_subtype, principal.user.userid, target.resource.type, target.user.attribute.roles.name, target.resource.resource_subtype, target.user.userid) = /(?i)service.*(?:account|^principal$)/ nocase
$Product_Event = metadata.product_event_type
$Product_Event != ""
match:
$Product_Event
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
最近修改的權限
metadata.event_type = "RESOURCE_PERMISSIONS_CHANGE"
or metadata.event_type = "USER_CHANGE_PERMISSIONS"
or metadata.event_type = "USER_RESOURCE_UPDATE_PERMISSIONS"
principal.user.account_type = "SERVICE_ACCOUNT_TYPE"
or principal.resource.resource_type = "SERVICE_ACCOUNT"
or principal.user.attribute.roles.type = "SERVICE_ACCOUNT"
or target.user.account_type = "SERVICE_ACCOUNT_TYPE"
or target.resource.resource_type = "SERVICE_ACCOUNT"
or target.user.attribute.roles.type = "SERVICE_ACCOUNT"
or strings.coalesce(principal.resource.type, principal.user.attribute.roles.name, principal.resource.resource_subtype, principal.user.userid, target.resource.type, target.user.attribute.roles.name, target.resource.resource_subtype, target.user.userid) = /(?i)service.*(?:account|^principal$)/ nocase
$Log_Type = metadata.log_type
$Initiator = strings.coalesce(principal.user.windows_sid, principal.user.userid, principal.user.email_addresses)
$User = strings.coalesce(target.user.userid, target.user.email_addresses)
$IP_Address = principal.ip
$Date = timestamp.get_timestamp(metadata.event_timestamp.seconds, "%F %T ")
match:
$Date, $Log_Type, $Initiator, $IP_Address, $User
order:
$Date desc
指定期間內成功登入次數
metadata.event_type = "USER_LOGIN"
security_result.action = "ALLOW"
principal.user.account_type = "SERVICE_ACCOUNT_TYPE"
or principal.resource.resource_type = "SERVICE_ACCOUNT"
or principal.user.attribute.roles.type = "SERVICE_ACCOUNT"
or target.user.account_type = "SERVICE_ACCOUNT_TYPE"
or target.resource.resource_type = "SERVICE_ACCOUNT"
or target.user.attribute.roles.type = "SERVICE_ACCOUNT"
or strings.coalesce(principal.resource.type, principal.user.attribute.roles.name, principal.resource.resource_subtype, principal.user.userid, target.resource.type, target.user.attribute.roles.name, target.resource.resource_subtype, target.user.userid) = /(?i)service.*(?:account|^principal$)/ nocase
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
match:
$Date
outcome:
$Count = count(metadata.id)
order:
$Date desc
前 10 項修改過的使用者權限
metadata.event_type = "RESOURCE_PERMISSIONS_CHANGE"
or metadata.event_type = "USER_CHANGE_PERMISSIONS"
or metadata.event_type = "USER_RESOURCE_UPDATE_PERMISSIONS"
principal.user.account_type = "SERVICE_ACCOUNT_TYPE"
or principal.resource.resource_type = "SERVICE_ACCOUNT"
or principal.user.attribute.roles.type = "SERVICE_ACCOUNT"
or target.user.account_type = "SERVICE_ACCOUNT_TYPE"
or target.resource.resource_type = "SERVICE_ACCOUNT"
or target.user.attribute.roles.type = "SERVICE_ACCOUNT"
or strings.coalesce(principal.resource.type, principal.user.attribute.roles.name, principal.resource.resource_subtype, principal.user.userid, target.resource.type, target.user.attribute.roles.name, target.resource.resource_subtype, target.user.userid) = /(?i)service.*(?:account|^principal$)/ nocase
$User = strings.coalesce(target.user.userid, target.user.email_addresses)
match:
$User
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
最近變更密碼
metadata.event_type = "USER_CHANGE_PASSWORD"
principal.user.account_type = "SERVICE_ACCOUNT_TYPE"
or principal.resource.resource_type = "SERVICE_ACCOUNT"
or principal.user.attribute.roles.type = "SERVICE_ACCOUNT"
or target.user.account_type = "SERVICE_ACCOUNT_TYPE"
or target.resource.resource_type = "SERVICE_ACCOUNT"
or target.user.attribute.roles.type = "SERVICE_ACCOUNT"
or strings.coalesce(principal.resource.type, principal.user.attribute.roles.name, principal.resource.resource_subtype, principal.user.userid, target.resource.type, target.user.attribute.roles.name, target.resource.resource_subtype, target.user.userid) = /(?i)service.*(?:account|^principal$)/ nocase
$Log_Type = metadata.log_type
$Initiator = strings.coalesce(principal.user.windows_sid, principal.user.userid, principal.user.email_addresses)
$User = strings.coalesce(target.user.userid, target.user.email_addresses)
$IP_Address = principal.ip
$Date = timestamp.get_timestamp(metadata.event_timestamp.seconds, "%F %T ")
match:
$Date, $Log_Type, $Initiator, $IP_Address, $User
order:
$Date desc
一段時間後刪除服務帳戶
metadata.event_type = "USER_DELETION"
or metadata.event_type = "USER_RESOURCE_DELETION"
principal.user.account_type = "SERVICE_ACCOUNT_TYPE"
or principal.resource.resource_type = "SERVICE_ACCOUNT"
or principal.user.attribute.roles.type = "SERVICE_ACCOUNT"
or target.user.account_type = "SERVICE_ACCOUNT_TYPE"
or target.resource.resource_type = "SERVICE_ACCOUNT"
or target.user.attribute.roles.type = "SERVICE_ACCOUNT"
or strings.coalesce(principal.resource.type, principal.user.attribute.roles.name, principal.resource.resource_subtype, principal.user.userid, target.resource.type, target.user.attribute.roles.name, target.resource.resource_subtype, target.user.userid) = /(?i)service.*(?:account|^principal$)/ nocase
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
match:
$Date
outcome:
$Count = count(metadata.id)
order:
$Date desc
登入失敗次數 (指定時間範圍)
metadata.event_type = "USER_LOGIN"
security_result.action = "BLOCK"
principal.user.account_type = "SERVICE_ACCOUNT_TYPE"
or principal.resource.resource_type = "SERVICE_ACCOUNT"
or principal.user.attribute.roles.type = "SERVICE_ACCOUNT"
or target.user.account_type = "SERVICE_ACCOUNT_TYPE"
or target.resource.resource_type = "SERVICE_ACCOUNT"
or target.user.attribute.roles.type = "SERVICE_ACCOUNT"
or strings.coalesce(principal.resource.type, principal.user.attribute.roles.name, principal.resource.resource_subtype, principal.user.userid, target.resource.type, target.user.attribute.roles.name, target.resource.resource_subtype, target.user.userid) = /(?i)service.*(?:account|^principal$)/ nocase
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
match:
$Date
outcome:
$Count = count(metadata.id)
order:
$Date desc
一段時間內的用量
principal.user.account_type = "SERVICE_ACCOUNT_TYPE"
or principal.resource.resource_type = "SERVICE_ACCOUNT"
or principal.user.attribute.roles.type = "SERVICE_ACCOUNT"
or target.user.account_type = "SERVICE_ACCOUNT_TYPE"
or target.resource.resource_type = "SERVICE_ACCOUNT"
or target.user.attribute.roles.type = "SERVICE_ACCOUNT"
or strings.coalesce(principal.resource.type, principal.user.attribute.roles.name, principal.resource.resource_subtype, principal.user.userid, target.resource.type, target.user.attribute.roles.name, target.resource.resource_subtype, target.user.userid) = /(?i)service.*(?:account|^principal$)/ nocase
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
match:
$Date
outcome:
$Count = count(metadata.id)
order:
$Date desc
最近刪除的服務帳戶
metadata.event_type = "USER_DELETION"
or metadata.event_type = "USER_RESOURCE_DELETION"
principal.user.account_type = "SERVICE_ACCOUNT_TYPE"
or principal.resource.resource_type = "SERVICE_ACCOUNT"
or principal.user.attribute.roles.type = "SERVICE_ACCOUNT"
or target.user.account_type = "SERVICE_ACCOUNT_TYPE"
or target.resource.resource_type = "SERVICE_ACCOUNT"
or target.user.attribute.roles.type = "SERVICE_ACCOUNT"
or strings.coalesce(principal.resource.type, principal.user.attribute.roles.name, principal.resource.resource_subtype, principal.user.userid, target.resource.type, target.user.attribute.roles.name, target.resource.resource_subtype, target.user.userid) = /(?i)service.*(?:account|^principal$)/ nocase
$Log_Type = metadata.log_type
$Initiator = strings.coalesce(principal.user.windows_sid, principal.user.userid, principal.user.email_addresses)
$User = strings.coalesce(target.user.userid, target.user.email_addresses)
$IP_Address = principal.ip
$Date = timestamp.get_timestamp(metadata.event_timestamp.seconds, "%F %T ")
match:
$Date, $Log_Type, $Initiator, $IP_Address, $User
order:
$Date desc
登入次數前 10 名的服務帳戶
metadata.event_type = "USER_LOGIN"
principal.user.account_type = "SERVICE_ACCOUNT_TYPE"
or principal.resource.resource_type = "SERVICE_ACCOUNT"
or principal.user.attribute.roles.type = "SERVICE_ACCOUNT"
or target.user.account_type = "SERVICE_ACCOUNT_TYPE"
or target.resource.resource_type = "SERVICE_ACCOUNT"
or target.user.attribute.roles.type = "SERVICE_ACCOUNT"
or strings.coalesce(principal.resource.type, principal.user.attribute.roles.name, principal.resource.resource_subtype, principal.user.userid, target.resource.type, target.user.attribute.roles.name, target.resource.resource_subtype, target.user.userid) = /(?i)service.*(?:account|^principal$)/ nocase
$Service_Account = group(principal.user.userid, target.user.userid)
$Service_Account != ""
match:
$Service_Account
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
最近建立的服務帳戶
metadata.event_type = "USER_CREATION"
principal.user.account_type = "SERVICE_ACCOUNT_TYPE"
or principal.resource.resource_type = "SERVICE_ACCOUNT"
or principal.user.attribute.roles.type = "SERVICE_ACCOUNT"
or target.user.account_type = "SERVICE_ACCOUNT_TYPE"
or target.resource.resource_type = "SERVICE_ACCOUNT"
or target.user.attribute.roles.type = "SERVICE_ACCOUNT"
or strings.coalesce(principal.resource.type, principal.user.attribute.roles.name, principal.resource.resource_subtype, principal.user.userid, target.resource.type, target.user.attribute.roles.name, target.resource.resource_subtype, target.user.userid) = /(?i)service.*(?:account|^principal$)/ nocase
$Log_Type = metadata.log_type
$Initiator = strings.coalesce(principal.user.windows_sid, principal.user.userid, principal.user.email_addresses)
$User = strings.coalesce(target.user.userid, target.user.email_addresses)
$IP_Address = principal.ip
$Date = timestamp.get_timestamp(metadata.event_timestamp.seconds, "%F %T ")
match:
$Date, $Log_Type, $Initiator, $IP_Address, $User
order:
$Date desc
前 10 大服務帳戶
principal.user.account_type = "SERVICE_ACCOUNT_TYPE"
or principal.resource.resource_type = "SERVICE_ACCOUNT"
or principal.user.attribute.roles.type = "SERVICE_ACCOUNT"
or target.user.account_type = "SERVICE_ACCOUNT_TYPE"
or target.resource.resource_type = "SERVICE_ACCOUNT"
or target.user.attribute.roles.type = "SERVICE_ACCOUNT"
or strings.coalesce(principal.resource.type, principal.user.attribute.roles.name, principal.resource.resource_subtype, principal.user.userid, target.resource.type, target.user.attribute.roles.name, target.resource.resource_subtype, target.user.userid) = /(?i)service.*(?:account|^principal$)/ nocase
$Service_Account = group(principal.user.userid, target.user.userid)
$Service_Account != ""
match:
$Service_Account
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
一段時間內建立的服務帳戶
metadata.event_type = "USER_CREATION"
principal.user.account_type = "SERVICE_ACCOUNT_TYPE"
or principal.resource.resource_type = "SERVICE_ACCOUNT"
or principal.user.attribute.roles.type = "SERVICE_ACCOUNT"
or target.user.account_type = "SERVICE_ACCOUNT_TYPE"
or target.resource.resource_type = "SERVICE_ACCOUNT"
or target.user.attribute.roles.type = "SERVICE_ACCOUNT"
or strings.coalesce(principal.resource.type, principal.user.attribute.roles.name, principal.resource.resource_subtype, principal.user.userid, target.resource.type, target.user.attribute.roles.name, target.resource.resource_subtype, target.user.userid) = /(?i)service.*(?:account|^principal$)/ nocase
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
match:
$Date
outcome:
$Count = count(metadata.id)
order:
$Date desc
大量 Kerberos 服務票證要求
metadata.product_event_type = /4769/ nocase
target.application != /\$$/ nocase
additional.fields["TicketEncryptionType"] = /0x(1|2|3|12|17)/ nocase
additional.fields["TicketOptions"] = /0x408(1000|0000|1001)0/ nocase
$Host = principal.hostname
match:
$Host over 1h
outcome:
$Count = count_distinct(target.application)
condition:
$Count >= 10
order:
$Count desc
limit:
10
登入失敗次數前 10 名的來源 IP
metadata.event_type = "USER_LOGIN"
security_result.action = "BLOCK"
principal.user.account_type = "SERVICE_ACCOUNT_TYPE"
or principal.resource.resource_type = "SERVICE_ACCOUNT"
or principal.user.attribute.roles.type = "SERVICE_ACCOUNT"
or target.user.account_type = "SERVICE_ACCOUNT_TYPE"
or target.resource.resource_type = "SERVICE_ACCOUNT"
or target.user.attribute.roles.type = "SERVICE_ACCOUNT"
or strings.coalesce(principal.resource.type, principal.user.attribute.roles.name, principal.resource.resource_subtype, principal.user.userid, target.resource.type, target.user.attribute.roles.name, target.resource.resource_subtype, target.user.userid) = /(?i)service.*(?:account|^principal$)/ nocase
$Source_IP = principal.ip
$Source_IP != ""
match:
$Source_IP
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
依互動式登入次數排序的前 10 大來源 IP
metadata.event_type = "USER_LOGIN"
extensions.auth.mechanism = "INTERACTIVE"
or extensions.auth.mechanism = "CACHED_INTERACTIVE"
or extensions.auth.mechanism = "CACHED_REMOTE_INTERACTIVE"
or extensions.auth.mechanism = "REMOTE_INTERACTIVE"
principal.user.account_type = "SERVICE_ACCOUNT_TYPE"
or principal.resource.resource_type = "SERVICE_ACCOUNT"
or principal.user.attribute.roles.type = "SERVICE_ACCOUNT"
or target.user.account_type = "SERVICE_ACCOUNT_TYPE"
or target.resource.resource_type = "SERVICE_ACCOUNT"
or target.user.attribute.roles.type = "SERVICE_ACCOUNT"
or strings.coalesce(principal.resource.type, principal.user.attribute.roles.name, principal.resource.resource_subtype, principal.user.userid, target.resource.type, target.user.attribute.roles.name, target.resource.resource_subtype, target.user.userid) = /(?i)service.*(?:account|^principal$)/ nocase
$Source_IP = principal.ip
match:
$Source_IP
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
一段時間內的互動式登入次數
metadata.event_type = "USER_LOGIN"
extensions.auth.mechanism = "INTERACTIVE"
or extensions.auth.mechanism = "CACHED_INTERACTIVE"
or extensions.auth.mechanism = "CACHED_REMOTE_INTERACTIVE"
or extensions.auth.mechanism = "REMOTE_INTERACTIVE"
principal.user.account_type = "SERVICE_ACCOUNT_TYPE"
or principal.resource.resource_type = "SERVICE_ACCOUNT"
or principal.user.attribute.roles.type = "SERVICE_ACCOUNT"
or target.user.account_type = "SERVICE_ACCOUNT_TYPE"
or target.resource.resource_type = "SERVICE_ACCOUNT"
or target.user.attribute.roles.type = "SERVICE_ACCOUNT"
or strings.coalesce(principal.resource.type, principal.user.attribute.roles.name, principal.resource.resource_subtype, principal.user.userid, target.resource.type, target.user.attribute.roles.name, target.resource.resource_subtype, target.user.userid) = /(?i)service.*(?:account|^principal$)/ nocase
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
match:
$Date
outcome:
$Count = count(metadata.id)
order:
$Date desc
密碼變更記錄
metadata.event_type = "USER_CHANGE_PASSWORD"
principal.user.account_type = "SERVICE_ACCOUNT_TYPE"
or principal.resource.resource_type = "SERVICE_ACCOUNT"
or principal.user.attribute.roles.type = "SERVICE_ACCOUNT"
or target.user.account_type = "SERVICE_ACCOUNT_TYPE"
or target.resource.resource_type = "SERVICE_ACCOUNT"
or target.user.attribute.roles.type = "SERVICE_ACCOUNT"
or strings.coalesce(principal.resource.type, principal.user.attribute.roles.name, principal.resource.resource_subtype, principal.user.userid, target.resource.type, target.user.attribute.roles.name, target.resource.resource_subtype, target.user.userid) = /(?i)service.*(?:account|^principal$)/ nocase
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
match:
$Date
outcome:
$Count = count(metadata.id)
order:
$Date desc
單一登入 (SSO) 監控
這個資訊主頁可協助資安團隊追蹤單一登入活動、偵測未經授權的存取行為，以及調整驗證方式，進而提升安全性並確保符合法規。
單一登入安全性警示
按動作劃分的單一登入 (SSO) 登入次數
未經授權的單一登入存取權
單一登入成功率與失敗率
使用者嘗試登入失敗次數
歷來單一登入事件 (依嚴重性分組)
單一登入總次數
單一登入 (SSO) 活動記錄
前 10 大應用程式的 SSO 登入次數
單一登入 (SSO) 使用趨勢
單一登入 (SSO) 異常登入位置
來源地理位置總覽
登入次數最多的前 10 名使用者
登入失敗次數前 10 名的應用程式
前 10 大供應商快訊
圖表名稱
查詢示例
單一登入安全性警示
$auth_type = extensions.auth.type
$auth_type = "SSO"
$alert_state = security_result.alert_state
$alert_state = "ALERTING"
$user = strings.coalesce(target.user.user_display_name, principal.user.user_display_name)
$user != ""
$action = security_result.action
$action != "UNKNOWN_ACTION"
$event_name = security_result.summary
$severity = security_result.severity
$category = security_result.category_details
match:
$event_name, $severity, $category
outcome :
$count = count($event_name)
按動作劃分的單一登入 (SSO) 登入次數
extensions.auth.type = "SSO"
$Action = security_result.action
$Event_Type = metadata.event_type
$Event_Type = "USER_LOGIN"
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
match:
$Date, $Action
outcome :
$Count = count(metadata.id)
未經授權的單一登入存取權
extensions.auth.type = "SSO"
$User = strings.coalesce(target.user.userid, target.user.user_display_name, target.user.email_addresses, principal.user.userid, principal.user.user_display_name, principal.user.email_addresses)
$Action = security_result.action
$Action != "ALLOW"
$Summary = strings.coalesce(security_result.summary, metadata.description, security_result.description)
$Severity = security_result.severity
$Category = security_result.category_details
match:
$Summary,$User, $Severity, $Action,$Category
outcome :
$Count = count(metadata.id)
單一登入成功率與失敗率
$auth_type = extensions.auth.type
$auth_type = "SSO"
$user = strings.coalesce(target.user.user_display_name, principal.user.user_display_name)
$user != ""
$action = security_result.action
$action != "UNKNOWN_ACTION"
match:
$action
outcome :
$count = count($action)
使用者嘗試登入失敗次數
metadata.event_type = "USER_LOGIN"
extensions.auth.type = "SSO"
security_result.action = "BLOCK"
$User = strings.coalesce(target.user.userid, target.user.user_display_name, target.user.email_addresses, principal.user.userid, principal.user.user_display_name, principal.user.email_addresses)
$User != ""
match:
$User
outcome :
$Count = count(metadata.id)
order:
$Count desc
歷來單一登入事件 (依嚴重性分組)
extensions.auth.type = "SSO"
$Severity = security_result.severity
(security_result.severity = "CRITICAL" or security_result.severity = "HIGH")
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
match:
$Date, $Severity
outcome :
$Count = count(metadata.id)
order:
$Date asc
單一登入總次數
$event_type = metadata.event_type
$event_type = "USER_LOGIN"
$auth_type = extensions.auth.type
$auth_type = "SSO"
$user = strings.coalesce(target.user.user_display_name, principal.user.user_display_name)
$user != ""
outcome :
$count = count($user)
單一登入 (SSO) 活動記錄
$auth_type = extensions.auth.type
$auth_type = "SSO"
$user = strings.coalesce(target.user.user_display_name, principal.user.user_display_name)
$user != ""
$location = principal.ip_geo_artifact.location.country_or_region
$summary = security_result.summary
$summary != ""
$action = security_result.action
match:
$summary, $location, $action
outcome :
$count = count($summary)
order:
$count desc
前 10 大應用程式的 SSO 登入次數
$event_type = metadata.event_type
$event_type = "USER_LOGIN"
$auth_type = extensions.auth.type
$auth_type = "SSO"
$user = strings.coalesce(target.user.user_display_name, principal.user.user_display_name)
$user != ""
$application = target.application
$application != ""
match:
$application
outcome :
$count = count($application)
order:
$count desc
limit: 10
單一登入 (SSO) 使用趨勢
$auth_type = extensions.auth.type
$auth_type = "SSO"
$user = target.user.user_display_name
$user != ""
$location = principal.ip_geo_artifact.location.country_or_region
$date = timestamp.get_date(metadata.event_timestamp.seconds)
match:
$auth_type, $date
outcome :
$count = count($auth_type)
未經授權的單一登入存取權
$auth_type = extensions.auth.type
$auth_type = "SSO"
$alert_state = security_result.alert_state
$user = strings.coalesce(target.user.user_display_name, principal.user.user_display_name)
$user != ""
$action = security_result.action
$action != "UNKNOWN_ACTION"
$event_name = security_result.summary
$event_name != ""
$severity = security_result.severity
$category = security_result.category_details
$category != ""
match:
$event_name,$user, $severity, $action,$category
outcome :
$count = count($event_name)
單一登入 (SSO) 異常登入位置
$auth_type = extensions.auth.type
$auth_type = "SSO"
$user = strings.coalesce(target.user.user_display_name, principal.user.user_display_name)
$user != ""
$location = principal.ip_geo_artifact.location.country_or_region
$location != ""
$location != "United States"
match:
$location
outcome :
$count = count($location)
$latitude = max(principal.ip_geo_artifact.location.region_coordinates.latitude)
$longitude = max(principal.ip_geo_artifact.location.region_coordinates.longitude)
來源地理位置總覽
metadata.event_type = "USER_LOGIN"
extensions.auth.type = "SSO"
$Location = principal.ip_geo_artifact.location.country_or_region
match:
$Location
outcome :
$Count = count(metadata.id)
$Latitude = max(principal.ip_geo_artifact.location.region_coordinates.latitude)
$Longitude = max(principal.ip_geo_artifact.location.region_coordinates.longitude)
登入次數最多的前 10 名使用者
$event_type = metadata.event_type
$event_type = "USER_LOGIN"
$auth_type = extensions.auth.type
$auth_type = "SSO"
$user = strings.coalesce(target.user.user_display_name, principal.user.user_display_name)
$user != ""
match:
$user
outcome :
$count = count($user)
order:
$count desc
limit:
10
登入失敗次數前 10 名的應用程式
metadata.event_type = "USER_LOGIN"
extensions.auth.type = "SSO"
security_result.action = "BLOCK"
$Application = target.application
$Application != ""
match:
$Application
outcome :
$Count = count(metadata.id)
Order:
$Count desc
limit:
10
前 10 大供應商快訊
extensions.auth.type = "SSO"
$Rule_Name = security_result.rule_name
$Rule_Name != ""
match:
$Rule_Name
outcome :
$Count = count(metadata.id)
order:
$Count desc
limit:
10
Sysmon 監控
這個資訊主頁可用於分析及監控 sysmon 產生的記錄。可深入瞭解系統活動，包括程序建立、網路連線和檔案變更。資訊主頁會匯總並顯示這類資料，協助安全分析師找出可疑行為、追蹤潛在威脅，並採取適當行動。
近期服務事件
前 10 大主機
前 10 大 Sysmon 事件 ID
一段時間內的自動執行登錄變更
最近的 WMI 事件
依簽章狀態劃分的圖片載入事件數
事件類型分布情形
不重複主機
前 10 大指令列
啟動網路連線的前 10 個程序
事件類型細目
建立檔案數前 10 名
依來源程序查詢的 DNS 網域前 10 名
不重複使用者
前 10 個父項程序
前 10 位使用者
處理隨時間變化的注入權利存取事件
Sysmon 事件總數
前 10 個程序
依簽章狀態劃分的驅動程式載入事件
Sysmon 事件趨勢
不重複主機總數
一段時間內的 Sysmon 事件
前 10 個修改過的登錄機碼
不重複使用者總數
圖表名稱
查詢示例
近期服務事件
metadata.log_type = "WINDOWS_SYSMON"
metadata.product_event_type = "4"
or metadata.product_event_type = "5"
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
match:
$Date
outcome:
$Count = count(metadata.id)
order:
$Date desc
前 10 大主機
$event.metadata.log_type = "WINDOWS_SYSMON"
$Hostname = $event.principal.hostname
$Hostname != ""
match:
$Hostname
outcome:
$Count = count($event.metadata.id)
order:
$Count desc
limit:
10
前 10 大 Sysmon 事件 ID
metadata.log_type = "WINDOWS_SYSMON"
$Event_ID = metadata.product_event_type
match:
$Event_ID
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
一段時間內的自動執行登錄變更
metadata.log_type = "WINDOWS_SYSMON"
metadata.product_event_type = "12"
or metadata.product_event_type = "13"
or metadata.product_event_type = "14"
target.registry.registry_key = /(?:HKCU|HKLM)\\Software\\Microsoft\\Windows(?:\sNT)?\\CurrentVersion\\(?:Run(?:Once)?|Winlogon\\(?:Shell|Userinit))/ nocase
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
match:
$Date
outcome:
$Count = count(metadata.id)
order:
$Date desc
最近的 WMI 事件
metadata.log_type = "WINDOWS_SYSMON"
metadata.product_event_type = "19"
or metadata.product_event_type = "20"
or metadata.product_event_type = "21"
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
match:
$Date
outcome:
$Count = count(metadata.id)
order:
$Date desc
依簽章狀態劃分的圖片載入事件數
metadata.log_type = "WINDOWS_SYSMON"
metadata.product_event_type = "7"
$Signature_Status = target.resource.attribute.labels["SignatureStatus"]
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
match:
$Date, $Signature_Status
outcome:
$Count = count(metadata.id)
order:
$Date desc
事件類型分布情形
metadata.log_type = "WINDOWS_SYSMON"
$Event_Type = metadata.event_type
match:
$Event_Type
outcome:
$Count = count(metadata.id)
order:
$Count desc
不重複主機
$event.metadata.log_type = "WINDOWS_SYSMON"
outcome:
$Count = count_distinct($event.principal.hostname)
前 10 大指令列
metadata.log_type = "WINDOWS_SYSMON"
$Command = target.process.command_line
$Command != ""
match:
$Command
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
啟動網路連線的前 10 個程序
metadata.log_type = "WINDOWS_SYSMON"
metadata.event_type = "NETWORK_CONNECTION"
$Process = principal.process.file.full_path
match:
$Process
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
事件類型細目
$event.metadata.log_type = "WINDOWS_SYSMON"
$Event_Type = $event.metadata.event_type
match:
$Event_Type
outcome:
$Count = count($event.metadata.id)
order:
$Count desc
建立檔案數前 10 名
$event.metadata.log_type = "WINDOWS_SYSMON"
$event.metadata.event_type = "FILE_CREATION"
$File = $event.target.file.full_path
match:
$File
outcome:
$Count = count($event.metadata.id)
order:
$Count desc
limit:
10
依來源程序查詢的 DNS 網域前 10 名
metadata.log_type = "WINDOWS_SYSMON"
metadata.product_event_type = "22"
$Source_Process = strings.coalesce(principal.process.file.full_path, principal.hostname)
$Domain = network.dns.questions.name
match:
$Domain, $Source_Process
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
不重複使用者
$event.metadata.log_type = "WINDOWS_SYSMON"
outcome:
$Count = count_distinct($event.principal.user.userid)
前 10 大主機
metadata.log_type = "WINDOWS_SYSMON"
$Hostname = principal.hostname
$Hostname != ""
match:
$Hostname
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
前 10 個父項程序
metadata.log_type = "WINDOWS_SYSMON"
$Process = principal.process.file.full_path
$Process != ""
match:
$Process
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
前 10 位使用者
$event.metadata.log_type = "WINDOWS_SYSMON"
$User = $event.principal.user.userid
$User != ""
match:
$User
outcome:
$Count = count($event.metadata.id)
order:
$Count desc
limit:
10
處理隨時間變化的注入權利存取事件
metadata.log_type = "WINDOWS_SYSMON"
metadata.product_event_type = "10"
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
$Target_Process = target.process.file.full_path
match:
$Date, $Target_Process
outcome:
$Count = count(metadata.id)
order:
$Date desc
Sysmon 事件總數
$event.metadata.log_type = "WINDOWS_SYSMON"
outcome:
$Count = count($event.metadata.id)
前 10 個程序
metadata.log_type = "WINDOWS_SYSMON"
$Process = target.process.file.full_path
$Process != ""
match:
$Process
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
前 10 個程序
$event.metadata.log_type = "WINDOWS_SYSMON"
$Process = $event.target.process.file.full_path
$Process != ""
match:
$Process
outcome:
$Count = count($event.metadata.id)
order:
$Count desc
limit:
10
前 10 大指令列
$event.metadata.log_type = "WINDOWS_SYSMON"
$Command = $event.target.process.command_line
$Command != ""
match:
$Command
outcome:
$Count = count($event.metadata.id)
order:
$Count desc
limit:
10
前 10 大 Sysmon 事件 ID
$event.metadata.log_type = "WINDOWS_SYSMON"
$Event_ID = $event.metadata.product_event_type
match:
$Event_ID
outcome:
$Count = count($event.metadata.id)
order:
$Count desc
limit:
10
依簽章狀態劃分的驅動程式載入事件
metadata.log_type = "WINDOWS_SYSMON"
metadata.product_event_type = "6"
$Signature_Status = target.resource.attribute.labels["SignatureStatus"]
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
match:
$Date, $Signature_Status
outcome:
$Count = count(metadata.id)
order:
$Date desc
Sysmon 事件趨勢
$event.metadata.log_type = "WINDOWS_SYSMON"
$Date = timestamp.get_date($event.metadata.event_timestamp.seconds)
match:
$Date
outcome:
$Count = count($event.metadata.id)
order:
$Date asc
啟動網路連線的前 10 個程序
$event.metadata.log_type = "WINDOWS_SYSMON"
$event.metadata.event_type = "NETWORK_CONNECTION"
$Process = $event.principal.process.file.full_path
match:
$Process
outcome:
$Count = count($event.metadata.id)
order:
$Count desc
limit:
10
建立檔案數前 10 名
metadata.log_type = "WINDOWS_SYSMON"
metadata.event_type = "FILE_CREATION"
$Source = principal.process.file.full_path
$File = target.file.full_path
match:
$File, $Source
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
前 10 位使用者
metadata.log_type = "WINDOWS_SYSMON"
$User = principal.user.userid
$User != ""
match:
$User
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
Sysmon 事件總數
metadata.log_type = "WINDOWS_SYSMON"
outcome:
$Count = count(metadata.id)
不重複主機總數
metadata.log_type = "WINDOWS_SYSMON"
outcome:
$Count = count_distinct(principal.hostname)
一段時間內的 Sysmon 事件
metadata.log_type = "WINDOWS_SYSMON"
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
match:
$Date
outcome:
$Count = count(metadata.id)
order:
$Date desc
前 10 個修改過的登錄機碼
metadata.log_type = "WINDOWS_SYSMON"
metadata.product_event_type = "13"
$Registry = target.registry.registry_key
match:
$Registry
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
不重複使用者總數
metadata.log_type = "WINDOWS_SYSMON"
outcome:
$Count = count_distinct(principal.user.userid)
前 10 個父項程序
$event.metadata.log_type = "WINDOWS_SYSMON"
$Process = $event.principal.process.file.full_path
$Process != ""
match:
$Process
outcome:
$Count = count($event.metadata.id)
order:
$Count desc
limit:
10
使用者生命週期稽核
這個資訊主頁是詳細的資訊主頁，供安全管理員和稽核人員查看使用者帳戶管理活動。這項功能可提供使用者生命週期的完整檢視畫面，協助確保正確遵循佈建和取消佈建政策。
注意： 套用篩選條件，即可在資訊主頁上顯示相關結果。
建立使用者的前 10 大來源 IP
最近建立的使用者帳戶
已刪除的使用者趨勢
已停用或刪除帳戶的活動
刪除使用者的前 10 大來源 IP
修改使用者最多的前 10 名使用者
使用者事件變化趨勢
一段時間內建立的使用者
近期修改使用者帳戶
一段時間內修改的使用者
刪除使用者次數最多的前 10 名使用者
修改使用者的前 10 大來源 IP
建立使用者的前 10 名使用者
圖表名稱
查詢示例
建立使用者的前 10 大來源 IP
metadata.event_type = "USER_CREATION"
security_result.action = "ALLOW"
$Log_Type = metadata.log_type
$IP_Address = principal.ip
match:
$Log_Type, $IP_Address
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
最近建立的使用者帳戶
metadata.event_type = "USER_CREATION"
security_result.action = "ALLOW"
$Log_Type = metadata.log_type
$Initiator = strings.coalesce(principal.user.windows_sid, principal.user.userid, principal.user.email_addresses)
$User = strings.coalesce(target.user.userid, target.user.email_addresses)
$IP_Address = principal.ip
$Date = timestamp.get_timestamp(metadata.event_timestamp.seconds, "%F %T ")
match:
$Date, $Log_Type, $Initiator, $IP_Address, $User
order:
$Date desc
已刪除的使用者趨勢
metadata.event_type = "USER_DELETION"
security_result.action = "ALLOW"
$Log_Type = metadata.log_type
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
match:
$Date, $Log_Type
outcome:
$Count = count(metadata.id)
order:
$Date desc
已停用或刪除帳戶的活動
$User = strings.coalesce(target.user.userid, target.user.email_addresses, target.user.windows_sid)
$User != ""
match:
$User
outcome:
$Deletion_Time = max(if(metadata.event_type = "USER_DELETION", metadata.event_timestamp.seconds, 0))
$Deletion_Timestamp = timestamp.get_timestamp($Deletion_Time, "%F %T ")
$Recent_Activity = max(metadata.event_timestamp.seconds)
$Recent_Activity_Timestamp = timestamp.get_timestamp($Recent_Activity, "%F %T ")
$Status = if($Deletion_Time != 0 AND ($Recent_Activity > $Deletion_Time), "Active Deleted Account", "Inactive Deleted Account")
$Event_Activities = array_distinct(metadata.event_type)
condition:
arrays.contains($Event_Activities, "USER_DELETION") AND $Status != "Inactive Deleted Account"
order:
$User desc
unselect:
$Event_Activities, $Deletion_Time, $Recent_Activity
刪除使用者的前 10 大來源 IP
metadata.event_type = "USER_DELETION"
security_result.action = "ALLOW"
$Log_Type = metadata.log_type
$IP_Address = principal.ip
match:
$Log_Type, $IP_Address
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
修改使用者最多的前 10 名使用者
metadata.event_type = "USER_CHANGE_PERMISSIONS"
or metadata.event_type = "USER_CHANGE_PASSWORD"
or metadata.event_type = "USER_RESOURCE_UPDATE_PERMISSIONS"
security_result.action = "ALLOW"
$Log_Type = metadata.log_type
$User = strings.coalesce(principal.user.windows_sid, principal.user.userid, principal.user.email_addresses)
match:
$Log_Type, $User
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
使用者事件變化趨勢
metadata.event_type = "USER_CREATION"
or metadata.event_type = "USER_DELETION"
or metadata.event_type = "USER_CHANGE_PERMISSIONS"
or metadata.event_type = "USER_CHANGE_PASSWORD"
or metadata.event_type = "USER_RESOURCE_UPDATE_PERMISSIONS"
security_result.action = "ALLOW"
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
$Event = metadata.event_type
match:
$Date, $Event
outcome:
$Count = count(metadata.id)
order:
$Date desc
一段時間內建立的使用者
metadata.event_type = "USER_CREATION"
security_result.action = "ALLOW"
$Log_Type = metadata.log_type
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
match:
$Date, $Log_Type
outcome:
$Count = count(metadata.id)
order:
$Date desc
近期修改使用者帳戶
metadata.event_type = "USER_CHANGE_PERMISSIONS"
or metadata.event_type = "USER_CHANGE_PASSWORD"
or metadata.event_type = "USER_RESOURCE_UPDATE_PERMISSIONS"
security_result.action = "ALLOW"
$Event_Type = metadata.event_type
$Log_Type = metadata.log_type
$User = strings.coalesce(target.user.userid, target.user.email_addresses)
$Initiator = strings.coalesce(principal.user.windows_sid, principal.user.userid, principal.user.email_addresses)
$IP_Address = principal.ip
$Date = timestamp.get_timestamp(metadata.event_timestamp.seconds, "%F %T ")
match:
$Date, $Log_Type, $Initiator, $IP_Address, $User, $Event_Type
order:
$Date desc
一段時間內修改的使用者
metadata.event_type = "USER_CHANGE_PERMISSIONS"
or metadata.event_type = "USER_CHANGE_PASSWORD"
or metadata.event_type = "USER_RESOURCE_UPDATE_PERMISSIONS"
security_result.action = "ALLOW"
$Log_Type = metadata.log_type
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
match:
$Date, $Log_Type
outcome:
$Count = count(metadata.id)
order:
$Date desc
刪除使用者次數最多的前 10 名使用者
metadata.event_type = "USER_DELETION"
security_result.action = "ALLOW"
$Log_Type = metadata.log_type
$User = strings.coalesce(principal.user.windows_sid, principal.user.userid, principal.user.email_addresses)
match:
$Log_Type, $User
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
修改使用者的前 10 大來源 IP
metadata.event_type = "USER_CHANGE_PERMISSIONS"
or metadata.event_type = "USER_CHANGE_PASSWORD"
or metadata.event_type = "USER_RESOURCE_UPDATE_PERMISSIONS"
security_result.action = "ALLOW"
$Log_Type = metadata.log_type
$IP_Address = principal.ip
match:
$Log_Type, $IP_Address
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
建立使用者的前 10 名使用者
metadata.event_type = "USER_CREATION"
security_result.action = "ALLOW"
$Log_Type = metadata.log_type
$User = strings.coalesce(principal.user.windows_sid, principal.user.userid, principal.user.email_addresses)
match:
$Log_Type, $User
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
使用者登入總覽
這個資訊主頁會全面分析驗證活動，協助您找出及監控登入事件。這有助於偵測潛在的高風險使用者、分析登入狀態和趨勢，以及瞭解地理位置活動和相關聯的主機。您也可以調查異常登入行為、因應潛在安全入侵，並透過持續監控和主動偵測威脅，維持強大的安全性。
登入次數 (按國家/地區劃分)
過去 1 天的成功登入次數
依登入狀態列出的前 10 個 IP
過去一天內前 10 名來源/目的地用量 (位元組)
依登入次數排序的前 10 個應用程式
應用程式登入次數
前 10 大來源目標配對 (依事件計數排序)
成功登入次數
登入狀態
登入失敗次數最多的前 10 位使用者
使用者 (按登入狀態劃分)
登入位置地圖
登入次數 (依狀態和時間)
依登入狀態顯示主機名稱
依目標 IP 劃分的濫用事件計數
依應用程式劃分的登入次數
登入失敗次數最多的前 10 個 IP
過去一天內用量最高的前 5 個來源/目的地
依登入成功次數排序的前 10 個主機名稱
憑證存取登入事件
登入失敗次數
IP (依登入狀態呈現)
登入失敗次數 (過去 24 小時)
登入成功次數前 10 名的 IP
登入次數最多的前 10 個國家/地區
不同日期的記錄類型事件數量
登入狀態
登入失敗次數前 10 名的主機名稱
過去一天內用量最高的 10 個來源/目的地
初始存取登入事件
依登入狀態排名的前 10 名使用者
登入失敗率
成功登入次數前 10 名的使用者
圖表名稱
查詢示例
登入次數 (按國家/地區劃分)
metadata.event_type = "USER_LOGIN"
$Country = principal.location.country_or_region
match:
$Country
outcome:
$Count = count(metadata.id)
order:
$Count desc
過去 1 天的成功登入次數
metadata.event_type = "USER_LOGIN"
security_result.action = $action
$action = "ALLOW"
match:
$action
outcome:
$event_count = count_distinct(metadata.id)
依登入狀態列出的前 10 個 IP
metadata.event_type = "USER_LOGIN"
$IP_Address = principal.ip
match:
$IP_Address
outcome:
$Count = count(metadata.id)
$Failed_Login_Count = sum(if(security_result.action = "BLOCK", 1, 0))
$Successful_Login_Count = sum(if(security_result.action = "ALLOW", 1, 0))
order:
$Count desc
limit:
10
過去一天內前 10 名來源/目的地用量 (位元組)
metadata.event_type = "NETWORK_CONNECTION"
$pip = principal.ip
$tip = target.ip
match:
$pip, $tip
outcome:
$event_count = count_distinct(metadata.id)
$bytes_sent = sum(network.sent_bytes)
$bytes_received = sum(network.received_bytes)
order:
$bytes_sent desc
limit:
10
依登入次數排序的前 10 個應用程式
metadata.event_type = "USER_LOGIN"
$Application = target.application
match:
$Application
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
應用程式登入次數
target.application != ""
$application = target.application
$login_status = security_result.action
match:
$application, $login_status
outcome:
$event_count = count_distinct(metadata.id)
order:
$event_count desc
前 10 大來源目標配對 (依事件計數排序)
principal.hostname != ""
target.ip != ""
$source = principal.hostname
$target = target.ip
match:
$source, $target
outcome:
$event_count = count_distinct(metadata.id)
order:
$event_count desc
limit:
10
成功登入次數
metadata.event_type = "USER_LOGIN"
security_result.action = "ALLOW"
outcome:
$Count = count(metadata.id)
登入狀態
metadata.event_type = "USER_LOGIN"
$security_result = security_result.action
match:
$security_result
outcome:
$event_count = count_distinct(metadata.id)
登入失敗次數最多的前 10 位使用者
metadata.event_type = "USER_LOGIN"
security_result.action = "BLOCK"
$User = target.user.userid
match:
$User
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
使用者 (按登入狀態劃分)
metadata.event_type = "USER_LOGIN"
$User = target.user.userid
match:
$User
outcome:
$Count = count(metadata.id)
$Failed_Login_Count = sum(if(security_result.action = "BLOCK", 1, 0))
$Successful_Login_Count = sum(if(security_result.action = "ALLOW", 1, 0))
order:
$Count desc
登入位置地圖
metadata.event_type = "USER_LOGIN"
$IP_Address = principal.ip
$Latitude = principal.location.region_latitude
$Latitude != 0
$Longitude = principal.location.region_longitude
$Longitude != 0
match:
$IP_Address, $Latitude, $Longitude
outcome:
$Count = count(metadata.id)
order:
$Count desc
登入次數 (依狀態和時間)
metadata.event_type = "USER_LOGIN"
$Action = security_result.action
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
match:
$Action, $Date
outcome:
$Count = count(metadata.id)
order:
$Count asc
依登入狀態顯示主機名稱
metadata.event_type = "USER_LOGIN"
$Hostname = principal.hostname
match:
$Hostname
outcome:
$Count = count(metadata.id)
$Failed_Login_Count = sum(if(security_result.action = "BLOCK", 1, 0))
$Successful_Login_Count = sum(if(security_result.action = "ALLOW", 1, 0))
order:
$Count desc
依目標 IP 劃分的濫用事件計數
principal.hostname = "abu"
$target = target.ip
match:
$target
outcome:
$event_count = count_distinct(metadata.id)
依應用程式劃分的登入次數
metadata.event_type = "USER_LOGIN"
$Application = target.application
match:
$Application
outcome:
$Count = count(metadata.id)
$Failed_Login_Count = sum(if(security_result.action = "BLOCK", 1, 0))
$Successful_Login_Count = sum(if(security_result.action = "ALLOW", 1, 0))
order:
$Count desc
limit:
10
登入失敗次數最多的前 10 個 IP
metadata.event_type = "USER_LOGIN"
security_result.action = "BLOCK"
$IP_Address = principal.ip
match:
$IP_Address
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
過去一天內用量最高的前 5 個來源/目的地
metadata.event_type = "NETWORK_CONNECTION"
$ip_pair = strings.concat(principal.ip,"/",target.ip)
principal.ip != "10.9.8.7"
match:
$ip_pair
outcome:
$event_count = count_distinct(metadata.id)
order:
$event_count desc
limit:
5
依登入成功次數排序的前 10 個主機名稱
metadata.event_type = "USER_LOGIN"
security_result.action = "ALLOW"
$Hostname = principal.hostname
match:
$Hostname
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
憑證存取登入事件
metadata.event_type = "USER_LOGIN"
strings.coalesce(security_result.attack_details.tactics.name, security_result.detection_fields["Tactic"]) = /Credential Access/ nocase
outcome:
$Count = count(metadata.id)
登入失敗次數
metadata.event_type = "USER_LOGIN"
security_result.action = "BLOCK"
outcome:
$Count = count(metadata.id)
IP (依登入狀態呈現)
metadata.event_type = "USER_LOGIN"
$IP_Address = principal.ip
match:
$IP_Address
outcome:
$Count = count(metadata.id)
$Failed_Login_Count = sum(if(security_result.action = "BLOCK", 1, 0))
$Successful_Login_Count = sum(if(security_result.action = "ALLOW", 1, 0))
order:
$Count desc
登入失敗次數 (過去 24 小時)
metadata.event_type = "USER_LOGIN"
security_result.action = "BLOCK"
$Date = timestamp.get_timestamp(metadata.event_timestamp.seconds)
$Hostname = principal.hostname
$IP_Address = principal.ip
$User = strings.coalesce(target.user.userid, target.user.user_display_name, principal.user.userid, principal.user.user_display_name)
match:
$Date, $User, $Hostname, $IP_Address
outcome:
$Failed_Logins = count(metadata.id)
order:
$Failed_Logins desc
登入成功次數前 10 名的 IP
metadata.event_type = "USER_LOGIN"
security_result.action = "ALLOW"
$IP_Address = principal.ip
match:
$IP_Address
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
登入次數最多的前 10 個國家/地區
metadata.event_type = "USER_LOGIN"
$Country = principal.location.country_or_region
match:
$Country
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
不同日期的記錄類型事件數量
$log_type = metadata.log_type
$date = timestamp.get_date(metadata.event_timestamp.seconds, "America/Los_Angeles")
match:
$date, $log_type
outcome:
$event_count = count_distinct(metadata.id)
order:
$event_count desc
登入狀態
metadata.event_type = "USER_LOGIN"
$Action = security_result.action
match:
$Action
outcome:
$Count = count(metadata.id)
order:
$Count desc
登入失敗次數前 10 名的主機名稱
metadata.event_type = "USER_LOGIN"
security_result.action = "BLOCK"
$Hostname = principal.hostname
match:
$Hostname
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
過去一天內用量最高的 10 個來源/目的地
metadata.event_type = "NETWORK_CONNECTION"
$pip = principal.ip
$tip = target.ip
match:
$pip, $tip
outcome:
$event_count = count_distinct(metadata.id)
order:
$event_count desc
limit:
10
初始存取登入事件
metadata.event_type = "USER_LOGIN"
strings.coalesce(security_result.attack_details.tactics.name, security_result.detection_fields["Tactic"]) = /Initial Access/ nocase
outcome:
$Count = count(metadata.id)
依登入狀態排名的前 10 名使用者
metadata.event_type = "USER_LOGIN"
$User = target.user.userid
match:
$User
outcome:
$Count = count(metadata.id)
$Failed_Login_Count = sum(if(security_result.action = "BLOCK", 1, 0))
$Successful_Login_Count = sum(if(security_result.action = "ALLOW", 1, 0))
order:
$Count desc
limit:
10
登入失敗率
metadata.event_type = "USER_LOGIN"
outcome:
$Total_Logins = count(metadata.id)
$Failed_Logins = sum(if(security_result.action = "BLOCK", 1, 0))
$Failure_Rate = math.round(($Failed_Logins / $Total_Logins), 2) * 100
成功登入次數前 10 名的使用者
metadata.event_type = "USER_LOGIN"
security_result.action = "ALLOW"
$User = target.user.userid
match:
$User
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
VPN 活動監控
這個資訊主頁會提供與安全性相關的 VPN 事件洞察資訊。
地理位置連線來源
使用者和 IP 嘗試連線 VPN 失敗次數前 10 名
VPN 使用趨勢
VPN 頻寬用量 (一段時間內)
來源平台發布
依事件計數排序的前 10 名 VPN 使用者
前 10 大目標 IP
有效的 VPN 連線
VPN 連線成功與失敗
圖表名稱
查詢示例
地理位置連線來源
$log_type = metadata.log_type
$log_type = /VPN|Zscaler_ZPA|ZSCALER_DECEPTION|TWINGATE|SYMANTEC_VIP_AUTHHUB/nocase
$location = principal.location.country_or_region
$location != ""
match:
$location
outcome:
$event_count = count($location)
$latitude = max(principal.location.region_coordinates.latitude)
$longitude = max(principal.location.region_coordinates.longitude)
使用者和 IP 嘗試連線 VPN 失敗次數前 10 名
$log_type = metadata.log_type
$log_type = /VPN|Zscaler_ZPA|ZSCALER_DECEPTION|TWINGATE|SYMANTEC_VIP_AUTHHUB/nocase
$summary = security_result.summary
($summary = /fail/ or additional.fields["connection-attempt-status"] = /fail/ or metadata.product_event_type = /fail/)
$user = principal.user.user_display_name
$src_ip = principal.ip
match:
$user,$src_ip
outcome:
$event_count = count(metadata.id)
order:
$event_count desc
limit :
10
VPN 使用趨勢
$log_type = metadata.log_type
$log_type = /VPN|Zscaler_ZPA|ZSCALER_DECEPTION|TWINGATE|SYMANTEC_VIP_AUTHHUB/nocase
$date = timestamp.get_date(metadata.event_timestamp.seconds)
match:
$date
outcome:
$event_count = count(metadata.id)
order:
$date asc
VPN 頻寬用量 (一段時間內)
$log_type = metadata.log_type
$log_type = /VPN|Zscaler_ZPA|ZSCALER_DECEPTION|TWINGATE|SYMANTEC_VIP_AUTHHUB/nocase
$date = timestamp.get_date(metadata.event_timestamp.seconds)
$sent_bytes = network.sent_bytes
$received_bytes = network.received_bytes
match:
$date
outcome:
$total_sent_bytes = sum($sent_bytes)
$total_received_bytes = sum($received_bytes)
$total_bandwidth = $total_sent_bytes + $total_received_bytes
$total_bandwidth_kb = $total_bandwidth/ 1024
order:
$date asc
VPN 使用趨勢
$log_type = metadata.log_type
$log_type = /VPN|Zscaler_ZPA|ZSCALER_DECEPTION|TWINGATE|SYMANTEC_VIP_AUTHHUB/nocase
$date = timestamp.get_date(metadata.event_timestamp.seconds)
match:
$date
outcome:
$event_count = count(metadata.id)
order:
$date asc
來源平台發布
$log_type = metadata.log_type
$log_type = /VPN|Zscaler_ZPA|ZSCALER_DECEPTION|TWINGATE|SYMANTEC_VIP_AUTHHUB/nocase
$platform = principal.platform
match:
$platform
outcome:
$event_count = count(metadata.id)
依事件計數排序的前 10 名 VPN 使用者
$log_type = metadata.log_type
$log_type = /VPN|Zscaler_ZPA|ZSCALER_DECEPTION|TWINGATE|SYMANTEC_VIP_AUTHHUB/nocase
$user = strings.coalesce(principal.user.user_display_name,target.user.user_display_name)
$user != ""
match:
$user
outcome:
$event_count = count(metadata.id)
order:
$event_count desc
limit:
10
前 10 大目標 IP
$log_type = metadata.log_type
$log_type = /VPN|Zscaler_ZPA|ZSCALER_DECEPTION|TWINGATE|SYMANTEC_VIP_AUTHHUB/nocase
$dest_ip = target.ip
$dest_ip != ""
match:
$dest_ip
outcome:
$event_count = count(metadata.id)
order:
$event_count desc
limit:
10
VPN 頻寬用量 (一段時間內)
$log_type = metadata.log_type
$log_type = /VPN|Zscaler_ZPA|ZSCALER_DECEPTION|TWINGATE|SYMANTEC_VIP_AUTHHUB/nocase
$date = timestamp.get_date(metadata.event_timestamp.seconds)
$sent_bytes = network.sent_bytes
$received_bytes = network.received_bytes
match:
$date
outcome:
$total_sent_bytes = sum($sent_bytes)
$total_received_bytes = sum($received_bytes)
$total_bandwidth = $total_sent_bytes + $total_received_bytes
$total_bandwidth_kb = $total_bandwidth/ 1024
order:
$date asc
有效的 VPN 連線
$log_type = metadata.log_type
$log_type = /VPN|Zscaler_ZPA|ZSCALER_DECEPTION|TWINGATE|SYMANTEC_VIP_AUTHHUB/nocase
$src_ip = principal.ip
$dest_ip = target.ip
$end_time = additional.fields["connection-end-time"]
$end_time = "NA"
$user = target.user.user_display_name
$session_duration = timestamp.diff(metadata.ingested_timestamp.seconds,timestamp.as_unix_seconds(additional.fields["connection-start-time"]))
$session_duration > 100
match:
$user,$src_ip,$dest_ip,$session_duration
outcome:
$event_count = count(metadata.id)
order:
$session_duration desc,$user asc
地理位置連線來源
$log_type = metadata.log_type
$log_type = /VPN|Zscaler_ZPA|ZSCALER_DECEPTION|TWINGATE|SYMANTEC_VIP_AUTHHUB/nocase
$location = principal.location.country_or_region
$location != ""
match:
$location
outcome:
$event_count = count($location)
$latitude = max(principal.location.region_coordinates.latitude)
$longitude = max(principal.location.region_coordinates.longitude)
使用者和 IP 嘗試連線 VPN 失敗次數前 10 名
$log_type = metadata.log_type
$log_type = /VPN|Zscaler_ZPA|ZSCALER_DECEPTION|TWINGATE|SYMANTEC_VIP_AUTHHUB/nocase
$summary = security_result.summary
($summary = /fail/ or additional.fields["connection-attempt-status"] = /fail/ or metadata.product_event_type = /fail/)
$user = principal.user.user_display_name
$src_ip = principal.ip
match:
$user,$src_ip
outcome:
$event_count = count(metadata.id)
order:
$event_count desc
limit :
10
來源平台發布
$log_type = metadata.log_type
$log_type = /VPN|Zscaler_ZPA|ZSCALER_DECEPTION|TWINGATE|SYMANTEC_VIP_AUTHHUB/nocase
$platform = principal.platform
match:
$platform
outcome:
$event_count = count(metadata.id)
有效的 VPN 連線
$log_type = metadata.log_type
$log_type = /VPN|Zscaler_ZPA|ZSCALER_DECEPTION|TWINGATE|SYMANTEC_VIP_AUTHHUB/nocase
$src_ip = principal.ip
$dest_ip = target.ip
$end_time = additional.fields["connection-end-time"]
$end_time = "NA"
$user = target.user.user_display_name
$session_duration = timestamp.diff(metadata.ingested_timestamp.seconds,timestamp.as_unix_seconds(additional.fields["connection-start-time"]))
$session_duration > 100
match:
$user,$src_ip,$dest_ip,$session_duration
outcome:
$event_count = count(metadata.id)
order:
$session_duration desc,$user asc
VPN 連線成功與失敗
$log_type = metadata.log_type
$log_type = /VPN|Zscaler_ZPA|ZSCALER_DECEPTION|TWINGATE|SYMANTEC_VIP_AUTHHUB/nocase
$summary = strings.coalesce(security_result.summary, metadata.product_event_type, additional.fields["connection-attempt-status"])
($summary = /fail/ or $summary = /success/)
match:
$summary
outcome:
$event_count = count(metadata.id)
VPN 連線成功與失敗
$log_type = metadata.log_type
$log_type = /VPN|Zscaler_ZPA|ZSCALER_DECEPTION|TWINGATE|SYMANTEC_VIP_AUTHHUB/nocase
$summary = strings.coalesce(security_result.summary, metadata.product_event_type, additional.fields["connection-attempt-status"])
($summary = /fail/ or $summary = /success/)
match:
$summary
outcome:
$event_count = count(metadata.id)
依事件計數排序的前 10 名 VPN 使用者
$log_type = metadata.log_type
$log_type = /VPN|Zscaler_ZPA|ZSCALER_DECEPTION|TWINGATE|SYMANTEC_VIP_AUTHHUB/nocase
$user = strings.coalesce(principal.user.user_display_name,target.user.user_display_name)
$user != ""
match:
$user
outcome:
$event_count = count(metadata.id)
order:
$event_count desc
limit:
10
前 10 大目標 IP
$log_type = metadata.log_type
$log_type = /VPN|Zscaler_ZPA|ZSCALER_DECEPTION|TWINGATE|SYMANTEC_VIP_AUTHHUB/nocase
$dest_ip = target.ip
$dest_ip != ""
match:
$dest_ip
outcome:
$event_count = count(metadata.id)
order:
$event_count desc
limit:
10
網頁應用程式防火牆 (WAF) 監控
這個資訊主頁可監控及分析網頁應用程式防火牆活動，進而提升安全性和威脅管理成效。這項功能會追蹤與 WAF 作業相關的各種指標和事件，即時提供網頁應用程式安全性的洞察資料，協助您有效管理及因應潛在的網路威脅。
異常流量偵測
前 10 大網路應用程式防火牆規則命中次數
前 10 大來源 IP
已封鎖的要求與允許的要求
攻擊的地理位置
前 10 大攻擊類型
前 10 個網址點擊次數
圖表名稱
查詢示例
異常流量偵測
$Log_Type = metadata.log_type
$Log_Type = /WAF/ nocase
$Action = security_result.action
$date = timestamp.get_date(metadata.event_timestamp.seconds)
match:
$date
outcome:
$count = count(metadata.id)
前 10 大網路應用程式防火牆規則命中次數
$Log_Type = metadata.log_type
$Log_Type = /WAF/ nocase
$Rule_Name = security_result.rule_name
match:
$Rule_Name, $Log_Type
outcome:
$count = count(metadata.id)
order:
$count desc
limit:
10
前 10 大來源 IP
$Log_Type = metadata.log_type
$Log_Type = /WAF/ nocase
$Source_IP = principal.ip
$Geolocation = principal.location.country_or_region
match:
$Source_IP, $Geolocation
outcome:
$Action = array_distinct(security_result.action)
$count = count(metadata.id)
Order:
$count desc
limit:
10
已封鎖的要求與允許的要求
$Log_Type = metadata.log_type
$Log_Type = /WAF/ nocase
$Action = security_result.action
match:
$Action
outcome:
$count = count(metadata.id)
已封鎖的要求與允許的要求
$Log_Type = metadata.log_type
$Log_Type = /WAF/
$Action = security_result.action
match:
$Action
outcome:
$count = count(metadata.id)
攻擊的地理位置
$Log_Type = metadata.log_type
$Log_Type = /WAF/
$Geolocation = principal.location.country_or_region
match:
$Geolocation
outcome:
$Latitude = max(principal.location.region_latitude)
$Longitude = max(principal.location.region_longitude)
$count = count(metadata.id)
前 10 大來源 IP
$Log_Type = metadata.log_type
$Log_Type = /WAF/
$Source_IP = principal.ip
$Source_IP != ""
$Geolocation = principal.location.country_or_region
match:
$Source_IP, $Geolocation
outcome:
$Action = array_distinct(security_result.action)
$count = count(metadata.id)
Order:
$count desc
limit:
10
前 10 大攻擊類型
$Log_Type = metadata.log_type
$Log_Type = /WAF/ nocase
$Description = security_result.description
match:
$Description, $Log_Type
outcome:
$Action = array_distinct(security_result.action)
$count = count(metadata.id)
order:
$count desc
limit:
10
異常流量偵測
$Log_Type = metadata.log_type
$Log_Type = /WAF/
$Action = security_result.action
$date = timestamp.get_date(metadata.event_timestamp.seconds)
match:
$date
outcome:
$count = count(metadata.id)
前 10 大攻擊類型
$Log_Type = metadata.log_type
$Log_Type = /WAF/
$Description = security_result.description
$Description != ""
match:
$Description, $Log_Type
outcome:
$Action = array_distinct(security_result.action)
$count = count(metadata.id)
order:
$count desc
limit:
10
攻擊的地理位置
$Log_Type = metadata.log_type
$Log_Type = /WAF/ nocase
$Geolocation = principal.location.country_or_region
match:
$Geolocation
outcome:
$Latitude = max(principal.location.region_latitude)
$Longitude = max(principal.location.region_longitude)
$count = count(metadata.id)
前 10 個網址點擊次數
$Log_Type = metadata.log_type
$Log_Type = /WAF/
$URL = target.url
$URL != ""
match:
$URL, $Log_Type
outcome:
$count = count(metadata.id)
order:
$count desc
limit:
10
前 10 大網路應用程式防火牆規則命中次數
$Log_Type = metadata.log_type
$Log_Type = /WAF/
$Rule_Name = security_result.rule_name
$Rule_Name != ""
match:
$Rule_Name, $Log_Type
outcome:
$count = count(metadata.id)
order:
$count desc
limit:
10
前 10 個網址點擊次數
$Log_Type = metadata.log_type
$Log_Type = /WAF/ nocase
$URL = target.url
match:
$URL, $Log_Type
outcome:
$count = count(metadata.id)
order:
$count desc
limit:
10
Web Center 總覽
這個資訊主頁會監控及分析整個網路的網頁流量模式和使用者活動。這項功能可提供熱門使用者代理程式、來源、目的地和網址的深入分析資料，協助您追蹤使用情況及偵測潛在風險。
一段時間內使用較舊的傳輸層安全標準 (TLS) 版本
TLS 密碼分配
前 10 個網址
最不常見的網址
未加密的通訊配置
依 HTTP 方法列出的歷來事件
前 10 大目的地 IP
前 10 大網站類別
依 HTTP 方法列出的前 10 名使用者
前 10 大 HTTP 使用者代理程式
前 10 大來源 IP
下載位元組數前 10 名的使用者
前 10 位使用者
封鎖網址數量前 10 多的國家/地區
一段時間內的事件 (按 HTTP 回應代碼劃分)
根據位置封鎖網址
前 10 個封鎖的網址
網頁失敗率
依位置封鎖的 HTTP 事件
前 10 個主體 IP
上傳位元組數前 10 名的使用者
圖表名稱
查詢示例
一段時間內使用較舊的傳輸層安全標準 (TLS) 版本
metadata.event_type = "NETWORK_HTTP"
network.tls.version = /^tls/ nocase
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
$TLS_Version = network.tls.version
$TLS_Version != ""
match:
$Date, $TLS_Version
outcome:
$Count = count(metadata.id)
order:
$Date asc
TLS 密碼分配
network.tls.cipher = /^tls/ nocase
$TLS = network.tls.cipher
$TLS != ""
match:
$TLS
outcome:
$Count = count(metadata.id)
order:
$Count desc
前 10 個網址
$event.metadata.event_type = "NETWORK_HTTP"
$URL = $event.target.url
$URL != ""
match:
$URL
outcome:
$Count = count($event.metadata.id)
order:
$Count desc
limit:
10
最不常見的網址
metadata.event_type = "NETWORK_HTTP"
$URL = target.url
$URL != ""
match:
$URL
outcome:
$Count = count(metadata.id)
order:
$Count asc
limit:
10
未加密的通訊配置
metadata.event_type = "NETWORK_UNCATEGORIZED"
or metadata.event_type = "NETWORK_FLOW"
or metadata.event_type = "NETWORK_CONNECTION"
or metadata.event_type = "NETWORK_FTP"
or metadata.event_type = "NETWORK_DHCP"
or metadata.event_type = "NETWORK_DNS"
or metadata.event_type = "NETWORK_HTTP"
or metadata.event_type = "NETWORK_SMTP"
network.application_protocol = "HTTP"
or network.application_protocol = "SMTP"
or network.application_protocol = "DNS"
$Protocol = network.application_protocol
match:
$Protocol
outcome:
$Count = count(metadata.id)
order:
$Count desc
依 HTTP 方法列出的歷來事件
$event.metadata.event_type = "NETWORK_HTTP"
$Log_Type = $event.metadata.log_type
$Event_Type = $event.metadata.event_type
$HTTP_Method = $event.network.http.method
$HTTP_Method != ""
$Date = timestamp.get_date($event.metadata.event_timestamp.seconds)
match:
$Date, $Log_Type, $Event_Type, $HTTP_Method
outcome:
$Count = count($event.metadata.id)
order:
$Date asc
前 10 大目的地 IP
$event.metadata.event_type = "NETWORK_HTTP"
$Destination_IP = $event.target.ip
match:
$Destination_IP
outcome:
$Count = count($event.metadata.id)
order:
$Count desc
limit:
10
前 10 大網站類別
$event.metadata.event_type = "NETWORK_HTTP"
$Log_Type = $event.metadata.log_type
$Event_Type = $event.metadata.event_type
$Categories = $event.security_result.category_details
$Categories != ""
match:
$Event_Type, $Log_Type, $Categories
outcome:
$Count = count($event.metadata.id)
order:
$Count desc
limit:
10
依 HTTP 方法列出的前 10 名使用者
metadata.event_type = "NETWORK_HTTP"
$User = principal.user.userid
$User != ""
$HTTP_Method = network.http.method
$HTTP_Method = /PUT|POST|DELETE/ nocase
match:
$User, $HTTP_Method
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
前 10 大 HTTP 使用者代理程式
$event.metadata.event_type = "NETWORK_HTTP"
$User_Agent = $event.network.http.user_agent
$User_Agent != ""
match:
$User_Agent
outcome:
$Count = count($event.metadata.id)
order:
$Count desc
limit:
10
前 10 大來源 IP
metadata.event_type = "NETWORK_HTTP"
$Source_IP = principal.ip
match:
$Source_IP
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
依 HTTP 方法列出的歷來事件
metadata.event_type = "NETWORK_HTTP"
$Log_Type = metadata.log_type
$Event_Type = metadata.event_type
$HTTP_Method = network.http.method
$HTTP_Method != ""
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
match:
$Date, $Log_Type, $Event_Type, $HTTP_Method
outcome:
$Count = count(metadata.id)
order:
$Date asc
下載位元組數前 10 名的使用者
metadata.event_type = "NETWORK_HTTP"
network.http.method = "GET"
$User = principal.user.userid
$User != ""
match:
$User
outcome:
$Count = sum(network.received_bytes)
order:
$Count desc
limit:
10
前 10 位使用者
$event.metadata.event_type = "NETWORK_HTTP"
$User = $event.principal.user.userid
$User != ""
match:
$User
outcome:
$Count = count($event.metadata.id)
order:
$Count desc
limit:
10
最不常見的網址
$event.metadata.event_type = "NETWORK_HTTP"
$URL = $event.target.url
$URL != ""
match:
$URL
outcome:
$Count = count($event.metadata.id)
order:
$Count asc
limit:
10
前 10 個網址
metadata.event_type = "NETWORK_HTTP"
$URL = target.url
$URL != ""
match:
$URL
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
前 10 大目的地 IP
metadata.event_type = "NETWORK_HTTP"
$Destination_IP = target.ip
match:
$Destination_IP
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
前 10 大 HTTP 使用者代理程式
metadata.event_type = "NETWORK_HTTP"
$User_Agent = network.http.user_agent
$User_Agent != ""
match:
$User_Agent
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
封鎖網址數量前 10 多的國家/地區
metadata.event_type = "NETWORK_HTTP"
security_result.action = "BLOCK"
$URL = target.url
$URL != ""
$Country = target.location.country_or_region
match:
$Country
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
一段時間內的事件 (按 HTTP 回應代碼劃分)
$event.metadata.event_type = "NETWORK_HTTP"
$Response_Code = strings.concat($event.network.http.response_code, " ")
$Date = timestamp.get_date($event.metadata.event_timestamp.seconds)
match:
$Date, $Response_Code
outcome:
$Count = count($event.metadata.id)
order:
$Date asc
根據位置封鎖網址
metadata.event_type = "NETWORK_HTTP"
security_result.action = "BLOCK"
$URL = target.url
$URL != ""
$Latitude = target.location.region_latitude
$Longitude = target.location.region_longitude
match:
$Latitude, $Longitude
outcome:
$Count = count(metadata.id)
order:
$Count desc
前 10 個封鎖的網址
$event.metadata.event_type = "NETWORK_HTTP"
$event.security_result.action = "BLOCK"
$Blocked_URL = $event.target.url
match:
$Blocked_URL
outcome:
$Event_Count = count($event.metadata.id)
order:
$Event_Count desc
limit:
10
一段時間內的事件 (按 HTTP 回應代碼劃分)
metadata.event_type = "NETWORK_HTTP"
$Response_Code = strings.concat(network.http.response_code, " ")
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
match:
$Date, $Response_Code
outcome:
$Count = count(metadata.id)
order:
$Date asc
前 10 個封鎖的網址
metadata.event_type = "NETWORK_HTTP"
security_result.action = "BLOCK"
$Blocked_URL = target.url
match:
$Blocked_URL
outcome:
$Event_Count = count(metadata.id)
order:
$Event_Count desc
limit:
10
網頁失敗率
metadata.event_type = "NETWORK_HTTP"
$Response_Code = strings.concat(network.http.response_code, " ")
outcome:
$Total_Count = count(metadata.id)
$Failure_Count = sum(if($Response_Code = /^(4|5)/, 1, 0))
$Failure_Rate = math.round($Failure_Count / $Total_Count, 2) * 100
前 10 大網站類別
metadata.event_type = "NETWORK_HTTP"
$Log_Type = metadata.log_type
$Event_Type = metadata.event_type
$Categories = security_result.category_details
$Categories != ""
match:
$Event_Type, $Log_Type, $Categories
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
依位置封鎖的 HTTP 事件
$event.metadata.event_type = "NETWORK_HTTP"
$event.security_result.action = "BLOCK"
$URL = $event.target.url
$URL != ""
$Latitude = $event.target.location.region_latitude
$Longitude = $event.target.location.region_longitude
match:
$Latitude, $Longitude
outcome:
$Count = count($event.metadata.id)
order:
$Count desc
前 10 個主體 IP
$event.metadata.event_type = "NETWORK_HTTP"
$Source_IP = $event.principal.ip
match:
$Source_IP
outcome:
$Count = count($event.metadata.id)
order:
$Count desc
limit:
10
前 10 位使用者
metadata.event_type = "NETWORK_HTTP"
$User = principal.user.userid
$User != ""
match:
$User
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
上傳位元組數前 10 名的使用者
metadata.event_type = "NETWORK_HTTP"
network.http.method = "POST"
$User = principal.user.userid
$User != ""
match:
$User
outcome:
$Count = sum(network.sent_bytes)
order:
$Count desc
limit:
10
Windows 安全性總覽
這個資訊主頁會分析使用者和系統活動，例如帳戶管理、登入模式、威脅詳細資料和設定變更，全面掌握 Windows 安全防護機制，並提升威脅偵測和回應能力。
注意： 套用篩選條件，即可在資訊主頁上顯示相關結果。
近期建立的排定工作
一段時間內成功登入與登入失敗的次數
刪除使用者帳戶
登入失敗次數前 10 名的使用者帳戶
依主機分類的快訊分布情形 (Defender ATP)
Windows Defender ATP 威脅
威脅動作分配
已清除安全性事件記錄
端點保護狀態 (Defender 防毒軟體)
一段時間內的帳戶建立和刪除次數
近期稽核政策異動
過去一段時間的威脅偵測
帳戶無法登入摘要
特殊權限群組修改
最近安裝的服務
威脅偵測摘要
前 10 大威脅檔案路徑
端點防護摘要 (Defender 防毒軟體)
登入類型分布情形
伺服器上產生的程序 (Windows Sysmon)
遠端登入國家/地區數
防毒軟體版本分布 (Defender Antivirus)
建立使用者帳戶
圖表名稱
查詢示例
近期建立的排定工作
metadata.product_event_type = "4698"
metadata.event_type = "SCHEDULED_TASK_CREATION"
$Description = strings.coalesce(metadata.description,security_result.description,security_result.summary)
$Event_Type = metadata.event_type
$Source_Hostname = strings.coalesce(principal.hostname, principal.asset.hostname)
$Source_IP = strings.coalesce(principal.ip, principal.asset.ip)
$Source_User = strings.coalesce(principal.user.userid, principal.user.user_display_name, principal.user.email_addresses )
$Severity = security_result.severity
match:
$Source_User, $Source_Hostname, $Description ,$Source_IP , $Event_Type, $Severity
outcome:
$Count = count(metadata.id)
$Date = timestamp.get_timestamp(max(metadata.event_timestamp.seconds), "%F %T")
order :
$Date desc, $Count desc
一段時間內成功登入與登入失敗的次數
(metadata.product_event_type = "4625" OR metadata.product_event_type = "4624")
$Action = security_result.action
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
match:
$Action, $Date
outcome:
$Count = count(metadata.id)
Order:
$Date asc
刪除使用者帳戶
(metadata.event_type = "USER_DELETION" OR metadata.product_event_type = "4726")
$Action = security_result.action
$Source_IP = strings.coalesce(principal.ip,principal.asset.ip)
$Hostname = strings.coalesce(principal.hostname,principal.asset.hostname, principal.asset.asset_id,intermediary.hostname)
$Source_User = strings.coalesce(principal.user.userid, principal.user.user_display_name, principal.user.email_addresses)
$Target_User = strings.coalesce(target.user.userid, target.user.user_display_name, target.user.email_addresses)
match:
$Source_IP, $Hostname, $Source_User, $Target_User,$Action
outcome :
$Count = count(metadata.id)
$Date = timestamp.get_timestamp(max(metadata.event_timestamp.seconds), "%F %T")
order:
$Date desc
登入失敗次數前 10 名的使用者帳戶
metadata.product_event_type = "4625"
$User = strings.coalesce(principal.user.userid, principal.user.user_display_name, principal.user.email_addresses, target.user.userid, target.user.user_display_name, target.user.email_addresses)
$Hostname = strings.coalesce(principal.hostname, principal.asset.hostname, intermediary.hostname, target.hostname, target.asset.hostname)
match:
$User, $Hostname
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
依主機分類的快訊分布情形 (Defender ATP)
metadata.product_event_type = "DeviceAlertEvents"
$Hostname = strings.coalesce(principal.hostname, principal.asset.hostname, target.hostname, target.asset.hostname)
match:
$Hostname
outcome:
$Critical = sum(if(security_result.severity = "CRITICAL", 1, 0))
$High = sum(if(security_result.severity = "HIGH", 1, 0))
$Medium = sum(if(security_result.severity = "MEDIUM", 1, 0))
$Low = sum(if(security_result.severity = "LOW", 1, 0))
$Information = sum(if(security_result.severity = "INFORMATIONAL", 1, 0))
$Error = sum(if(security_result.severity = "ERROR", 1, 0))
$Unknown_Severity = sum(if(security_result.severity = "UNKNOWN_SEVERITY", 1, 0))
$Count = count(security_result.severity)
order :
$Count desc
Windows Defender ATP 威脅
metadata.product_event_type = "DeviceAlertEvents"
$Threat_Name = security_result.threat_name
$Threat_Category = security_result.category_details
$Threat_Summary = security_result.summary
$Threat_Severity = security_result.severity
$Threat_Action = security_result.action
$Hostname = strings.coalesce(principal.hostname, principal.asset.hostname, target.hostname, target.asset.hostname)
$Threat_Name != ""
match:
$Threat_Name, $Threat_Category, $Threat_Severity, $Threat_Action, $Hostname, $Threat_Summary
outcome:
$Count = count(metadata.id)
order :
$Count desc
威脅動作分配
security_result.threat_name != ""
$Action = security_result.action
match:
$Action
outcome:
$Count = count(metadata.id)
已清除安全性事件記錄
(metadata.product_event_type = "104" OR metadata.product_event_type = "1102" )
$Description = strings.coalesce(metadata.description,security_result.description,security_result.summary)
$Source_Hostname = strings.coalesce(principal.hostname, principal.asset.hostname)
$Severity = security_result.severity
match:
$Source_Hostname, $Description, $Severity
outcome:
$Count = count(metadata.id)
$Date = timestamp.get_timestamp(max(metadata.event_timestamp.seconds), "%F %T")
order :
$Count desc
端點保護狀態 (Defender 防毒軟體)
(metadata.product_event_type = "MALWAREPROTECTION_RTP_DISABLED" OR metadata.product_event_type = "MALWAREPROTECTION_RTP_ENABLED")
$Event_Type = metadata.product_event_type
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
match:
$Date, $Event_Type
outcome:
$Count = count(metadata.id)
order :
$Date asc
一段時間內的帳戶建立和刪除次數
(metadata.event_type = "USER_CREATION" OR metadata.event_type = "USER_DELETION" OR metadata.product_event_type = "4726" OR metadata.product_event_type = "4720")
$Event_Type = metadata.event_type
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
match:
$Event_Type, $Date
outcome:
$Count = count(metadata.id)
order:
$Date asc
近期稽核政策異動
metadata.product_event_type= "4719"
$Description = metadata.description
$Hostname = strings.coalesce(principal.hostname, principal.asset.hostname)
$User = strings.coalesce(principal.user.userid, principal.user.user_display_name, principal.user.email_addresses)
$Source_Domain = principal.administrative_domain
$Category = extracted.fields["AuditPolicyChanges"]
$Changes = extracted.fields["Changes"]
$Severity = security_result.severity
match:
$User, $Source_Domain, $Hostname, $Description,$Severity, $Category, $Changes
outcome:
$Count = count(metadata.id)
$Date = timestamp.get_timestamp(max(metadata.event_timestamp.seconds), "%F %T")
order:
$Severity desc, $Count desc
過去一段時間的威脅偵測
$Threat_Name = security_result.threat_name
$Threat_Name != ""
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
match:
$Threat_Name, $Date
outcome:
$Count = count(metadata.id)
order:
$Date asc
帳戶無法登入摘要
metadata.product_event_type = "4740"
$User = strings.coalesce(principal.user.userid, principal.user.user_display_name, principal.user.email_addresses, target.user.userid, target.user.user_display_name, target.user.email_addresses)
$Hostname = strings.coalesce(principal.hostname, principal.asset.hostname)
match:
$User, $Hostname
outcome:
$Date = timestamp.get_timestamp(max(metadata.event_timestamp.seconds))
$Count = count(metadata.id)
order:
$Count desc
特殊權限群組修改
(metadata.product_event_type = "4728" OR metadata.product_event_type = "4729" OR metadata.product_event_type = "4730" OR metadata.product_event_type = "4731" OR metadata.product_event_type = "4732" OR metadata.product_event_type = "4733")
$Event_Type = metadata.event_type
$Description = metadata.description
$Source_User = strings.coalesce(principal.user.userid, principal.user.user_display_name, principal.user.email_addresses)
$Target_User = strings.coalesce(target.user.userid, target.user.user_display_name, target.user.email_addresses)
$Target_Domain_Group = target.group.group_display_name
$Severity = security_result.severity
$Summary = additional.fields["Message"]
match:
$Source_User, $Target_User, $Target_Domain_Group, $Event_Type, $Description, $Severity, $Summary
outcome:
$Count = count(metadata.id)
$Date = timestamp.get_timestamp(max(metadata.event_timestamp.seconds), "%F %T")
order:
$Severity desc, $Count desc
最近安裝的服務
metadata.product_event_type = "7045"
$Description = metadata.description
$User = strings.coalesce(principal.user.userid, principal.user.user_display_name, principal.user.email_addresses)
$Hostname = strings.coalesce(principal.hostname, principal.asset.hostname)
$Service_Name = extracted.fields["ServiceName"]
$Service_Filepath = target.process.file.full_path
$Service_Account = extracted.fields["ServiceAccount"]
$Service_Type = additional.fields["ServiceType"]
$Service_StartType = extracted.fields["ServiceStartType"]
$Severity = security_result.severity
match:
$User, $Hostname, $Description, $Service_Name, $Service_Filepath, $Service_Account, $Service_Type, $Service_StartType, $Severity
outcome:
$Count = count(metadata.id)
$Date = timestamp.get_timestamp(max(metadata.event_timestamp.seconds), "%F %T")
order:
$Severity desc, $Count desc
威脅偵測摘要
$Threat_Name = security_result.threat_name
$Threat_Name != ""
$Log_Type = metadata.log_type
$Event_Type = metadata.product_event_type
$Action = security_result.action
$Severity = security_result.severity
$Description = strings.coalesce(metadata.description, security_result.description, security_result.summary)
$Source_Hostname = strings.coalesce(principal.hostname, principal.asset.hostname)
$File_Path = strings.coalesce(target.file.full_path, target.registry.registry_key, principal.process.file.full_path)
match:
$Log_Type, $Description, $Threat_Name, $Event_Type, $Source_Hostname, $File_Path, $Action, $Severity
outcome:
$Count = count(metadata.id)
$Date = timestamp.get_timestamp(max(metadata.event_timestamp.seconds), "%F %T")
order:
$Date desc,$Count desc
前 10 大威脅檔案路徑
security_result.action = "ALLOW" OR security_result.action = "ALLOW_WITH_MODIFICATION" OR security_result.action = "UNKNOWN_ACTION"
security_result.threat_name != ""
$Severity = security_result.severity
$File_Path = strings.coalesce(target.file.full_path, target.registry.registry_key, principal.process.file.full_path)
match:
$File_Path, $Severity
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
端點防護摘要 (Defender 防毒軟體)
(metadata.product_event_type = "MALWAREPROTECTION_RTP_DISABLED" OR metadata.product_event_type = "MALWAREPROTECTION_RTP_ENABLED")
$Description = strings.coalesce(metadata.description, security_result.description, security_result.summary)
$Severity = security_result.severity
$Action = security_result.action
$Hostname = strings.coalesce(principal.hostname, principal.asset.hostname, target.hostname, target.asset.hostname)
$Source_User = strings.coalesce(principal.user.user_display_name, principal.user.userid, principal.user.email_addresses)
$Version = metadata.product_version
match:
$Description, $Hostname, $Source_User, $Severity, $Action, $Version
outcome:
$Count = count(metadata.id)
$Date = timestamp.get_timestamp(max(metadata.event_timestamp.seconds), "%F %T")
order :
$Count desc, $Date desc
登入類型分布情形
metadata.product_event_type = "4624"
$Logon_type = extensions.auth.mechanism
match:
$Logon_type
outcome:
$Count = count(metadata.id)
伺服器上產生的程序 (Windows Sysmon)
metadata.product_event_type = "1"
$Hostname = strings.coalesce(principal.hostname, principal.asset.hostname)
$User = strings.coalesce(principal.user.userid, principal.user.user_display_name, principal.user.email_addresses)
$Severity = security_result.severity
$Description = security_result.summary
$Principal_Process_Path = principal.process.file.full_path
$Target_Process_Path = target.process.file.full_path
match :
$Hostname, $User, $Severity, $Principal_Process_Path, $Target_Process_Path
outcome:
$Count = count(metadata.id)
order:
$Count desc
遠端登入國家/地區數
metadata.event_type = "USER_LOGIN"
metadata.product_event_type = "4624"
extensions.auth.mechanism = "REMOTE_INTERACTIVE"
$Logon = extensions.auth.mechanism
$Logon_type = extensions.auth.auth_details
$Source_IP = strings.coalesce(principal.ip, principal.asset.ip)
$Source_Hostname = strings.coalesce(principal.hostname, principal.asset.hostname)
$Source_User = strings.coalesce(principal.user.userid, principal.user.user_display_name, principal.user.email_addresses )
match:
$Source_User, $Source_IP, $Source_Hostname, $Logon, $Logon_type
outcome:
$Country = array_distinct(principal.ip_geo_artifact.location.country_or_region)
$Date = timestamp.get_timestamp(max(metadata.event_timestamp.seconds), "%F %T")
$Count = count(metadata.id)
order:
$Date desc
防毒軟體版本分布 (Defender Antivirus)
$Anti_Virus_Version = metadata.product_version
match:
$Anti_Virus_Version
outcome:
$Count = count_distinct(principal.hostname)
limit:
50
建立使用者帳戶
(metadata.event_type = "USER_CREATION" OR metadata.product_event_type = "4720")
$Source_IP = strings.coalesce(principal.ip,principal.asset.ip)
$Hostname = strings.coalesce(principal.hostname,principal.asset.hostname, principal.asset.asset_id,intermediary.hostname)
$Source_User = strings.coalesce(principal.user.userid, principal.user.user_display_name, principal.user.email_addresses)
$Target_User = strings.coalesce(target.user.userid, target.user.user_display_name, target.user.email_addresses)
$Action = security_result.action
match:
$Source_IP, $Hostname, $Source_User, $Target_User,$Action
outcome :
$Count = count(metadata.id)
$Date = timestamp.get_timestamp(max(metadata.event_timestamp.seconds), "%F %T")
order:
$Date desc
無線網路安全
這個資訊主頁可深入瞭解網路活動和安全性，包括驗證分配情形、登入失敗次數、偵測到的未經授權 AP，以及用戶端連線行為。有助於依嚴重程度追蹤安全事件、識別可疑 ID，以及提升網路效能，主動管理風險。
注意： 套用篩選條件，即可在資訊主頁上顯示相關結果。
偵測流氓存取點
前 10 大驗證類型 (依動作)
依來源 MAC 位址列出的前 10 大 SSID(Cisco Meraki)
依來源 MAC 位址排序的前 10 個存取點
依動作劃分的前 10 大事件類型
驗證失敗次數前 10 名的 MAC 位址
最近驗證失敗 (過去 24 小時)
來源裝置總數
前 10 大說明
在流氓存取點上偵測到的前 10 個用戶端 IP
驗證類型分布
偵測到 Ad-Hoc 網路活動 (CISCO MERAKI)
可疑的無線活動
驗證失敗的 SSID(Cisco Meraki)
嚴重程度分布
偵測到的流氓存取點數量
來源地理位置總覽
圖表名稱
查詢示例
偵測流氓存取點
$Rogue = strings.coalesce(
if (extracted.fields["description"] = /Rogue|AP Detection|Spoof/ nocase, extracted.fields["description"], ""),
if (security_result.description = /Rogue|AP Detection|Spoof/ nocase, security_result.description, ""),
if (security_result.summary = /Rogue|AP Detection|Spoof/ nocase, security_result.summary, ""),
if (metadata.description = /Rogue|AP Detection|Spoof/ nocase, metadata.description,""))
$Rogue != ""
$Source_MAC = strings.coalesce(principal.mac, principal.asset.mac)
$ID = strings.coalesce(extracted.fields["ssid"], principal.resource.name)
$Description = strings.coalesce(metadata.description, security_result.summary)
$Source_IP= strings.coalesce(principal.ip, principal.asset.ip,extracted.fields["clientIp"])
$Log_Source = metadata.log_type
$Severity = security_result.severity
$Action = security_result.action
$Target_MAC = strings.coalesce(target.mac, target.asset.mac)
match:
$Log_Source, $Description,$Source_MAC, $Source_IP, $ID, $Target_MAC,$Severity,$Action
outcome:
$Count = count(metadata.id)
$Date = timestamp.get_timestamp(max(metadata.event_timestamp.seconds), "%F %T")
order :
$Severity desc,$Date desc
前 10 大驗證類型 (依動作)
metadata.event_type = "USER_LOGIN"
$Logon_type = extensions.auth.type
$Action = security_result.action
match:
$Action,$Logon_type
outcome:
$Count = count(metadata.id)
order :
$Count desc
limit:
10
依來源 MAC 位址列出的前 10 大 SSID(Cisco Meraki)
$SSID = extracted.fields["ssid"]
$Log_Type = metadata.log_type
$SSID != ""
$Action = security_result.action
match:
$SSID, $Action
outcome:
$Count = count_distinct(strings.coalesce(principal.mac, principal.asset.mac))
order:
$Count desc
limit:
10
依來源 MAC 位址排序的前 10 個存取點
$Access_Point = strings.coalesce(target.hostname, target.asset.hostname, principal.user.company_name, observer.hostname,intermediary.hostname)
$Log_Type = metadata.log_type
match:
$Access_Point, $Log_Type
outcome:
$Count = count_distinct(strings.coalesce(principal.mac, principal.asset.mac))
order :
$Count desc
limit :
10
依動作劃分的前 10 大事件類型
$Event_Type = metadata.event_type
$Action = security_result.action
match:
$Event_Type,$Action
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
驗證失敗次數前 10 名的 MAC 位址
$Authentication_Failed = strings.coalesce(
if (extracted.fields["description"] = /authentication failed/ nocase, extracted.fields["description"], ""),
if (security_result.description = /failed to connect/ nocase, security_result.description, ""),
if (security_result.summary = /Failed Authentication|authentication failed/ nocase, security_result.summary, ""),
if (metadata.description = /Authentication failed|verification failed/ nocase, metadata.description,""))
($Authentication_Failed != "" OR (metadata.event_type= "USER_LOGIN" AND security_result.action ="BLOCK"))
$MAC_Address = strings.coalesce(principal.mac, principal.asset.mac, target.mac, target.asset.mac)
$Severity = security_result.severity
match:
$MAC_Address, $Severity
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
最近驗證失敗 (過去 24 小時)
$Authentication_Failed = strings.coalesce(
if (extracted.fields["description"] = /authentication failed/ nocase, extracted.fields["description"], ""),
if (security_result.description = /failed to connect/ nocase, security_result.description, ""),
if (security_result.summary = /Failed Authentication|authentication failed/ nocase, security_result.summary, ""),
if (metadata.description = /Authentication failed|verification failed/ nocase, metadata.description, ""))
($Authentication_Failed != "" OR (metadata.event_type= "USER_LOGIN" AND security_result.action ="BLOCK"))
$Log_Source = metadata.log_type
$Source_MAC = strings.coalesce(principal.mac, principal.asset.mac)
$Source_IP = strings.coalesce(principal.ip, principal.asset.ip,extracted.fields["clientIp"])
$Severity = security_result.severity
$Action = security_result.action
$Security_Event_Type = metadata.product_event_type
$Target_MAC = strings.coalesce(target.mac, target.asset.mac)
$Description = strings.coalesce(metadata.description,extracted.fields["description"], security_result.description,security_result.summary)
$Access_Point = strings.coalesce(target.hostname, target.asset.hostname, principal.user.company_name, observer.hostname,intermediary.hostname)
match:
$Log_Source,$Description, $Source_MAC, $Source_IP, $Access_Point, $Target_MAC, $Action, $Severity
outcome:
$Count = count(metadata.id)
$Date = timestamp.get_timestamp(max(metadata.event_timestamp.seconds), "%F %T")
order :
$Date desc, $Severity desc
來源裝置總數
outcome:
$Count = count_distinct(strings.coalesce(principal.mac, principal.asset.mac))
前 10 大說明
$Description = strings.coalesce(metadata.description,security_result.description,security_result.summary,extracted.fields["description"])
$Log_Type = metadata.log_type
$Description != ""
match:
$Log_Type, $Description
outcome :
$Count = count(metadata.id)
order :
$Count desc
limit:
10
在流氓存取點上偵測到的前 10 個用戶端 IP
$Rogue = strings.coalesce(
if (extracted.fields["description"] = /Rogue|AP Detection|Spoof/ nocase, extracted.fields["description"], ""),
if (security_result.description = /Rogue|AP Detection|Spoof/ nocase, security_result.description, ""),
if (security_result.summary = /Rogue|AP Detection|Spoof/ nocase, security_result.summary, ""),
if (metadata.description = /Rogue|AP Detection|Spoof/ nocase, metadata.description,""))
$Rogue != ""
$Client_IP = strings.coalesce(principal.ip,principal.asset.ip,extracted.fields["clientIp"])
$Action = security_result.action
match:
$Client_IP, $Action
outcome:
$Count = count(metadata.id)
order :
$Count desc
limit :
10
驗證類型分布
$Logon_type = extensions.auth.type
match:
$Logon_type
outcome:
$Count = count(metadata.id)
偵測到 Ad-Hoc 網路活動 (CISCO MERAKI)
extracted.fields["type"] = "adhoc_network_detected"
$Detection_Type = extracted.fields["type"]
$SSID = extracted.fields["ssid"]
$SSID != ""
$Source_IP = extracted.fields["clientIp"]
$Source_MAC = strings.coalesce(principal.mac, principal.asset.mac)
$Category = security_result.category
$Security_Description = security_result.description
match:
$Security_Description, $Detection_Type, $SSID, $Source_MAC, $Source_IP, $Category
outcome:
$Count = count(metadata.id)
$Date = timestamp.get_timestamp(max(metadata.event_timestamp.seconds), "%F %T")
order :
$Count desc
可疑的無線活動
(security_result.category = "NETWORK_MALICIOUS" OR security_result.category = "NETWORK_SUSPICIOUS" OR security_result.category = "NETWORK_CATEGORIZED_CONTENT" OR security_result.category = "NETWORK_COMMAND_AND_CONTROL" OR security_result.category = "NETWORK_DENIAL_OF_SERVICE" OR security_result.category = "NETWORK_RECON" OR security_result.category = "AUTH_VIOLATION")
$Log_Source = metadata.log_type
$Source_MAC = strings.coalesce(principal.mac, principal.asset.mac)
$ID = strings.coalesce(extracted.fields["ssid"], principal.resource.name)
$Source_IP = strings.coalesce(principal.ip, principal.asset.ip,extracted.fields["clientIp"])
$Severity = security_result.severity
$Action = security_result.action
$Target_MAC = strings.coalesce(target.mac, target.asset.mac)
$Description = strings.coalesce(metadata.description,extracted.fields["description"], security_result.description,security_result.summary)
match:
$Log_Source, $Description, $Source_IP, $Source_MAC, $ID, $Target_MAC , $Severity, $Action
outcome:
$Count = count(metadata.id)
$Date = timestamp.get_timestamp(max(metadata.event_timestamp.seconds), "%F %T")
order :
$Severity desc,$Date desc
驗證失敗的 SSID(Cisco Meraki)
$Authentication_Failed = strings.coalesce(
if (extracted.fields["description"] = /authentication failed/ nocase, extracted.fields["description"], ""),
if (security_result.description = /failed to connect/ nocase,security_result.description, ""),
if (security_result.summary = /Failed Authentication/ nocase, security_result.summary, ""),
if (metadata.description = /Authentication failed|verification failed/ nocase, metadata.description,""))
($Authentication_Failed != "" OR (metadata.event_type= "USER_LOGIN" AND security_result.action ="BLOCK"))
$SSID = extracted.fields["ssid"]
$Source_IP = extracted.fields["clientIp"]
$SSID != ""
$Source_MAC = strings.coalesce(principal.mac, principal.asset.mac)
$Access_Point = strings.coalesce(target.hostname, target.asset.hostname, principal.user.company_name, observer.hostname,intermediary.hostname)
$AP_Model = target.asset.hardware.model
$Target_Url = target.url
$Source_Hostname = principal.hostname
$Resource_Name = principal.resource.name
match:
$SSID, $Source_MAC, $Source_IP, $Access_Point, $AP_Model, $Target_Url, $Source_Hostname, $Resource_Name
outcome:
$Count = count(metadata.id)
$Date = timestamp.get_timestamp(max(metadata.event_timestamp.seconds), "%F %T")
order :
$Count desc
嚴重程度分布
$Severity = security_result.severity
match:
$Severity
outcome:
$Count = count(metadata.id)
偵測到的流氓存取點數量
$Rogue = strings.coalesce(
if (extracted.fields["description"] = /Rogue|AP Detection|Spoof/ nocase, extracted.fields["description"], ""),
if (security_result.description = /Rogue|AP Detection|Spoof/ nocase, security_result.description, ""),
if (security_result.summary = /Rogue|AP Detection|Spoof/ nocase, security_result.summary, ""),
if (metadata.description = /Rogue|AP Detection|Spoof/ nocase, metadata.description,""))
$Rogue != ""
outcome:
$Count = count_distinct(strings.coalesce(target.hostname, target.asset.hostname, principal.user.company_name, observer.hostname,intermediary.hostname))
來源地理位置總覽
$Country = strings.coalesce(principal.location.country_or_region, principal.ip_geo_artifact.location.country_or_region)
$Country != ""
match:
$Country
outcome:
$Count = count(metadata.id)
$Latitude = max(principal.location.region_latitude)
$Longitude = max(principal.location.region_longitude)
order:
$Count desc
還有其他問題嗎？ 向社群成員和 Google SecOps 專業人員尋求答案。
