Executar consultas de UDM
Este documento é destinado a gerentes e analistas do Centro de Operações de Segurança (SOC) que querem monitorar cenários de ameaças e a integridade do sistema usando painéis selecionados, ou seja, painéis predefinidos projetados para visibilidade em vários casos de uso de segurança no Google Security Operations.
Este documento fornece uma coleção de painéis selecionados e as consultas subjacentes para o tipo de fonte UDM .
As tabelas a seguir fornecem uma lista de gráficos e exemplos de consultas para cada painel de controle selecionado. Você pode usar essas consultas no editor de consultas ou como uma base para widgets personalizados.
Para informações sobre como criar e gerenciar painéis, consulte Gerenciar painéis .
Controle de aplicativos
Esse painel fornece insights sobre segurança de aplicativos, ajudando as equipes de segurança a detectar softwares não autorizados e aplicar políticas de uso.
Ela oferece visibilidade sobre comportamentos de risco, tentativas bloqueadas e padrões de atividade incomuns.
Observação : aplique os filtros disponíveis para refinar os dados e mostrar resultados relevantes.
Execuções de aplicativos ao longo do tempo
As 10 principais execuções de aplicativos não aprovadas (modo de auditoria/permissão)
10 principais aplicativos executados em mídia removível
10 principais execuções de aplicativos bloqueadas por motivo
Status das execuções de aplicativos ao longo do tempo
As 10 principais execuções de aplicativos bloqueadas
Aplicativos executados em locais atípicos
10 principais hosts por execução bloqueada
10 principais usuários por execução bloqueada
Execuções bloqueadas por hora
Nome do gráfico
Exemplo de consulta
Execuções de aplicativos ao longo do tempo
metadata.product_event_type = /(execution|application) (allow|block)/ nocase
or security_result.threat_name = /application control/ nocase
$Date = timestamp.get_timestamp(metadata.event_timestamp.seconds, "%F")
match:
$Date
outcome:
$Count = count(metadata.id)
As 10 principais execuções de aplicativos não aprovadas (modo de auditoria/permissão)
metadata.product_event_type != /(execution|application) block/ nocase
metadata.product_event_type = /unapproved/ nocase
$Application = strings.coalesce(about.file.full_path, target.process.file.full_path, additional.fields["fname"])
match:
$Application
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
10 principais aplicativos executados em mídia removível
metadata.product_event_type = /(execution|application) (allow|block)/ nocase
or security_result.threat_name = /application control/ nocase
strings.coalesce(about.file.full_path, target.process.file.full_path, additional.fields["fname"]) = /(^(D|E|F|G):)|\/\/removable|usb/ nocase
$Application = strings.coalesce(about.file.full_path, target.process.file.full_path, additional.fields["fname"])
match:
$Application
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
10 principais execuções de aplicativos bloqueadas por motivo
metadata.product_event_type = /(execution|application) block/ nocase
or security_result.threat_name = /application control/ nocase
security_result.action = "BLOCK"
$Application = strings.coalesce(about.file.full_path, target.process.file.full_path, additional.fields["fname"])
$Reason = strings.coalesce(target.resource.attribute.labels["categoryTupleDescription"], security_result.action_details, metadata.product_event_type)
match:
$Application, $Reason
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
Status das execuções de aplicativos ao longo do tempo
metadata.product_event_type = /(execution|application) (allow|block)/ nocase
or security_result.threat_name = /application control/ nocase
$Action = strings.coalesce(if(security_result.action = "BLOCK", "BLOCK", "ALLOW"), if(metadata.product_event_type = /(execution|application) block/ nocase, "BLOCK", "ALLOW"))
$Date = timestamp.get_timestamp(metadata.event_timestamp.seconds,"%F")
match:
$Action, $Date
outcome:
$Count = count(metadata.id)
order:
$Date desc
As 10 principais execuções de aplicativos bloqueadas
metadata.product_event_type = /(execution|application) block/ nocase
or security_result.threat_name = /application control/ nocase
security_result.action = "BLOCK"
$Application = strings.coalesce(about.file.full_path, target.process.file.full_path, additional.fields["fname"])
match:
$Application
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
Aplicativos executados em locais atípicos
strings.coalesce(about.file.full_path, target.process.file.full_path, additional.fields["fname"]) = /C\:\\(?:Users|Temp|Windows)\\(?:.*\\(?:AppData|Downloads)?|Temp)?/ nocase
$File_Path = strings.coalesce(about.file.full_path, target.process.file.full_path, additional.fields["fname"])
match:
$File_Path
10 principais hosts por execução bloqueada
metadata.product_event_type = /(execution|application) block/ nocase
or security_result.threat_name = /application control/ nocase
security_result.action = "BLOCK"
$Host = strings.coalesce(principal.hostname, principal.asset.hostname, target.hostname)
match:
$Host
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
10 principais usuários por execução bloqueada
metadata.product_event_type = /(execution|application) block/ nocase
or security_result.threat_name = /application control/ nocase
security_result.action = "BLOCK"
$User = strings.coalesce(target.user.userid, target.user.user_display_name, principal.user.userid, principal.user.user_display_name)
match:
$User
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
Execuções bloqueadas por hora
metadata.product_event_type = /(execution|application) block/ nocase
or security_result.threat_name = /application control/ nocase
security_result.action = "BLOCK"
$Hours = timestamp.get_timestamp(metadata.event_timestamp.seconds,"%F %H:00")
match:
$Hours
outcome:
$Count = count(metadata.id)
order:
$Hours desc
Agente de segurança de acesso à nuvem
Esse painel oferece uma visão geral do uso de aplicativos na nuvem, eventos de segurança, ameaças e acesso não autorizado.
Ele monitora os principais alertas, atividades e ações do usuário, além de endereços IP de origem e destino para melhorar a aplicação da política e a resposta a riscos.
Os 10 principais user agents
10 principais aplicativos
10 principais atividades do CASB
10 principais IPs de destino
10 principais nomes de host de destino
Eventos por ação: permitir x bloquear
Distribuição de tipo de autenticação
10 principais alertas de fornecedores
10 principais nomes de host de origem
Distribuição do SO
10 principais usuários
Os 10 principais usuários bloqueados
Eventos ao longo do tempo por tipo de registro
10 principais IPs de origem
10 principais tipos de evento
10 principais URLs
10 principais locais de origem de eventos do CASB
Nome do gráfico
Exemplo de consulta
Os 10 principais user agents
metadata.log_type = /_CASB|SMARTSHEET|CISCO_SDWAN|NETSKOPE_CLIENT|ORACLE_NETSUITE|TAILSCALE/
$User_Agent = network.http.user_agent
$Log_Type = metadata.log_type
match:
$User_Agent, $Log_Type
outcome:
$Count = count(network.http.user_agent)
order:
$Count desc
limit:
10
10 principais aplicativos
metadata.log_type = /_CASB|SMARTSHEET|CISCO_SDWAN|NETSKOPE_CLIENT|ORACLE_NETSUITE|TAILSCALE/
$Application = target.application
$Log_Type = metadata.log_type
$Application != ""
match:
$Application, $Log_Type
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
10 principais atividades do CASB
metadata.log_type = /_CASB|SMARTSHEET|CISCO_SDWAN|NETSKOPE_CLIENT|ORACLE_NETSUITE|TAILSCALE/
$Activity = strings.coalesce(security_result.summary, metadata.description)
$Log_Type = metadata.log_type
$Activity != ""
match:
$Activity, $Log_Type
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
10 principais IPs de destino
metadata.log_type = /_CASB|SMARTSHEET|CISCO_SDWAN|NETSKOPE_CLIENT|ORACLE_NETSUITE|TAILSCALE/
$IP_Address = target.ip
$Log_Type = metadata.log_type
$IP_Address != ""
match:
$IP_Address, $Log_Type
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
10 principais nomes de host de destino
metadata.log_type = /_CASB|SMARTSHEET|CISCO_SDWAN|NETSKOPE_CLIENT|ORACLE_NETSUITE|TAILSCALE/ nocase
$Hostname = target.hostname
$Log_Type = metadata.log_type
match:
$Hostname, $Log_Type
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
Eventos por ação: permitir x bloquear
metadata.log_type = /_CASB|SMARTSHEET|CISCO_SDWAN|NETSKOPE_CLIENT|ORACLE_NETSUITE|TAILSCALE/
security_result.action = "ALLOW"
or security_result.action = "BLOCK"
$Action = security_result.action
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
match:
$Action, $Date
outcome:
$Count = count(security_result.action)
Distribuição de tipo de autenticação
metadata.log_type = /_CASB|SMARTSHEET|CISCO_SDWAN|NETSKOPE_CLIENT|ORACLE_NETSUITE|TAILSCALE/
$Log_Type = metadata.log_type
$Product_Event = metadata.product_event_type
$Authentication = extensions.auth.type
match:
$Log_Type, $Product_Event, $Authentication
outcome:
$Count = count(metadata.id)
10 principais alertas de fornecedores
metadata.log_type = /_CASB|SMARTSHEET|CISCO_SDWAN|NETSKOPE_CLIENT|ORACLE_NETSUITE|TAILSCALE/
$Rule_Name = security_result.rule_name
$Log_Type = metadata.log_type
$Rule_Name != ""
match:
$Rule_Name, $Log_Type
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
10 principais atividades do CASB
metadata.log_type = /_CASB|SMARTSHEET|CISCO_SDWAN|NETSKOPE_CLIENT|ORACLE_NETSUITE|TAILSCALE/ nocase
$Activity = strings.coalesce(security_result.summary, metadata.description)
$Log_Type = metadata.log_type
match:
$Activity, $Log_Type
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
10 principais alertas de fornecedores
metadata.log_type = /_CASB|SMARTSHEET|CISCO_SDWAN|NETSKOPE_CLIENT|ORACLE_NETSUITE|TAILSCALE/ nocase
$Rule_Name = security_result.rule_name
$Log_Type = metadata.log_type
match:
$Rule_Name, $Log_Type
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
10 principais nomes de host de origem
metadata.log_type = /_CASB|SMARTSHEET|CISCO_SDWAN|NETSKOPE_CLIENT|ORACLE_NETSUITE|TAILSCALE/
$Hostname = principal.hostname
$Log_Type = metadata.log_type
$Hostname != ""
match:
$Hostname, $Log_Type
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
Distribuição do SO
metadata.log_type = /_CASB|SMARTSHEET|CISCO_SDWAN|NETSKOPE_CLIENT|ORACLE_NETSUITE|TAILSCALE/ nocase
$Platform = principal.platform
match:
$Platform
outcome:
$Count = count(metadata.id)
order:
$Count desc
10 principais usuários
metadata.log_type = /_CASB|SMARTSHEET|CISCO_SDWAN|NETSKOPE_CLIENT|ORACLE_NETSUITE|TAILSCALE/ nocase
$User = principal.user.userid
$Log_Type = metadata.log_type
match:
$User, $Log_Type
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
10 principais nomes de host de destino
metadata.log_type = /_CASB|SMARTSHEET|CISCO_SDWAN|NETSKOPE_CLIENT|ORACLE_NETSUITE|TAILSCALE/
$Hostname = target.hostname
$Log_Type = metadata.log_type
$Hostname != ""
match:
$Hostname, $Log_Type
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
Os 10 principais usuários bloqueados
metadata.log_type = /_CASB|SMARTSHEET|CISCO_SDWAN|NETSKOPE_CLIENT|ORACLE_NETSUITE|TAILSCALE/ nocase
security_result.action = "BLOCK"
$User = principal.user.userid
$Log_Type = metadata.log_type
match:
$User, $Log_Type
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
Eventos ao longo do tempo por tipo de registro
metadata.log_type = /_CASB|SMARTSHEET|CISCO_SDWAN|NETSKOPE_CLIENT|ORACLE_NETSUITE|TAILSCALE/ nocase
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
$Log_Type = metadata.log_type
match:
$Date, $Log_Type
outcome:
$Count = count(metadata.id)
order:
$Date asc
Os 10 principais user agents
metadata.log_type = /_CASB|SMARTSHEET|CISCO_SDWAN|NETSKOPE_CLIENT|ORACLE_NETSUITE|TAILSCALE/ nocase
$User_Agent = network.http.user_agent
$Log_Type = metadata.log_type
match:
$User_Agent, $Log_Type
outcome:
$Count = count(network.http.user_agent)
order:
$Count desc
limit:
10
Eventos por ação: permitir x bloquear
metadata.log_type = /_CASB|SMARTSHEET|CISCO_SDWAN|NETSKOPE_CLIENT|ORACLE_NETSUITE|TAILSCALE/ nocase
security_result.action = "ALLOW"
or security_result.action = "BLOCK"
$Action = security_result.action
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
match:
$Action, $Date
outcome:
$Count = count(security_result.action)
10 principais aplicativos
metadata.log_type = /_CASB|SMARTSHEET|CISCO_SDWAN|NETSKOPE_CLIENT|ORACLE_NETSUITE|TAILSCALE/ nocase
$Application = target.application
$Log_Type = metadata.log_type
match:
$Application, $Log_Type
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
10 principais IPs de origem
metadata.log_type = /_CASB|SMARTSHEET|CISCO_SDWAN|NETSKOPE_CLIENT|ORACLE_NETSUITE|TAILSCALE/ nocase
$IP_Address = principal.ip
$Log_Type = metadata.log_type
match:
$IP_Address, $Log_Type
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
10 principais IPs de origem
metadata.log_type = /_CASB|SMARTSHEET|CISCO_SDWAN|NETSKOPE_CLIENT|ORACLE_NETSUITE|TAILSCALE/
$IP_Address = principal.ip
$Log_Type = metadata.log_type
$IP_Address != ""
match:
$IP_Address, $Log_Type
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
10 principais tipos de evento
metadata.log_type = /_CASB|SMARTSHEET|CISCO_SDWAN|NETSKOPE_CLIENT|ORACLE_NETSUITE|TAILSCALE/ nocase
$Event_Type = metadata.event_type
$Log_Type = metadata.log_type
match:
$Event_Type, $Log_Type
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
Distribuição do SO
metadata.log_type = /_CASB|SMARTSHEET|CISCO_SDWAN|NETSKOPE_CLIENT|ORACLE_NETSUITE|TAILSCALE/
$Platform = principal.platform
match:
$Platform
outcome:
$Count = count(metadata.id)
order:
$Count desc
10 principais tipos de evento
metadata.log_type = /_CASB|SMARTSHEET|CISCO_SDWAN|NETSKOPE_CLIENT|ORACLE_NETSUITE|TAILSCALE/
$Event_Type = metadata.event_type
$Log_Type = metadata.log_type
match:
$Event_Type, $Log_Type
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
10 principais URLs
metadata.log_type = /_CASB|SMARTSHEET|CISCO_SDWAN|NETSKOPE_CLIENT|ORACLE_NETSUITE|TAILSCALE/
$URL = target.url
$Log_Type = metadata.log_type
$URL != ""
match:
$URL, $Log_Type
outcome:
$Count = count(target.url)
order:
$Count desc
limit:
10
Eventos ao longo do tempo por tipo de registro
metadata.log_type = /_CASB|SMARTSHEET|CISCO_SDWAN|NETSKOPE_CLIENT|ORACLE_NETSUITE|TAILSCALE/
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
$Log_Type = metadata.log_type
match:
$Date, $Log_Type
outcome:
$Count = count(metadata.id)
order:
$Date asc
10 principais locais de origem de eventos do CASB
metadata.log_type = /_CASB|SMARTSHEET|CISCO_SDWAN|NETSKOPE_CLIENT|ORACLE_NETSUITE|TAILSCALE/ nocase
$Country = principal.location.country_or_region
$Latitude = principal.location.region_latitude
$Latitude != 0
$Longitude = principal.location.region_longitude
$Longitude != 0
match:
$Country, $Latitude, $Longitude
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
10 principais locais de origem de eventos do CASB
metadata.log_type = /_CASB|SMARTSHEET|CISCO_SDWAN|NETSKOPE_CLIENT|ORACLE_NETSUITE|TAILSCALE/
$Country = principal.location.country_or_region
$Latitude = principal.location.region_latitude
$Latitude != 0
$Longitude = principal.location.region_longitude
$Longitude != 0
match:
$Country, $Latitude, $Longitude
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
Os 10 principais usuários bloqueados
metadata.log_type = /_CASB|SMARTSHEET|CISCO_SDWAN|NETSKOPE_CLIENT|ORACLE_NETSUITE|TAILSCALE/
security_result.action = "BLOCK"
$User = principal.user.userid
$Log_Type = metadata.log_type
$User != ""
match:
$User, $Log_Type
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
10 principais URLs
metadata.log_type = /_CASB|SMARTSHEET|CISCO_SDWAN|NETSKOPE_CLIENT|ORACLE_NETSUITE|TAILSCALE/ nocase
$URL = target.url
$Log_Type = metadata.log_type
match:
$URL, $Log_Type
outcome:
$Count = count(target.url)
order:
$Count desc
limit:
10
10 principais usuários
metadata.log_type = /_CASB|SMARTSHEET|CISCO_SDWAN|NETSKOPE_CLIENT|ORACLE_NETSUITE|TAILSCALE/
$User = principal.user.userid
$Log_Type = metadata.log_type
$User != ""
match:
$User, $Log_Type
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
Distribuição de tipo de autenticação
metadata.log_type = /_CASB|SMARTSHEET|CISCO_SDWAN|NETSKOPE_CLIENT|ORACLE_NETSUITE|TAILSCALE/ nocase
$Log_Type = metadata.log_type
$Product_Event = metadata.product_event_type
$Authentication = extensions.auth.type
match:
$Log_Type, $Product_Event, $Authentication
outcome:
$Count = count(metadata.id)
10 principais nomes de host de origem
metadata.log_type = /_CASB|SMARTSHEET|CISCO_SDWAN|NETSKOPE_CLIENT|ORACLE_NETSUITE|TAILSCALE/ nocase
$Hostname = principal.hostname
$Log_Type = metadata.log_type
match:
$Hostname, $Log_Type
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
10 principais IPs de destino
metadata.log_type = /_CASB|SMARTSHEET|CISCO_SDWAN|NETSKOPE_CLIENT|ORACLE_NETSUITE|TAILSCALE/ nocase
$IP_Address = target.ip
$Log_Type = metadata.log_type
match:
$IP_Address, $Log_Type
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
Operações do Chrome Enterprise Premium
Este painel oferece uma visão geral da integração do Chrome Enterprise Premium com o Google SecOps. Isso
inclui informações sobre navegadores e perfis gerenciados.
Extensões do navegador transferidas por sideload
Extensões de navegador mais instaladas
Eventos do Chrome
Integridade da telemetria do Chrome
Os 10 principais navegadores gerenciados por versão do Chrome
Os 10 principais navegadores gerenciados por sistema operacional
Organizações de gerenciamento
Extensões de navegador mais usadas
Os 10 principais usuários com mais extensões de navegador instaladas
Extensões do navegador por permissão
Extensões de navegador menos instaladas
Nome do gráfico
Exemplo de consulta
Extensões do navegador transferidas por sideload
metadata.log_type = "CHROME_MANAGEMENT"
metadata.product_event_type = "browserExtensionInstallEvent"
target.resource.attribute.labels["extension_source"] != "CHROME_WEBSTORE"
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
$Source_Store = target.resource.attribute.labels["extension_source"]
$Browser_Extension = target.resource.name
$Browser_Extension_ID = target.resource.product_object_id
match:
$Date, $Source_Store, $Browser_Extension, $Browser_Extension_ID
Extensões de navegador mais instaladas
metadata.log_type = "CHROME_MANAGEMENT"
metadata.product_event_type = "browserExtensionInstallEvent"
target.resource.attribute.labels["extension_action"] = "INSTALL"
$Browser_Extension = target.resource.name
$Browser_Extension_ID = target.resource.product_object_id
$Extension_Version = target.resource.attribute.labels["extension_version"]
$Extension_Source = target.resource.attribute.labels["extension_source"]
match:
$Browser_Extension, $Browser_Extension_ID, $Extension_Version, $Extension_Source
outcome:
$Count = count(metadata.id)
order:
$Count desc
Eventos do Chrome
metadata.log_type = "CHROME_MANAGEMENT"
metadata.product_event_type != ""
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
$Event_Type = metadata.product_event_type
match:
$Date, $Event_Type
outcome:
$Count = count(metadata.id)
Integridade da telemetria do Chrome
metadata.log_type = "CHROME_MANAGEMENT"
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
match:
$Date
outcome:
$Count = count(metadata.id)
order:
$Date desc
Os 10 principais navegadores gerenciados por versão do Chrome
metadata.log_type = "CHROME_MANAGEMENT"
network.http.parsed_user_agent.browser_version != ""
principal.application != ""
$Browser_Version = network.http.parsed_user_agent.browser_version
$Application = principal.application
match:
$Browser_Version, $Application
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
Os 10 principais navegadores gerenciados por sistema operacional
metadata.log_type = "CHROME_MANAGEMENT"
network.http.parsed_user_agent.os != ""
principal.application != ""
$OS = network.http.parsed_user_agent.os
$Application = principal.application
match:
$OS, $Application
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
Organizações de gerenciamento
metadata.log_type = "CHROME_MANAGEMENT"
target.domain.name != ""
$Organization = target.domain.name
match:
$Organization
outcome:
$Count = count(principal.user.email_addresses)
order:
$Count desc
Extensões de navegador mais usadas
metadata.log_type = "CHROME_MANAGEMENT"
metadata.product_event_type = "browserExtensionInstallEvent"
target.resource.attribute.labels["extension_action"] = "INSTALL"
or target.resource.attribute.labels["extension_action"] = "UPDATE"
$Browser_Extension = target.resource.name
$Browser_Extension_ID = target.resource.product_object_id
$Extension_Version = target.resource.attribute.labels["extension_version"]
$Extension_Source = target.resource.attribute.labels["extension_source"]
match:
$Browser_Extension, $Browser_Extension_ID, $Extension_Version, $Extension_Source
outcome:
$Total_Unique_Instances = count(metadata.id)
order:
$Total_Unique_Instances desc
Os 10 principais usuários com mais extensões de navegador instaladas
metadata.log_type = "CHROME_MANAGEMENT"
metadata.product_event_type = "browserExtensionInstallEvent"
$User = principal.user.email_addresses
match:
$User
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
Extensões do navegador por permissão
metadata.log_type = "CHROME_MANAGEMENT"
metadata.product_event_type = "extensionTelemetryEvent"
target.resource.name = "COOKIES_GET_ALL_INFO"
or target.resource.name = "COOKIES_GET_INFO"
or target.resource.name = "TABS_API_INFO"
$Browser_Extension = target.resource_ancestors.name
$Browser_Extension_ID = target.resource_ancestors.product_object_id
$Extension_Version = target.resource_ancestors.attribute.labels["extension_version"]
$Extension_Source = target.resource_ancestors.attribute.labels["extension_source"]
$Severity = security_result.severity
match:
$Browser_Extension, $Browser_Extension_ID, $Extension_Version, $Extension_Source, $Severity
outcome:
$Permissions = array_distinct(target.resource.name)
$Count = count(metadata.id)
order:
$Browser_Extension asc
Extensões de navegador menos instaladas
metadata.log_type = "CHROME_MANAGEMENT"
metadata.product_event_type = "browserExtensionInstallEvent"
target.resource.attribute.labels["extension_action"] = "INSTALL"
$Browser_Extension = target.resource.name
$Browser_Extension_ID = target.resource.product_object_id
$Extension_Version = target.resource.attribute.labels["extension_version"]
$Extension_Source = target.resource.attribute.labels["extension_source"]
match:
$Browser_Extension, $Browser_Extension_ID, $Extension_Version, $Extension_Source
outcome:
$Count = count(metadata.id)
order:
$Count asc
Segurança do Chrome Enterprise Premium
Esse painel oferece insights em tempo real sobre eventos de segurança relacionados ao Chrome, como transferências de dados sensíveis, acesso a domínios de alto risco, eventos de proteção de dados, tentativas de malware e phishing e problemas de segurança de senhas. Ele permite que as equipes de segurança monitorem, investiguem e respondam a ameaças baseadas no Chrome.
DLP do Chrome : insights de dados
DLP do Chrome : total de transferências sensíveis na Web
DLP do Chrome : total de impressões de arquivos sensíveis
DLP do Chrome : total de uploads de arquivos sensíveis
Eventos de reutilização de senha
Domínios de alto risco do Chrome
Eventos de violação de senha
Eventos de malware
Acessos a sites não seguros
Eventos de phishing
DLP do Chrome : total de transferências de conteúdo sensível
DLP do Chrome : total de downloads de arquivos sensíveis
DLP do Chrome: usuários com detecções de conteúdo sensível
DLP do Chrome : domínios de conteúdo sensível
Nome do gráfico
Exemplo de consulta
DLP do Chrome : insights de dados
metadata.product_event_type = /sensitiveDataEvent|contentTransferEvent/ nocase
security_result.summary = /CONTENT_MATCHED_SENSITIVE_DATA_TYPES/ nocase or extracted.fields["reason"] = /CONTENT_MATCHED_SENSITIVE_DATA_TYPES/ nocase
$Sensitive_Data_Type = extracted.fields["matched_detectors[0].detector_id"]
$Trigger_Type = security_result.about.labels.value
match:
$Sensitive_Data_Type, $Trigger_Type
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
DLP do Chrome : total de transferências sensíveis na Web
metadata.product_event_type = /Sensitive data transfer|SENSITIVE_DATA_TRANSFER|sensitiveDataEvent|sensitiveDataTransferEvent/ nocase
security_result.about.labels.value = /web_content_upload/ nocase
outcome:
$Sensitive_Web_Transfer = count(metadata.id)
DLP do Chrome : total de impressões de arquivos sensíveis
metadata.product_event_type = /Sensitive data transfer|SENSITIVE_DATA_TRANSFER|sensitiveDataEvent|sensitiveDataTransferEvent/ nocase
security_result.about.labels.value = /print/ nocase
outcome:
$Sensitive_File_Print = count(metadata.id)
DLP do Chrome : total de uploads de arquivos sensíveis
metadata.product_event_type = /Sensitive data transfer|SENSITIVE_DATA_TRANSFER|sensitiveDataEvent|sensitiveDataTransferEvent/ nocase
security_result.about.labels.value = /file_upload/ nocase
outcome:
$Sensitive_File_Upload = count(metadata.id)
Eventos de reutilização de senha
metadata.product_event_type = /PASSWORD_REUSE|passwordReuseEvent/ nocase
$Action = security_result.action_details
$Severity = security_result.severity
$User = strings.coalesce(principal.user.userid , principal.user.user_display_name, principal.user.email_addresses)
$Summary = strings.coalesce(security_result.summary, security_result.description, metadata.product_event_type, security_result.category_details)
$URL = target.url
match:
$User, $Summary, $Severity, $Action, $URL
outcome:
$Date = timestamp.get_timestamp(max(metadata.event_timestamp.seconds), "%F %T")
$Count = count(metadata.id)
order:
$Count desc
Domínios de alto risco do Chrome
extracted.fields["url_info.risk_infos[0].risk_level"] = "HIGH"
target.url != ""
$URL = target.url
$Category = security_result.category
$Action = security_result.action_details
$Severity = principal.security_result.severity
$Risk_Level = extracted.fields["url_info.risk_infos[0].risk_level"]
$Threat_Type = extracted.fields["url_info.risk_infos[0].threat_type"]
$Domain = re.capture(target.url, `^(?:https?:\/\/)?(?:www\.)?([^\/:]+)`)
match:
$URL, $Domain, $Category, $Severity, $Risk_Level, $Threat_Type, $Action
outcome:
$Date = timestamp.get_timestamp(max(metadata.event_timestamp.seconds), "%F %T")
$Count = count(metadata.id)
order:
$Count desc
Eventos de violação de senha
metadata.product_event_type = /passwordBreachEvent/ nocase
$User = strings.coalesce(principal.user.userid, principal.user.user_display_name, principal.user.email_addresses, target.user.userid, target.user.user_display_name, target.user.email_addresses)
$Summary = strings.coalesce(security_result.summary, security_result.description, metadata.product_event_type, security_result.category_details)
$URL = target.url
$Action = security_result.action_details
$Severity = security_result.severity
match:
$User, $Summary, $URL, $Severity, $Action
outcome:
$Date = timestamp.get_timestamp(max(metadata.event_timestamp.seconds), "%F %T")
$Count = count(metadata.id)
order:
$Date desc
Eventos de malware
metadata.product_event_type = /dangerousDownloadEvent|contentTransferEvent/ nocase
(extracted.fields["content_risk[0].risk_level"] = "HIGH" or extracted.fields["content_risk_level"] = "HIGH")
(extracted.fields["content_risk[0].threat_type"] = "MALWARE")
$File_Hash = target.file.sha256
$File_Path = target.file.full_path
$Category = security_result.category
$Severity = security_result.severity
$Risk_Level = strings.coalesce(extracted.fields["content_risk[0].risk_level"],extracted.fields["content_risk_level"])
match:
$File_Path, $File_Hash, $Category, $Severity, $Risk_Level
outcome:
$Date = timestamp.get_timestamp(max(metadata.event_timestamp.seconds), "%F %T")
$Summary = array_distinct(security_result.summary)
$Action = array_distinct(security_result.action_details)
$Count = count(metadata.id)
order:
$Count desc
Acessos a sites não seguros
metadata.product_event_type = /badNavigationEvent/ nocase
(extracted.fields["url_info.risk_infos[0].risk_level"] = "HIGH" OR extracted.fields["url_info.risk_level"] = "HIGH")
//(extracted.fields["content_risk[0].threat_type"] = "MALWARE" or extracted.fields["tab_url_info.threat_type"] = "MALWARE")
$URL = target.url
$Category = security_result.category
$Threat_Type = extracted.fields["url_info.risk_infos[0].threat_type"]
$User = strings.coalesce(principal.user.userid, principal.user.user_display_name, principal.user.email_addresses)
$Risk_Level = strings.coalesce(extracted.fields["url_info.risk_infos[0].risk_level"], extracted.fields["url_info.risk_level"])
match:
$User, $URL, $Category, $Threat_Type, $Risk_Level
outcome:
$Action = array_distinct(security_result.action_details)
$Date = timestamp.get_timestamp(max(metadata.event_timestamp.seconds), "%F %T")
$Count = count(metadata.id)
order:
$Count desc
Eventos de phishing
extracted.fields["url_info.risk_infos[0].threat_type"] = "SOCIAL_ENGINEERING"
$URL = target.url
$Category = security_result.category
$Action = security_result.action_details
$Severity = principal.security_result.severity
$Risk_Level = extracted.fields["url_info.risk_infos[0].risk_level"]
$User = strings.coalesce(principal.user.userid, principal.user.user_display_name, principal.user.email_addresses, target.user.userid, target.user.user_display_name, target.user.email_addresses)
match:
$User, $URL, $Category, $Severity, $Risk_Level, $Action
outcome:
$Date = timestamp.get_timestamp(max(metadata.event_timestamp.seconds), "%F %T")
$Count = count(metadata.id)
order:
$Count desc
DLP do Chrome : total de transferências de conteúdo sensível
metadata.product_event_type = /Sensitive data transfer|SENSITIVE_DATA_TRANSFER|sensitiveDataEvent|sensitiveDataTransferEvent/ nocase
outcome:
$Total_Sensitive_Content_Transfer = count(metadata.id)
DLP do Chrome : total de downloads de arquivos sensíveis
metadata.product_event_type = /Sensitive data transfer|SENSITIVE_DATA_TRANSFER|sensitiveDataEvent|sensitiveDataTransferEvent/ nocase
security_result.about.labels.value = /file_download/ nocase
outcome:
$Sensitive_File_Download = count(metadata.id)
DLP do Chrome: usuários com detecções de conteúdo sensível
metadata.product_event_type = /sensitiveDataEvent/ nocase or security_result.summary = /CONTENT_MATCHED_SENSITIVE_DATA_TYPES/ nocase
$Device_IP = extracted.fields["remote_ip"]
$Device_ID = extracted.fields["device_id"]
$Action = security_result.action_details
$Severity = principal.security_result.severity
$Trigger_Type = security_result.about.labels.value
$Sensitive_Data_Type = extracted.fields["matched_detectors[0].display_name"]
$Device_User = strings.coalesce(extracted.fields["device_user"], extracted.fields["profile_user"])
match:
$Device_User, $Device_IP, $Device_ID, $Trigger_Type, $Sensitive_Data_Type, $Action, $Severity
outcome:
$Date = timestamp.get_timestamp(max(metadata.event_timestamp.seconds), "%F %T")
$Count = count(metadata.id)
order:
$Count desc
DLP do Chrome : domínios de conteúdo sensível
metadata.product_event_type = /Sensitive data transfer|SENSITIVE_DATA_TRANSFER|sensitiveDataEvent|sensitiveDataTransferEvent/ nocase
or security_result.summary = /CONTENT_MATCHED_SENSITIVE_DATA_TYPES/ nocase
target.url != ""
$Domain = target.url
$Action = security_result.action_details
$Severity = security_result.severity
$Sensitive_Data_Type = extracted.fields["matched_detectors[0].display_name"]
match:
$Domain, $Action, $Severity, $Sensitive_Data_Type
outcome:
$Date = timestamp.get_timestamp(max(metadata.event_timestamp.seconds), "%F %T")
$Count = count(metadata.id)
order:
$Count desc
Visão geral da conformidade com os controles do CIS
Esse painel fortalece a governança de segurança ao oferecer visibilidade clara da adesão aos controles de segurança críticos do CIS. Ele rastreia métricas essenciais de conformidade, como precisão do inventário de ativos, progresso da correção de vulnerabilidades, confiabilidade do backup, aplicação do controle de acesso e preparação para resposta a incidentes.
Usuários inativos (mais de 7 dias)
Execuções recentes de aplicativos bloqueados
Resumo da autenticação SSO
Distribuição de eventos do SDI / IPS
Eventos de MFA de contas privilegiadas ao longo do tempo
Os 10 principais sistemas com vulnerabilidades críticas/altas
Eventos de phishing recentes
Algoritmos de criptografia fracos ao longo do tempo
Mudanças de permissão ao longo do tempo
Criações recentes de contas de usuário
Criações de contas de usuário ao longo do tempo
Tendências de sucesso x falha de conexão VPN ao longo do tempo
Detecções de malware ao longo do tempo
Vulnerabilidade alta/crítica por idade
As 10 principais contas de serviço por logins
Detalhes do arquivo de malware
Atividades maliciosas com base em rede
Atividades e modificações de contas privilegiadas
Eventos de login ao longo do tempo por ação
Distribuição de eventos de segurança de dados
Eventos de exclusão e remoção de dados
Verificações de vulnerabilidades ao longo do tempo
Eventos de phishing ao longo do tempo
Eventos de backup recentes
As 10 principais ameaças de e-mail por gravidade
Eventos de backup ao longo do tempo
Total de dispositivos ao longo do tempo
As 10 principais execuções de aplicativos bloqueadas
Tentativas de MFA bloqueadas para contas privilegiadas
Nome do gráfico
Exemplo de consulta
Usuários inativos (mais de 7 dias)
stage inactive_users {
(metadata.event_type = "USER_UNCATEGORIZED"
or metadata.event_type = "USER_LOGIN"
or metadata.event_type = "USER_LOGOUT"
or metadata.event_type = "USER_CREATION"
or metadata.event_type = "USER_CHANGE_PASSWORD"
or metadata.event_type = "USER_CHANGE_PERMISSIONS"
or metadata.event_type = "USER_BADGE_IN"
or metadata.event_type = "USER_DELETION"
or metadata.event_type = "USER_RESOURCE_CREATION"
or metadata.event_type = "USER_RESOURCE_UPDATE_CONTENT"
or metadata.event_type = "USER_RESOURCE_UPDATE_PERMISSIONS"
or metadata.event_type = "USER_COMMUNICATION"
or metadata.event_type = "USER_RESOURCE_ACCESS"
or metadata.event_type = "USER_RESOURCE_DELETION")
principal.user.last_login_time.seconds > 0
$Event_Type = metadata.event_type
$User = strings.coalesce(principal.user.userid, principal.user.user_display_name, principal.user.email_addresses)
$User != ""
$Log_Type = metadata.log_type
match:
$User, $Event_Type, $Log_Type
outcome:
$Logtime = max(metadata.event_timestamp.seconds)
$Lastime = max(principal.user.last_login_time.seconds)
$Time_Difference = cast.as_int(max(metadata.event_timestamp.seconds - principal.user.last_login_time.seconds)/86400)
condition:
$Time_Difference > 7
}
$User = $inactive_users.User
$Event_Type = $inactive_users.Event_Type
$Log_Type = $inactive_users.Log_Type
match:
$User, $Event_Type, $Log_Type
outcome:
$Last_Login = timestamp.get_timestamp(max($inactive_users.Lastime))
$Latest_Login = timestamp.get_timestamp(max($inactive_users.Logtime))
$Time_Difference = max($inactive_users.Time_Difference)
order:
$Time_Difference desc
Execuções recentes de aplicativos bloqueados
(metadata.product_event_type = /(execution|application) block/ nocase or security_result.summary = /(execution|application) block/ or metadata.description = /(execution|application) block/ nocase or security_result.threat_name = /application control/ nocase)
(security_result.action = "BLOCK" or security_result.action_details = /block/ nocase or (target.resource.attribute.labels.key = "categoryBehavior" and target.resource.attribute.labels.value = /blocked/ nocase))
$Application = strings.coalesce(about.file.full_path, target.process.file.full_path, additional.fields["fname"], principal.application, target.application)
$Description = strings.coalesce(target.resource.attribute.labels["categoryTupleDescription"], security_result.summary, metadata.product_event_type, security_result.description, metadata.description, security_result.action_details)
$Log_Type = metadata.log_type
$Severity = security_result.severity
match:
$Application, $Description, $Severity, $Log_Type
outcome:
$Count = count(metadata.id)
$Date = timestamp.get_timestamp(max(metadata.event_timestamp.seconds), "%F %T")
order:
$Count desc
Resumo da autenticação SSO
extensions.auth.type = "SSO"
(metadata.event_type = "USER_LOGIN" or metadata.event_type = "USER_LOGOUT")
$Description = strings.coalesce(security_result.summary, metadata.description, security_result.description, metadata.product_event_type)
$User = strings.coalesce(principal.user.userid, principal.user.user_display_name, principal.user.email_addresses,target.user.userid, target.user.user_display_name, target.user.email_addresses)
$Source_Hostname = strings.coalesce(principal.hostname, principal.asset.hostname)
$Source_IP = strings.coalesce(principal.ip,principal.asset.ip)
$Action = security_result.action
$Severity = security_result.severity
match:
$User, $Description, $Source_Hostname, $Source_IP, $Action, $Severity
outcome:
$Count = count(metadata.id)
$Date = timestamp.get_timestamp(max(metadata.event_timestamp.seconds), "%F %T")
order:
$Severity desc, $Date desc
Distribuição de eventos do SDI / IPS
metadata.log_type = /_IDS|_IPS|AWS_SECURITY_HUB|EXTRAHOP|GUARDDUTY|MICROSOFT_ATA|ORCA|OSSEC|SURICATA_EVE|VMWARE_TANZU/ nocase
(metadata.event_type = "SCAN_UNCATEGORIZED"
or metadata.event_type = "SCAN_NETWORK"
or metadata.event_type = "NETWORK_CONNECTION"
or metadata.event_type = "NETWORK_DHCP"
or metadata.event_type = "NETWORK_DNS"
or metadata.event_type = "NETWORK_FLOW"
or metadata.event_type = "NETWORK_FTP"
or metadata.event_type = "NETWORK_HTTP"
or metadata.event_type = "NETWORK_HTTP"
or metadata.event_type = "NETWORK_SMTP")
$Category = security_result.category
match:
$Category
outcome:
$Count = count(metadata.id)
order:
$Count desc
Eventos de MFA de contas privilegiadas ao longo do tempo
(re.regex(metadata.product_name, "MULTI-FACTOR_AUTHENTICATION") or re.regex(additional.fields["AuthenticationRequirement"], `multiFactorAuthentication`) nocase or re.regex(security_result.detection_fields.value, `MFA`) nocase or re.regex(metadata.product_event_type, `mfa(?:\S)?auth|auth(?:.*)?mfa`) nocase)
$User = strings.coalesce(principal.user.userid, principal.user.user_display_name, principal.user.email_addresses, target.user.userid, target.user.user_display_name,target.user.email_addresses)
$User = /admin|root|administrator|security|support|default/ nocase //It will be updated as per the client's environment.
$Action = security_result.action
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
match:
$Date, $Action
outcome:
$Count = count(metadata.id)
order:
$Date asc
Os 10 principais sistemas com vulnerabilidades críticas/altas
metadata.log_type = /ARMIS_VULNERABILITIES|FINGERPRINT_JS|NUCLEUS_VULNERABILITY|QUALYS_ASSET_CONTEXT|QUALYS_SCAN|QUALYS_VIRTUAL_SCANNER|QUALYS_VM|RAPID7_INSIGHT|RAPID7_NEXPOSE|SNYK_SDLC|SPUR_FEEDS|STACKHAWK|SUBLIMESECURITY|SYMANTEC_SA|TENABLE_IO|TENABLE_OT|TENABLE_SC|UPGUARD|URLSCAN_IO/ nocase
(principal.asset.vulnerabilities.severity = "HIGH" or extensions.vulns.vulnerabilities.severity = "HIGH" or security_result.severity = "HIGH"
or target.asset.vulnerabilities.severity = "HIGH") or (principal.asset.vulnerabilities.severity = "CRITICAL" or extensions.vulns.vulnerabilities.severity = "CRITICAL"
or security_result.severity = "CRITICAL" or target.asset.vulnerabilities.severity = "CRITICAL")
$Severity =
if (principal.asset.vulnerabilities.severity != "UNKNOWN_SEVERITY",
principal.asset.vulnerabilities.severity,
if (target.asset.vulnerabilities.severity != "UNKNOWN_SEVERITY",
target.asset.vulnerabilities.severity,
if (extensions.vulns.vulnerabilities.severity != "UNKNOWN_SEVERITY",
extensions.vulns.vulnerabilities.severity,
"UNKNOWN_SEVERITY")))
$Vulnerability = strings.coalesce(
if(principal.asset.vulnerabilities.name != "" and principal.asset.vulnerabilities.description != "",
strings.concat(principal.asset.vulnerabilities.name, " : ", principal.asset.vulnerabilities.description),
strings.coalesce(principal.asset.vulnerabilities.name, principal.asset.vulnerabilities.description)),
if(additional.fields["ScanReference"] != "" and metadata.description != "",
strings.concat(additional.fields["ScanReference"], " : ", metadata.description),
strings.coalesce(additional.fields["ScanReference"], metadata.description)),
if(extensions.vulns.vulnerabilities.vendor_vulnerability_id != "" and extensions.vulns.vulnerabilities.description != "",
strings.concat(extensions.vulns.vulnerabilities.vendor_vulnerability_id, " : ", extensions.vulns.vulnerabilities.description),
strings.coalesce(extensions.vulns.vulnerabilities.vendor_vulnerability_id, extensions.vulns.vulnerabilities.description)
)
)
($Vulnerability != " : " and $Vulnerability != "")
$Hostname = strings.coalesce(principal.hostname,principal.asset.hostname, target.hostname, target.asset.hostname)
$Log_Type = metadata.log_type
match:
$Hostname, $Vulnerability, $Severity, $Log_Type
outcome:
$Date = timestamp.get_timestamp(max(metadata.event_timestamp.seconds), "%F %T")
$Count = count(strings.coalesce(extensions.vulns.vulnerabilities.name, extensions.vulns.vulnerabilities.description, extensions.vulns.vulnerabilities.vendor_vulnerability_id,
principal.asset.vulnerabilities.name, target.asset.vulnerabilities.name, additional.fields["ScanReference"]))
order:
$Count desc
limit:
10
Eventos de phishing recentes
metadata.log_type = /MAIL|ABNORMAL_SECURITY|AREA1|COFENSE_TRIAGE|FIREEYE|FORCEPOINT|FORTINET|KNOWBE4_PHISHER|MICROSOFT_GRAPH_ALERT|MIMECAST_URL_LOGS|OBSERVEIT|OFFICE_365|PHISHLABS|PROOFPOINT|SYMANTEC_VIP|VOLTAGE|WORKSPACE_ALERTS/ nocase
(security_result.category = "MAIL_PHISHING" or re.regex(security_result.threat_name,`Phish`) nocase or re.regex(security_result.category_details,`Phish`)nocase)
security_result.threat_name != "NOT_PHISHING"
$Security_Event_Type = metadata.product_event_type
$Summary = strings.coalesce(security_result.summary, metadata.description, security_result.description)
$Sender = strings.coalesce(network.email.from, principal.user.email_addresses)
$Subject = network.email.subject
$File_Path = strings.coalesce(target.file.full_path, about.file.full_path, target.file.names)
$File_Type = strings.coalesce(about.file.mime_type, target.file.mime_type)
match:
$Security_Event_Type, $Sender, $Subject, $File_Path, $File_Type, $Summary
outcome:
$Count = count(metadata.id)
$Receiver_Count = count_distinct(strings.coalesce(network.email.to, network.email.reply_to, target.user.email_addresses))
$Date = timestamp.get_timestamp(max(metadata.event_timestamp.seconds), "%F %T")
order:
$Count desc
Algoritmos de criptografia fracos ao longo do tempo
(((target.resource.attribute.labels.key = "keyProperties_type" or target.resource.attribute.labels.key = "requestParameters.keySpec" or target.resource.attribute.labels.key = /key/ nocase) and target.resource.attribute.labels.value = /^(RSA-)|DES|RC4|MD5|SHA1|SHA-1/) or network.tls.cipher = /^(RSA-)|DES|RC4|MD5|SHA1|SHA-1/)
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
$Log_Type = metadata.log_type
match:
$Date, $Log_Type
outcome:
$Count = count(metadata.id)
order:
$Date asc
Mudanças de permissão ao longo do tempo
(metadata.event_type = "RESOURCE_PERMISSIONS_CHANGE" or metadata.event_type = "USER_CHANGE_PERMISSIONS" or metadata.event_type = "USER_RESOURCE_UPDATE_PERMISSIONS")
security_result.action = "ALLOW"
$Log_Type = metadata.log_type
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
match:
$Date, $Log_Type
outcome:
$Count = count(metadata.id)
order:
$Date asc
Criações recentes de contas de usuário
metadata.event_type = "USER_CREATION"
security_result.action = "ALLOW"
$Log_Type = metadata.log_type
$Source_IP = strings.coalesce(principal.ip,principal.asset.ip)
$Source_Hostname = strings.coalesce(principal.hostname, principal.asset.hostname, principal.mac, principal.asset.mac, extracted.fields["access_device.hostname"],
if(target.resource.attribute.labels.key = "Private DnsName",target.resource.attribute.labels.value, ""),
principal.resource.product_object_id, target.resource.product_object_id,
if(security_result.detection_fields.key = "actor_2",security_result.detection_fields.value, "")
)
$Initiator = strings.coalesce(principal.user.userid, principal.user.user_display_name, principal.user.email_addresses)
$User_Created = strings.coalesce(target.user.userid, target.user.user_display_name, target.user.email_addresses)
match:
$Log_Type, $Source_IP, $Source_Hostname, $Initiator, $User_Created
outcome:
$Date = timestamp.get_timestamp(max(metadata.event_timestamp.seconds), "%F %T ")
order:
$Date desc
Criações de contas de usuário ao longo do tempo
metadata.event_type = "USER_CREATION"
security_result.action = "ALLOW"
$Log_Type = metadata.log_type
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
match:
$Date, $Log_Type
outcome:
$Count = count(metadata.id)
order:
$Date asc
Tendências de sucesso x falha de conexão VPN ao longo do tempo
metadata.log_type = /VPN|ZSCALER_ZPA|ZSCALER_DECEPTION|TWINGATE|SYMANTEC_VIP_AUTHHUB/ nocase
$Action = if ((strings.coalesce(security_result.summary, metadata.product_event_type, extracted.fields["connection-attempt-status"]) = /Success|Authenticated/ nocase), "SUCCESS", "FAIL")
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
match:
$Date, $Action
outcome:
$Count = count(metadata.id)
order:
$Count desc
Detecções de malware ao longo do tempo
(metadata.product_event_type = /malware/ nocase or security_result.summary = /malware/ nocase or security_result.category_details = /malware/ nocase or metadata.description = /malware/ nocase or security_result.threat_name = /malware/ nocase or security_result.rule_name = /malware/ nocase or security_result.category = "SOFTWARE_MALICIOUS")
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
$Action = security_result.action
match :
$Date, $Action
outcome:
$Count = count(metadata.id)
order:
$Date asc
Vulnerabilidade alta/crítica por idade
(principal.asset.vulnerabilities.severity = "CRITICAL" or extensions.vulns.vulnerabilities.severity = "CRITICAL"
or security_result.severity = "CRITICAL" or target.asset.vulnerabilities.severity = "CRITICAL") OR
(principal.asset.vulnerabilities.severity = "HIGH" or extensions.vulns.vulnerabilities.severity = "HIGH"
or security_result.severity = "HIGH" or target.asset.vulnerabilities.severity = "HIGH")
(timestamp.as_unix_seconds(additional.fields["first_found"]) > 0 or extensions.vulns.vulnerabilities.first_found.seconds > 0)
$Severity =
if (principal.asset.vulnerabilities.severity != "UNKNOWN_SEVERITY",
principal.asset.vulnerabilities.severity,
if (target.asset.vulnerabilities.severity != "UNKNOWN_SEVERITY",
target.asset.vulnerabilities.severity,
if (extensions.vulns.vulnerabilities.severity != "UNKNOWN_SEVERITY",
extensions.vulns.vulnerabilities.severity,
"UNKNOWN_SEVERITY")))
$Vulnerability = strings.coalesce(
if(principal.asset.vulnerabilities.name != "" and principal.asset.vulnerabilities.description != "",
strings.concat(principal.asset.vulnerabilities.name, " : ", principal.asset.vulnerabilities.description),
strings.coalesce(principal.asset.vulnerabilities.name, principal.asset.vulnerabilities.description)),
if(additional.fields["ScanReference"] != "" and metadata.description != "",
strings.concat(additional.fields["ScanReference"], " : ", metadata.description),
strings.coalesce(additional.fields["ScanReference"], metadata.description)),
if(extensions.vulns.vulnerabilities.vendor_vulnerability_id != "" and extensions.vulns.vulnerabilities.description != "",
strings.concat(extensions.vulns.vulnerabilities.vendor_vulnerability_id, " : ", extensions.vulns.vulnerabilities.description),
strings.coalesce(extensions.vulns.vulnerabilities.vendor_vulnerability_id, extensions.vulns.vulnerabilities.description)
)
)
($Vulnerability != " : " and $Vulnerability != "")
$Log_Type = metadata.log_type
match:
$Vulnerability, $Log_Type, $Severity
outcome:
$Age_Max = max(cast.as_int((metadata.event_timestamp.seconds - if(timestamp.as_unix_seconds(additional.fields["first_found"]) > 0,
timestamp.as_unix_seconds(additional.fields["first_found"]), if(extensions.vulns.vulnerabilities.first_found.seconds > 0,
extensions.vulns.vulnerabilities.first_found.seconds, metadata.event_timestamp.seconds))) / 86400))
$Count = count(strings.coalesce(extensions.vulns.vulnerabilities.name, extensions.vulns.vulnerabilities.description, extensions.vulns.vulnerabilities.vendor_vulnerability_id,
principal.asset.vulnerabilities.name, target.asset.vulnerabilities.name, additional.fields["ScanReference"]))
order:
$Age_Max desc
As 10 principais contas de serviço por logins
metadata.event_type = "USER_LOGIN"
principal.user.account_type = "SERVICE_ACCOUNT_TYPE"
or principal.resource.resource_type = "SERVICE_ACCOUNT"
or principal.user.attribute.roles.type = "SERVICE_ACCOUNT"
or target.user.account_type = "SERVICE_ACCOUNT_TYPE"
or target.resource.resource_type = "SERVICE_ACCOUNT"
or target.user.attribute.roles.type = "SERVICE_ACCOUNT"
or strings.coalesce(principal.resource.type, principal.user.attribute.roles.name, principal.resource.resource_subtype, principal.user.userid, principal.user.user_display_name, principal.user.email_addresses,target.resource.type, target.user.attribute.roles.name, target.resource.resource_subtype, target.user.userid, target.user.user_display_name, target.user.email_addresses) = /(?i)service.*(?:account|^principal$)/ nocase
$Service_Account = strings.coalesce(principal.user.userid, principal.user.user_display_name, principal.user.email_addresses, target.user.userid, target.user.user_display_name, target.user.email_addresses)
$Service_Account != ""
$Action = security_result.action
match:
$Service_Account, $Action
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
Detalhes do arquivo de malware
(metadata.product_event_type = /malware/ nocase or security_result.summary = /malware/ nocase or security_result.category_details = /malware/ nocase or metadata.description = /malware/ nocase or security_result.threat_name = /malware/ nocase or security_result.rule_name = /malware/ nocase or security_result.category = "SOFTWARE_MALICIOUS")
$Source_User = strings.coalesce(principal.user.user_display_name, principal.user.userid, principal.user.email_addresses)
$File_Name = strings.coalesce(target.file.full_path, about.file.full_path)
$File_Name != ""
$File_Type = strings.coalesce(target.file.mime_type, about.file.mime_type)
$Severity = security_result.severity
$Action = security_result.action
match :
$File_Name, $File_Type, $Source_User, $Severity, $Action
outcome:
$Count = count(metadata.id)
$Date = timestamp.get_timestamp(max(metadata.event_timestamp.seconds), "%F %T")
order:
$Count desc
Atividades maliciosas com base em rede
(metadata.event_type = "NETWORK_UNCATEGORIZED"
or metadata.event_type = "NETWORK_FLOW"
or metadata.event_type = "NETWORK_CONNECTION"
or metadata.event_type = "NETWORK_FTP"
or metadata.event_type = "NETWORK_DHCP"
or metadata.event_type = "NETWORK_DNS"
or metadata.event_type = "NETWORK_HTTP"
or metadata.event_type = "NETWORK_SMTP")
(security_result.category = "NETWORK_DENIAL_OF_SERVICE" or security_result.category = "NETWORK_MALICIOUS" or security_result.category = "NETWORK_SUSPICIOUS" or
security_result.category = "SOFTWARE_MALICIOUS" or security_result.category = "SOFTWARE_SUSPICIOUS" or security_result.category = "NETWORK_RECON")
$Log_Type = metadata.log_type
$Category = security_result.category
$Summary = strings.coalesce(security_result.description, security_result.summary, metadata.description, security_result.rule_name, metadata.product_event_type)
$Hostname = strings.coalesce(principal.asset.hostname, principal.hostname, principal.mac, principal.asset.mac, target.hostname, target.asset.hostname, target.mac, target.asset.mac,
target.resource.product_object_id, principal.group.product_object_id, principal.ip, principal.asset.ip, target.ip, target.asset.ip)
$Action = security_result.action
match:
$Summary, $Category, $Hostname, $Log_Type, $Action
outcome:
$Count = count(metadata.id)
$Date = timestamp.get_timestamp(max(metadata.event_timestamp.seconds), "%F %T")
order:
$Count desc
Atividades e modificações de contas privilegiadas
metadata.event_type = "GROUP_CREATION" or metadata.event_type = "GROUP_MODIFICATION" or metadata.event_type = "GROUP_DELETION" or metadata.event_type = "USER_LOGIN" or metadata.product_event_type = /(RemoveUserFrom|AddUserTo|Add member to |Remove member from )|(?:group)/ nocase
$User = strings.coalesce(principal.user.userid, principal.user.user_display_name, principal.user.email_addresses, target.user.userid,target.user.user_display_name,target.user.email_addresses)
($User = /admin|root|svc|adm|privilege/ nocase or principal.user.attribute.roles.type = "SERVICE_ACCOUNT" or principal.user.attribute.roles.type = "ADMINISTRATOR" or principal.user.account_type = "DOMAIN_ACCOUNT_TYPE" or principal.user.account_type = "SERVICE_ACCOUNT_TYPE")
$Event_Type = metadata.event_type
$Source_IP = strings.coalesce(principal.ip, principal.asset.ip, principal.hostname, principal.asset.hostname, principal.mac)
$Target_Resource = strings.coalesce(target.resource.name, target.file.full_path, target.resource.product_object_id, target.group.product_object_id, target.user.group_identifiers, target.group.group_display_name)
$Target_Resourcetype = target.resource.resource_type
$Action = security_result.action
$Security_Event_Type = metadata.product_event_type
$Summary = strings.coalesce(additional.fields["Message"], security_result.summary, security_result.description, metadata.description)
match:
$Event_Type, $User,$Source_IP, $Target_Resource, $Action, $Security_Event_Type, $Summary
outcome:
$Count = count(metadata.id)
$Date = timestamp.get_timestamp(max(metadata.event_timestamp.seconds), "%F %H:%M:%S")
order:
$Count desc
Eventos de login ao longo do tempo por ação
metadata.event_type = "USER_LOGIN"
$Action = security_result.action
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
match:
$Date, $Action
outcome:
$Count = count(metadata.id)
order:
$Date asc
Distribuição de eventos de segurança de dados
metadata.log_type = /ARUBA_CENTRAL|CLOUDFLARE_WARP|DELL_CYBERSENSE|FORGEROCK_OPENIDM|IMPERVA_DRA|IMPERVA_SECURESPHERE|IBM_OPENPAGES|INTEL471_WATCHER_ALERTS|METABASE|OKERA_DAP|OPENCANARY|RUBRIK_POLARIS|SENTRY|TINES|TINTRI|VARONIS/ nocase
$Event_Type = metadata.event_type
match:
$Event_Type
outcome:
$Count = count(metadata.id)
order:
$Count desc
Eventos de exclusão e remoção de dados
(metadata.event_type = "FILE_DELETION"
or metadata.event_type = "RESOURCE_DELETION"
or metadata.event_type = "SYSTEM_AUDIT_LOG_WIPE"
or metadata.event_type = "REGISTRY_DELETION"
or metadata.event_type = "SETTING_DELETION"
or metadata.event_type = "USER_RESOURCE_DELETION"
or metadata.event_type = "GROUP_DELETION"
or metadata.event_type = "SERVICE_DELETION"
or metadata.event_type = "SCHEDULED_TASK_DELETION"
or strings.coalesce(metadata.product_event_type, security_result.summary, security_result.description, security_result.action_details) = /delet(?:e|ed|ion|ing)|purge/ nocase)
security_result.action = "ALLOW"
$Description = strings.coalesce(security_result.summary, security_result.description, metadata.description, security_result.action_details)
$Product_Event_Type = metadata.product_event_type
$Event_Type = metadata.event_type
$Log_Type = metadata.log_type
$Target_Resource = strings.coalesce(target.resource.name, target.file.full_path, target.resource.product_object_id, target.group.product_object_id, target.user.group_identifiers)
$User = strings.coalesce(principal.user.user_display_name, principal.user.userid, principal.user.email_addresses, target.user.userid,target.user.user_display_name,target.user.email_addresses)
match:
$User, $Log_Type, $Description, $Product_Event_Type, $Event_Type, $Target_Resource
outcome:
$Date = timestamp.get_timestamp(max(metadata.event_timestamp.seconds), "%F %T")
$Count = count(metadata.id)
order:
$Date desc, $Count desc
Verificações de vulnerabilidades ao longo do tempo
metadata.log_type = /ARMIS_VULNERABILITIES|FINGERPRINT_JS|NUCLEUS_VULNERABILITY|QUALYS_ASSET_CONTEXT|QUALYS_SCAN|QUALYS_VIRTUAL_SCANNER|QUALYS_VM|RAPID7_INSIGHT|RAPID7_NEXPOSE|SNYK_SDLC|SPUR_FEEDS|STACKHAWK|SUBLIMESECURITY|SYMANTEC_SA|TENABLE_IO|TENABLE_OT|TENABLE_SC|UPGUARD|URLSCAN_IO/ nocase
(metadata.event_type = "SCAN_VULN_HOST" or additional.fields["Type"] = "Scan" or security_result.detection_fields.key = /scan/ nocase or security_result.detection_fields.value = /scan/ nocase)
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
$Log_Type = metadata.log_type
match:
$Log_Type, $Date
outcome:
$Count = count(metadata.id)
order:
$Date asc
Eventos de phishing ao longo do tempo
metadata.log_type = /MAIL|ABNORMAL_SECURITY|AREA1|COFENSE_TRIAGE|FIREEYE|FORCEPOINT|FORTINET|KNOWBE4_PHISHER|MICROSOFT_GRAPH_ALERT|MIMECAST_URL_LOGS|OBSERVEIT|OFFICE_365|PHISHLABS|PROOFPOINT|SYMANTEC_VIP|VOLTAGE|WORKSPACE_ALERTS/ nocase
(security_result.category = "MAIL_PHISHING" or re.regex(security_result.threat_name,`Phish`) nocase or re.regex(security_result.category_details,`Phish`)nocase)
security_result.threat_name != "NOT_PHISHING"
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
$Severity = security_result.severity
match:
$Date, $Severity
outcome:
$Count = count(metadata.id)
order:
$Date asc
Eventos de backup recentes
(metadata.log_type = /COHESITY|DRUVA_BACKUP|VEEAM|VERITAS_NETBACKUP/ nocase or metadata.log_type = "RUBRIK")
$Description = strings.coalesce(metadata.description, security_result.description, security_result.summary)
$Log_Type = metadata.log_type
$Event_Type = metadata.event_type
$Security_Event_Type = metadata.product_event_type
$Action = security_result.action
match:
$Description, $Security_Event_Type, $Event_Type, $Action, $Log_Type
outcome:
$Count = count(metadata.id)
$Date = timestamp.get_timestamp(max(metadata.event_timestamp.seconds), "%F %T ")
order:
$Count desc
As 10 principais ameaças de e-mail por gravidade
metadata.log_type = /MAIL|ABNORMAL_SECURITY|AREA1|COFENSE_TRIAGE|FIREEYE|FORCEPOINT|FORTINET|KNOWBE4_PHISHER|MICROSOFT_GRAPH_ALERT|MIMECAST_URL_LOGS|OBSERVEIT|OFFICE_365|PHISHLABS|PROOFPOINT|SYMANTEC_VIP|VOLTAGE|WORKSPACE_ALERTS/ nocase
security_result.category = "MAIL_SPAM"
or security_result.category = "MAIL_SPOOFING"
or security_result.category = "SOFTWARE_MALICIOUS"
or (security_result.category = "MAIL_PHISHING" and security_result.threat_name!= "NOT_PHISHING")
or strings.coalesce(security_result.threat_name, security_result.category_details) = /Phish|Mail/ nocase
$Severity = security_result.severity
$Threat_Name = strings.coalesce(security_result.threat_name, security_result.category_details)
$Threat_Name != ""
match:
$Threat_Name, $Severity
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
Eventos de backup ao longo do tempo
(metadata.log_type = /COHESITY|DRUVA_BACKUP|VEEAM|VERITAS_NETBACKUP/ nocase or metadata.log_type = "RUBRIK")
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
$Log_Type = metadata.log_type
match:
$Date, $Log_Type
outcome:
$Count = count(metadata.id)
order:
$Date asc
Total de dispositivos ao longo do tempo
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
match:
$Date
outcome:
$Count = count_distinct(strings.coalesce(principal.hostname, principal.asset.hostname, target.hostname, target.asset.hostname))
order:
$Date asc
As 10 principais execuções de aplicativos bloqueadas
(metadata.product_event_type = /(execution|application) block/ nocase or security_result.summary = /(execution|application) block/ or metadata.description = /(execution|application) block/ nocase or security_result.threat_name = /application control/ nocase)
(security_result.action = "BLOCK" or security_result.action_details = /block/ nocase or (target.resource.attribute.labels.key = "categoryBehavior" and target.resource.attribute.labels.value = /blocked/ nocase))
$Application = strings.coalesce(about.file.full_path, target.process.file.full_path, additional.fields["fname"], principal.application, target.application)
$Description = strings.coalesce(target.resource.attribute.labels["categoryTupleDescription"], security_result.summary, metadata.product_event_type, security_result.description, metadata.description, security_result.action_details)
match:
$Application, $Description, metadata.log_type
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
Tentativas de MFA bloqueadas para contas privilegiadas
(re.regex(metadata.product_name, "MULTI-FACTOR_AUTHENTICATION") or re.regex(additional.fields["AuthenticationRequirement"], `multiFactorAuthentication`) nocase or re.regex(security_result.detection_fields.value, `MFA`) nocase or re.regex(metadata.product_event_type, `mfa(?:\S)?auth|auth(?:.*)?mfa`) nocase)
security_result.action = "BLOCK"
$User = strings.coalesce(principal.user.userid, principal.user.user_display_name, principal.user.email_addresses, target.user.userid, target.user.user_display_name,target.user.email_addresses)
$User = /admin|root|administrator|security|support|default/ nocase //It will be updated as per the client's environment.
$Reason = strings.coalesce(security_result.summary, metadata.product_event_type)
$Location = strings.coalesce(principal.location.country_or_region, principal.ip_geo_artifact.location.country_or_region)
$Source_IP = strings.coalesce(principal.ip, principal.asset.ip)
$Log_Type = metadata.log_type
$Severity = security_result.severity
match:
$Reason, $User, $Source_IP, $Location, $Severity, $Log_Type
outcome:
$Count = count(metadata.id)
$Date = timestamp.get_timestamp(max(metadata.event_timestamp.seconds), "%F %T")
order:
$Count desc
Visão geral do Cloud Key Management
Esse painel oferece uma visão detalhada das principais atividades de gerenciamento na infraestrutura em nuvem da sua organização. O painel monitora o status de chaves, certificados e secrets durante todo o ciclo de vida (criação, exclusão, ativação, rotação e desativação), permitindo a detecção de anomalias ou atividades não autorizadas.
Objetos desativados ao longo do tempo
Contagem total de eventos por tipo de registro
Os 10 principais usuários que criam objetos
Objetos excluídos ao longo do tempo
Objetos criados ao longo do tempo
10 principais IPs de origem que ativam objetos
Os 10 principais usuários que giram objetos
Objetos rotacionados ao longo do tempo
10 principais endereços IP de origem que giram objetos
Os 10 principais usuários que excluem objetos
10 principais objetos girados
10 principais objetos desativados
Os 10 principais usuários bloqueados
Os 10 principais usuários que ativaram objetos
Objetos criados recentemente (últimas 24 horas)
10 principais objetos ativados
Os 10 principais user agents
Os 10 principais IPs de origem que criam objetos
10 principais locais de objetos
Objetos ativados ao longo do tempo
Os 10 principais IPs de origem bloqueados
Objetos criados por geolocalização
Os 10 principais usuários que desativam objetos
10 principais IPs de origem que desativam objetos
Objetos excluídos recentemente(últimas 24 horas)
10 principais IPs de origem: como excluir objetos
Nome do gráfico
Exemplo de consulta
Objetos desativados ao longo do tempo
((((metadata.log_type = /AZURE_KEYVAULT_AUDIT/ nocase and (additional.fields["resultType"] = /Allow|Success/ nocase or security_result.action = "ALLOW")) or
(target.application = "kms.amazonaws.com" and security_result.action = "ALLOW")) and metadata.product_event_type = /Disable/ nocase) or
(metadata.log_type = /GCP_CLOUDAUDIT/ nocase and metadata.product_event_type = /UpdateCryptoKeyVersion|Disable/ nocase and metadata.product_event_type = /key|secret|certificate/ nocase and
target.resource.attribute.labels.value = /DISABLED/ nocase and security_result.action = "ALLOW"))
$Log_Type = strings.coalesce(metadata.log_type, target.application)
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
match:
$Log_Type, $Date
outcome:
$Count = count(metadata.id)
order:
$Date asc
Contagem total de eventos por tipo de registro
(metadata.log_type = /AZURE_KEYVAULT_AUDIT|GCP_CLOUDAUDIT/ nocase or target.application = "kms.amazonaws.com")
$Log_Type = strings.coalesce(metadata.log_type, target.application)
match:
$Log_Type
outcome:
$Count = count(metadata.id)
order:
$Count desc
Os 10 principais usuários que criam objetos
((((metadata.log_type = /AZURE_KEYVAULT_AUDIT/ nocase and (additional.fields["resultType"] = /Allow|Success/ nocase or security_result.action = "ALLOW")) or
(target.application = "kms.amazonaws.com" and security_result.action = "ALLOW")) and metadata.product_event_type = /Create/ nocase) or
(metadata.log_type = /GCP_CLOUDAUDIT/ nocase and metadata.product_event_type = /Create/ nocase and metadata.product_event_type = /key|secret|certificate/ nocase and
metadata.product_event_type != /version/ nocase and security_result.action = "ALLOW"))
$User = strings.coalesce(principal.user.userid, principal.user.user_display_name, principal.user.email_addresses, principal.user.group_identifiers)
$Log_Type = strings.coalesce(metadata.log_type, target.application)
match:
$User, $Log_Type
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
Objetos excluídos ao longo do tempo
((((metadata.log_type = /AZURE_KEYVAULT_AUDIT/ nocase and (additional.fields["resultType"] = /Allow|Success/ nocase or security_result.action = "ALLOW")) or
(target.application = "kms.amazonaws.com" and security_result.action = "ALLOW")) and metadata.product_event_type = /Delete/ nocase) or
(metadata.log_type = /GCP_CLOUDAUDIT/ nocase and metadata.product_event_type = /Delete|Destroy/ nocase and metadata.product_event_type = /key|secret|certificate/ nocase
and security_result.action = "ALLOW"))
$Log_Type = strings.coalesce(metadata.log_type, target.application)
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
match:
$Log_Type, $Date
outcome:
$Count = count(metadata.id)
order:
$Date asc
Objetos criados ao longo do tempo
((((metadata.log_type = /AZURE_KEYVAULT_AUDIT/ nocase and ((additional.fields["resultType"] = /Allow|Success/ nocase) or (security_result.action = "ALLOW"))) or
(target.application = "kms.amazonaws.com" and security_result.action = "ALLOW")) and metadata.product_event_type = /Create/ nocase) or
(metadata.log_type = /GCP_CLOUDAUDIT/ nocase and metadata.product_event_type = /Create/ nocase and metadata.product_event_type = /key|secret|certificate/ nocase and
metadata.product_event_type != /version/ nocase and security_result.action = "ALLOW"))
$Log_Type = strings.coalesce(metadata.log_type, target.application)
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
match:
$Log_Type, $Date
outcome:
$Count = count(metadata.id)
order:
$Date asc
10 principais IPs de origem que ativam objetos
((((metadata.log_type = /AZURE_KEYVAULT_AUDIT/ nocase and (additional.fields["resultType"] = /Allow|Success/ nocase or security_result.action = "ALLOW")) or
(target.application = "kms.amazonaws.com" and security_result.action = "ALLOW")) and metadata.product_event_type = /Enable/ nocase) or
(metadata.log_type = /GCP_CLOUDAUDIT/ nocase and metadata.product_event_type = /UpdateCryptoKeyVersion|Enable/ nocase and metadata.product_event_type = /key|secret|certificate/ nocase and
target.resource.attribute.labels.value = /ENABLED/ nocase and security_result.action = "ALLOW"))
$Source_IP = strings.coalesce(principal.ip, principal.asset.ip)
$Log_Type = strings.coalesce(metadata.log_type, target.application)
match:
$Source_IP, $Log_Type
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
Os 10 principais usuários que giram objetos
((((metadata.log_type = /AZURE_KEYVAULT_AUDIT/ nocase and (additional.fields["resultType"] = /Allow|Success/ nocase or security_result.action = "ALLOW")) or
(target.application = "kms.amazonaws.com" and security_result.action = "ALLOW")) and metadata.product_event_type = /Rotate|KeyRotation/ nocase) or
(metadata.log_type = /GCP_CLOUDAUDIT/ nocase and metadata.product_event_type = /CreateCryptoKeyVersion|updateCryptoKeyPrimaryVersion|Rotate/ nocase and metadata.product_event_type = /key|secret|certificate/ nocase and security_result.action = "ALLOW"))
$User = strings.coalesce(principal.user.userid, principal.user.user_display_name, principal.user.email_addresses, principal.user.group_identifiers)
$Log_Type = strings.coalesce(metadata.log_type, target.application)
match:
$User, $Log_Type
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
Objetos rotacionados ao longo do tempo
((((metadata.log_type = /AZURE_KEYVAULT_AUDIT/ nocase and (additional.fields["resultType"] = /Allow|Success/ nocase or security_result.action = "ALLOW")) or
(target.application = "kms.amazonaws.com" and security_result.action = "ALLOW")) and metadata.product_event_type = /Rotate|KeyRotation/ nocase) or
(metadata.log_type = /GCP_CLOUDAUDIT/ nocase and metadata.product_event_type = /CreateCryptoKeyVersion|updateCryptoKeyPrimaryVersion|Rotate/ nocase and metadata.product_event_type = /key|secret|certificate/ nocase and security_result.action = "ALLOW"))
$Log_Type = strings.coalesce(metadata.log_type, target.application)
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
match:
$Log_Type, $Date
outcome:
$Count = count(metadata.id)
order:
$Date asc
10 principais endereços IP de origem que giram objetos
((((metadata.log_type = /AZURE_KEYVAULT_AUDIT/ nocase and (additional.fields["resultType"] = /Allow|Success/ nocase or security_result.action = "ALLOW")) or
(target.application = "kms.amazonaws.com" and security_result.action = "ALLOW")) and metadata.product_event_type = /Rotate|KeyRotation/ nocase) or
(metadata.log_type = /GCP_CLOUDAUDIT/ nocase and metadata.product_event_type = /CreateCryptoKeyVersion|updateCryptoKeyPrimaryVersion|Rotate/ nocase and metadata.product_event_type = /key|secret|certificate/ nocase and security_result.action = "ALLOW"))
$Source_IP = strings.coalesce(principal.ip, principal.asset.ip)
$Log_Type = strings.coalesce(metadata.log_type, target.application)
match:
$Source_IP, $Log_Type
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
Os 10 principais usuários que excluem objetos
((((metadata.log_type = /AZURE_KEYVAULT_AUDIT/ nocase and (additional.fields["resultType"] = /Allow|Success/ nocase or security_result.action = "ALLOW")) or
(target.application = "kms.amazonaws.com" and security_result.action = "ALLOW")) and metadata.product_event_type = /Delete/ nocase) or
(metadata.log_type = /GCP_CLOUDAUDIT/ nocase and metadata.product_event_type = /Delete|Destroy/ nocase and metadata.product_event_type = /key|secret|certificate/ nocase
and security_result.action = "ALLOW"))
$User = strings.coalesce(principal.user.userid, principal.user.user_display_name, principal.user.email_addresses, principal.user.group_identifiers)
$Log_Type = strings.coalesce(metadata.log_type, target.application)
match:
$User, $Log_Type
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
10 principais objetos girados
((((metadata.log_type = /AZURE_KEYVAULT_AUDIT/ nocase and (additional.fields["resultType"] = /Allow|Success/ nocase or security_result.action = "ALLOW")) or
(target.application = "kms.amazonaws.com" and security_result.action = "ALLOW")) and metadata.product_event_type = /Rotate|KeyRotation/ nocase) or
(metadata.log_type = /GCP_CLOUDAUDIT/ nocase and metadata.product_event_type = /CreateCryptoKeyVersion|updateCryptoKeyPrimaryVersion|Rotate/ nocase and metadata.product_event_type = /key|secret|certificate/ nocase and security_result.action = "ALLOW"))
$Object_ID = strings.coalesce(target.resource.product_object_id, principal.user.product_object_id, principal.resource.product_object_id)
$Log_Type = strings.coalesce(metadata.log_type, target.application)
match:
$Object_ID, $Log_Type
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
10 principais objetos desativados
((((metadata.log_type = /AZURE_KEYVAULT_AUDIT/ nocase and (additional.fields["resultType"] = /Allow|Success/ nocase or security_result.action = "ALLOW")) or
(target.application = "kms.amazonaws.com" and security_result.action = "ALLOW")) and metadata.product_event_type = /Disable/ nocase) or
(metadata.log_type = /GCP_CLOUDAUDIT/ nocase and metadata.product_event_type = /UpdateCryptoKeyVersion|Disable/ nocase and metadata.product_event_type = /key|secret|certificate/ nocase and
target.resource.attribute.labels.value = /DISABLED/ nocase and security_result.action = "ALLOW"))
$Object_ID = strings.coalesce(target.resource.product_object_id, principal.user.product_object_id, principal.resource.product_object_id)
$Log_Type = strings.coalesce(metadata.log_type, target.application)
match:
$Object_ID, $Log_Type
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
Os 10 principais usuários bloqueados
((metadata.log_type = /AZURE_KEYVAULT_AUDIT|GCP_CLOUDAUDIT/ nocase and (additional.fields["resultType"] = /Fail/ nocase or security_result.action = "BLOCK")) or
(target.application = "kms.amazonaws.com" and security_result.action = "BLOCK"))
$Event_Type = metadata.event_type
$User = strings.coalesce(principal.user.userid, principal.user.user_display_name, principal.user.email_addresses, principal.user.group_identifiers)
match:
$User, $Event_Type
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
Os 10 principais usuários que ativaram objetos
((((metadata.log_type = /AZURE_KEYVAULT_AUDIT/ nocase and (additional.fields["resultType"] = /Allow|Success/ nocase or security_result.action = "ALLOW")) or
(target.application = "kms.amazonaws.com" and security_result.action = "ALLOW")) and metadata.product_event_type = /Enable/ nocase) or
(metadata.log_type = /GCP_CLOUDAUDIT/ nocase and metadata.product_event_type = /UpdateCryptoKeyVersion|Enable/ nocase and metadata.product_event_type = /key|secret|certificate/ nocase and
target.resource.attribute.labels.value = /ENABLED/ nocase and security_result.action = "ALLOW"))
$User = strings.coalesce(principal.user.userid, principal.user.user_display_name, principal.user.email_addresses, principal.user.group_identifiers)
$Log_Type = strings.coalesce(metadata.log_type, target.application)
match:
$User, $Log_Type
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
Objetos criados recentemente (últimas 24 horas)
((((metadata.log_type = /AZURE_KEYVAULT_AUDIT/ nocase and (additional.fields["resultType"] = /Allow|Success/ nocase or security_result.action = "ALLOW")) or
(target.application = "kms.amazonaws.com" and security_result.action = "ALLOW")) and metadata.product_event_type = /Create/ nocase) or
(metadata.log_type = /GCP_CLOUDAUDIT/ nocase and metadata.product_event_type = /Create/ nocase and metadata.product_event_type = /key|secret|certificate/ nocase and
metadata.product_event_type != /version/ nocase and security_result.action = "ALLOW"))
$Source_IP = strings.coalesce(principal.ip, principal.asset.ip)
$Security_Event_Type = metadata.product_event_type
$User = strings.coalesce(principal.user.userid, principal.user.user_display_name, principal.user.email_addresses, principal.user.group_identifiers)
$Object_ID = strings.coalesce(target.resource.product_object_id, principal.user.product_object_id, principal.resource.product_object_id)
$Log_Type = strings.coalesce(metadata.log_type, target.application)
$Location = principal.location.country_or_region
$Date = timestamp.get_timestamp(metadata.event_timestamp.seconds, "%F %T ")
match:
$Date , $Log_Type, $Object_ID, $Security_Event_Type, $User, $Source_IP, $Location
order:
$Date desc
10 principais objetos ativados
((((metadata.log_type = /AZURE_KEYVAULT_AUDIT/ nocase and (additional.fields["resultType"] = /Allow|Success/ nocase or security_result.action = "ALLOW")) or
(target.application = "kms.amazonaws.com" and security_result.action = "ALLOW")) and metadata.product_event_type = /Enable/ nocase) or
(metadata.log_type = /GCP_CLOUDAUDIT/ nocase and metadata.product_event_type = /UpdateCryptoKeyVersion|Enable/ nocase and metadata.product_event_type = /key|secret|certificate/ nocase and
target.resource.attribute.labels.value = /ENABLED/ nocase and security_result.action = "ALLOW"))
$Object_ID = strings.coalesce(target.resource.product_object_id, principal.user.product_object_id, principal.resource.product_object_id)
$Log_Type = strings.coalesce(metadata.log_type, target.application)
match:
$Object_ID, $Log_Type
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
Os 10 principais user agents
(metadata.log_type = /AZURE_KEYVAULT_AUDIT|GCP_CLOUDAUDIT/ nocase or target.application = "kms.amazonaws.com")
$User_Agent = network.http.user_agent
$Log_Type = strings.coalesce(metadata.log_type, target.application)
match:
$User_Agent, $Log_Type
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
Os 10 principais IPs de origem que criam objetos
((((metadata.log_type = /AZURE_KEYVAULT_AUDIT/ nocase and (additional.fields["resultType"] = /Allow|Success/ nocase or security_result.action = "ALLOW")) or
(target.application = "kms.amazonaws.com" and security_result.action = "ALLOW")) and metadata.product_event_type = /Create/ nocase) or
(metadata.log_type = /GCP_CLOUDAUDIT/ nocase and metadata.product_event_type = /Create/ nocase and metadata.product_event_type = /key|secret|certificate/ nocase and
metadata.product_event_type != /version/ nocase and security_result.action = "ALLOW"))
$Source_IP = strings.coalesce(principal.ip, principal.asset.ip)
$Log_Type = strings.coalesce(metadata.log_type, target.application)
match:
$Source_IP, $Log_Type
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
10 principais locais de objetos
(metadata.log_type = /AZURE_KEYVAULT_AUDIT|GCP_CLOUDAUDIT/ nocase or target.application = "kms.amazonaws.com")
$Object_ID = strings.coalesce(target.resource.product_object_id, principal.user.product_object_id, principal.resource.product_object_id)
$Log_Type = strings.coalesce(metadata.log_type, target.application)
$Location = target.location.name
match:
$Location, $Log_Type
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
Objetos ativados ao longo do tempo
((((metadata.log_type = /AZURE_KEYVAULT_AUDIT/ nocase and (additional.fields["resultType"] = /Allow|Success/ nocase or security_result.action = "ALLOW")) or
(target.application = "kms.amazonaws.com" and security_result.action = "ALLOW")) and metadata.product_event_type = /Enable/ nocase) or
(metadata.log_type = /GCP_CLOUDAUDIT/ nocase and metadata.product_event_type = /UpdateCryptoKeyVersion|Enable/ nocase and metadata.product_event_type = /key|secret|certificate/ nocase and
target.resource.attribute.labels.value = /ENABLED/ nocase and security_result.action = "ALLOW"))
$Log_Type = strings.coalesce(metadata.log_type, target.application)
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
match:
$Log_Type, $Date
outcome:
$Count = count(metadata.id)
order:
$Date asc
Os 10 principais IPs de origem bloqueados
((metadata.log_type = /AZURE_KEYVAULT_AUDIT|GCP_CLOUDAUDIT/ nocase and (additional.fields["resultType"] = /Fail/ nocase or security_result.action = "BLOCK")) or
(target.application = "kms.amazonaws.com" and security_result.action = "BLOCK"))
$Event_Type = metadata.event_type
$Source_IP = strings.coalesce(principal.ip, principal.asset.ip)
match:
$Source_IP, $Event_Type
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
Objetos criados por geolocalização
((((metadata.log_type = /AZURE_KEYVAULT_AUDIT/ nocase and (additional.fields["resultType"] = /Allow|Success/ nocase or security_result.action = "ALLOW")) or
(target.application = "kms.amazonaws.com" and security_result.action = "ALLOW")) and metadata.product_event_type = /Create/ nocase) or
(metadata.log_type = /GCP_CLOUDAUDIT/ nocase and metadata.product_event_type = /Create/ nocase and metadata.product_event_type = /key|secret|certificate/ nocase and
metadata.product_event_type != /version/ nocase and security_result.action = "ALLOW"))
$Country = principal.ip_geo_artifact.location.country_or_region
$Country != ""
match:
$Country
outcome:
$Count = count(metadata.id)
$Latitude = max(principal.ip_geo_artifact.location.region_coordinates.latitude)
$Longitude = max(principal.ip_geo_artifact.location.region_coordinates.longitude)
order:
$Count desc
Os 10 principais usuários que desativam objetos
((((metadata.log_type = /AZURE_KEYVAULT_AUDIT/ nocase and (additional.fields["resultType"] = /Allow|Success/ nocase or security_result.action = "ALLOW")) or
(target.application = "kms.amazonaws.com" and security_result.action = "ALLOW")) and metadata.product_event_type = /Disable/ nocase) or
(metadata.log_type = /GCP_CLOUDAUDIT/ nocase and metadata.product_event_type = /UpdateCryptoKeyVersion|Disable/ nocase and metadata.product_event_type = /key|secret|certificate/ nocase and
target.resource.attribute.labels.value = /DISABLED/ nocase and security_result.action = "ALLOW"))
$User = strings.coalesce(principal.user.userid, principal.user.user_display_name, principal.user.email_addresses, principal.user.group_identifiers)
$Log_Type = strings.coalesce(metadata.log_type, target.application)
match:
$User, $Log_Type
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
10 principais IPs de origem que desativam objetos
((((metadata.log_type = /AZURE_KEYVAULT_AUDIT/ nocase and (additional.fields["resultType"] = /Allow|Success/ nocase or security_result.action = "ALLOW")) or
(target.application = "kms.amazonaws.com" and security_result.action = "ALLOW")) and metadata.product_event_type = /Disable/ nocase) or
(metadata.log_type = /GCP_CLOUDAUDIT/ nocase and metadata.product_event_type = /UpdateCryptoKeyVersion|Disable/ nocase and metadata.product_event_type = /key|secret|certificate/ nocase and
target.resource.attribute.labels.value = /DISABLED/ nocase and security_result.action = "ALLOW"))
$Source_IP = strings.coalesce(principal.ip, principal.asset.ip)
$Log_Type = strings.coalesce(metadata.log_type, target.application)
match:
$Source_IP, $Log_Type
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
Objetos excluídos recentemente(últimas 24 horas)
((metadata.log_type = "AZURE_KEYVAULT_AUDIT" and additional.fields["resultType"] = /Allow|Success/ nocase) or
(target.application = "kms.amazonaws.com" and security_result.action = "ALLOW"))
metadata.product_event_type = /Delete/ nocase
$Source_IP = strings.coalesce(principal.ip, principal.asset.ip)
$Security_Event_Type = metadata.product_event_type
$User = strings.coalesce(principal.user.userid, principal.user.user_display_name, principal.user.email_addresses, principal.user.group_identifiers)
$Object_ID = strings.coalesce(target.resource.product_object_id, principal.user.product_object_id, principal.resource.product_object_id)
$Location = principal.location.country_or_region
$Log_Type = strings.coalesce(metadata.log_type, target.application)
$Date = timestamp.get_timestamp(metadata.event_timestamp.seconds, "%F %T ")
match:
$Date, $Log_Type, $Object_ID, $Security_Event_Type, $User, $Source_IP, $Location
order:
$Date desc
limit:
10
10 principais IPs de origem: como excluir objetos
((((metadata.log_type = /AZURE_KEYVAULT_AUDIT/ nocase and (additional.fields["resultType"] = /Allow|Success/ nocase or security_result.action = "ALLOW")) or
(target.application = "kms.amazonaws.com" and security_result.action = "ALLOW")) and metadata.product_event_type = /Delete/ nocase) or
(metadata.log_type = /GCP_CLOUDAUDIT/ nocase and metadata.product_event_type = /Delete|Destroy/ nocase and metadata.product_event_type = /key|secret|certificate/ nocase
and security_result.action = "ALLOW"))
$Source_IP = strings.coalesce(principal.ip, principal.asset.ip)
$Log_Type = strings.coalesce(metadata.log_type, target.application)
match:
$Source_IP, $Log_Type
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
Visão geral da postura de segurança do Cloud
Esse painel fornece insights sobre a postura de segurança do Cloud rastreando métricas importantes no Google Cloud, na AWS e no Azure.
Visão geral dos serviços do Cloud Storage
Esse painel oferece insights valiosos sobre atividades de armazenamento em nuvem, como
recursos criados, excluídos, acessados, atualizados e permissões alteradas. Ele inclui visualizações de tendências de eventos e alertas ao longo do tempo e destaca os principais usuários, endereços IP, user agents e locais de recursos. Essas informações ajudam a identificar padrões incomuns, monitorar alertas e manter a integridade de dados, protegendo os ambientes de nuvem.
Os 10 principais IPs de origem que acessam recursos
Recursos acessados por geolocalização
Os 10 principais user agents
Os 10 principais IPs de origem que atualizam recursos
10 principais recursos acessados
Recursos excluídos ao longo do tempo
Os 10 principais usuários bloqueados
Recursos criados recentemente (últimas 24 horas)
Recursos acessados ao longo do tempo
Os 10 principais IPs de origem que mudaram as permissões de recursos
Recursos excluídos recentemente (últimas 24 horas)
Os 10 principais IPs de origem bloqueados
Eventos ao longo do tempo
10 principais locais de recursos
Os 10 principais IPs de origem que excluem recursos
Permissões de recursos mudaram com o tempo
Os 10 principais IPs de origem que criam recursos
Os 10 principais usuários que acessam recursos
Os 10 principais recursos com permissão alterada
Os 10 principais usuários que atualizam recursos
Os 10 principais usuários que mudaram as permissões de recursos
Recursos criados ao longo do tempo
Os 10 principais recursos atualizados
Os 10 principais usuários que excluem recursos
Os 10 principais usuários que criam recursos
Recursos atualizados ao longo do tempo
Buckets compartilhados publicamente
Nome do gráfico
Exemplo de consulta
Os 10 principais IPs de origem que acessam recursos
(
(metadata.log_type = /(AWS_CLOUDTRAIL|GCP_CLOUDAUDIT)/ nocase
and metadata.event_type = "RESOURCE_READ"
and metadata.product_event_type = /(storage|bucket)/ nocase)
or
(metadata.log_type = /AZURE/ nocase
and metadata.product_event_type = /microsoft\.storage\/storageaccounts\/read/ nocase)
)
security_result.action = "ALLOW"
$Log_Type = metadata.log_type
$IP_Address = principal.ip
match:
$Log_Type, $IP_Address
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
Recursos acessados por geolocalização
(
(metadata.log_type = /(AWS_CLOUDTRAIL|GCP_CLOUDAUDIT)/ nocase
and metadata.event_type = "RESOURCE_READ"
and metadata.product_event_type = /(storage|bucket)/ nocase)
or
(metadata.log_type = /AZURE/ nocase
and metadata.product_event_type = /microsoft\.storage\/storageaccounts\/read/ nocase)
)
security_result.action = "ALLOW"
$Country = principal.location.country_or_region
$Country != ""
$Latitude = principal.location.region_coordinates.latitude
$Longitude = principal.location.region_coordinates.longitude
match:
$Country, $Latitude, $Longitude
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
Os 10 principais user agents
(metadata.log_type = /AWS_CLOUDTRAIL|GCP_CLOUDAUDIT/ nocase
and metadata.product_event_type = /storage|bucket/ nocase
and (metadata.event_type = "RESOURCE_CREATION"
or metadata.event_type = "RESOURCE_DELETION"
or metadata.event_type = "RESOURCE_PERMISSIONS_CHANGE"
or metadata.event_type = "RESOURCE_READ"
or metadata.event_type = "RESOURCE_WRITTEN"))
or
(metadata.log_type = /AZURE/ nocase
and metadata.product_event_type = /microsoft\.storage\/storageaccounts\/(?:write|delete|read)/ nocase)
network.http.user_agent != ""
$Log_Type = metadata.log_type
$User_Agent = network.http.user_agent
match:
$Log_Type, $User_Agent
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
Os 10 principais IPs de origem que atualizam recursos
(
(metadata.log_type = /(AWS_CLOUDTRAIL|GCP_CLOUDAUDIT)/ nocase
and metadata.event_type = "RESOURCE_WRITTEN"
and metadata.product_event_type = /(storage|bucket)/ nocase)
or
(metadata.log_type = /AZURE/ nocase
and metadata.product_event_type = /microsoft\.storage\/storageaccounts\/(?:write|.*\/write)?/ nocase)
)
security_result.action = "ALLOW"
$Log_Type = metadata.log_type
$IP_Address = principal.ip
match:
$Log_Type, $IP_Address
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
10 principais recursos acessados
(
(metadata.log_type = /(AWS_CLOUDTRAIL|GCP_CLOUDAUDIT)/ nocase
and metadata.event_type = "RESOURCE_READ"
and metadata.product_event_type = /(storage|bucket)/ nocase)
or
(metadata.log_type = /AZURE/ nocase
and metadata.product_event_type = /microsoft\.storage\/storageaccounts\/(?:write|.*\/write)?/ nocase)
)
security_result.action = "ALLOW"
$Log_Type = metadata.log_type
$Resource_Name = target.resource.name
match:
$Log_Type, $Resource_Name
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
Recursos excluídos ao longo do tempo
(
(metadata.log_type = /(AWS_CLOUDTRAIL|GCP_CLOUDAUDIT)/ nocase
and metadata.event_type = "RESOURCE_DELETION"
and metadata.product_event_type = /(storage|bucket)/ nocase)
or
(metadata.log_type = /AZURE/ nocase
and metadata.product_event_type = /microsoft\.storage\/storageaccounts\/delete/ nocase)
)
security_result.action = "ALLOW"
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
$Log_Type = metadata.log_type
match:
$Date, $Log_Type
outcome:
$Count = count(metadata.id)
Os 10 principais usuários bloqueados
(metadata.log_type = /AWS_CLOUDTRAIL|GCP_CLOUDAUDIT/ nocase
and metadata.product_event_type = /storage|bucket/ nocase
and (metadata.event_type = "RESOURCE_CREATION"
or metadata.event_type = "RESOURCE_DELETION"
or metadata.event_type = "RESOURCE_PERMISSIONS_CHANGE"
or metadata.event_type = "RESOURCE_READ"
or metadata.event_type = "RESOURCE_WRITTEN"))
or
(metadata.log_type = /AZURE/ nocase
and metadata.product_event_type = /microsoft\.storage\/storageaccounts\/(?:write|delete|read)/ nocase)
security_result.action = "BLOCK"
$Event_Type = metadata.event_type
$User = principal.user.userid
match:
$Event_Type, $User
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
Recursos criados recentemente (últimas 24 horas)
(
(metadata.log_type = /AWS_CLOUDTRAIL|GCP_CLOUDAUDIT/ nocase
and metadata.event_type = "RESOURCE_CREATION"
and metadata.product_event_type = /storage|bucket/ nocase)
or
(metadata.log_type = /AZURE/ nocase
and metadata.product_event_type = /microsoft\.storage\/storageaccounts\/write/ nocase)
)
security_result.action = "ALLOW"
$Log_Type = metadata.log_type
$IP_Address = principal.ip
$User = principal.user.userid
$Resource_Name = target.resource.name
$Location = principal.location.country_or_region
$Date = timestamp.get_timestamp(metadata.event_timestamp.seconds, "%F %T ")
match:
$Date, $Log_Type, $IP_Address, $User, $Location, $Resource_Name
order:
$Date desc
Recursos acessados ao longo do tempo
(
(metadata.log_type = /(AWS_CLOUDTRAIL|GCP_CLOUDAUDIT)/ nocase
and metadata.event_type = "RESOURCE_READ"
and metadata.product_event_type = /(storage|bucket)/ nocase)
or
(metadata.log_type = /AZURE/ nocase
and metadata.product_event_type = /microsoft\.storage\/storageaccounts\/read/ nocase)
)
security_result.action = "ALLOW"
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
$Log_Type = metadata.log_type
match:
$Date, $Log_Type
outcome:
$Count = count(metadata.id)
Os 10 principais IPs de origem que mudaram as permissões de recursos
(
(metadata.log_type = /AWS_CLOUDTRAIL|GCP_CLOUDAUDIT/ nocase
and metadata.event_type = "RESOURCE_PERMISSIONS_CHANGE"
and metadata.product_event_type = /storage|bucket/ nocase)
or
(metadata.log_type = /AZURE/ nocase
and metadata.product_event_type = /microsoft\.authorization\/(?:policyassignments|roledefinitions)?\/write/ nocase
and target.resource.resource_type = "STORAGE_BUCKET")
)
security_result.action = "ALLOW"
$Log_Type = metadata.log_type
$IP_Address = principal.ip
match:
$Log_Type, $IP_Address
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
Recursos excluídos recentemente (últimas 24 horas)
(
(metadata.log_type = /(AWS_CLOUDTRAIL|GCP_CLOUDAUDIT)/ nocase
and metadata.event_type = "RESOURCE_DELETION"
and metadata.product_event_type = /(storage|bucket)/ nocase)
or
(metadata.log_type = /AZURE/ nocase
and metadata.product_event_type = /microsoft\.storage\/storageaccounts\/delete/ nocase)
)
security_result.action = "ALLOW"
$Log_Type = metadata.log_type
$IP_Address = principal.ip
$User = principal.user.userid
$Resource_Name = target.resource.name
$Location = principal.location.country_or_region
$Date = timestamp.get_timestamp(metadata.event_timestamp.seconds, "%F %T ")
match:
$Date, $Log_Type, $IP_Address, $User, $Location, $Resource_Name
order:
$Date desc
Os 10 principais IPs de origem bloqueados
(metadata.log_type = /AWS_CLOUDTRAIL|GCP_CLOUDAUDIT/ nocase
and metadata.product_event_type = /storage|bucket/ nocase
and (metadata.event_type = "RESOURCE_CREATION"
or metadata.event_type = "RESOURCE_DELETION"
or metadata.event_type = "RESOURCE_PERMISSIONS_CHANGE"
or metadata.event_type = "RESOURCE_READ"
or metadata.event_type = "RESOURCE_WRITTEN"))
or
(metadata.log_type = /AZURE/ nocase
and metadata.product_event_type = /microsoft\.storage\/storageaccounts\/(?:write|delete|read)/ nocase)
security_result.action = "BLOCK"
$Event_Type = metadata.event_type
$IP_Address = principal.ip
match:
$Event_Type, $IP_Address
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
Eventos ao longo do tempo
(metadata.log_type = /AWS_CLOUDTRAIL|GCP_CLOUDAUDIT/ nocase
and metadata.product_event_type = /storage|bucket/ nocase
and (metadata.event_type = "RESOURCE_CREATION"
or metadata.event_type = "RESOURCE_DELETION"
or metadata.event_type = "RESOURCE_PERMISSIONS_CHANGE"
or metadata.event_type = "RESOURCE_READ"
or metadata.event_type = "RESOURCE_WRITTEN"))
or
(metadata.log_type = /AZURE/ nocase
and metadata.product_event_type = /microsoft\.storage\/storageaccounts\/(?:write|delete|read)/ nocase)
$Log_Type = metadata.log_type
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
match:
$Log_Type, $Date
outcome:
$Count = count(metadata.id)
10 principais locais de recursos
(metadata.log_type = /AWS_CLOUDTRAIL|GCP_CLOUDAUDIT/ nocase
and metadata.product_event_type = /storage|bucket/ nocase
and (metadata.event_type = "RESOURCE_CREATION"
or metadata.event_type = "RESOURCE_DELETION"
or metadata.event_type = "RESOURCE_PERMISSIONS_CHANGE"
or metadata.event_type = "RESOURCE_READ"
or metadata.event_type = "RESOURCE_WRITTEN"))
or
(metadata.log_type = /AZURE/ nocase
and metadata.product_event_type = /microsoft\.storage[\/\.]storageaccounts[\/\.](?:write|delete|read)/ nocase)
target.location.name != ""
security_result.action = "ALLOW"
$Location = target.location.name
$Log_Type = metadata.log_type
match:
$Location, $Log_Type
outcome:
$Count = count_distinct(metadata.id)
order:
$Count desc
limit:
10
Os 10 principais IPs de origem que excluem recursos
(
(metadata.log_type = /(AWS_CLOUDTRAIL|GCP_CLOUDAUDIT)/ nocase
and metadata.event_type = "RESOURCE_DELETION"
and metadata.product_event_type = /(storage|bucket)/ nocase)
or
(metadata.log_type = /AZURE/ nocase
and metadata.product_event_type = /microsoft\.storage\/storageaccounts\/delete/ nocase)
)
security_result.action = "ALLOW"
$Log_Type = metadata.log_type
$IP_Address = principal.ip
match:
$Log_Type, $IP_Address
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
Permissões de recursos mudaram com o tempo
(
(metadata.log_type = /AWS_CLOUDTRAIL|GCP_CLOUDAUDIT/ nocase
and metadata.event_type = "RESOURCE_PERMISSIONS_CHANGE"
and metadata.product_event_type = /storage|bucket/ nocase)
or
(metadata.log_type = /AZURE/ nocase
and metadata.product_event_type = /microsoft\.authorization\/(?:policyassignments|roledefinitions)?\/write/ nocase
and target.resource.resource_type = "STORAGE_BUCKET")
)
security_result.action = "ALLOW"
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
$Log_Type = metadata.log_type
match:
$Date, $Log_Type
outcome:
$Count = count(metadata.id)
Os 10 principais IPs de origem que criam recursos
(
(metadata.log_type = /AWS_CLOUDTRAIL|GCP_CLOUDAUDIT/ nocase
and metadata.event_type = "RESOURCE_CREATION"
and metadata.product_event_type = /storage|bucket/ nocase)
or
(metadata.log_type = /AZURE/ nocase
and metadata.product_event_type = /microsoft\.storage\/storageaccounts\/write/ nocase)
)
security_result.action = "ALLOW"
$Log_Type = metadata.log_type
$IP_Address = principal.ip
match:
$Log_Type, $IP_Address
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
Os 10 principais usuários que acessam recursos
(
(metadata.log_type = /(AWS_CLOUDTRAIL|GCP_CLOUDAUDIT)/ nocase
and metadata.event_type = "RESOURCE_READ"
and metadata.product_event_type = /(storage|bucket)/ nocase)
or
(metadata.log_type = /AZURE/ nocase
and metadata.product_event_type = /microsoft\.storage\/storageaccounts\/read/ nocase)
)
security_result.action = "ALLOW"
$Log_Type = metadata.log_type
$User = principal.user.userid
match:
$Log_Type, $User
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
Os 10 principais recursos com permissão alterada
(
(metadata.log_type = /AWS_CLOUDTRAIL|GCP_CLOUDAUDIT/ nocase
and metadata.event_type = "RESOURCE_PERMISSIONS_CHANGE"
and metadata.product_event_type = /storage|bucket/ nocase)
or
(metadata.log_type = /AZURE/ nocase
and metadata.product_event_type = /microsoft\.authorization\/(?:policyassignments|roledefinitions)?\/write/ nocase
and target.resource.resource_type = "STORAGE_BUCKET")
)
security_result.action = "ALLOW"
$Log_Type = metadata.log_type
$Resource_Name = target.resource.name
match:
$Log_Type, $Resource_Name
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
Os 10 principais usuários que atualizam recursos
(
(metadata.log_type = /(AWS_CLOUDTRAIL|GCP_CLOUDAUDIT)/ nocase
and metadata.event_type = "RESOURCE_WRITTEN"
and metadata.product_event_type = /(storage|bucket)/ nocase)
or
(metadata.log_type = /AZURE/ nocase
and metadata.product_event_type = /microsoft\.storage\/storageaccounts\/(?:write|.*\/write)?/ nocase)
)
security_result.action = "ALLOW"
$Log_Type = metadata.log_type
$User = principal.user.userid
match:
$Log_Type, $User
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
Os 10 principais usuários que mudaram as permissões de recursos
(
(metadata.log_type = /AWS_CLOUDTRAIL|GCP_CLOUDAUDIT/ nocase
and metadata.event_type = "RESOURCE_PERMISSIONS_CHANGE"
and metadata.product_event_type = /storage|bucket/ nocase)
or
(metadata.log_type = /AZURE/ nocase
and metadata.product_event_type = /microsoft\.authorization\/(?:policyassignments|roledefinitions)?\/write/ nocase
and target.resource.resource_type = "STORAGE_BUCKET")
)
security_result.action = "ALLOW"
$Log_Type = metadata.log_type
$User = principal.user.userid
match:
$Log_Type, $User
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
Recursos criados ao longo do tempo
(
(metadata.log_type = /AWS_CLOUDTRAIL|GCP_CLOUDAUDIT/ nocase
and metadata.event_type = "RESOURCE_CREATION"
and metadata.product_event_type = /storage|bucket/ nocase)
or
(metadata.log_type = /AZURE/ nocase
and metadata.product_event_type = /microsoft\.storage\/storageaccounts\/write/ nocase)
)
security_result.action = "ALLOW"
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
$Log_Type = metadata.log_type
match:
$Date, $Log_Type
outcome:
$Count = count(metadata.id)
Os 10 principais recursos atualizados
(
(metadata.log_type = /(AWS_CLOUDTRAIL|GCP_CLOUDAUDIT)/ nocase
and metadata.event_type = "RESOURCE_WRITTEN"
and metadata.product_event_type = /(storage|bucket)/ nocase)
or
(metadata.log_type = /AZURE/ nocase
and metadata.product_event_type = /microsoft\.storage\/storageaccounts\/(?:write|.*\/write)?/ nocase)
)
security_result.action = "ALLOW"
$Log_Type = metadata.log_type
$Resource_Name = target.resource.name
match:
$Log_Type, $Resource_Name
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
Os 10 principais usuários que excluem recursos
(
(metadata.log_type = /(AWS_CLOUDTRAIL|GCP_CLOUDAUDIT)/ nocase
and metadata.event_type = "RESOURCE_DELETION"
and metadata.product_event_type = /(storage|bucket)/ nocase)
or
(metadata.log_type = /AZURE/ nocase
and metadata.product_event_type = /microsoft\.storage\/storageaccounts\/delete/ nocase)
)
security_result.action = "ALLOW"
$Log_Type = metadata.log_type
$User = principal.user.userid
match:
$Log_Type, $User
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
Os 10 principais usuários que criam recursos
(
(metadata.log_type = /AWS_CLOUDTRAIL|GCP_CLOUDAUDIT/ nocase
and metadata.event_type = "RESOURCE_CREATION"
and metadata.product_event_type = /storage|bucket/ nocase)
or
(metadata.log_type = /AZURE/ nocase
and metadata.product_event_type = /microsoft\.storage\/storageaccounts\/write/ nocase)
)
security_result.action = "ALLOW"
$Log_Type = metadata.log_type
$User = principal.user.userid
match:
$Log_Type, $User
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
Recursos atualizados ao longo do tempo
(
(metadata.log_type = /(AWS_CLOUDTRAIL|GCP_CLOUDAUDIT)/ nocase
and metadata.event_type = "RESOURCE_WRITTEN"
and metadata.product_event_type = /(storage|bucket)/ nocase)
or
(metadata.log_type = /AZURE/ nocase
and metadata.product_event_type = /microsoft\.storage\/storageaccounts\/(?:write|.*\/write)?/ nocase)
)
security_result.action = "ALLOW"
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
$Log_Type = metadata.log_type
match:
$Date, $Log_Type
outcome:
$Count = count(metadata.id)
Buckets compartilhados publicamente
(metadata.log_type = "AZURE_ACTIVITY"
and metadata.product_event_type = "Microsoft.Storage/storageAccounts/write" nocase
and security_result.detection_fields["allowBlobPublicAccess"] = "true")
or
(metadata.log_type = "GCP_CLOUDAUDIT"
and metadata.product_event_type = "storage.setIamPermissions"
and target.application = "storage.googleapis.com"
and security_result.action = "ALLOW"
and target.resource.attribute.labels["ser_binding_deltas_action"] = "ADD"
and target.resource.attribute.labels["ser_binding_deltas_role"] = /roles\/storage.*/
and target.resource.attribute.labels["ser_binding_deltas_member"] = /allUsers|allAuthenticatedUsers/
and target.resource.resource_type = "STORAGE_BUCKET"
)
or
(metadata.log_type = "AWS_CLOUDTRAIL"
and metadata.ingestion_labels["EventSource"] = "s3.amazonaws.com" nocase
and metadata.product_event_type = /PutBucketPublicAccessBlock/ nocase
and (target.resource.attribute.labels["BlockPublicAcls"] = "false"
or target.resource.attribute.labels["BlockPublicPolicy"] = "false"
or target.resource.attribute.labels["IgnorePublicAcls"] = "false"
or target.resource.attribute.labels["RestrictPublicBuckets"] = "false")
)
$Date = timestamp.get_timestamp(metadata.event_timestamp.seconds, "%F %T ")
$Log_Type = metadata.log_type
$User = principal.user.userid
$Resource_Name = target.resource.name
match:
$Date, $Log_Type, $User, $Resource_Name
Visão geral do DDoS
Esse painel oferece uma análise abrangente das atividades de ataque distribuído de negação de serviço (DDoS), com insights sobre tendências, padrões e comportamentos de ataque.
Ele ajuda a identificar vetores de ameaças e áreas de alto risco na rede, permitindo que as equipes de segurança detectem, respondam e mitiguem ataques DDoS de maneira eficaz.
10 principais alertas de fornecedores
10 principais IPs de origem por ação
Eventos por tipo de evento
Alertas do fornecedor ao longo do tempo por tipo de registro
Eventos ao longo do tempo por tipo de registro
Eventos por descrição
Visão geral da geolocalização de origem
Nome do gráfico
Exemplo de consulta
10 principais alertas de fornecedores
(metadata.log_type = /ddos/ nocase or (security_result.description = /ddos/ nocase or security_result.summary = /ddos/ nocase or metadata.description = /ddos/ nocase))
$Rule_Name = security_result.rule_name
$Rule_Name != ""
$Log_Type = metadata.log_type
$Action = security_result.action
match:
$Rule_Name, $Log_Type, $Action
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
10 principais IPs de origem por ação
(metadata.log_type = /ddos/ nocase or (security_result.description = /ddos/ nocase or security_result.summary = /ddos/ nocase or metadata.description = /ddos/ nocase))
$Source_Ip = strings.coalesce(principal.ip, principal.asset.ip)
$Action = security_result.action
match:
$Source_Ip, $Action
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
Eventos por tipo de evento
(metadata.log_type = /ddos/ nocase or (security_result.description = /ddos/ nocase or security_result.summary = /ddos/ nocase or metadata.description = /ddos/ nocase))
$Event_Type = metadata.event_type
match:
$Event_Type
outcome:
$Count = count(metadata.id)
order:
$Count desc
Alertas do fornecedor ao longo do tempo por tipo de registro
(metadata.log_type = /ddos/ nocase or (security_result.description = /ddos/ nocase or security_result.summary = /ddos/ nocase or metadata.description = /ddos/ nocase))
security_result.rule_name != ""
$Log_Type = metadata.log_type
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
match:
$Date, $Log_Type
outcome:
$Count = count(metadata.id)
order:
$Date asc
Eventos ao longo do tempo por tipo de registro
(metadata.log_type = /ddos/ nocase or (security_result.description = /ddos/ nocase or security_result.summary = /ddos/ nocase or metadata.description = /ddos/ nocase))
$Log_Type = metadata.log_type
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
match:
$Date, $Log_Type
outcome:
$Count = count(metadata.id)
order:
$Date asc
Eventos por descrição
(metadata.log_type = /ddos/ nocase or (security_result.description = /ddos/ nocase or security_result.summary = /ddos/ nocase or metadata.description = /ddos/ nocase))
$Description = strings.coalesce(metadata.description,security_result.summary,security_result.description)
$Log_Type = metadata.log_type
$Source_IP = strings.coalesce(principal.ip, principal.asset.ip)
$Destination_IP = strings.coalesce(target.ip, target.asset.ip)
$Action = security_result.action
$Destination_Hostname = strings.coalesce(target.hostname, target.asset.hostname)
$File = principal.process.file.full_path
match:
$Description, $Source_IP, $Destination_IP, $Destination_Hostname, $Action, $Log_Type
outcome:
$Count = count(metadata.id)
$Date = timestamp.get_timestamp(max(metadata.event_timestamp.seconds), "%F %T")
order:
$Count desc
Visão geral da geolocalização de origem
(metadata.log_type = /ddos/ nocase or (security_result.description = /ddos/ nocase or security_result.summary = /ddos/ nocase or metadata.description = /ddos/ nocase))
$Country = principal.ip_geo_artifact.location.country_or_region
$Country !=""
match:
$Country
outcome:
$Count = count(metadata.id)
$Latitude = max(principal.ip_geo_artifact.location.region_latitude)
$Longitude = max(principal.ip_geo_artifact.location.region_longitude)
order:
$Count desc
Monitoramento de DNS
Esse painel oferece uma visão geral detalhada da atividade de DNS e da integridade da rede, com insights sobre eventos de DNS, tendências de consultas e a distribuição de consultas permitidas e bloqueadas. Ele permite monitoramento eficiente, detecção de ameaças e solução de problemas por meio de visualizações de anomalias, locais e falhas de DNS.
Observação : aplique os filtros disponíveis para refinar os dados e mostrar resultados relevantes.
As 10 principais consultas DNS permitidas
10 principais categorias permitidas de DNS
Total de eventos de DNS
Hosts de relatórios
As 10 principais perguntas sobre DNS
Total de eventos de DNS por tipo de registro
10 principais categorias bloqueadas pelo DNS
Resposta DNS bem-sucedida ao longo do tempo
Atividades comuns de DNS
10 principais consultas DNS bloqueadas
Consultas DNS por ação: permitir x bloquear
Eventos de DNS por tipo de registro ao longo do tempo
Detalhamento dos tipos de registros DNS
Falha na resposta de DNS ao longo do tempo
10 principais IPs de origem
Tipos de registros DNS ao longo do tempo
Volume total de registros de eventos DNS ao longo do tempo
Consultas DNS por tipo de registro
Total de hosts que geram relatórios
Consultas de DNS ao longo do tempo
As 10 principais consultas DNS por local
Nome do gráfico
Exemplo de consulta
As 10 principais consultas DNS permitidas
metadata.event_type = "NETWORK_DNS"
network.dns.questions.name != ""
security_result.action = "ALLOW"
$Log_Type = metadata.log_type
$DNS_Questions_Name = network.dns.questions.name
match:
$DNS_Questions_Name, $Log_Type
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
10 principais categorias permitidas de DNS
metadata.event_type = "NETWORK_DNS"
security_result.action = "ALLOW"
security_result.category_details != ""
$Log_Type = metadata.log_type
$Category = security_result.category_details
match:
$Category, $Log_Type
outcome:
$Count = count($Category)
order:
$Count desc
limit:
10
Total de eventos de DNS
metadata.event_type = "NETWORK_DNS"
outcome:
$Count = count(metadata.id)
Hosts de relatórios
metadata.event_type = "NETWORK_DNS"
$Hostname = principal.hostname
match:
$Hostname
As 10 principais perguntas sobre DNS
$event.metadata.log_type = /EXTRAHOP_DNS|UMBRELLA_DNS/ nocase
$event.metadata.event_type = "NETWORK_DNS"
$Questions_Name = $event.network.dns.questions.name
match:
$Questions_Name
outcome:
$Count = count($event.metadata.id)
order:
$Count desc
limit:
10
Total de eventos de DNS
$event.metadata.log_type = /EXTRAHOP_DNS|UMBRELLA_DNS/ nocase
$event.metadata.event_type = "NETWORK_DNS"
outcome:
$Count = count($event.metadata.id)
Total de eventos de DNS por tipo de registro
$event.metadata.log_type = /EXTRAHOP_DNS|UMBRELLA_DNS/ nocase
$event.metadata.event_type = "NETWORK_DNS"
$Log_Type = $event.metadata.log_type
$Event_Type = $event.metadata.event_type
match:
$Log_Type, $Event_Type
outcome:
$Count = count($event.metadata.id)
order:
$Count asc
10 principais categorias bloqueadas pelo DNS
metadata.event_type = "NETWORK_DNS"
security_result.action = "BLOCK"
security_result.category_details != ""
$Log_Type = metadata.log_type
$Category = security_result.category_details
match:
$Category, $Log_Type
outcome:
$Count = count($Category)
order:
$Count desc
limit:
10
Resposta DNS bem-sucedida ao longo do tempo
$event.metadata.log_type = /EXTRAHOP_DNS|UMBRELLA_DNS/ nocase
$event.metadata.event_type = "NETWORK_DNS"
$event.network.dns.response = true
$event.network.application_protocol = "DNS"
$Answered = $event.network.dns.response
$Date = timestamp.get_date($event.metadata.event_timestamp.seconds)
match:
$Date, $Answered
outcome:
$Count = count($event.metadata.id)
order:
$Date asc
Atividades comuns de DNS
metadata.event_type = "NETWORK_DNS"
$Log_Type = metadata.log_type
$Source_IP = principal.ip
$Description = strings.coalesce(metadata.description, security_result.summary)
$DNS_Questions_Name = network.dns.questions.name
match:
$Source_IP, $Log_Type, $Description, $DNS_Questions_Name
outcome:
$Count = count(metadata.id)
order:
$Count desc
10 principais consultas DNS bloqueadas
metadata.event_type = "NETWORK_DNS"
network.dns.questions.name != ""
security_result.action = "BLOCK"
$Log_Type = metadata.log_type
$DNS_Questions_Name = network.dns.questions.name
match:
$DNS_Questions_Name, $Log_Type
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
Consultas DNS por ação: permitir x bloquear
metadata.event_type = "NETWORK_DNS"
network.dns.questions.name != ""
security_result.action = "ALLOW"
or security_result.action = "BLOCK"
$Action = security_result.action
match:
$Action
outcome:
$Count = count(metadata.id)
order:
$Count desc
Eventos de DNS por tipo de registro ao longo do tempo
metadata.event_type = "NETWORK_DNS"
$Log_Type = metadata.log_type
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
match:
$Date, $Log_Type
outcome:
$Count = count(metadata.id)
order:
$Date desc
Detalhamento dos tipos de registros DNS
$event.metadata.log_type = /EXTRAHOP_DNS|UMBRELLA_DNS/ nocase
$event.metadata.event_type = "NETWORK_DNS"
$Log_Type = $event.metadata.log_type
$Event_Type = $event.metadata.event_type
$DNS_Record_Type = $event.additional.fields["dns_record_type"]
$DNS_Record_Type != ""
$Return_Message = $event.additional.fields["dns_return_message"]
$Date = timestamp.get_timestamp($event.metadata.event_timestamp.seconds)
$Description = $event.metadata.description
match:
$Date, $Log_Type, $DNS_Record_Type, $Description, $Return_Message
order:
$Date desc
limit:
50
Falha na resposta de DNS ao longo do tempo
metadata.event_type = "NETWORK_DNS"
network.dns.response_code = 3
or network.dns.response_code = 5
$Denied = strings.concat(network.dns.response_code, " ")
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
match:
$Denied, $Date
outcome:
$Count = count(metadata.id)
order:
$Date desc
10 principais IPs de origem
$event.metadata.log_type = /EXTRAHOP_DNS|UMBRELLA_DNS/ nocase
$event.metadata.event_type = "NETWORK_DNS"
$Log_Type = $event.metadata.log_type
$Event_Type = $event.metadata.event_type
$Source_IP = $event.principal.ip
$Source_IP != ""
match:
$Source_IP, $Event_Type, $Log_Type
outcome:
$Count = count($event.metadata.id)
order:
$Count desc
limit:
10
Tipos de registros DNS ao longo do tempo
$event.metadata.log_type = /EXTRAHOP_DNS|UMBRELLA_DNS/ nocase
$event.metadata.event_type = "NETWORK_DNS"
$Record_Types = $event.additional.fields["dns_record_type"]
$Date = timestamp.get_date($event.metadata.event_timestamp.seconds)
match:
$Record_Types, $Date
outcome:
$Count = count($event.metadata.id)
order:
$Date asc
Total de eventos de DNS por tipo de registro
metadata.event_type = "NETWORK_DNS"
$Log_Type = metadata.log_type
match:
$Log_Type
outcome:
$Count = count(metadata.id)
order:
$Count desc
Volume total de registros de eventos DNS ao longo do tempo
$event.metadata.log_type = /EXTRAHOP_DNS|UMBRELLA_DNS/ nocase
$event.metadata.event_type = "NETWORK_DNS"
$Log_Type = $event.metadata.log_type
$Date = timestamp.get_date($event.metadata.event_timestamp.seconds)
match:
$Date, $Log_Type
outcome:
$Count = count($event.metadata.id)
order:
$Date asc
Falha na resposta de DNS ao longo do tempo
$event.metadata.log_type = /EXTRAHOP_DNS|UMBRELLA_DNS/ nocase
$event.network.dns.response_code = 3
or $event.network.dns.response_code = 5
$event.metadata.event_type = "NETWORK_DNS"
$Denied = $event.network.dns.response_code
$Date = timestamp.get_date($event.metadata.event_timestamp.seconds)
match:
$Denied, $Date
outcome:
$Count = count($event.metadata.id)
order:
$Date asc
Detalhamento dos tipos de registros DNS
metadata.event_type = "NETWORK_DNS"
$Log_Type = metadata.log_type
$Event_Type = metadata.event_type
$Source_IP = principal.ip
$Hostname = principal.hostname
$DNS_Record_Type = strings.coalesce(additional.fields["dns_record_type"], extracted.fields["query_type"], extracted.fields["qtype_name"])
$Return_Message = additional.fields["dns_return_message"]
$Date = timestamp.get_timestamp(metadata.event_timestamp.seconds)
$Description = strings.coalesce(metadata.description, security_result.summary)
match:
$Date, $Log_Type, $Source_IP, $Hostname, $DNS_Record_Type, $Description, $Return_Message
order:
$Date desc
10 principais IPs de origem
metadata.event_type = "NETWORK_DNS"
$Log_Type = metadata.log_type
$Source_IP = principal.ip
match:
$Source_IP, $Log_Type
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
Consultas DNS por tipo de registro
metadata.event_type = "NETWORK_DNS"
network.dns.questions.name != ""
$Record_Types = strings.coalesce(additional.fields["dns_record_type"], extracted.fields["query_type"], extracted.fields["qtype_name"])
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
match:
$Date, $Record_Types
outcome:
$Count = count(metadata.id)
order:
$Date desc
Total de hosts que geram relatórios
metadata.event_type = "NETWORK_DNS"
outcome:
$Count = count_distinct(principal.hostname)
Consultas de DNS ao longo do tempo
metadata.event_type = "NETWORK_DNS"
network.dns.questions.name != ""
$Log_Type = metadata.log_type
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
match:
$Date, $Log_Type
outcome:
$Count = count(network.dns.questions.name)
order:
$Date desc
Resposta DNS bem-sucedida ao longo do tempo
metadata.event_type = "NETWORK_DNS"
network.dns.response = true
$Answered = network.dns.response
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
match:
$Date, $Answered
outcome:
$Count = count(metadata.id)
order:
$Date desc
Atividades comuns de DNS
$event.metadata.log_type = /EXTRAHOP_DNS|UMBRELLA_DNS/ nocase
$event.metadata.event_type = "NETWORK_DNS"
$Log_Type = $event.metadata.log_type
$Source_IP = $event.principal.ip
$Description = $event.metadata.description
$DQ_Name = $event.network.dns.questions.name
match:
$Source_IP, $Description, $DQ_Name
outcome:
$Count = count($event.metadata.id)
order:
$Count desc
limit:
50
As 10 principais consultas DNS por local
metadata.event_type = "NETWORK_DNS"
network.dns.questions.name != ""
$Questions_Name = network.dns.questions.name
$Country = principal.ip_geo_artifact.location.country_or_region
$Latitude = principal.ip_geo_artifact.location.region_latitude
$Longitude = principal.ip_geo_artifact.location.region_longitude
match:
$Questions_Name, $Country, $Latitude, $Longitude
outcome:
$Count = count(metadata.id)
limit:
10
Ingestão e integridade de dados
Esse painel oferece insights importantes sobre o fluxo de dados, mostrando eventos ingeridos e contagens de erros para uma visibilidade clara de possíveis problemas. Ele inclui
visualizações da distribuição de tipos de registros e do status dos eventos ingeridos,
além da atividade de ingestão recente e informações diárias de registros. Ao rastrear a capacidade de processamento de ingestão em vários períodos, o painel ajuda a identificar tendências e problemas, melhorando a capacidade da sua organização de gerenciar a ingestão de dados e manter as operações funcionando sem problemas.
Registro do agente do Bindplane: registros por gravidade ao longo do tempo
Número de dias desde que os hosts informaram um evento (últimos sete dias)
Registro do agente do Bindplane: mensagens por contagem
Nome do gráfico
Exemplo de consulta
Registro do agente do Bindplane: registros por gravidade ao longo do tempo
metadata.log_type = "BINDPLANE_AGENT"
metadata.ingestion_labels.key = "ingestion_source"
metadata.ingestion_labels.value = $agent
metadata.description = $message
security_result.severity = $severity
timestamp.get_timestamp(metadata.event_timestamp.seconds) = $timestamp
match:
$severity, $timestamp
outcome:
$total = count(metadata.id)
order :
$severity
Número de dias desde que os hosts informaram um evento (últimos sete dias)
$host = principal.hostname
$event_time = metadata.event_timestamp.seconds
match:
$host
outcome:
$last_seen_timestamp = timestamp.get_timestamp(max($event_time))
$days_since_last_seen = math.round((timestamp.current_seconds() - max($event_time)) / 86400, 0)
order:
$days_since_last_seen desc
Registro do agente do Bindplane: mensagens por contagem
metadata.log_type = "BINDPLANE_AGENT"
metadata.ingestion_labels.key = "ingestion_source"
metadata.ingestion_labels.value = $agent
metadata.description = $message
security_result.severity = $severity
match:
$severity, $message
outcome:
$total = count(metadata.id)
$first_seen = timestamp.get_timestamp(min(metadata.event_timestamp.seconds))
$last_seen = timestamp.get_timestamp(max(metadata.event_timestamp.seconds))
Prevenção contra perda de dados
Esse painel fornece métricas importantes relacionadas a eventos da DLP.
10 principais usuários
Tentativas de acesso a dados sensíveis
Tendência de eventos da DLP ao longo do tempo
Eventos por ação
Violações da DLP por gravidade
Os 10 principais tipos de eventos de violação da política de DLP
Violações da DLP ao longo do tempo
10 principais hosts
10 principais regras da DLP
Os 10 principais usuários por tentativas de exfiltração de dados
10 principais arquivos
Nome do gráfico
Exemplo de consulta
10 principais usuários
$log_type = metadata.log_type
$log_type = /DLP/ nocase
$user= strings.coalesce(principal.user.user_display_name,principal.user.userid)
$user != ""
match:
$user
outcome:
$user_count = count(metadata.id)
order:
$user_count desc
limit: 10
Tentativas de acesso a dados sensíveis
$log_type = metadata.log_type
$log_type = /DLP/ nocase
$event_type = metadata.event_type
$security_event_type = metadata.product_event_type
$security_event_type = /Sensitive/
$user = strings.coalesce(principal.user.user_display_name,principal.user.userid)
$action = security_result.action_details
$hostname = principal.hostname
$src_ip = principal.ip
$file_path = target.file.full_path
match:
$user,$action,$src_ip,$hostname,$file_path
outcome:
$event_count = count(metadata.id)
order:
$event_count desc
Tendência de eventos da DLP ao longo do tempo
$date = timestamp.get_date(metadata.event_timestamp.seconds)
$log_type = metadata.log_type
$log_type = /DLP/ nocase
match:
$date
outcome:
$event_count = count(metadata.id)
Eventos por ação
$log_type = metadata.log_type
$log_type = /DLP/ nocase
$action = security_result.action_details
$action != ""
match:
$action
outcome:
$event_count = count(metadata.id)
order:
$action asc
Violações da DLP por gravidade
$date = timestamp.get_date(metadata.event_timestamp.seconds)
$log_type=metadata.log_type
$log_type = /DLP/ nocase
$severity =security_result.severity
$security_event_type=metadata.product_event_type
$security_event_type = /Violation/ nocase
match:
$severity
outcome:
$count = count(metadata.id)
order:
$severity desc
Os 10 principais tipos de eventos de violação da política de DLP
$log_type = metadata.log_type
$log_type = /DLP/ nocase
$event_type = metadata.product_event_type
$user = principal.user.user_display_name
$reason = strings.coalesce(security_result.summary,metadata.description,metadata.product_event_type)
$reason = /violation/ nocase
match:
$event_type
outcome:
$event_count = count(metadata.id)
$Count_user = count_distinct($user)
order:
$event_count desc
limit:
10
Violações da DLP ao longo do tempo
$date = timestamp.get_date(metadata.event_timestamp.seconds)
$log_type=metadata.log_type
$log_type = /DLP/ nocase
$security_event_type=metadata.product_event_type
$security_event_type = /Violation/ nocase
match:
$date
outcome:
$count = count(metadata.id)
order:
$date asc
10 principais hosts
$log_type = metadata.log_type
$log_type = /DLP/ nocase
$hostname= strings.coalesce(principal.hostname, principal.asset.hostname)
$hostname != ""
match:
$hostname
outcome:
$event_count = count(metadata.id)
order:
$event_count desc
limit: 10
10 principais regras da DLP
$log_type = metadata.log_type
$log_type = /DLP/
$rule_name = security_result.rule_name
$rule_name != ""
match:
$rule_name
outcome:
$event_count = count(metadata.id)
order:
$event_count desc
limit: 10
Os 10 principais usuários por tentativas de exfiltração de dados
$log_type = metadata.log_type
$log_type = /DLP/ nocase
$user = strings.coalesce(principal.user.user_display_name,principal.user.userid)
$user !=""
$reason = strings.coalesce(metadata.product_event_type,security_result.summary,metadata.description)
$reason = /exfiltration/ nocase
$action = security_result.action_details
match:
$user
outcome:
$Action = array_distinct($action)
$Reason = array_distinct($reason)
$event_count = count(metadata.id)
order:
$event_count desc
limit:
10
10 principais arquivos
$log_type = metadata.log_type
$log_type = /DLP/
$file_name = strings.coalesce(target.file.full_path, additional.fields["fname"])
match:
$file_name
outcome:
$event_count = count(metadata.id)
order:
$event_count desc
limit: 10
Monitoramento da segurança de dados
Esse painel oferece uma visão abrangente dos eventos de segurança fornecidos por ferramentas de segurança de dados, com foco em métricas como gravidade do evento, ações realizadas e regras de ativação. Ele rastreia os principais hosts, usuários e padrões geográficos para identificar ameaças e tendências emergentes.
Eventos por gravidade
Eventos ao longo do tempo por tipo de registro
Eventos por ação
Mapa de calor de geolocalização de origem
Distribuição de tipos de evento
Total de eventos
Os 10 principais eventos por descrição
10 principais nomes de host de origem
10 principais nomes de usuário de origem
10 principais regras de produtos de segurança de dados acionadas
Nome do gráfico
Exemplo de consulta
Eventos por gravidade
metadata.log_type = /ARUBA_CENTRAL|CLOUDFLARE_WARP|DELL_CYBERSENSE|FORGEROCK_OPENIDM|IMPERVA_DRA|IMPERVA_SECURESPHERE|IBM_OPENPAGES|INTEL471_WATCHER_ALERTS|OKERA_DAP|OPENCANARY|RUBRIK_POLARIS|SENTRY|TINES|TINTRI|VARONIS/ nocase
$Severity = security_result.severity
match:
$Severity
outcome:
$Count = count(metadata.id)
order:
$Count desc
Eventos ao longo do tempo por tipo de registro
$Log_Type = metadata.log_type
$Log_Type = /ARUBA_CENTRAL|CLOUDFLARE_WARP|DELL_CYBERSENSE|FORGEROCK_OPENIDM|IMPERVA_DRA|IMPERVA_SECURESPHERE|IBM_OPENPAGES|INTEL471_WATCHER_ALERTS|OKERA_DAP|OPENCANARY|RUBRIK_POLARIS|SENTRY|TINES|TINTRI|VARONIS/ nocase
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
match:
$Date, $Log_Type
outcome:
$Count = count(metadata.id)
order:
$Date asc
Eventos por ação
metadata.log_type = /ARUBA_CENTRAL|CLOUDFLARE_WARP|DELL_CYBERSENSE|FORGEROCK_OPENIDM|IMPERVA_DRA|IMPERVA_SECURESPHERE|IBM_OPENPAGES|INTEL471_WATCHER_ALERTS|OKERA_DAP|OPENCANARY|RUBRIK_POLARIS|SENTRY|TINES|TINTRI|VARONIS/ nocase
$Action = security_result.action
match:
$Action
outcome:
$Count = count(metadata.id)
order:
$Count desc
Mapa de calor de geolocalização de origem
metadata.log_type = /ARUBA_CENTRAL|CLOUDFLARE_WARP|DELL_CYBERSENSE|FORGEROCK_OPENIDM|IMPERVA_DRA|IMPERVA_SECURESPHERE|IBM_OPENPAGES|INTEL471_WATCHER_ALERTS|OKERA_DAP|OPENCANARY|RUBRIK_POLARIS|SENTRY|TINES|TINTRI|VARONIS/ nocase
$Country = principal.ip_geo_artifact.location.country_or_region
match:
$Country
outcome:
$Count = count(metadata.id)
$Latitude = max(principal.ip_geo_artifact.location.region_latitude)
$Longitude = max(principal.ip_geo_artifact.location.region_longitude)
order:
$Count desc
Distribuição de tipos de evento
metadata.log_type = /ARUBA_CENTRAL|CLOUDFLARE_WARP|DELL_CYBERSENSE|FORGEROCK_OPENIDM|IMPERVA_DRA|IMPERVA_SECURESPHERE|IBM_OPENPAGES|INTEL471_WATCHER_ALERTS|OKERA_DAP|OPENCANARY|RUBRIK_POLARIS|SENTRY|TINES|TINTRI|VARONIS/ nocase
$Event_Type = metadata.event_type
match:
$Event_Type
outcome:
$Count = count(metadata.id)
order:
$Count desc
Total de eventos
metadata.log_type = /ARUBA_CENTRAL|CLOUDFLARE_WARP|DELL_CYBERSENSE|FORGEROCK_OPENIDM|IMPERVA_DRA|IMPERVA_SECURESPHERE|IBM_OPENPAGES|INTEL471_WATCHER_ALERTS|OKERA_DAP|OPENCANARY|RUBRIK_POLARIS|SENTRY|TINES|TINTRI|VARONIS/
outcome:
$Count = count(metadata.id)
Os 10 principais eventos por descrição
metadata.log_type = /ARUBA_CENTRAL|CLOUDFLARE_WARP|DELL_CYBERSENSE|FORGEROCK_OPENIDM|IMPERVA_DRA|IMPERVA_SECURESPHERE|IBM_OPENPAGES|INTEL471_WATCHER_ALERTS|OKERA_DAP|OPENCANARY|RUBRIK_POLARIS|SENTRY|TINES|TINTRI|VARONIS/ nocase
$Summary = strings.coalesce(metadata.description,security_result.description,security_result.summary)
$Summary != ""
match:
$Summary
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
10 principais nomes de host de origem
metadata.log_type = /ARUBA_CENTRAL|CLOUDFLARE_WARP|DELL_CYBERSENSE|FORGEROCK_OPENIDM|IMPERVA_DRA|IMPERVA_SECURESPHERE|IBM_OPENPAGES|INTEL471_WATCHER_ALERTS|OKERA_DAP|OPENCANARY|RUBRIK_POLARIS|SENTRY|TINES|TINTRI|VARONIS/ nocase
$Hostname= strings.coalesce(principal.hostname, principal.asset.hostname)
$Hostname!=""
match:
$Hostname
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
10 principais nomes de usuário de origem
metadata.log_type = /ARUBA_CENTRAL|CLOUDFLARE_WARP|DELL_CYBERSENSE|FORGEROCK_OPENIDM|IMPERVA_DRA|IMPERVA_SECURESPHERE|IBM_OPENPAGES|INTEL471_WATCHER_ALERTS|OKERA_DAP|OPENCANARY|RUBRIK_POLARIS|SENTRY|TINES|TINTRI|VARONIS/ nocase
$User = strings.coalesce(principal.user.user_display_name, principal.user.userid, principal.user.email_addresses)
$User != ""
match:
$User
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
10 principais regras de produtos de segurança de dados acionadas
metadata.log_type = /ARUBA_CENTRAL|CLOUDFLARE_WARP|DELL_CYBERSENSE|FORGEROCK_OPENIDM|IMPERVA_DRA|IMPERVA_SECURESPHERE|IBM_OPENPAGES|INTEL471_WATCHER_ALERTS|OKERA_DAP|OPENCANARY|RUBRIK_POLARIS|SENTRY|TINES|TINTRI|VARONIS/ nocase
$Rule_Name = security_result.rule_name
$Rule_Name !=""
match:
$Rule_Name
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
Monitoramento do banco de dados
Esse painel oferece visibilidade detalhada das operações, da segurança, da performance e da integridade do banco de dados ao rastrear atividades do usuário, instruções SQL executadas, tendências de login e gravidades de eventos. Isso ajuda a identificar comportamentos incomuns, garantir a eficiência operacional e gerenciar proativamente os riscos em ambientes de banco de dados.
Observação : aplique filtros com base em tipos de registros específicos para mostrar resultados relevantes no
painel.
Eventos por ação
Objetos por gravidade
Falhas na tentativa de login ao longo do tempo
Os 10 principais usuários por instruções CREATE
Acesso privilegiado concedido
Os 10 principais usuários por instruções DROP
10 principais caminhos de arquivos relacionados a bancos de dados
Operações de arquivo recentes
Usuários recentes por instruções CREATE
Tentativas de login com falha recentes
Instruções DDL
10 principais instruções executadas
Tentativas de login bem-sucedidas recentes
Usuários recentes por conexões de banco de dados
Tentativas de login bem-sucedidas ao longo do tempo
Benefícios ao longo do tempo
Tráfego de aplicativos ao longo do tempo
Usuários recentes por instruções DROP
Instruções DDL ao longo do tempo por tipo de registro
Eventos de banco de dados por aplicativo
Distribuição de gravidade
Nome do gráfico
Exemplo de consulta
Eventos por ação
$Action = security_result.action
match:
$Action
outcome:
$Count = count(metadata.id)
order:
$Count desc
Objetos por gravidade
$Object_id = strings.coalesce(target.resource.product_object_id, principal.resource.product_object_id)
$Object_id != ""
$Severity = security_result.severity
$User = strings.coalesce(principal.user.userid, principal.user.user_display_name, principal.user.email_addresses, target.user.userid, target.user.user_display_name, target.user.email_addresses)
$Summary = strings.coalesce(target.process.command_line, security_result.action_details, security_result.description, extracted.fields["textPayload"], extracted.fields["cmd_line"])
$IP = strings.coalesce(principal.ip, principal.asset.ip, target.ip, target.asset.ip)
$Log_Type = metadata.log_type
match:
$Object_id, $Summary, $User, $IP, $Severity, $Log_Type
outcome:
$Count = count(metadata.id)
$Date = timestamp.get_timestamp(max(metadata.event_timestamp.seconds), "%F %T")
order:
$Count desc
Falhas na tentativa de login ao longo do tempo
((metadata.event_type = "USER_LOGIN" and security_result.action = "BLOCK") or (metadata.event_type = "GENERIC_EVENT" and (extracted.fields["token_metadata.event_type"] = "DB_LOGIN_FAILED")))
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
$Log_Type = metadata.log_type
match:
$Date, $Log_Type
outcome:
$Count = count(metadata.id)
order:
$Date asc
Os 10 principais usuários por instruções CREATE
(target.process.command_line = /create/ nocase or extracted.fields["textPayload"] = /create/ nocase or additional.fields["statement"] = /create/ nocase or security_result.description = /create/ nocase or metadata.product_event_type = /create/ nocase)
$User = strings.coalesce(principal.user.userid, principal.user.user_display_name, principal.user.email_addresses, target.user.userid, target.user.user_display_name, target.user.email_addresses)
$Log_Type = metadata.log_type
match:
$User, $Log_Type
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
Acesso privilegiado concedido
$Summary = strings.coalesce(if (target.process.command_line = /grant|revoke|(alter|create|drop|delete)\s+(user|role|database|server\s+role|login|table|trigger|function)|set\s+(role|password)|rename|backup|restore|impersonate|superuser/ nocase,target.process.command_line, ""),
if (extracted.fields["textPayload"] = /grant|revoke|(alter|create|drop|delete)\s+(user|role|database|server\s+role|login|table|trigger|function)|set\s+(role|password)|rename|backup|restore|impersonate|superuser/ nocase,extracted.fields["textPayload"], ""),
if (additional.fields["statement"] = /grant|revoke|(alter|create|drop|delete)\s+(user|role|database|server\s+role|login|table|trigger|function)|set\s+(role|password)|rename|backup|restore|impersonate|superuser/ nocase,additional.fields["statement"], ""),
if (security_result.description = /grant|revoke|(alter|create|drop|delete)\s+(user|role|database|server\s+role|login|table|trigger|function)|set\s+(role|password)|rename|backup|restore|impersonate|superuser/ nocase,security_result.description, ""),
if (metadata.product_event_type = /grant|revoke|(alter|create|drop|delete)\s+(user|role|database|server\s+role|login|table|trigger|function)|set\s+(role|password)|rename|backup|restore|impersonate|superuser/ nocase, strings.concat(metadata.product_event_type, " : ", extracted.fields["cmd_line"]), ""))
$Summary != ""
$User = strings.coalesce(principal.user.userid, principal.user.user_display_name, principal.user.email_addresses, target.user.userid, target.user.user_display_name, target.user.email_addresses)
$Hostname = strings.coalesce(principal.hostname, principal.asset.hostname, target.hostname, target.asset.hostname, target.resource.name)
$Log_Type = metadata.log_type
match:
$User, $Hostname, $Summary, $Log_Type
outcome:
$Count = count(metadata.id)
$Date = timestamp.get_timestamp(max(metadata.event_timestamp.seconds), "%F %T")
order:
$Count desc
Os 10 principais usuários por instruções DROP
(target.process.command_line = /drop/ nocase or extracted.fields["textPayload"] = /drop/ nocase or additional.fields["statement"] = /drop/ nocase or security_result.description = /drop/ nocase or metadata.product_event_type = /drop/ nocase)
$User = strings.coalesce(principal.user.userid, principal.user.user_display_name, principal.user.email_addresses, target.user.userid, target.user.user_display_name, target.user.email_addresses)
$Log_Type = metadata.log_type
match:
$User, $Log_Type
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
10 principais caminhos de arquivos relacionados a bancos de dados
$File_Path = target.file.full_path
$File_Path != ""
$Log_Type = metadata.log_type
match:
$File_Path, $Log_Type
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
Operações de arquivo recentes
$File = target.file.full_path
$File != ""
$Summary = strings.coalesce(target.process.command_line, security_result.description, security_result.action_details, extracted.fields["textPayload"], extracted.fields["cmd_line"])
$User = strings.coalesce(principal.user.userid, principal.user.user_display_name, principal.user.email_addresses, target.user.userid, target.user.user_display_name, target.user.email_addresses)
$Log_Type = metadata.log_type
match:
$User, $File, $Summary, $Log_Type
outcome:
$Count = count(metadata.id)
$Date = timestamp.get_timestamp(max(metadata.event_timestamp.seconds), "%F %T")
order:
$Count desc
Usuários recentes por instruções CREATE
$Summary = strings.coalesce(if (target.process.command_line = /create/ nocase, target.process.command_line, ""),
if (extracted.fields["textPayload"] = /create/ nocase, extracted.fields["textPayload"], ""),
if (additional.fields["statement"] = /create/ nocase, additional.fields["statement"], ""),
if (security_result.description = /create/ nocase, security_result.description, "" ),
if (metadata.product_event_type = /create/ nocase, strings.concat(metadata.product_event_type, " : " ,extracted.fields["cmd_line"]), ""))
$Summary != ""
$User = strings.coalesce(principal.user.userid, principal.user.user_display_name, principal.user.email_addresses, target.user.userid, target.user.user_display_name, target.user.email_addresses)
$Hostname = strings.coalesce(principal.hostname, principal.asset.hostname, target.hostname, target.asset.hostname, target.resource.name)
$Log_Type = metadata.log_type
match:
$User, $Hostname, $Summary, $Log_Type
outcome:
$Count = count(metadata.id)
$Date = timestamp.get_timestamp(max(metadata.event_timestamp.seconds), "%F %T")
order:
$Count desc
Tentativas de login com falha recentes
((metadata.event_type = "USER_LOGIN" and security_result.action = "BLOCK") or (metadata.event_type = "GENERIC_EVENT" and (extracted.fields["token_metadata.event_type"] = "DB_LOGIN_FAILED")))
$Log_Type = metadata.log_type
$User = strings.coalesce(principal.user.userid, principal.user.user_display_name, principal.user.email_addresses, target.user.userid, target.user.user_display_name, target.user.email_addresses)
$Hostname = strings.coalesce(principal.hostname, principal.asset.hostname, target.hostname, target.asset.hostname, target.resource.name)
$Summary = strings.coalesce(extracted.fields["textPayload"], extracted.fields["cmd_line"], principal.user.attribute.permissions.name, security_result.action_details, security_result.description)
match:
$User, $Hostname, $Summary, $Log_Type
outcome:
$Count = count(metadata.id)
$Date = timestamp.get_timestamp(max(metadata.event_timestamp.seconds), "%F %T")
order:
$Count desc
Instruções DDL
$DDL_Statements = strings.coalesce(if (target.process.command_line = /alter|create|drop|rename|truncate|comment/ nocase, target.process.command_line, ""),
if (extracted.fields["textPayload"] = /alter|create|drop|rename|truncate|comment/ nocase, extracted.fields["textPayload"], ""),
if (additional.fields["statement"] = /alter|create|drop|rename|truncate|comment/ nocase, additional.fields["statement"], ""),
if (security_result.description = /alter|create|drop|rename|truncate|comment/ nocase, security_result.description, "" ),
if (metadata.product_event_type = /alter|create|drop|rename|truncate|comment/ nocase, strings.concat(metadata.product_event_type, " : " ,extracted.fields["cmd_line"]), ""))
$DDL_Statements != ""
$User = strings.coalesce(principal.user.userid, principal.user.user_display_name, principal.user.email_addresses, target.user.userid, target.user.user_display_name, target.user.email_addresses)
$Hostname = strings.coalesce(principal.hostname, principal.asset.hostname, target.hostname, target.asset.hostname, target.resource.name)
$Log_Type = metadata.log_type
match:
$DDL_Statements, $User, $Hostname, $Log_Type
outcome:
$Count = count(metadata.id)
$Date = timestamp.get_timestamp(max(metadata.event_timestamp.seconds), "%F %T")
order:
$Count desc
10 principais instruções executadas
$Command_Line = strings.coalesce(target.process.command_line, extracted.fields["textPayload"], additional.fields["statement"], extracted.fields["cmd_line"] security_result.description)
$Log_Type = metadata.log_type
match:
$Command_Line ,$Log_Type
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
Tentativas de login bem-sucedidas recentes
((metadata.event_type = "USER_LOGIN" and security_result.action = "ALLOW") or (metadata.event_type = "GENERIC_EVENT" and (extracted.fields["token_metadata.event_type"] = "DB_LOGIN_SUCCESS")))
$Log_Type = metadata.log_type
$User = strings.coalesce(principal.user.userid, principal.user.user_display_name, principal.user.email_addresses, target.user.userid, target.user.user_display_name, target.user.email_addresses)
$Hostname = strings.coalesce(principal.hostname, principal.asset.hostname, target.hostname, target.asset.hostname, target.resource.name)
$Summary = strings.coalesce(extracted.fields["textPayload"], extracted.fields["cmd_line"], principal.user.attribute.permissions.name, security_result.action_details, security_result.description)
match:
$User, $Hostname, $Summary, $Log_Type
outcome:
$Count = count(metadata.id)
$Date = timestamp.get_timestamp(max(metadata.event_timestamp.seconds), "%F %T")
order:
$Count desc
Usuários recentes por conexões de banco de dados
(metadata.product_event_type = /connection/ nocase or security_result.description = /Connection/ nocase or additional.fields["operation_name"]= /Connection/ nocase or extracted.fields["textPayload"] = /connection/ nocase or additional.fields["ctx"] = /conn/ nocase)
$User = strings.coalesce(principal.user.userid, principal.user.user_display_name, principal.user.email_addresses, target.user.userid, target.user.user_display_name, target.user.email_addresses)
$Summary = strings.coalesce(extracted.fields["textPayload"], security_result.description, security_result.action_details, metadata.description)
$Hostname = strings.coalesce(principal.hostname, principal.asset.hostname, target.hostname, target.asset.hostname, target.resource.name)
$Log_Type = metadata.log_type
match:
$User, $Hostname, $Summary, $Log_Type
outcome:
$Count = count(metadata.id)
$Date = timestamp.get_timestamp(max(metadata.event_timestamp.seconds), "%F %T")
order:
$Count desc
Tentativas de login bem-sucedidas ao longo do tempo
((metadata.event_type = "USER_LOGIN" and security_result.action = "ALLOW") or (metadata.event_type = "GENERIC_EVENT" and (extracted.fields["token_metadata.event_type"] = "DB_LOGIN_SUCCESS")))
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
$Log_Type = metadata.log_type
match:
$Date, $Log_Type
outcome:
$Count = count(metadata.id)
order:
$Date asc
Benefícios ao longo do tempo
(target.process.command_line = /grant/ nocase or extracted.fields["textPayload"] = /grant/ nocase or additional.fields["statement"] = /grant/ nocase or security_result.description = /grant/ nocase or metadata.product_event_type = /grant/ nocase)
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
$Log_Type = metadata.log_type
match:
$Date, $Log_Type
outcome:
$Count = count(metadata.id)
order:
$Date asc
Tráfego de aplicativos ao longo do tempo
$Application = target.application
$Application != ""
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
match:
$Application, $Date
outcome:
$Count = count(metadata.id)
order:
$Date asc
Usuários recentes por instruções DROP
$Summary = strings.coalesce(if (target.process.command_line = /drop/ nocase, additional.fields["statement"], ""),
if (extracted.fields["textPayload"] = /drop/ nocase, extracted.fields["textPayload"], ""),
if (additional.fields["statement"] = /drop/ nocase, additional.fields["statement"], ""),
if (security_result.description = /drop/ nocase, security_result.description, "" ),
if (metadata.product_event_type = /drop/ nocase, strings.concat(metadata.product_event_type, " : " ,extracted.fields["cmd_line"]), ""))
$Summary != ""
$User = strings.coalesce(principal.user.userid, principal.user.user_display_name, principal.user.email_addresses, target.user.userid, target.user.user_display_name, target.user.email_addresses)
$Hostname = strings.coalesce(principal.hostname, principal.asset.hostname, target.hostname, target.asset.hostname, target.resource.name)
$Log_Type = metadata.log_type
match:
$User, $Hostname, $Summary, $Log_Type
outcome:
$Count = count(metadata.id)
$Date = timestamp.get_timestamp(max(metadata.event_timestamp.seconds), "%F %T")
order:
$Count desc
Instruções DDL ao longo do tempo por tipo de registro
(target.process.command_line = /alter|create|drop|rename|truncate|comment/ nocase or extracted.fields["textPayload"] = /alter|create|drop|rename|truncate|comment/ nocase or additional.fields["statement"] = /alter|create|drop|rename|truncate|comment/ nocase or security_result.description = /alter|create|drop|rename|truncate|comment/ nocase or metadata.product_event_type = /alter|create|drop|rename|truncate|comment/ nocase)
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
$Log_Type = metadata.log_type
match:
$Date, $Log_Type
outcome:
$Count = count(metadata.id)
order:
$Date asc
Eventos de banco de dados por aplicativo
$Application = target.application
$Application != ""
$Log_Type = metadata.log_type
$User = strings.coalesce(principal.user.userid, principal.user.user_display_name, principal.user.email_addresses, target.user.userid, target.user.user_display_name, target.user.email_addresses)
$Hostname = strings.coalesce(principal.hostname, principal.asset.hostname, target.hostname, target.asset.hostname, target.resource.name)
$Summary = strings.coalesce(extracted.fields["textPayload"], extracted.fields["cmd_line"],target.process.command_line, security_result.action_details, security_result.description)
match:
$Application, $Summary, $User, $Hostname, $Log_Type
outcome:
$Count = count(metadata.id)
$Date = timestamp.get_timestamp(max(metadata.event_timestamp.seconds), "%F %T")
order:
$Count desc
Distribuição de gravidade
$Severity = security_result.severity
match:
$Severity
outcome:
$Count = count(metadata.id)
order:
$Count desc
Monitoramento de engano
Esse painel oferece uma visão geral abrangente das atividades relacionadas a fraudes, com insights sobre tendências, padrões e comportamentos de eventos. Ele também destaca áreas de alto risco nas redes de isca, permitindo que as equipes de segurança analisem, monitorem e respondam a ameaças de maneira eficaz.
Observação : aplique filtros com base em tipos de registros específicos para mostrar resultados relevantes no
painel.
10 principais IPs de destino
10 principais IPs de origem
Eventos ao longo do tempo por tipo de registro
10 principais portas e protocolos
Visão geral da geolocalização de origem
10 principais nomes de host de destino
Detalhamento da fase da Kill Chain do chamariz (Zscaler Deception)
Os 10 principais usuários de origem
10 principais tipos de eventos por tipo de registro
10 principais tipos de recursos de chamariz segmentados (Zscaler Deception)
Os 10 principais chamarizes com pontuações de alto risco (Zscaler Deception)
Detalhamento da atividade por rede de chamariz (Zscaler Deception)
Eventos por gravidade
Nome do gráfico
Exemplo de consulta
10 principais IPs de destino
$Destination_IP = strings.coalesce(target.ip, target.asset.ip)
$Log_Type = metadata.log_type
match:
$Destination_IP, $Log_Type
outcome:
$Count = count(metadata.id)
Order:
$Count desc
limit:
10
10 principais IPs de origem
$Source_IP = strings.coalesce(principal.ip, principal.asset.ip)
$Log_Type = metadata.log_type
match:
$Source_IP, $Log_Type
outcome:
$Count = count(metadata.id)
Order:
$Count desc
limit:
10
Eventos ao longo do tempo por tipo de registro
$Log_Type = metadata.log_type
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
match:
$Date, $Log_Type
outcome:
$Count = count(metadata.id)
10 principais portas e protocolos
$Port = target.port
match:
$Port
outcome:
$Protocol = array_distinct(network.application_protocol)
$Count = count(metadata.id)
order:
$Count desc
limit:
10
Visão geral da geolocalização de origem
$Country = principal.ip_geo_artifact.location.country_or_region
$Country != ""
match:
$Country
outcome:
$Count = count(metadata.id)
$Latitude = max(principal.ip_geo_artifact.location.region_latitude)
$Longitude = max(principal.ip_geo_artifact.location.region_longitude)
order:
$Count desc
10 principais nomes de host de destino
$Destination_Hostname = strings.coalesce(target.hostname,target.asset.hostname)
$Log_Type = metadata.log_type
match:
$Destination_Hostname, $Log_Type
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
Detalhamento da fase da Kill Chain do chamariz (Zscaler Deception)
$Kill_Chain = strings.coalesce(additional.fields["kill_chain_phase"],extracted.fields["kill_chain_phase"])
$Decoy_Server = strings.coalesce(additional.fields["decoy_recon_server_type"],extracted.fields["decoy_recon_server_type"])
$Attack_Type = strings.coalesce(additional.fields["decoy_recon_dataset_type"],extracted.fields["decoy_recon_dataset_type"])
$Source_User = strings.coalesce(principal.user.user_display_name, principal.user.userid, principal.user.email_addresses)
$Destination_Hostname = strings.coalesce(target.hostname, target.asset.hostname)
$Source_IP = strings.coalesce(principal.ip, principal.asset.ip)
$Destination_IP = strings.coalesce(target.ip, target.asset.ip)
$Log_Type = metadata.log_type
match:
$Kill_Chain ,$Decoy_Server ,$Attack_Type, $Destination_Hostname, $Source_User, $Source_IP, $Destination_IP, $Log_Type
outcome:
$Count = count(metadata.id)
$Date = timestamp.get_timestamp(max(metadata.event_timestamp.seconds), "%F %T")
order:
$Count desc
Os 10 principais usuários de origem
$Source_User = strings.coalesce(principal.user.userid, principal.user.email_addresses, principal.user.user_display_name)
$Log_Type = metadata.log_type
match:
$Source_User, $Log_Type
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
10 principais tipos de eventos por tipo de registro
$Log_Type = metadata.log_type
$Event_Type = metadata.event_type
match:
$Event_Type, $Log_Type
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
10 principais tipos de recursos de chamariz segmentados (Zscaler Deception)
$Resource_Type = target.resource.type
$Destination_Hostname = strings.coalesce(target.hostname, target.asset.hostname)
match:
$Resource_Type, $Destination_Hostname
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
Os 10 principais chamarizes com pontuações de alto risco (Zscaler Deception)
$Decoy_Server = strings.coalesce(additional.fields["decoy_recon_server_type"], extracted.fields["decoy_recon_server_type"])
$Attack_Type = strings.coalesce(additional.fields["decoy_recon_dataset_type"], extracted.fields["decoy_recon_dataset_type"])
$Risk_Score = security_result.risk_score
$Log_Type = metadata.log_type
match:
$Decoy_Server, $Attack_Type , $Risk_Score, $Log_Type
outcome:
$Count = count(metadata.id)
$Date = timestamp.get_timestamp(max(metadata.event_timestamp.seconds), "%F %T")
order:
$Risk_Score desc
limit :
10
Detalhamento da atividade por rede de chamariz (Zscaler Deception)
$Decoy_Network = strings.coalesce(additional.fields["decoy_network_name"],extracted.fields["decoy_network_name"])
$Attack_Type = strings.coalesce(additional.fields["decoy_recon_dataset_type"],extracted.fields["decoy_recon_dataset_type"])
$Log_Type = metadata.log_type
match:
$Decoy_Network, $Attack_Type, $Log_Type
outcome:
$Count = count(metadata.id)
$Date = timestamp.get_timestamp(max(metadata.event_timestamp.seconds), "%F %T")
order:
$Count desc
Eventos por gravidade
$Severity = security_result.severity
match:
$Severity
outcome:
$Count = count(metadata.id)
Visão geral dos alertas de EDR
Esse painel oferece uma visão abrangente de recursos, eventos e detecções de ameaças ativas, o que aumenta a visibilidade e o controle.
10 principais alertas de EDR
Total de alertas de EDR
Sensores EDR ativos
Os 10 principais hosts com base em alertas de EDR
Número de sensores de EDR
10 principais técnicas
Gravidade com base em alertas de EDR
10 principais táticas
Total de alertas de EDR ao longo do tempo
Os 10 principais usuários com base em alertas de EDR
Nome do gráfico
Exemplo de consulta
10 principais alertas de EDR
$event.metadata.log_type = /LIMACHARLIE_EDR|CS_EDR|CS_DETECTS|ESET_EDR|CHECKPOINT_EDR|SOPHOS_EDR|OSQUERY_EDR|DIGITALGUARDIAN_EDR|SENTINEL_DV|MICROSOFT_DEFENDER_ENDPOINT|SENTINEL_EDR|UPTYCS_EDR|SYMANTEC_EDR|FORTINET_FORTIEDR|REDCANARY_EDR|CYBEREASON_EDR|MICROSOFT_DEFENDER_IDENTITY|DEEP_INSTINCT_EDR|CB_EDR|PAN_EDR|FIREEYE_HX|WATCHGUARD_EDR/ nocase
$Log_Type = $event.metadata.log_type
$Detection = $event.security_result.summary
$Detection != ""
match:
$Detection, $Log_Type
outcome:
$Count = count($event.security_result.summary)
order:
$Count desc
limit:
10
10 principais alertas de EDR
$event.metadata.log_type = /LIMACHARLIE_EDR|CS_EDR|CS_DETECTS|ESET_EDR|CHECKPOINT_EDR|SOPHOS_EDR|OSQUERY_EDR|DIGITALGUARDIAN_EDR|SENTINEL_DV|MICROSOFT_DEFENDER_ENDPOINT|SENTINEL_EDR|UPTYCS_EDR|SYMANTEC_EDR|FORTINET_FORTIEDR|REDCANARY_EDR|CYBEREASON_EDR|MICROSOFT_DEFENDER_IDENTITY|DEEP_INSTINCT_EDR|CB_EDR|PAN_EDR|FIREEYE_HX|WATCHGUARD_EDR/ nocase
$Log_Type = $event.metadata.log_type
$Detection = $event.security_result.summary
$Detection != ""
match:
$Detection, $Log_Type
outcome:
$Count = count($event.security_result.summary)
order:
$Count desc
limit:
10
Total de alertas de EDR
$event.metadata.log_type = /LIMACHARLIE_EDR|CS_EDR|CS_DETECTS|ESET_EDR|CHECKPOINT_EDR|SOPHOS_EDR|OSQUERY_EDR|DIGITALGUARDIAN_EDR|SENTINEL_DV|MICROSOFT_DEFENDER_ENDPOINT|SENTINEL_EDR|UPTYCS_EDR|SYMANTEC_EDR|FORTINET_FORTIEDR|REDCANARY_EDR|CYBEREASON_EDR|MICROSOFT_DEFENDER_IDENTITY|DEEP_INSTINCT_EDR|CB_EDR|PAN_EDR|FIREEYE_HX|WATCHGUARD_EDR/ nocase
outcome:
$Count = count($event.security_result.summary)
Sensores EDR ativos
$event.metadata.log_type = /LIMACHARLIE_EDR|CS_EDR|CS_DETECTS|ESET_EDR|CHECKPOINT_EDR|SOPHOS_EDR|OSQUERY_EDR|DIGITALGUARDIAN_EDR|SENTINEL_DV|MICROSOFT_DEFENDER_ENDPOINT|SENTINEL_EDR|UPTYCS_EDR|SYMANTEC_EDR|FORTINET_FORTIEDR|REDCANARY_EDR|CYBEREASON_EDR|MICROSOFT_DEFENDER_IDENTITY|DEEP_INSTINCT_EDR|CB_EDR|PAN_EDR|FIREEYE_HX|WATCHGUARD_EDR/ nocase
$EDR_Asset = strings.coalesce($event.principal.asset.hostname, $event.principal.hostname)
$EDR_Asset != ""
match:
$EDR_Asset
limit:
50
Os 10 principais hosts com base em alertas de EDR
$event.metadata.log_type = /LIMACHARLIE_EDR|CS_EDR|CS_DETECTS|ESET_EDR|CHECKPOINT_EDR|SOPHOS_EDR|OSQUERY_EDR|DIGITALGUARDIAN_EDR|SENTINEL_DV|MICROSOFT_DEFENDER_ENDPOINT|SENTINEL_EDR|UPTYCS_EDR|SYMANTEC_EDR|FORTINET_FORTIEDR|REDCANARY_EDR|CYBEREASON_EDR|MICROSOFT_DEFENDER_IDENTITY|DEEP_INSTINCT_EDR|CB_EDR|PAN_EDR|FIREEYE_HX|WATCHGUARD_EDR/ nocase
$Hostname = strings.coalesce($event.principal.asset.hostname, $event.principal.hostname)
$Hostname != ""
match:
$Hostname
outcome:
$Count = count($event.security_result.summary)
order:
$Count desc
limit:
10
Número de sensores de EDR
$event.metadata.log_type = /LIMACHARLIE_EDR|CS_EDR|CS_DETECTS|ESET_EDR|CHECKPOINT_EDR|SOPHOS_EDR|OSQUERY_EDR|DIGITALGUARDIAN_EDR|SENTINEL_DV|MICROSOFT_DEFENDER_ENDPOINT|SENTINEL_EDR|UPTYCS_EDR|SYMANTEC_EDR|FORTINET_FORTIEDR|REDCANARY_EDR|CYBEREASON_EDR|MICROSOFT_DEFENDER_IDENTITY|DEEP_INSTINCT_EDR|CB_EDR|PAN_EDR|FIREEYE_HX|WATCHGUARD_EDR/ nocase
outcome:
$Count = count_distinct(strings.coalesce($event.principal.asset.hostname, $event.principal.hostname))
10 principais técnicas
$event.metadata.log_type = /LIMACHARLIE_EDR|CS_EDR|CS_DETECTS|ESET_EDR|CHECKPOINT_EDR|SOPHOS_EDR|OSQUERY_EDR|DIGITALGUARDIAN_EDR|SENTINEL_DV|MICROSOFT_DEFENDER_ENDPOINT|SENTINEL_EDR|UPTYCS_EDR|SYMANTEC_EDR|FORTINET_FORTIEDR|REDCANARY_EDR|CYBEREASON_EDR|MICROSOFT_DEFENDER_IDENTITY|DEEP_INSTINCT_EDR|CB_EDR|PAN_EDR|FIREEYE_HX|WATCHGUARD_EDR/ nocase
$Technique_ID = strings.coalesce($event.security_result.attack_details.techniques.id, $event.security_result.detection_fields["Technique ID"])
$Technique = strings.coalesce($event.security_result.attack_details.techniques.name, $event.security_result.detection_fields["Technique"])
$Technique_ID != ""
$Technique != ""
match:
$Technique_ID, $Technique
outcome:
$Count = count($event.security_result.summary)
order:
$Count desc
limit:
10
Gravidade com base em alertas de EDR
$event.metadata.log_type = /LIMACHARLIE_EDR|CS_EDR|CS_DETECTS|ESET_EDR|CHECKPOINT_EDR|SOPHOS_EDR|OSQUERY_EDR|DIGITALGUARDIAN_EDR|SENTINEL_DV|MICROSOFT_DEFENDER_ENDPOINT|SENTINEL_EDR|UPTYCS_EDR|SYMANTEC_EDR|FORTINET_FORTIEDR|REDCANARY_EDR|CYBEREASON_EDR|MICROSOFT_DEFENDER_IDENTITY|DEEP_INSTINCT_EDR|CB_EDR|PAN_EDR|FIREEYE_HX|WATCHGUARD_EDR/ nocase
$event.security_result.summary != ""
$Severity = $event.security_result.severity
match:
$Severity
outcome:
$Count = count($event.security_result.summary)
order:
$Severity asc
limit:
10
Gravidade com base em alertas de EDR
$event.metadata.log_type = /LIMACHARLIE_EDR|CS_EDR|CS_DETECTS|ESET_EDR|CHECKPOINT_EDR|SOPHOS_EDR|OSQUERY_EDR|DIGITALGUARDIAN_EDR|SENTINEL_DV|MICROSOFT_DEFENDER_ENDPOINT|SENTINEL_EDR|UPTYCS_EDR|SYMANTEC_EDR|FORTINET_FORTIEDR|REDCANARY_EDR|CYBEREASON_EDR|MICROSOFT_DEFENDER_IDENTITY|DEEP_INSTINCT_EDR|CB_EDR|PAN_EDR|FIREEYE_HX|WATCHGUARD_EDR/ nocase
$event.security_result.summary != ""
$Severity = $event.security_result.severity
match:
$Severity
outcome:
$Count = count($event.security_result.summary)
order:
$Severity asc
limit:
10
10 principais táticas
$event.metadata.log_type = /LIMACHARLIE_EDR|CS_EDR|CS_DETECTS|ESET_EDR|CHECKPOINT_EDR|SOPHOS_EDR|OSQUERY_EDR|DIGITALGUARDIAN_EDR|SENTINEL_DV|MICROSOFT_DEFENDER_ENDPOINT|SENTINEL_EDR|UPTYCS_EDR|SYMANTEC_EDR|FORTINET_FORTIEDR|REDCANARY_EDR|CYBEREASON_EDR|MICROSOFT_DEFENDER_IDENTITY|DEEP_INSTINCT_EDR|CB_EDR|PAN_EDR|FIREEYE_HX|WATCHGUARD_EDR/ nocase
$Tactic_ID = strings.coalesce($event.security_result.attack_details.tactics.id, $event.security_result.detection_fields["Tactic ID"])
$Tactic_Name = strings.coalesce($event.security_result.attack_details.tactics.name, $event.security_result.detection_fields["Tactic"])
$Tactic_ID != ""
$Tactic_Name != ""
match:
$Tactic_ID, $Tactic_Name
outcome:
$Count = count($event.security_result.summary)
order:
$Count desc
limit:
10
Total de alertas de EDR ao longo do tempo
$event.metadata.log_type = /LIMACHARLIE_EDR|CS_EDR|CS_DETECTS|ESET_EDR|CHECKPOINT_EDR|SOPHOS_EDR|OSQUERY_EDR|DIGITALGUARDIAN_EDR|SENTINEL_DV|MICROSOFT_DEFENDER_ENDPOINT|SENTINEL_EDR|UPTYCS_EDR|SYMANTEC_EDR|FORTINET_FORTIEDR|REDCANARY_EDR|CYBEREASON_EDR|MICROSOFT_DEFENDER_IDENTITY|DEEP_INSTINCT_EDR|CB_EDR|PAN_EDR|FIREEYE_HX|WATCHGUARD_EDR/ nocase
$Log_Type = $event.metadata.log_type
$Date = timestamp.get_date($event.metadata.event_timestamp.seconds)
match:
$Date, $Log_Type
outcome:
$Count = count($event.security_result.summary)
order:
$Date asc
Sensores EDR ativos
$event.metadata.log_type = /LIMACHARLIE_EDR|CS_EDR|CS_DETECTS|ESET_EDR|CHECKPOINT_EDR|SOPHOS_EDR|OSQUERY_EDR|DIGITALGUARDIAN_EDR|SENTINEL_DV|MICROSOFT_DEFENDER_ENDPOINT|SENTINEL_EDR|UPTYCS_EDR|SYMANTEC_EDR|FORTINET_FORTIEDR|REDCANARY_EDR|CYBEREASON_EDR|MICROSOFT_DEFENDER_IDENTITY|DEEP_INSTINCT_EDR|CB_EDR|PAN_EDR|FIREEYE_HX|WATCHGUARD_EDR/ nocase
$EDR_Asset = strings.coalesce($event.principal.asset.hostname, $event.principal.hostname)
$EDR_Asset != ""
match:
$EDR_Asset
limit:
50
Total de alertas de EDR ao longo do tempo
$event.metadata.log_type = /LIMACHARLIE_EDR|CS_EDR|CS_DETECTS|ESET_EDR|CHECKPOINT_EDR|SOPHOS_EDR|OSQUERY_EDR|DIGITALGUARDIAN_EDR|SENTINEL_DV|MICROSOFT_DEFENDER_ENDPOINT|SENTINEL_EDR|UPTYCS_EDR|SYMANTEC_EDR|FORTINET_FORTIEDR|REDCANARY_EDR|CYBEREASON_EDR|MICROSOFT_DEFENDER_IDENTITY|DEEP_INSTINCT_EDR|CB_EDR|PAN_EDR|FIREEYE_HX|WATCHGUARD_EDR/ nocase
$Log_Type = $event.metadata.log_type
$Date = timestamp.get_date($event.metadata.event_timestamp.seconds)
match:
$Date, $Log_Type
outcome:
$Count = count($event.security_result.summary)
order:
$Date asc
10 principais técnicas
$event.metadata.log_type = /LIMACHARLIE_EDR|CS_EDR|CS_DETECTS|ESET_EDR|CHECKPOINT_EDR|SOPHOS_EDR|OSQUERY_EDR|DIGITALGUARDIAN_EDR|SENTINEL_DV|MICROSOFT_DEFENDER_ENDPOINT|SENTINEL_EDR|UPTYCS_EDR|SYMANTEC_EDR|FORTINET_FORTIEDR|REDCANARY_EDR|CYBEREASON_EDR|MICROSOFT_DEFENDER_IDENTITY|DEEP_INSTINCT_EDR|CB_EDR|PAN_EDR|FIREEYE_HX|WATCHGUARD_EDR/ nocase
$Technique_ID = strings.coalesce($event.security_result.attack_details.techniques.id, $event.security_result.detection_fields["Technique ID"])
$Technique = strings.coalesce($event.security_result.attack_details.techniques.name, $event.security_result.detection_fields["Technique"])
$Technique_ID != ""
$Technique != ""
match:
$Technique_ID, $Technique
outcome:
$Count = count($event.security_result.summary)
order:
$Count desc
limit:
10
Os 10 principais usuários com base em alertas de EDR
$event.metadata.log_type = /LIMACHARLIE_EDR|CS_EDR|CS_DETECTS|ESET_EDR|CHECKPOINT_EDR|SOPHOS_EDR|OSQUERY_EDR|DIGITALGUARDIAN_EDR|SENTINEL_DV|MICROSOFT_DEFENDER_ENDPOINT|SENTINEL_EDR|UPTYCS_EDR|SYMANTEC_EDR|FORTINET_FORTIEDR|REDCANARY_EDR|CYBEREASON_EDR|MICROSOFT_DEFENDER_IDENTITY|DEEP_INSTINCT_EDR|CB_EDR|PAN_EDR|FIREEYE_HX|WATCHGUARD_EDR/ nocase
$User = $event.principal.user.user_display_name
$User != ""
match:
$User
outcome:
$Count = count($event.security_result.summary)
order:
$Count desc
limit:
10
Os 10 principais usuários com base em alertas de EDR
$event.metadata.log_type = /LIMACHARLIE_EDR|CS_EDR|CS_DETECTS|ESET_EDR|CHECKPOINT_EDR|SOPHOS_EDR|OSQUERY_EDR|DIGITALGUARDIAN_EDR|SENTINEL_DV|MICROSOFT_DEFENDER_ENDPOINT|SENTINEL_EDR|UPTYCS_EDR|SYMANTEC_EDR|FORTINET_FORTIEDR|REDCANARY_EDR|CYBEREASON_EDR|MICROSOFT_DEFENDER_IDENTITY|DEEP_INSTINCT_EDR|CB_EDR|PAN_EDR|FIREEYE_HX|WATCHGUARD_EDR/ nocase
$User = $event.principal.user.user_display_name
$User != ""
match:
$User
outcome:
$Count = count($event.security_result.summary)
order:
$Count desc
limit:
10
10 principais táticas
$event.metadata.log_type = /LIMACHARLIE_EDR|CS_EDR|CS_DETECTS|ESET_EDR|CHECKPOINT_EDR|SOPHOS_EDR|OSQUERY_EDR|DIGITALGUARDIAN_EDR|SENTINEL_DV|MICROSOFT_DEFENDER_ENDPOINT|SENTINEL_EDR|UPTYCS_EDR|SYMANTEC_EDR|FORTINET_FORTIEDR|REDCANARY_EDR|CYBEREASON_EDR|MICROSOFT_DEFENDER_IDENTITY|DEEP_INSTINCT_EDR|CB_EDR|PAN_EDR|FIREEYE_HX|WATCHGUARD_EDR/ nocase
$Tactic_ID = strings.coalesce($event.security_result.attack_details.tactics.id, $event.security_result.detection_fields["Tactic ID"])
$Tactic_Name = strings.coalesce($event.security_result.attack_details.tactics.name, $event.security_result.detection_fields["Tactic"])
$Tactic_ID != ""
$Tactic_Name != ""
match:
$Tactic_ID, $Tactic_Name
outcome:
$Count = count($event.security_result.summary)
order:
$Count desc
limit:
10
Total de alertas de EDR
$event.metadata.log_type = /LIMACHARLIE_EDR|CS_EDR|CS_DETECTS|ESET_EDR|CHECKPOINT_EDR|SOPHOS_EDR|OSQUERY_EDR|DIGITALGUARDIAN_EDR|SENTINEL_DV|MICROSOFT_DEFENDER_ENDPOINT|SENTINEL_EDR|UPTYCS_EDR|SYMANTEC_EDR|FORTINET_FORTIEDR|REDCANARY_EDR|CYBEREASON_EDR|MICROSOFT_DEFENDER_IDENTITY|DEEP_INSTINCT_EDR|CB_EDR|PAN_EDR|FIREEYE_HX|WATCHGUARD_EDR/ nocase
outcome:
$Count = count($event.security_result.summary)
Número de sensores de EDR
$event.metadata.log_type = /LIMACHARLIE_EDR|CS_EDR|CS_DETECTS|ESET_EDR|CHECKPOINT_EDR|SOPHOS_EDR|OSQUERY_EDR|DIGITALGUARDIAN_EDR|SENTINEL_DV|MICROSOFT_DEFENDER_ENDPOINT|SENTINEL_EDR|UPTYCS_EDR|SYMANTEC_EDR|FORTINET_FORTIEDR|REDCANARY_EDR|CYBEREASON_EDR|MICROSOFT_DEFENDER_IDENTITY|DEEP_INSTINCT_EDR|CB_EDR|PAN_EDR|FIREEYE_HX|WATCHGUARD_EDR/ nocase
outcome:
$Count = count_distinct(strings.coalesce($event.principal.asset.hostname, $event.principal.hostname))
Os 10 principais hosts com base em alertas de EDR
$event.metadata.log_type = /LIMACHARLIE_EDR|CS_EDR|CS_DETECTS|ESET_EDR|CHECKPOINT_EDR|SOPHOS_EDR|OSQUERY_EDR|DIGITALGUARDIAN_EDR|SENTINEL_DV|MICROSOFT_DEFENDER_ENDPOINT|SENTINEL_EDR|UPTYCS_EDR|SYMANTEC_EDR|FORTINET_FORTIEDR|REDCANARY_EDR|CYBEREASON_EDR|MICROSOFT_DEFENDER_IDENTITY|DEEP_INSTINCT_EDR|CB_EDR|PAN_EDR|FIREEYE_HX|WATCHGUARD_EDR/ nocase
$Hostname = strings.coalesce($event.principal.asset.hostname, $event.principal.hostname)
$Hostname != ""
match:
$Hostname
outcome:
$Count = count($event.security_result.summary)
order:
$Count desc
limit:
10
Visão geral da atividade de e-mail
Esse painel oferece um resumo detalhado do tráfego de e-mail, incluindo volumes totais, e-mails permitidos x bloqueados, remetentes únicos, destinatários únicos e estatísticas importantes sobre os principais remetentes e destinatários. Ele oferece insights valiosos sobre padrões de comunicação e melhora a segurança, a eficácia da filtragem e o gerenciamento geral de e-mails.
Eventos recentes de e-mail
E-mails bloqueados
Os cinco principais destinatários por tipo de registro
Eventos de e-mail permitidos
Total de eventos de e-mail
Dez principais origens de registros de e-mail por tipo de evento
Os cinco principais remetentes por tipo de registro
Remetentes únicos
Destinatários únicos
Nome do gráfico
Exemplo de consulta
Eventos recentes de e-mail
$event.metadata.event_type = "EMAIL_UNCATEGORIZED"
or $event.metadata.event_type = "EMAIL_TRANSACTION"
$Sender = $event.network.email.from
$Recipient = $event.network.email.to
$Subject = $event.network.email.subject
$Subject != ""
$Date = timestamp.get_timestamp($event.metadata.event_timestamp.seconds)
$Action = $event.security_result.action
match:
$Date, $Sender, $Recipient, $Subject, $Action
order:
$Date desc
limit:
50
E-mails bloqueados
$event.metadata.event_type = "EMAIL_UNCATEGORIZED"
or $event.metadata.event_type = "EMAIL_TRANSACTION"
$event.security_result.action = "BLOCK"
outcome:
$Count = count($event.metadata.id)
Os cinco principais destinatários por tipo de registro
$event.metadata.event_type = "EMAIL_UNCATEGORIZED"
or $event.metadata.event_type = "EMAIL_TRANSACTION"
$Log_Type = $event.metadata.log_type
$Recipients = $event.network.email.to
$Recipients != ""
match:
$Log_Type, $Recipients
outcome:
$Count = count($event.metadata.id)
order:
$Count desc
limit:
5
Eventos de e-mail permitidos
$event.metadata.event_type = "EMAIL_UNCATEGORIZED"
or $event.metadata.event_type = "EMAIL_TRANSACTION"
$event.security_result.action = "ALLOW"
outcome:
$Count = count($event.metadata.id)
Os cinco principais destinatários por tipo de registro
$event.metadata.event_type = "EMAIL_UNCATEGORIZED"
or $event.metadata.event_type = "EMAIL_TRANSACTION"
$Log_Type = $event.metadata.log_type
$Recipients = $event.network.email.to
$Recipients != ""
match:
$Log_Type, $Recipients
outcome:
$Count = count($event.metadata.id)
order:
$Count desc
limit:
5
Total de eventos de e-mail
$event.metadata.event_type = "EMAIL_UNCATEGORIZED"
or $event.metadata.event_type = "EMAIL_TRANSACTION"
outcome:
$Count = count($event.metadata.id)
Dez principais origens de registros de e-mail por tipo de evento
$event.metadata.event_type = "EMAIL_UNCATEGORIZED"
or $event.metadata.event_type = "EMAIL_TRANSACTION"
$Event_Type = $event.metadata.event_type
$Log_Type = $event.metadata.log_type
match:
$Log_Type, $Event_Type
outcome:
$Count = count($event.metadata.id)
order:
$Count desc
limit:
10
Eventos de e-mail permitidos
$event.metadata.event_type = "EMAIL_UNCATEGORIZED"
or $event.metadata.event_type = "EMAIL_TRANSACTION"
$event.security_result.action = "ALLOW"
outcome:
$Count = count($event.metadata.id)
Os cinco principais remetentes por tipo de registro
$event.metadata.event_type = "EMAIL_UNCATEGORIZED"
or $event.metadata.event_type = "EMAIL_TRANSACTION"
$Log_Type = $event.metadata.log_type
$Sender = $event.network.email.from
$Sender != ""
match:
$Log_Type, $Sender
outcome:
$Count = count($event.metadata.id)
order:
$Count desc
limit:
5
Remetentes únicos
$event.metadata.event_type = "EMAIL_UNCATEGORIZED"
or $event.metadata.event_type = "EMAIL_TRANSACTION"
outcome:
$Count = count_distinct($event.network.email.from)
Remetentes únicos
$event.metadata.event_type = "EMAIL_UNCATEGORIZED"
or $event.metadata.event_type = "EMAIL_TRANSACTION"
outcome:
$Count = count_distinct($event.network.email.from)
Total de eventos de e-mail
$event.metadata.event_type = "EMAIL_UNCATEGORIZED"
or $event.metadata.event_type = "EMAIL_TRANSACTION"
outcome:
$Count = count($event.metadata.id)
Os cinco principais remetentes por tipo de registro
$event.metadata.event_type = "EMAIL_UNCATEGORIZED"
or $event.metadata.event_type = "EMAIL_TRANSACTION"
$Log_Type = $event.metadata.log_type
$Sender = $event.network.email.from
$Sender != ""
match:
$Log_Type, $Sender
outcome:
$Count = count($event.metadata.id)
order:
$Count desc
limit:
5
Eventos recentes de e-mail
$event.metadata.event_type = "EMAIL_UNCATEGORIZED"
or $event.metadata.event_type = "EMAIL_TRANSACTION"
$Sender = $event.network.email.from
$Recipient = $event.network.email.to
$Subject = $event.network.email.subject
$Subject != ""
$Date = timestamp.get_timestamp($event.metadata.event_timestamp.seconds)
$Action = $event.security_result.action
match:
$Date, $Sender, $Recipient, $Subject, $Action
order:
$Date desc
limit:
50
Destinatários únicos
$event.metadata.event_type = "EMAIL_UNCATEGORIZED"
or $event.metadata.event_type = "EMAIL_TRANSACTION"
outcome:
$Count = count_distinct($event.network.email.to)
E-mails bloqueados
$event.metadata.event_type = "EMAIL_UNCATEGORIZED"
or $event.metadata.event_type = "EMAIL_TRANSACTION"
$event.security_result.action = "BLOCK"
outcome:
$Count = count($event.metadata.id)
Destinatários únicos
$event.metadata.event_type = "EMAIL_UNCATEGORIZED"
or $event.metadata.event_type = "EMAIL_TRANSACTION"
outcome:
$Count = count_distinct($event.network.email.to)
Dez principais origens de registros de e-mail por tipo de evento
$event.metadata.event_type = "EMAIL_UNCATEGORIZED"
or $event.metadata.event_type = "EMAIL_TRANSACTION"
$Event_Type = $event.metadata.event_type
$Log_Type = $event.metadata.log_type
match:
$Log_Type, $Event_Type
outcome:
$Count = count($event.metadata.id)
order:
$Count desc
limit:
10
Visão geral da segurança de e-mail
Esse painel de controle fornece informações sobre ameaças de e-mail, como phishing, malware, ransomware e comprometimento de e-mail comercial (BEC). Ele fornece uma visão geral de eventos relacionados à segurança, remetentes maliciosos, IPs de origem e endereços de e-mail segmentados.
10 principais domínios identificados
Total de phishing detectado
Categoria de e-mail ao longo do tempo
10 principais URLs suspeitos
Phishing detectado
Os 10 principais IPs de origem maliciosos
Ameaças de e-mail por categoria
Ação realizada ao longo do tempo
Ameaça de e-mail identificada ao longo do tempo
Ameaças ativas recentes
URLs bloqueados x permitidos
10 principais remetentes maliciosos
Anexos maliciosos recentes
10 principais e-mails segmentados
10 principais ameaças de alta gravidade
10 principais locais maliciosos
As 10 principais ameaças de e-mail por gravidade
Distribuição do status de ameaça
Distribuição de ações de resultados de segurança
Nome do gráfico
Exemplo de consulta
10 principais domínios identificados
$event.metadata.log_type = /ABNORMAL_SECURITY|AREA1|AVANAN_EMAIL|BARRACUDA_EMAIL|CISCO_EMAIL_SECURITY|COFENSE_TRIAGE|EXCHANGE_MAIL|FIREEYE_EMPS|FIREEYE_ETP|FORCEPOINT_EMAILSECURITY|FORCEPOINT_MAIL_RELAY|FORTINET_FORTIMAIL|KNOWBE4_PHISHER|MAILMARSHAL|MICROSOFT_DEFENDER_MAIL|MIMECAST_MAIL|MIMECAST_URL_LOGS|OBSERVEIT|OFFICE_365|POSTFIX_MAIL|PROOFPOINT_MAIL|PROOFPOINT_MAIL_FILTER|PROOFPOINT_ON_DEMAND|PROOFPOINT_SENDMAIL_SENTRION|PROOFPOINT_SER|PROOFPOINT_TAP_FORENSICS|PROOFPOINT_TRAP|SENDMAIL|SEPPMAIL|SYMANTEC_VIP|VIRTRU_EMAIL_ENCRYPTION|VOLTAGE|WORKSPACE_ALERTS|ZIX_EMAIL_ENCRYPTION|PHISHLABS/ nocase
$event.metadata.event_type = "EMAIL_UNCATEGORIZED"
or $event.metadata.event_type = "EMAIL_TRANSACTION"
or $event.metadata.event_type = "NETWORK_HTTP"
$event.principal.administrative_domain != ""
$Domain = $event.principal.administrative_domain
match:
$Domain
outcome:
$Count = count($event.metadata.id)
order:
$Count desc
limit:
10
Total de phishing detectado
$event.metadata.log_type = /ABNORMAL_SECURITY|AREA1|AVANAN_EMAIL|BARRACUDA_EMAIL|CISCO_EMAIL_SECURITY|COFENSE_TRIAGE|EXCHANGE_MAIL|FIREEYE_EMPS|FIREEYE_ETP|FORCEPOINT_EMAILSECURITY|FORCEPOINT_MAIL_RELAY|FORTINET_FORTIMAIL|KNOWBE4_PHISHER|MAILMARSHAL|MICROSOFT_DEFENDER_MAIL|MIMECAST_MAIL|MIMECAST_URL_LOGS|OBSERVEIT|OFFICE_365|POSTFIX_MAIL|PROOFPOINT_MAIL|PROOFPOINT_MAIL_FILTER|PROOFPOINT_ON_DEMAND|PROOFPOINT_SENDMAIL_SENTRION|PROOFPOINT_SER|PROOFPOINT_TAP_FORENSICS|PROOFPOINT_TRAP|SENDMAIL|SEPPMAIL|SYMANTEC_VIP|VIRTRU_EMAIL_ENCRYPTION|VOLTAGE|WORKSPACE_ALERTS|ZIX_EMAIL_ENCRYPTION|PHISHLABS/ nocase
$event.metadata.event_type = "EMAIL_UNCATEGORIZED"
or $event.metadata.event_type = "EMAIL_TRANSACTION"
or $event.metadata.event_type = "NETWORK_HTTP"
$event.security_result.category = "MAIL_PHISHING"
outcome:
$Count = count_distinct($event.principal.user.email_addresses)
Categoria de e-mail ao longo do tempo
$event.metadata.log_type = /ABNORMAL_SECURITY|AREA1|AVANAN_EMAIL|BARRACUDA_EMAIL|CISCO_EMAIL_SECURITY|COFENSE_TRIAGE|EXCHANGE_MAIL|FIREEYE_EMPS|FIREEYE_ETP|FORCEPOINT_EMAILSECURITY|FORCEPOINT_MAIL_RELAY|FORTINET_FORTIMAIL|KNOWBE4_PHISHER|MAILMARSHAL|MICROSOFT_DEFENDER_MAIL|MIMECAST_MAIL|MIMECAST_URL_LOGS|OBSERVEIT|OFFICE_365|POSTFIX_MAIL|PROOFPOINT_MAIL|PROOFPOINT_MAIL_FILTER|PROOFPOINT_ON_DEMAND|PROOFPOINT_SENDMAIL_SENTRION|PROOFPOINT_SER|PROOFPOINT_TAP_FORENSICS|PROOFPOINT_TRAP|SENDMAIL|SEPPMAIL|SYMANTEC_VIP|VIRTRU_EMAIL_ENCRYPTION|VOLTAGE|WORKSPACE_ALERTS|ZIX_EMAIL_ENCRYPTION|PHISHLABS/ nocase
$event.metadata.event_type = "EMAIL_UNCATEGORIZED"
or $event.metadata.event_type = "EMAIL_TRANSACTION"
or $event.metadata.event_type = "NETWORK_HTTP"
$Category = $event.security_result.category
$Date = timestamp.get_date($event.metadata.event_timestamp.seconds)
match:
$Date, $Category
outcome:
$Count = count($event.metadata.id)
order:
$Date asc
10 principais URLs suspeitos
$event.metadata.log_type = /ABNORMAL_SECURITY|AREA1|AVANAN_EMAIL|BARRACUDA_EMAIL|CISCO_EMAIL_SECURITY|COFENSE_TRIAGE|EXCHANGE_MAIL|FIREEYE_EMPS|FIREEYE_ETP|FORCEPOINT_EMAILSECURITY|FORCEPOINT_MAIL_RELAY|FORTINET_FORTIMAIL|KNOWBE4_PHISHER|MAILMARSHAL|MICROSOFT_DEFENDER_MAIL|MIMECAST_MAIL|MIMECAST_URL_LOGS|OBSERVEIT|OFFICE_365|POSTFIX_MAIL|PROOFPOINT_MAIL|PROOFPOINT_MAIL_FILTER|PROOFPOINT_ON_DEMAND|PROOFPOINT_SENDMAIL_SENTRION|PROOFPOINT_SER|PROOFPOINT_TAP_FORENSICS|PROOFPOINT_TRAP|SENDMAIL|SEPPMAIL|SYMANTEC_VIP|VIRTRU_EMAIL_ENCRYPTION|VOLTAGE|WORKSPACE_ALERTS|ZIX_EMAIL_ENCRYPTION|PHISHLABS/ nocase
$event.metadata.event_type = "EMAIL_UNCATEGORIZED"
or $event.metadata.event_type = "EMAIL_TRANSACTION"
or $event.metadata.event_type = "NETWORK_HTTP"
$event.security_result.category = "MAIL_PHISHING"
or $event.security_result.category = "MAIL_SPAM"
or $event.security_result.category = "MAIL_SPOOFING"
or $event.security_result.category = "SOFTWARE_MALICIOUS"
strings.coalesce($event.target.url, $event.security_result.about.url,$event.security_result.detection_fields["detectedUrls"]) != ""
$URL = strings.coalesce($event.target.url, $event.security_result.about.url,$event.security_result.detection_fields["detectedUrls"])
match:
$URL
outcome:
$Count = count($event.metadata.id)
order:
$Count desc
limit:
10
Phishing detectado
$event.metadata.log_type = /ABNORMAL_SECURITY|AREA1|AVANAN_EMAIL|BARRACUDA_EMAIL|CISCO_EMAIL_SECURITY|COFENSE_TRIAGE|EXCHANGE_MAIL|FIREEYE_EMPS|FIREEYE_ETP|FORCEPOINT_EMAILSECURITY|FORCEPOINT_MAIL_RELAY|FORTINET_FORTIMAIL|KNOWBE4_PHISHER|MAILMARSHAL|MICROSOFT_DEFENDER_MAIL|MIMECAST_MAIL|MIMECAST_URL_LOGS|OBSERVEIT|OFFICE_365|POSTFIX_MAIL|PROOFPOINT_MAIL|PROOFPOINT_MAIL_FILTER|PROOFPOINT_ON_DEMAND|PROOFPOINT_SENDMAIL_SENTRION|PROOFPOINT_SER|PROOFPOINT_TAP_FORENSICS|PROOFPOINT_TRAP|SENDMAIL|SEPPMAIL|SYMANTEC_VIP|VIRTRU_EMAIL_ENCRYPTION|VOLTAGE|WORKSPACE_ALERTS|ZIX_EMAIL_ENCRYPTION|PHISHLABS/ nocase
$event.metadata.event_type = "EMAIL_UNCATEGORIZED"
or $event.metadata.event_type = "EMAIL_TRANSACTION"
or $event.metadata.event_type = "NETWORK_HTTP"
$event.security_result.category = "MAIL_PHISHING"
$Email = $event.principal.user.email_addresses
match:
$Email
Os 10 principais IPs de origem maliciosos
$event.metadata.log_type = /ABNORMAL_SECURITY|AREA1|AVANAN_EMAIL|BARRACUDA_EMAIL|CISCO_EMAIL_SECURITY|COFENSE_TRIAGE|EXCHANGE_MAIL|FIREEYE_EMPS|FIREEYE_ETP|FORCEPOINT_EMAILSECURITY|FORCEPOINT_MAIL_RELAY|FORTINET_FORTIMAIL|KNOWBE4_PHISHER|MAILMARSHAL|MICROSOFT_DEFENDER_MAIL|MIMECAST_MAIL|MIMECAST_URL_LOGS|OBSERVEIT|OFFICE_365|POSTFIX_MAIL|PROOFPOINT_MAIL|PROOFPOINT_MAIL_FILTER|PROOFPOINT_ON_DEMAND|PROOFPOINT_SENDMAIL_SENTRION|PROOFPOINT_SER|PROOFPOINT_TAP_FORENSICS|PROOFPOINT_TRAP|SENDMAIL|SEPPMAIL|SYMANTEC_VIP|VIRTRU_EMAIL_ENCRYPTION|VOLTAGE|WORKSPACE_ALERTS|ZIX_EMAIL_ENCRYPTION|PHISHLABS/ nocase
$event.metadata.event_type = "EMAIL_UNCATEGORIZED"
or $event.metadata.event_type = "EMAIL_TRANSACTION"
or $event.metadata.event_type = "NETWORK_HTTP"
$event.security_result.detection_fields["judgement"] = /MALICIOUS/ nocase
$event.principal.ip != ""
$Source_IP = $event.principal.ip
match:
$Source_IP
outcome:
$Count = count($event.principal.ip)
order:
$Count desc
limit:
10
Ameaças de e-mail por categoria
$event.metadata.log_type = /ABNORMAL_SECURITY|AREA1|AVANAN_EMAIL|BARRACUDA_EMAIL|CISCO_EMAIL_SECURITY|COFENSE_TRIAGE|EXCHANGE_MAIL|FIREEYE_EMPS|FIREEYE_ETP|FORCEPOINT_EMAILSECURITY|FORCEPOINT_MAIL_RELAY|FORTINET_FORTIMAIL|KNOWBE4_PHISHER|MAILMARSHAL|MICROSOFT_DEFENDER_MAIL|MIMECAST_MAIL|MIMECAST_URL_LOGS|OBSERVEIT|OFFICE_365|POSTFIX_MAIL|PROOFPOINT_MAIL|PROOFPOINT_MAIL_FILTER|PROOFPOINT_ON_DEMAND|PROOFPOINT_SENDMAIL_SENTRION|PROOFPOINT_SER|PROOFPOINT_TAP_FORENSICS|PROOFPOINT_TRAP|SENDMAIL|SEPPMAIL|SYMANTEC_VIP|VIRTRU_EMAIL_ENCRYPTION|VOLTAGE|WORKSPACE_ALERTS|ZIX_EMAIL_ENCRYPTION|PHISHLABS/ nocase
$Threat_Name = $event.security_result.category_details
$Category = $event.security_result.category
match:
$Threat_Name, $Category
outcome:
$Count = count($event.security_result.threat_name)
order:
$Count desc
limit:
50
Ação realizada ao longo do tempo
$event.metadata.log_type = /ABNORMAL_SECURITY|AREA1|AVANAN_EMAIL|BARRACUDA_EMAIL|CISCO_EMAIL_SECURITY|COFENSE_TRIAGE|EXCHANGE_MAIL|FIREEYE_EMPS|FIREEYE_ETP|FORCEPOINT_EMAILSECURITY|FORCEPOINT_MAIL_RELAY|FORTINET_FORTIMAIL|KNOWBE4_PHISHER|MAILMARSHAL|MICROSOFT_DEFENDER_MAIL|MIMECAST_MAIL|MIMECAST_URL_LOGS|OBSERVEIT|OFFICE_365|POSTFIX_MAIL|PROOFPOINT_MAIL|PROOFPOINT_MAIL_FILTER|PROOFPOINT_ON_DEMAND|PROOFPOINT_SENDMAIL_SENTRION|PROOFPOINT_SER|PROOFPOINT_TAP_FORENSICS|PROOFPOINT_TRAP|SENDMAIL|SEPPMAIL|SYMANTEC_VIP|VIRTRU_EMAIL_ENCRYPTION|VOLTAGE|WORKSPACE_ALERTS|ZIX_EMAIL_ENCRYPTION|PHISHLABS/ nocase
$event.metadata.event_type = "EMAIL_UNCATEGORIZED"
or $event.metadata.event_type = "EMAIL_TRANSACTION"
or $event.metadata.event_type = "NETWORK_HTTP"
$Action = $event.security_result.action
$Date = timestamp.get_date($event.metadata.event_timestamp.seconds)
match:
$Date, $Action
outcome:
$Count = count($event.metadata.id)
order:
$Date asc
Ameaça de e-mail identificada ao longo do tempo
$event.metadata.log_type = /ABNORMAL_SECURITY|AREA1|AVANAN_EMAIL|BARRACUDA_EMAIL|CISCO_EMAIL_SECURITY|COFENSE_TRIAGE|EXCHANGE_MAIL|FIREEYE_EMPS|FIREEYE_ETP|FORCEPOINT_EMAILSECURITY|FORCEPOINT_MAIL_RELAY|FORTINET_FORTIMAIL|KNOWBE4_PHISHER|MAILMARSHAL|MICROSOFT_DEFENDER_MAIL|MIMECAST_MAIL|MIMECAST_URL_LOGS|OBSERVEIT|OFFICE_365|POSTFIX_MAIL|PROOFPOINT_MAIL|PROOFPOINT_MAIL_FILTER|PROOFPOINT_ON_DEMAND|PROOFPOINT_SENDMAIL_SENTRION|PROOFPOINT_SER|PROOFPOINT_TAP_FORENSICS|PROOFPOINT_TRAP|SENDMAIL|SEPPMAIL|SYMANTEC_VIP|VIRTRU_EMAIL_ENCRYPTION|VOLTAGE|WORKSPACE_ALERTS|ZIX_EMAIL_ENCRYPTION|PHISHLABS/ nocase
$event.metadata.event_type = "EMAIL_UNCATEGORIZED"
or $event.metadata.event_type = "EMAIL_TRANSACTION"
or $event.metadata.event_type = "NETWORK_HTTP"
$Threat_Name = $event.security_result.threat_name
$Date = timestamp.get_date($event.metadata.event_timestamp.seconds)
match:
$Date, $Threat_Name
outcome:
$Count = count($event.metadata.id)
order:
$Date asc
Ameaça de e-mail identificada ao longo do tempo
$event.metadata.log_type = /ABNORMAL_SECURITY|AREA1|AVANAN_EMAIL|BARRACUDA_EMAIL|CISCO_EMAIL_SECURITY|COFENSE_TRIAGE|EXCHANGE_MAIL|FIREEYE_EMPS|FIREEYE_ETP|FORCEPOINT_EMAILSECURITY|FORCEPOINT_MAIL_RELAY|FORTINET_FORTIMAIL|KNOWBE4_PHISHER|MAILMARSHAL|MICROSOFT_DEFENDER_MAIL|MIMECAST_MAIL|MIMECAST_URL_LOGS|OBSERVEIT|OFFICE_365|POSTFIX_MAIL|PROOFPOINT_MAIL|PROOFPOINT_MAIL_FILTER|PROOFPOINT_ON_DEMAND|PROOFPOINT_SENDMAIL_SENTRION|PROOFPOINT_SER|PROOFPOINT_TAP_FORENSICS|PROOFPOINT_TRAP|SENDMAIL|SEPPMAIL|SYMANTEC_VIP|VIRTRU_EMAIL_ENCRYPTION|VOLTAGE|WORKSPACE_ALERTS|ZIX_EMAIL_ENCRYPTION|PHISHLABS/ nocase
$event.metadata.event_type = "EMAIL_UNCATEGORIZED"
or $event.metadata.event_type = "EMAIL_TRANSACTION"
or $event.metadata.event_type = "NETWORK_HTTP"
$Threat_Name = $event.security_result.threat_name
$Date = timestamp.get_date($event.metadata.event_timestamp.seconds)
match:
$Date, $Threat_Name
outcome:
$Count = count($event.metadata.id)
order:
$Date asc
Ameaças ativas recentes
$event.metadata.log_type = /ABNORMAL_SECURITY|AREA1|AVANAN_EMAIL|BARRACUDA_EMAIL|CISCO_EMAIL_SECURITY|COFENSE_TRIAGE|EXCHANGE_MAIL|FIREEYE_EMPS|FIREEYE_ETP|FORCEPOINT_EMAILSECURITY|FORCEPOINT_MAIL_RELAY|FORTINET_FORTIMAIL|KNOWBE4_PHISHER|MAILMARSHAL|MICROSOFT_DEFENDER_MAIL|MIMECAST_MAIL|MIMECAST_URL_LOGS|OBSERVEIT|OFFICE_365|POSTFIX_MAIL|PROOFPOINT_MAIL|PROOFPOINT_MAIL_FILTER|PROOFPOINT_ON_DEMAND|PROOFPOINT_SENDMAIL_SENTRION|PROOFPOINT_SER|PROOFPOINT_TAP_FORENSICS|PROOFPOINT_TRAP|SENDMAIL|SEPPMAIL|SYMANTEC_VIP|VIRTRU_EMAIL_ENCRYPTION|VOLTAGE|WORKSPACE_ALERTS|ZIX_EMAIL_ENCRYPTION|PHISHLABS/ nocase
$event.metadata.event_type = "EMAIL_UNCATEGORIZED"
or $event.metadata.event_type = "EMAIL_TRANSACTION"
or $event.metadata.event_type = "NETWORK_HTTP"
$Threat_Name = $event.security_result.threat_name
$Status = $event.security_result.threat_status
match:
$Threat_Name, $Status
outcome:
$Count = count($event.metadata.id)
$Date = timestamp.get_timestamp(max($event.metadata.event_timestamp.seconds))
order:
$Date desc
limit:
50
URLs bloqueados x permitidos
$event.metadata.log_type = /ABNORMAL_SECURITY|AREA1|AVANAN_EMAIL|BARRACUDA_EMAIL|CISCO_EMAIL_SECURITY|COFENSE_TRIAGE|EXCHANGE_MAIL|FIREEYE_EMPS|FIREEYE_ETP|FORCEPOINT_EMAILSECURITY|FORCEPOINT_MAIL_RELAY|FORTINET_FORTIMAIL|KNOWBE4_PHISHER|MAILMARSHAL|MICROSOFT_DEFENDER_MAIL|MIMECAST_MAIL|MIMECAST_URL_LOGS|OBSERVEIT|OFFICE_365|POSTFIX_MAIL|PROOFPOINT_MAIL|PROOFPOINT_MAIL_FILTER|PROOFPOINT_ON_DEMAND|PROOFPOINT_SENDMAIL_SENTRION|PROOFPOINT_SER|PROOFPOINT_TAP_FORENSICS|PROOFPOINT_TRAP|SENDMAIL|SEPPMAIL|SYMANTEC_VIP|VIRTRU_EMAIL_ENCRYPTION|VOLTAGE|WORKSPACE_ALERTS|ZIX_EMAIL_ENCRYPTION|PHISHLABS/ nocase
$event.metadata.event_type = "EMAIL_UNCATEGORIZED"
or $event.metadata.event_type = "EMAIL_TRANSACTION"
or $event.metadata.event_type = "NETWORK_HTTP"
$event.security_result.action = "ALLOW"
or $event.security_result.action = "BLOCK"
$Action = $event.security_result.action
$Date = timestamp.get_date($event.metadata.event_timestamp.seconds)
match:
$Date, $Action
outcome:
$Count = count($event.target.url)
order:
$Count desc
Phishing detectado
$event.metadata.log_type = /ABNORMAL_SECURITY|AREA1|AVANAN_EMAIL|BARRACUDA_EMAIL|CISCO_EMAIL_SECURITY|COFENSE_TRIAGE|EXCHANGE_MAIL|FIREEYE_EMPS|FIREEYE_ETP|FORCEPOINT_EMAILSECURITY|FORCEPOINT_MAIL_RELAY|FORTINET_FORTIMAIL|KNOWBE4_PHISHER|MAILMARSHAL|MICROSOFT_DEFENDER_MAIL|MIMECAST_MAIL|MIMECAST_URL_LOGS|OBSERVEIT|OFFICE_365|POSTFIX_MAIL|PROOFPOINT_MAIL|PROOFPOINT_MAIL_FILTER|PROOFPOINT_ON_DEMAND|PROOFPOINT_SENDMAIL_SENTRION|PROOFPOINT_SER|PROOFPOINT_TAP_FORENSICS|PROOFPOINT_TRAP|SENDMAIL|SEPPMAIL|SYMANTEC_VIP|VIRTRU_EMAIL_ENCRYPTION|VOLTAGE|WORKSPACE_ALERTS|ZIX_EMAIL_ENCRYPTION|PHISHLABS/ nocase
$event.metadata.event_type = "EMAIL_UNCATEGORIZED"
or $event.metadata.event_type = "EMAIL_TRANSACTION"
or $event.metadata.event_type = "NETWORK_HTTP"
$event.security_result.category = "MAIL_PHISHING"
$Email = $event.principal.user.email_addresses
match:
$Email
10 principais remetentes maliciosos
$event.metadata.log_type = /ABNORMAL_SECURITY|AREA1|AVANAN_EMAIL|BARRACUDA_EMAIL|CISCO_EMAIL_SECURITY|COFENSE_TRIAGE|EXCHANGE_MAIL|FIREEYE_EMPS|FIREEYE_ETP|FORCEPOINT_EMAILSECURITY|FORCEPOINT_MAIL_RELAY|FORTINET_FORTIMAIL|KNOWBE4_PHISHER|MAILMARSHAL|MICROSOFT_DEFENDER_MAIL|MIMECAST_MAIL|MIMECAST_URL_LOGS|OBSERVEIT|OFFICE_365|POSTFIX_MAIL|PROOFPOINT_MAIL|PROOFPOINT_MAIL_FILTER|PROOFPOINT_ON_DEMAND|PROOFPOINT_SENDMAIL_SENTRION|PROOFPOINT_SER|PROOFPOINT_TAP_FORENSICS|PROOFPOINT_TRAP|SENDMAIL|SEPPMAIL|SYMANTEC_VIP|VIRTRU_EMAIL_ENCRYPTION|VOLTAGE|WORKSPACE_ALERTS|ZIX_EMAIL_ENCRYPTION|PHISHLABS/ nocase
$event.metadata.event_type = "EMAIL_UNCATEGORIZED"
or $event.metadata.event_type = "EMAIL_TRANSACTION"
or $event.metadata.event_type = "NETWORK_HTTP"
$event.security_result.detection_fields["judgement"] = /MALICIOUS/ nocase
$event.network.email.from != ""
$Sender = $event.network.email.from
match:
$Sender
outcome:
$Count = count($event.network.email.from)
order:
$Count desc
limit:
10
Anexos maliciosos recentes
$event.metadata.log_type = /ABNORMAL_SECURITY|AREA1|AVANAN_EMAIL|BARRACUDA_EMAIL|CISCO_EMAIL_SECURITY|COFENSE_TRIAGE|EXCHANGE_MAIL|FIREEYE_EMPS|FIREEYE_ETP|FORCEPOINT_EMAILSECURITY|FORCEPOINT_MAIL_RELAY|FORTINET_FORTIMAIL|KNOWBE4_PHISHER|MAILMARSHAL|MICROSOFT_DEFENDER_MAIL|MIMECAST_MAIL|MIMECAST_URL_LOGS|OBSERVEIT|OFFICE_365|POSTFIX_MAIL|PROOFPOINT_MAIL|PROOFPOINT_MAIL_FILTER|PROOFPOINT_ON_DEMAND|PROOFPOINT_SENDMAIL_SENTRION|PROOFPOINT_SER|PROOFPOINT_TAP_FORENSICS|PROOFPOINT_TRAP|SENDMAIL|SEPPMAIL|SYMANTEC_VIP|VIRTRU_EMAIL_ENCRYPTION|VOLTAGE|WORKSPACE_ALERTS|ZIX_EMAIL_ENCRYPTION|PHISHLABS/ nocase
$event.metadata.event_type = "EMAIL_UNCATEGORIZED"
or $event.metadata.event_type = "EMAIL_TRANSACTION"
or $event.metadata.event_type = "NETWORK_HTTP"
strings.coalesce($event.about.file.full_path, $event.security_result.detection_fields["attachmentNames"]) != ""
$Attachment = strings.coalesce($event.about.file.full_path, $event.security_result.detection_fields["attachmentNames"])
$Category = $event.security_result.category
$Sender = $event.network.email.from
$Receiver = $event.network.email.to
$Status = $event.additional.fields["remediationStatus"]
$Date = timestamp.get_date($event.metadata.event_timestamp.seconds)
match:
$Date, $Sender, $Receiver, $Attachment, $Category, $Status
order:
$Date desc
limit:
50
Total de phishing detectado
$event.metadata.log_type = /ABNORMAL_SECURITY|AREA1|AVANAN_EMAIL|BARRACUDA_EMAIL|CISCO_EMAIL_SECURITY|COFENSE_TRIAGE|EXCHANGE_MAIL|FIREEYE_EMPS|FIREEYE_ETP|FORCEPOINT_EMAILSECURITY|FORCEPOINT_MAIL_RELAY|FORTINET_FORTIMAIL|KNOWBE4_PHISHER|MAILMARSHAL|MICROSOFT_DEFENDER_MAIL|MIMECAST_MAIL|MIMECAST_URL_LOGS|OBSERVEIT|OFFICE_365|POSTFIX_MAIL|PROOFPOINT_MAIL|PROOFPOINT_MAIL_FILTER|PROOFPOINT_ON_DEMAND|PROOFPOINT_SENDMAIL_SENTRION|PROOFPOINT_SER|PROOFPOINT_TAP_FORENSICS|PROOFPOINT_TRAP|SENDMAIL|SEPPMAIL|SYMANTEC_VIP|VIRTRU_EMAIL_ENCRYPTION|VOLTAGE|WORKSPACE_ALERTS|ZIX_EMAIL_ENCRYPTION|PHISHLABS/ nocase
$event.metadata.event_type = "EMAIL_UNCATEGORIZED"
or $event.metadata.event_type = "EMAIL_TRANSACTION"
or $event.metadata.event_type = "NETWORK_HTTP"
$event.security_result.category = "MAIL_PHISHING"
outcome:
$Count = count_distinct($event.principal.user.email_addresses)
10 principais e-mails segmentados
$event.metadata.log_type = /ABNORMAL_SECURITY|AREA1|AVANAN_EMAIL|BARRACUDA_EMAIL|CISCO_EMAIL_SECURITY|COFENSE_TRIAGE|EXCHANGE_MAIL|FIREEYE_EMPS|FIREEYE_ETP|FORCEPOINT_EMAILSECURITY|FORCEPOINT_MAIL_RELAY|FORTINET_FORTIMAIL|KNOWBE4_PHISHER|MAILMARSHAL|MICROSOFT_DEFENDER_MAIL|MIMECAST_MAIL|MIMECAST_URL_LOGS|OBSERVEIT|OFFICE_365|POSTFIX_MAIL|PROOFPOINT_MAIL|PROOFPOINT_MAIL_FILTER|PROOFPOINT_ON_DEMAND|PROOFPOINT_SENDMAIL_SENTRION|PROOFPOINT_SER|PROOFPOINT_TAP_FORENSICS|PROOFPOINT_TRAP|SENDMAIL|SEPPMAIL|SYMANTEC_VIP|VIRTRU_EMAIL_ENCRYPTION|VOLTAGE|WORKSPACE_ALERTS|ZIX_EMAIL_ENCRYPTION|PHISHLABS/ nocase
$event.metadata.event_type = "EMAIL_UNCATEGORIZED"
or $event.metadata.event_type = "EMAIL_TRANSACTION"
or $event.metadata.event_type = "NETWORK_HTTP"
$event.target.user.email_addresses != ""
$Target = $event.target.user.email_addresses
match:
$Target
outcome:
$Count = count($event.target.user.email_addresses)
order:
$Count desc
limit:
10
Categoria de e-mail ao longo do tempo
$event.metadata.log_type = /ABNORMAL_SECURITY|AREA1|AVANAN_EMAIL|BARRACUDA_EMAIL|CISCO_EMAIL_SECURITY|COFENSE_TRIAGE|EXCHANGE_MAIL|FIREEYE_EMPS|FIREEYE_ETP|FORCEPOINT_EMAILSECURITY|FORCEPOINT_MAIL_RELAY|FORTINET_FORTIMAIL|KNOWBE4_PHISHER|MAILMARSHAL|MICROSOFT_DEFENDER_MAIL|MIMECAST_MAIL|MIMECAST_URL_LOGS|OBSERVEIT|OFFICE_365|POSTFIX_MAIL|PROOFPOINT_MAIL|PROOFPOINT_MAIL_FILTER|PROOFPOINT_ON_DEMAND|PROOFPOINT_SENDMAIL_SENTRION|PROOFPOINT_SER|PROOFPOINT_TAP_FORENSICS|PROOFPOINT_TRAP|SENDMAIL|SEPPMAIL|SYMANTEC_VIP|VIRTRU_EMAIL_ENCRYPTION|VOLTAGE|WORKSPACE_ALERTS|ZIX_EMAIL_ENCRYPTION|PHISHLABS/ nocase
$event.metadata.event_type = "EMAIL_UNCATEGORIZED"
or $event.metadata.event_type = "EMAIL_TRANSACTION"
or $event.metadata.event_type = "NETWORK_HTTP"
$Category = $event.security_result.category
$Date = timestamp.get_date($event.metadata.event_timestamp.seconds)
match:
$Date, $Category
outcome:
$Count = count($event.metadata.id)
order:
$Date asc
10 principais URLs suspeitos
$event.metadata.log_type = /ABNORMAL_SECURITY|AREA1|AVANAN_EMAIL|BARRACUDA_EMAIL|CISCO_EMAIL_SECURITY|COFENSE_TRIAGE|EXCHANGE_MAIL|FIREEYE_EMPS|FIREEYE_ETP|FORCEPOINT_EMAILSECURITY|FORCEPOINT_MAIL_RELAY|FORTINET_FORTIMAIL|KNOWBE4_PHISHER|MAILMARSHAL|MICROSOFT_DEFENDER_MAIL|MIMECAST_MAIL|MIMECAST_URL_LOGS|OBSERVEIT|OFFICE_365|POSTFIX_MAIL|PROOFPOINT_MAIL|PROOFPOINT_MAIL_FILTER|PROOFPOINT_ON_DEMAND|PROOFPOINT_SENDMAIL_SENTRION|PROOFPOINT_SER|PROOFPOINT_TAP_FORENSICS|PROOFPOINT_TRAP|SENDMAIL|SEPPMAIL|SYMANTEC_VIP|VIRTRU_EMAIL_ENCRYPTION|VOLTAGE|WORKSPACE_ALERTS|ZIX_EMAIL_ENCRYPTION|PHISHLABS/ nocase
$event.metadata.event_type = "EMAIL_UNCATEGORIZED"
or $event.metadata.event_type = "EMAIL_TRANSACTION"
or $event.metadata.event_type = "NETWORK_HTTP"
$event.security_result.category = "MAIL_PHISHING"
or $event.security_result.category = "MAIL_SPAM"
or $event.security_result.category = "MAIL_SPOOFING"
or $event.security_result.category = "SOFTWARE_MALICIOUS"
strings.coalesce($event.target.url, $event.security_result.about.url,$event.security_result.detection_fields["detectedUrls"]) != ""
$URL = strings.coalesce($event.target.url, $event.security_result.about.url,$event.security_result.detection_fields["detectedUrls"])
match:
$URL
outcome:
$Count = count($event.metadata.id)
order:
$Count desc
limit:
10
Ação realizada ao longo do tempo
$event.metadata.log_type = /ABNORMAL_SECURITY|AREA1|AVANAN_EMAIL|BARRACUDA_EMAIL|CISCO_EMAIL_SECURITY|COFENSE_TRIAGE|EXCHANGE_MAIL|FIREEYE_EMPS|FIREEYE_ETP|FORCEPOINT_EMAILSECURITY|FORCEPOINT_MAIL_RELAY|FORTINET_FORTIMAIL|KNOWBE4_PHISHER|MAILMARSHAL|MICROSOFT_DEFENDER_MAIL|MIMECAST_MAIL|MIMECAST_URL_LOGS|OBSERVEIT|OFFICE_365|POSTFIX_MAIL|PROOFPOINT_MAIL|PROOFPOINT_MAIL_FILTER|PROOFPOINT_ON_DEMAND|PROOFPOINT_SENDMAIL_SENTRION|PROOFPOINT_SER|PROOFPOINT_TAP_FORENSICS|PROOFPOINT_TRAP|SENDMAIL|SEPPMAIL|SYMANTEC_VIP|VIRTRU_EMAIL_ENCRYPTION|VOLTAGE|WORKSPACE_ALERTS|ZIX_EMAIL_ENCRYPTION|PHISHLABS/ nocase
$event.metadata.event_type = "EMAIL_UNCATEGORIZED"
or $event.metadata.event_type = "EMAIL_TRANSACTION"
or $event.metadata.event_type = "NETWORK_HTTP"
$Action = $event.security_result.action
$Date = timestamp.get_date($event.metadata.event_timestamp.seconds)
match:
$Date, $Action
outcome:
$Count = count($event.metadata.id)
order:
$Date asc
10 principais ameaças de alta gravidade
$event.metadata.log_type = /ABNORMAL_SECURITY|AREA1|AVANAN_EMAIL|BARRACUDA_EMAIL|CISCO_EMAIL_SECURITY|COFENSE_TRIAGE|EXCHANGE_MAIL|FIREEYE_EMPS|FIREEYE_ETP|FORCEPOINT_EMAILSECURITY|FORCEPOINT_MAIL_RELAY|FORTINET_FORTIMAIL|KNOWBE4_PHISHER|MAILMARSHAL|MICROSOFT_DEFENDER_MAIL|MIMECAST_MAIL|MIMECAST_URL_LOGS|OBSERVEIT|OFFICE_365|POSTFIX_MAIL|PROOFPOINT_MAIL|PROOFPOINT_MAIL_FILTER|PROOFPOINT_ON_DEMAND|PROOFPOINT_SENDMAIL_SENTRION|PROOFPOINT_SER|PROOFPOINT_TAP_FORENSICS|PROOFPOINT_TRAP|SENDMAIL|SEPPMAIL|SYMANTEC_VIP|VIRTRU_EMAIL_ENCRYPTION|VOLTAGE|WORKSPACE_ALERTS|ZIX_EMAIL_ENCRYPTION|PHISHLABS/ nocase
$event.metadata.event_type = "EMAIL_UNCATEGORIZED"
or $event.metadata.event_type = "EMAIL_TRANSACTION"
or $event.metadata.event_type = "NETWORK_HTTP"
$event.security_result.category_details != ""
$event.security_result.severity = "HIGH"
$Category = $event.security_result.category_details
$Category != ""
match:
$Category
outcome:
$Count = count($event.metadata.id)
order:
$Count desc
limit:
10
Os 10 principais IPs de origem maliciosos
$event.metadata.log_type = /ABNORMAL_SECURITY|AREA1|AVANAN_EMAIL|BARRACUDA_EMAIL|CISCO_EMAIL_SECURITY|COFENSE_TRIAGE|EXCHANGE_MAIL|FIREEYE_EMPS|FIREEYE_ETP|FORCEPOINT_EMAILSECURITY|FORCEPOINT_MAIL_RELAY|FORTINET_FORTIMAIL|KNOWBE4_PHISHER|MAILMARSHAL|MICROSOFT_DEFENDER_MAIL|MIMECAST_MAIL|MIMECAST_URL_LOGS|OBSERVEIT|OFFICE_365|POSTFIX_MAIL|PROOFPOINT_MAIL|PROOFPOINT_MAIL_FILTER|PROOFPOINT_ON_DEMAND|PROOFPOINT_SENDMAIL_SENTRION|PROOFPOINT_SER|PROOFPOINT_TAP_FORENSICS|PROOFPOINT_TRAP|SENDMAIL|SEPPMAIL|SYMANTEC_VIP|VIRTRU_EMAIL_ENCRYPTION|VOLTAGE|WORKSPACE_ALERTS|ZIX_EMAIL_ENCRYPTION|PHISHLABS/ nocase
$event.metadata.event_type = "EMAIL_UNCATEGORIZED"
or $event.metadata.event_type = "EMAIL_TRANSACTION"
or $event.metadata.event_type = "NETWORK_HTTP"
$event.security_result.detection_fields["judgement"] = /MALICIOUS/ nocase
$event.principal.ip != ""
$Source_IP = $event.principal.ip
match:
$Source_IP
outcome:
$Count = count($event.principal.ip)
order:
$Count desc
limit:
10
10 principais remetentes maliciosos
$event.metadata.log_type = /ABNORMAL_SECURITY|AREA1|AVANAN_EMAIL|BARRACUDA_EMAIL|CISCO_EMAIL_SECURITY|COFENSE_TRIAGE|EXCHANGE_MAIL|FIREEYE_EMPS|FIREEYE_ETP|FORCEPOINT_EMAILSECURITY|FORCEPOINT_MAIL_RELAY|FORTINET_FORTIMAIL|KNOWBE4_PHISHER|MAILMARSHAL|MICROSOFT_DEFENDER_MAIL|MIMECAST_MAIL|MIMECAST_URL_LOGS|OBSERVEIT|OFFICE_365|POSTFIX_MAIL|PROOFPOINT_MAIL|PROOFPOINT_MAIL_FILTER|PROOFPOINT_ON_DEMAND|PROOFPOINT_SENDMAIL_SENTRION|PROOFPOINT_SER|PROOFPOINT_TAP_FORENSICS|PROOFPOINT_TRAP|SENDMAIL|SEPPMAIL|SYMANTEC_VIP|VIRTRU_EMAIL_ENCRYPTION|VOLTAGE|WORKSPACE_ALERTS|ZIX_EMAIL_ENCRYPTION|PHISHLABS/ nocase
$event.metadata.event_type = "EMAIL_UNCATEGORIZED"
or $event.metadata.event_type = "EMAIL_TRANSACTION"
or $event.metadata.event_type = "NETWORK_HTTP"
$event.security_result.detection_fields["judgement"] = /MALICIOUS/ nocase
$event.network.email.from != ""
$Sender = $event.network.email.from
match:
$Sender
outcome:
$Count = count($event.network.email.from)
order:
$Count desc
limit:
10
URLs bloqueados x permitidos
$event.metadata.log_type = /ABNORMAL_SECURITY|AREA1|AVANAN_EMAIL|BARRACUDA_EMAIL|CISCO_EMAIL_SECURITY|COFENSE_TRIAGE|EXCHANGE_MAIL|FIREEYE_EMPS|FIREEYE_ETP|FORCEPOINT_EMAILSECURITY|FORCEPOINT_MAIL_RELAY|FORTINET_FORTIMAIL|KNOWBE4_PHISHER|MAILMARSHAL|MICROSOFT_DEFENDER_MAIL|MIMECAST_MAIL|MIMECAST_URL_LOGS|OBSERVEIT|OFFICE_365|POSTFIX_MAIL|PROOFPOINT_MAIL|PROOFPOINT_MAIL_FILTER|PROOFPOINT_ON_DEMAND|PROOFPOINT_SENDMAIL_SENTRION|PROOFPOINT_SER|PROOFPOINT_TAP_FORENSICS|PROOFPOINT_TRAP|SENDMAIL|SEPPMAIL|SYMANTEC_VIP|VIRTRU_EMAIL_ENCRYPTION|VOLTAGE|WORKSPACE_ALERTS|ZIX_EMAIL_ENCRYPTION|PHISHLABS/ nocase
$event.metadata.event_type = "EMAIL_UNCATEGORIZED"
or $event.metadata.event_type = "EMAIL_TRANSACTION"
or $event.metadata.event_type = "NETWORK_HTTP"
$event.security_result.action = "ALLOW"
or $event.security_result.action = "BLOCK"
$Action = $event.security_result.action
$Date = timestamp.get_date($event.metadata.event_timestamp.seconds)
match:
$Date, $Action
outcome:
$Count = count($event.target.url)
order:
$Count desc
Anexos maliciosos recentes
$event.metadata.log_type = /ABNORMAL_SECURITY|AREA1|AVANAN_EMAIL|BARRACUDA_EMAIL|CISCO_EMAIL_SECURITY|COFENSE_TRIAGE|EXCHANGE_MAIL|FIREEYE_EMPS|FIREEYE_ETP|FORCEPOINT_EMAILSECURITY|FORCEPOINT_MAIL_RELAY|FORTINET_FORTIMAIL|KNOWBE4_PHISHER|MAILMARSHAL|MICROSOFT_DEFENDER_MAIL|MIMECAST_MAIL|MIMECAST_URL_LOGS|OBSERVEIT|OFFICE_365|POSTFIX_MAIL|PROOFPOINT_MAIL|PROOFPOINT_MAIL_FILTER|PROOFPOINT_ON_DEMAND|PROOFPOINT_SENDMAIL_SENTRION|PROOFPOINT_SER|PROOFPOINT_TAP_FORENSICS|PROOFPOINT_TRAP|SENDMAIL|SEPPMAIL|SYMANTEC_VIP|VIRTRU_EMAIL_ENCRYPTION|VOLTAGE|WORKSPACE_ALERTS|ZIX_EMAIL_ENCRYPTION|PHISHLABS/ nocase
$event.metadata.event_type = "EMAIL_UNCATEGORIZED"
or $event.metadata.event_type = "EMAIL_TRANSACTION"
or $event.metadata.event_type = "NETWORK_HTTP"
strings.coalesce($event.about.file.full_path, $event.security_result.detection_fields["attachmentNames"]) != ""
$Attachment = strings.coalesce($event.about.file.full_path, $event.security_result.detection_fields["attachmentNames"])
$Category = $event.security_result.category
$Sender = $event.network.email.from
$Receiver = $event.network.email.to
$Status = $event.additional.fields["remediationStatus"]
$Date = timestamp.get_date($event.metadata.event_timestamp.seconds)
match:
$Date, $Sender, $Receiver, $Attachment, $Category, $Status
order:
$Date desc
limit:
50
10 principais locais maliciosos
$event.metadata.log_type = /ABNORMAL_SECURITY|AREA1|AVANAN_EMAIL|BARRACUDA_EMAIL|CISCO_EMAIL_SECURITY|COFENSE_TRIAGE|EXCHANGE_MAIL|FIREEYE_EMPS|FIREEYE_ETP|FORCEPOINT_EMAILSECURITY|FORCEPOINT_MAIL_RELAY|FORTINET_FORTIMAIL|KNOWBE4_PHISHER|MAILMARSHAL|MICROSOFT_DEFENDER_MAIL|MIMECAST_MAIL|MIMECAST_URL_LOGS|OBSERVEIT|OFFICE_365|POSTFIX_MAIL|PROOFPOINT_MAIL|PROOFPOINT_MAIL_FILTER|PROOFPOINT_ON_DEMAND|PROOFPOINT_SENDMAIL_SENTRION|PROOFPOINT_SER|PROOFPOINT_TAP_FORENSICS|PROOFPOINT_TRAP|SENDMAIL|SEPPMAIL|SYMANTEC_VIP|VIRTRU_EMAIL_ENCRYPTION|VOLTAGE|WORKSPACE_ALERTS|ZIX_EMAIL_ENCRYPTION|PHISHLABS/ nocase
$event.metadata.event_type = "EMAIL_UNCATEGORIZED"
or $event.metadata.event_type = "EMAIL_TRANSACTION"
or $event.metadata.event_type = "NETWORK_HTTP"
$event.security_result.detection_fields["judgement"] = /MALICIOUS/ nocase
$event.principal.location.country_or_region != ""
$Countries = $event.principal.location.country_or_region
$Latitude = $event.principal.location.region_coordinates.latitude
$Longitude = $event.principal.location.region_coordinates.longitude
match:
$Countries, $Latitude, $Longitude
outcome:
$Count = count($event.metadata.id)
order:
$Count desc
limit:
10
Ameaças de e-mail por categoria
$event.metadata.log_type = /ABNORMAL_SECURITY|AREA1|AVANAN_EMAIL|BARRACUDA_EMAIL|CISCO_EMAIL_SECURITY|COFENSE_TRIAGE|EXCHANGE_MAIL|FIREEYE_EMPS|FIREEYE_ETP|FORCEPOINT_EMAILSECURITY|FORCEPOINT_MAIL_RELAY|FORTINET_FORTIMAIL|KNOWBE4_PHISHER|MAILMARSHAL|MICROSOFT_DEFENDER_MAIL|MIMECAST_MAIL|MIMECAST_URL_LOGS|OBSERVEIT|OFFICE_365|POSTFIX_MAIL|PROOFPOINT_MAIL|PROOFPOINT_MAIL_FILTER|PROOFPOINT_ON_DEMAND|PROOFPOINT_SENDMAIL_SENTRION|PROOFPOINT_SER|PROOFPOINT_TAP_FORENSICS|PROOFPOINT_TRAP|SENDMAIL|SEPPMAIL|SYMANTEC_VIP|VIRTRU_EMAIL_ENCRYPTION|VOLTAGE|WORKSPACE_ALERTS|ZIX_EMAIL_ENCRYPTION|PHISHLABS/ nocase
$Threat_Name = $event.security_result.category_details
$Category = $event.security_result.category
match:
$Threat_Name, $Category
outcome:
$Count = count($event.security_result.threat_name)
order:
$Count desc
limit:
50
As 10 principais ameaças de e-mail por gravidade
$event.metadata.log_type = /ABNORMAL_SECURITY|AREA1|AVANAN_EMAIL|BARRACUDA_EMAIL|CISCO_EMAIL_SECURITY|COFENSE_TRIAGE|EXCHANGE_MAIL|FIREEYE_EMPS|FIREEYE_ETP|FORCEPOINT_EMAILSECURITY|FORCEPOINT_MAIL_RELAY|FORTINET_FORTIMAIL|KNOWBE4_PHISHER|MAILMARSHAL|MICROSOFT_DEFENDER_MAIL|MIMECAST_MAIL|MIMECAST_URL_LOGS|OBSERVEIT|OFFICE_365|POSTFIX_MAIL|PROOFPOINT_MAIL|PROOFPOINT_MAIL_FILTER|PROOFPOINT_ON_DEMAND|PROOFPOINT_SENDMAIL_SENTRION|PROOFPOINT_SER|PROOFPOINT_TAP_FORENSICS|PROOFPOINT_TRAP|SENDMAIL|SEPPMAIL|SYMANTEC_VIP|VIRTRU_EMAIL_ENCRYPTION|VOLTAGE|WORKSPACE_ALERTS|ZIX_EMAIL_ENCRYPTION|PHISHLABS/ nocase
$event.metadata.event_type = "EMAIL_UNCATEGORIZED"
or $event.metadata.event_type = "EMAIL_TRANSACTION"
or $event.metadata.event_type = "NETWORK_HTTP"
$event.security_result.category_details != ""
$Severity = $event.security_result.severity
$Threat_Name = $event.security_result.category_details
$Threat_Name != ""
match:
$Threat_Name, $Severity
outcome:
$Count = count($event.security_result.severity)
order:
$Count desc
limit:
10
Ameaças ativas recentes
$event.metadata.log_type = /ABNORMAL_SECURITY|AREA1|AVANAN_EMAIL|BARRACUDA_EMAIL|CISCO_EMAIL_SECURITY|COFENSE_TRIAGE|EXCHANGE_MAIL|FIREEYE_EMPS|FIREEYE_ETP|FORCEPOINT_EMAILSECURITY|FORCEPOINT_MAIL_RELAY|FORTINET_FORTIMAIL|KNOWBE4_PHISHER|MAILMARSHAL|MICROSOFT_DEFENDER_MAIL|MIMECAST_MAIL|MIMECAST_URL_LOGS|OBSERVEIT|OFFICE_365|POSTFIX_MAIL|PROOFPOINT_MAIL|PROOFPOINT_MAIL_FILTER|PROOFPOINT_ON_DEMAND|PROOFPOINT_SENDMAIL_SENTRION|PROOFPOINT_SER|PROOFPOINT_TAP_FORENSICS|PROOFPOINT_TRAP|SENDMAIL|SEPPMAIL|SYMANTEC_VIP|VIRTRU_EMAIL_ENCRYPTION|VOLTAGE|WORKSPACE_ALERTS|ZIX_EMAIL_ENCRYPTION|PHISHLABS/ nocase
$event.metadata.event_type = "EMAIL_UNCATEGORIZED"
or $event.metadata.event_type = "EMAIL_TRANSACTION"
or $event.metadata.event_type = "NETWORK_HTTP"
$Threat_Name = $event.security_result.threat_name
$Status = $event.security_result.threat_status
match:
$Threat_Name, $Status
outcome:
$Count = count($event.metadata.id)
$Date = timestamp.get_timestamp(max($event.metadata.event_timestamp.seconds))
order:
$Date desc
limit:
50
Distribuição do status de ameaça
$event.metadata.log_type = /ABNORMAL_SECURITY|AREA1|AVANAN_EMAIL|BARRACUDA_EMAIL|CISCO_EMAIL_SECURITY|COFENSE_TRIAGE|EXCHANGE_MAIL|FIREEYE_EMPS|FIREEYE_ETP|FORCEPOINT_EMAILSECURITY|FORCEPOINT_MAIL_RELAY|FORTINET_FORTIMAIL|KNOWBE4_PHISHER|MAILMARSHAL|MICROSOFT_DEFENDER_MAIL|MIMECAST_MAIL|MIMECAST_URL_LOGS|OBSERVEIT|OFFICE_365|POSTFIX_MAIL|PROOFPOINT_MAIL|PROOFPOINT_MAIL_FILTER|PROOFPOINT_ON_DEMAND|PROOFPOINT_SENDMAIL_SENTRION|PROOFPOINT_SER|PROOFPOINT_TAP_FORENSICS|PROOFPOINT_TRAP|SENDMAIL|SEPPMAIL|SYMANTEC_VIP|VIRTRU_EMAIL_ENCRYPTION|VOLTAGE|WORKSPACE_ALERTS|ZIX_EMAIL_ENCRYPTION|PHISHLABS/ nocase
$event.metadata.event_type = "EMAIL_UNCATEGORIZED"
or $event.metadata.event_type = "EMAIL_TRANSACTION"
or $event.metadata.event_type = "NETWORK_HTTP"
$Status = $event.security_result.threat_status
match:
$Status
outcome:
$Count = count($event.security_result.threat_name)
order:
$Count desc
Distribuição de ações de resultados de segurança
$event.metadata.log_type = /ABNORMAL_SECURITY|AREA1|AVANAN_EMAIL|BARRACUDA_EMAIL|CISCO_EMAIL_SECURITY|COFENSE_TRIAGE|EXCHANGE_MAIL|FIREEYE_EMPS|FIREEYE_ETP|FORCEPOINT_EMAILSECURITY|FORCEPOINT_MAIL_RELAY|FORTINET_FORTIMAIL|KNOWBE4_PHISHER|MAILMARSHAL|MICROSOFT_DEFENDER_MAIL|MIMECAST_MAIL|MIMECAST_URL_LOGS|OBSERVEIT|OFFICE_365|POSTFIX_MAIL|PROOFPOINT_MAIL|PROOFPOINT_MAIL_FILTER|PROOFPOINT_ON_DEMAND|PROOFPOINT_SENDMAIL_SENTRION|PROOFPOINT_SER|PROOFPOINT_TAP_FORENSICS|PROOFPOINT_TRAP|SENDMAIL|SEPPMAIL|SYMANTEC_VIP|VIRTRU_EMAIL_ENCRYPTION|VOLTAGE|WORKSPACE_ALERTS|ZIX_EMAIL_ENCRYPTION|PHISHLABS/ nocase
$event.metadata.event_type = "EMAIL_UNCATEGORIZED"
or $event.metadata.event_type = "EMAIL_TRANSACTION"
or $event.metadata.event_type = "NETWORK_HTTP"
$Action = $event.security_result.action
match:
$Action
outcome:
$Count = count($event.security_result.action)
order:
$Count desc
Distribuição de ações de resultados de segurança
$event.metadata.log_type = /ABNORMAL_SECURITY|AREA1|AVANAN_EMAIL|BARRACUDA_EMAIL|CISCO_EMAIL_SECURITY|COFENSE_TRIAGE|EXCHANGE_MAIL|FIREEYE_EMPS|FIREEYE_ETP|FORCEPOINT_EMAILSECURITY|FORCEPOINT_MAIL_RELAY|FORTINET_FORTIMAIL|KNOWBE4_PHISHER|MAILMARSHAL|MICROSOFT_DEFENDER_MAIL|MIMECAST_MAIL|MIMECAST_URL_LOGS|OBSERVEIT|OFFICE_365|POSTFIX_MAIL|PROOFPOINT_MAIL|PROOFPOINT_MAIL_FILTER|PROOFPOINT_ON_DEMAND|PROOFPOINT_SENDMAIL_SENTRION|PROOFPOINT_SER|PROOFPOINT_TAP_FORENSICS|PROOFPOINT_TRAP|SENDMAIL|SEPPMAIL|SYMANTEC_VIP|VIRTRU_EMAIL_ENCRYPTION|VOLTAGE|WORKSPACE_ALERTS|ZIX_EMAIL_ENCRYPTION|PHISHLABS/ nocase
$event.metadata.event_type = "EMAIL_UNCATEGORIZED"
or $event.metadata.event_type = "EMAIL_TRANSACTION"
or $event.metadata.event_type = "NETWORK_HTTP"
$Action = $event.security_result.action
match:
$Action
outcome:
$Count = count($event.security_result.action)
order:
$Count desc
10 principais e-mails segmentados
$event.metadata.log_type = /ABNORMAL_SECURITY|AREA1|AVANAN_EMAIL|BARRACUDA_EMAIL|CISCO_EMAIL_SECURITY|COFENSE_TRIAGE|EXCHANGE_MAIL|FIREEYE_EMPS|FIREEYE_ETP|FORCEPOINT_EMAILSECURITY|FORCEPOINT_MAIL_RELAY|FORTINET_FORTIMAIL|KNOWBE4_PHISHER|MAILMARSHAL|MICROSOFT_DEFENDER_MAIL|MIMECAST_MAIL|MIMECAST_URL_LOGS|OBSERVEIT|OFFICE_365|POSTFIX_MAIL|PROOFPOINT_MAIL|PROOFPOINT_MAIL_FILTER|PROOFPOINT_ON_DEMAND|PROOFPOINT_SENDMAIL_SENTRION|PROOFPOINT_SER|PROOFPOINT_TAP_FORENSICS|PROOFPOINT_TRAP|SENDMAIL|SEPPMAIL|SYMANTEC_VIP|VIRTRU_EMAIL_ENCRYPTION|VOLTAGE|WORKSPACE_ALERTS|ZIX_EMAIL_ENCRYPTION|PHISHLABS/ nocase
$event.metadata.event_type = "EMAIL_UNCATEGORIZED"
or $event.metadata.event_type = "EMAIL_TRANSACTION"
or $event.metadata.event_type = "NETWORK_HTTP"
$event.target.user.email_addresses != ""
$Target = $event.target.user.email_addresses
match:
$Target
outcome:
$Count = count($event.target.user.email_addresses)
order:
$Count desc
limit:
10
10 principais locais maliciosos
$event.metadata.log_type = /ABNORMAL_SECURITY|AREA1|AVANAN_EMAIL|BARRACUDA_EMAIL|CISCO_EMAIL_SECURITY|COFENSE_TRIAGE|EXCHANGE_MAIL|FIREEYE_EMPS|FIREEYE_ETP|FORCEPOINT_EMAILSECURITY|FORCEPOINT_MAIL_RELAY|FORTINET_FORTIMAIL|KNOWBE4_PHISHER|MAILMARSHAL|MICROSOFT_DEFENDER_MAIL|MIMECAST_MAIL|MIMECAST_URL_LOGS|OBSERVEIT|OFFICE_365|POSTFIX_MAIL|PROOFPOINT_MAIL|PROOFPOINT_MAIL_FILTER|PROOFPOINT_ON_DEMAND|PROOFPOINT_SENDMAIL_SENTRION|PROOFPOINT_SER|PROOFPOINT_TAP_FORENSICS|PROOFPOINT_TRAP|SENDMAIL|SEPPMAIL|SYMANTEC_VIP|VIRTRU_EMAIL_ENCRYPTION|VOLTAGE|WORKSPACE_ALERTS|ZIX_EMAIL_ENCRYPTION|PHISHLABS/ nocase
$event.metadata.event_type = "EMAIL_UNCATEGORIZED"
or $event.metadata.event_type = "EMAIL_TRANSACTION"
or $event.metadata.event_type = "NETWORK_HTTP"
$event.security_result.detection_fields["judgement"] = /MALICIOUS/ nocase
$event.principal.location.country_or_region != ""
$Countries = $event.principal.location.country_or_region
$Latitude = $event.principal.location.region_coordinates.latitude
$Longitude = $event.principal.location.region_coordinates.longitude
match:
$Countries, $Latitude, $Longitude
outcome:
$Count = count($event.metadata.id)
order:
$Count desc
limit:
10
10 principais ameaças de alta gravidade
$event.metadata.log_type = /ABNORMAL_SECURITY|AREA1|AVANAN_EMAIL|BARRACUDA_EMAIL|CISCO_EMAIL_SECURITY|COFENSE_TRIAGE|EXCHANGE_MAIL|FIREEYE_EMPS|FIREEYE_ETP|FORCEPOINT_EMAILSECURITY|FORCEPOINT_MAIL_RELAY|FORTINET_FORTIMAIL|KNOWBE4_PHISHER|MAILMARSHAL|MICROSOFT_DEFENDER_MAIL|MIMECAST_MAIL|MIMECAST_URL_LOGS|OBSERVEIT|OFFICE_365|POSTFIX_MAIL|PROOFPOINT_MAIL|PROOFPOINT_MAIL_FILTER|PROOFPOINT_ON_DEMAND|PROOFPOINT_SENDMAIL_SENTRION|PROOFPOINT_SER|PROOFPOINT_TAP_FORENSICS|PROOFPOINT_TRAP|SENDMAIL|SEPPMAIL|SYMANTEC_VIP|VIRTRU_EMAIL_ENCRYPTION|VOLTAGE|WORKSPACE_ALERTS|ZIX_EMAIL_ENCRYPTION|PHISHLABS/ nocase
$event.metadata.event_type = "EMAIL_UNCATEGORIZED"
or $event.metadata.event_type = "EMAIL_TRANSACTION"
or $event.metadata.event_type = "NETWORK_HTTP"
$event.security_result.category_details != ""
$event.security_result.severity = "HIGH"
$Category = $event.security_result.category_details
match:
$Category
outcome:
$Count = count($event.metadata.id)
order:
$Count desc
limit:
10
Distribuição do status de ameaça
$event.metadata.log_type = /ABNORMAL_SECURITY|AREA1|AVANAN_EMAIL|BARRACUDA_EMAIL|CISCO_EMAIL_SECURITY|COFENSE_TRIAGE|EXCHANGE_MAIL|FIREEYE_EMPS|FIREEYE_ETP|FORCEPOINT_EMAILSECURITY|FORCEPOINT_MAIL_RELAY|FORTINET_FORTIMAIL|KNOWBE4_PHISHER|MAILMARSHAL|MICROSOFT_DEFENDER_MAIL|MIMECAST_MAIL|MIMECAST_URL_LOGS|OBSERVEIT|OFFICE_365|POSTFIX_MAIL|PROOFPOINT_MAIL|PROOFPOINT_MAIL_FILTER|PROOFPOINT_ON_DEMAND|PROOFPOINT_SENDMAIL_SENTRION|PROOFPOINT_SER|PROOFPOINT_TAP_FORENSICS|PROOFPOINT_TRAP|SENDMAIL|SEPPMAIL|SYMANTEC_VIP|VIRTRU_EMAIL_ENCRYPTION|VOLTAGE|WORKSPACE_ALERTS|ZIX_EMAIL_ENCRYPTION|PHISHLABS/ nocase
$event.metadata.event_type = "EMAIL_UNCATEGORIZED"
or $event.metadata.event_type = "EMAIL_TRANSACTION"
or $event.metadata.event_type = "NETWORK_HTTP"
$Status = $event.security_result.threat_status
match:
$Status
outcome:
$Count = count($event.security_result.threat_name)
order:
$Count desc
As 10 principais ameaças de e-mail por gravidade
$event.metadata.log_type = /ABNORMAL_SECURITY|AREA1|AVANAN_EMAIL|BARRACUDA_EMAIL|CISCO_EMAIL_SECURITY|COFENSE_TRIAGE|EXCHANGE_MAIL|FIREEYE_EMPS|FIREEYE_ETP|FORCEPOINT_EMAILSECURITY|FORCEPOINT_MAIL_RELAY|FORTINET_FORTIMAIL|KNOWBE4_PHISHER|MAILMARSHAL|MICROSOFT_DEFENDER_MAIL|MIMECAST_MAIL|MIMECAST_URL_LOGS|OBSERVEIT|OFFICE_365|POSTFIX_MAIL|PROOFPOINT_MAIL|PROOFPOINT_MAIL_FILTER|PROOFPOINT_ON_DEMAND|PROOFPOINT_SENDMAIL_SENTRION|PROOFPOINT_SER|PROOFPOINT_TAP_FORENSICS|PROOFPOINT_TRAP|SENDMAIL|SEPPMAIL|SYMANTEC_VIP|VIRTRU_EMAIL_ENCRYPTION|VOLTAGE|WORKSPACE_ALERTS|ZIX_EMAIL_ENCRYPTION|PHISHLABS/ nocase
$event.metadata.event_type = "EMAIL_UNCATEGORIZED"
or $event.metadata.event_type = "EMAIL_TRANSACTION"
or $event.metadata.event_type = "NETWORK_HTTP"
$event.security_result.category_details != ""
$Severity = $event.security_result.severity
$Threat_Name = $event.security_result.category_details
match:
$Threat_Name, $Severity
outcome:
$Count = count($event.security_result.severity)
order:
$Count desc
limit:
10
10 principais domínios identificados
$event.metadata.log_type = /ABNORMAL_SECURITY|AREA1|AVANAN_EMAIL|BARRACUDA_EMAIL|CISCO_EMAIL_SECURITY|COFENSE_TRIAGE|EXCHANGE_MAIL|FIREEYE_EMPS|FIREEYE_ETP|FORCEPOINT_EMAILSECURITY|FORCEPOINT_MAIL_RELAY|FORTINET_FORTIMAIL|KNOWBE4_PHISHER|MAILMARSHAL|MICROSOFT_DEFENDER_MAIL|MIMECAST_MAIL|MIMECAST_URL_LOGS|OBSERVEIT|OFFICE_365|POSTFIX_MAIL|PROOFPOINT_MAIL|PROOFPOINT_MAIL_FILTER|PROOFPOINT_ON_DEMAND|PROOFPOINT_SENDMAIL_SENTRION|PROOFPOINT_SER|PROOFPOINT_TAP_FORENSICS|PROOFPOINT_TRAP|SENDMAIL|SEPPMAIL|SYMANTEC_VIP|VIRTRU_EMAIL_ENCRYPTION|VOLTAGE|WORKSPACE_ALERTS|ZIX_EMAIL_ENCRYPTION|PHISHLABS/ nocase
$event.metadata.event_type = "EMAIL_UNCATEGORIZED"
or $event.metadata.event_type = "EMAIL_TRANSACTION"
or $event.metadata.event_type = "NETWORK_HTTP"
$event.principal.administrative_domain != ""
$Domain = $event.principal.administrative_domain
match:
$Domain
outcome:
$Count = count($event.metadata.id)
order:
$Count desc
limit:
10
Monitoramento contínuo do FEDRAMP
Esse painel oferece uma visão clara da conformidade do sistema e da postura de segurança.
Ele rastreia vulnerabilidades e a eficácia do controle em relação aos padrões do FedRAMP, ajudando você a manter a conformidade e priorizar os esforços de correção.
Total de conexões de entrada
Sistemas com atualizações disponíveis
Alertas recentes de fornecedores de proteção de mídia
10 principais domínios bloqueados
Tráfego de rede ao longo do tempo por direção
Vulnerabilidades por gravidade
10 principais execuções de aplicativos bloqueadas por motivo
Uso de versões TLS fracas ao longo do tempo
Logins por status ao longo do tempo
Status do registro da MFA
Os 10 principais endpoints por alertas de alta gravidade
Os 10 principais endereços IP de entrada
Alertas de fornecedores de proteção de mídia por ação ao longo do tempo
10 principais inserções de selos de usuários recentes
Detecções de endpoint de alta gravidade ao longo do tempo
Total de conexões de saída
Os 10 principais usuários por falhas de login
Distribuição de criptografia TLS
Violações da DLP por gravidade
Vulnerabilidades por idade
Alterar permissões das contas de usuário
Os 10 principais endereços IP de saída
10 principais usuários por ações privilegiadas
Nome do gráfico
Exemplo de consulta
Total de conexões de entrada
metadata.event_type = "NETWORK_CONNECTION"
network.direction = "INBOUND"
outcome:
$Count = count_distinct(principal.ip)
Sistemas com atualizações disponíveis
metadata.product_event_type = "40"
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
$Hostname = strings.coalesce(principal.asset.hostname, principal.hostname)
match:
$Hostname, $Date
outcome:
$Count = count(metadata.id)
order:
$Date asc
Alertas recentes de fornecedores de proteção de mídia
strings.coalesce(metadata.product_event_type, security_result.rule_name, security_result.summary) = /\busb|removable|drive\b/ nocase
$Vendor_Alert = strings.coalesce(metadata.product_event_type, security_result.rule_name, security_result.summary)
$User = strings.coalesce(principal.user.user_display_name, target.user.user_display_name)
$Source_IP = strings.coalesce(principal.asset.ip, principal.ip)
$File_Name = target.file.full_path
$Action = security_result.action
$Date = timestamp.get_timestamp(metadata.event_timestamp.seconds, "%F %T ")
match:
$Date, $Vendor_Alert, $Source_IP, $User, $File_Name, $Action
order:
$Date desc
10 principais domínios bloqueados
security_result.action = "BLOCK"
$Destination_Domain = strings.coalesce(target.administrative_domain, about.administrative_domain, target.ip_geo_artifact.network.dns_domain)
$Destination_Domain != ""
match:
$Destination_Domain
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
Tráfego de rede ao longo do tempo por direção
metadata.event_type = "NETWORK_UNCATEGORIZED"
or metadata.event_type = "NETWORK_FLOW"
or metadata.event_type = "NETWORK_CONNECTION"
or metadata.event_type = "NETWORK_FTP"
or metadata.event_type = "NETWORK_DHCP"
or metadata.event_type = "NETWORK_DNS"
or metadata.event_type = "NETWORK_HTTP"
or metadata.event_type = "NETWORK_SMTP"
$Direction = network.direction
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
match:
$Direction, $Date
outcome:
$Count = count(metadata.id)
order:
$Date desc
Vulnerabilidades por gravidade
$Severity =
if (principal.asset.vulnerabilities.severity != "UNKNOWN_SEVERITY",
principal.asset.vulnerabilities.severity,
if (target.asset.vulnerabilities.severity != "UNKNOWN_SEVERITY",
target.asset.vulnerabilities.severity,
if (extensions.vulns.vulnerabilities.severity != "UNKNOWN_SEVERITY",
extensions.vulns.vulnerabilities.severity,
"UNKNOWN_SEVERITY")))
match:
$Severity
outcome:
$Event_Count = count(strings.coalesce(extensions.vulns.vulnerabilities.name, extensions.vulns.vulnerabilities.description, extensions.vulns.vulnerabilities.vendor_vulnerability_id, principal.asset.vulnerabilities.name, target.asset.vulnerabilities.name, additional.fields["ScanReference"]))
order:
$Severity desc
10 principais execuções de aplicativos bloqueadas por motivo
metadata.product_event_type = /(execution|application) block/ nocase
or security_result.threat_name = /application control/ nocase
security_result.action = "BLOCK"
$Application = strings.coalesce(about.file.full_path, target.process.file.full_path, additional.fields["fname"])
$Reason = strings.coalesce(target.resource.attribute.labels["categoryTupleDescription"], security_result.action_details, metadata.product_event_type)
match:
$Application, $Reason
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
Uso de versões TLS fracas ao longo do tempo
network.tls.version != /1(\.|_)?(2|3)/ nocase
$Cipher_Version = network.tls.version
$Cipher_Version != ""
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
match:
$Cipher_Version, $Date
outcome:
$Count = count(metadata.id)
order:
$Date desc
Logins por status ao longo do tempo
metadata.event_type = "USER_LOGIN"
$Action = security_result.action
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
match:
$Action, $Date
outcome:
$Count = count(metadata.id)
order:
$Date desc
Status do registro da MFA
metadata.product_name = "MULTI-FACTOR_AUTHENTICATION"
or strings.coalesce(additional.fields["AuthenticationRequirement"], security_result.detection_fields.value) = /mfa|multi(?:\s|\S)?factor(?:\s|\S)?authentication|/ nocase
metadata.product_event_type = "enrollment"
or target.resource_ancestors.resource_subtype = "AuthenticatorEnrollment"
$Result = security_result.summary
match:
$Result
outcome:
$Count = count(metadata.id)
order:
$Count desc
Os 10 principais endpoints por alertas de alta gravidade
principal.hostname != ""
$Hostname = principal.hostname
$Severity = security_result.severity
$Severity = "CRITICAL" or $Severity = "HIGH"
match:
$Hostname, $Severity
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
Os 10 principais endereços IP de entrada
network.direction = "INBOUND"
$Log_Type = metadata.log_type
$Source_IP = principal.ip
match:
$Log_Type, $Source_IP
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
Alertas de fornecedores de proteção de mídia por ação ao longo do tempo
strings.coalesce(metadata.product_event_type, security_result.rule_name, security_result.summary) = /\busb|removable|drive\b/ nocase
$Action = security_result.action
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
match:
$Date, $Action
outcome:
$Count = count(metadata.id)
order:
$Date desc
10 principais inserções de selos de usuários recentes
(metadata.event_type = "USER_BADGE_IN"
or metadata.event_type = "USER_RESOURCE_ACCESS"
or metadata.event_type = "USER_UNCATEGORIZED")
strings.coalesce(metadata.description, security_result.action_details, security_result.description, security_result.summary, additional.fields["plasectrxEvtypename"]) = /(?:access\sgranted|badge\sin)/ nocase
$User = strings.coalesce(principal.user.user_display_name, principal.user.email_addresses, additional.fields["person"], principal.user.userid)
$Location = strings.coalesce(security_result.rule_labels["Place"], additional.fields["site"], target.location.name, principal.resource.name)
$Date = timestamp.get_timestamp(metadata.event_timestamp.seconds, "%F %H:%M:%S ")
match:
$Date, $User, $Location
order:
$Date desc
limit:
10
Detecções de endpoint de alta gravidade ao longo do tempo
principal.hostname != ""
$Severity = security_result.severity
$Severity = "CRITICAL" or $Severity = "HIGH"
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
match:
$Severity, $Date
outcome:
$Count = count(metadata.id)
order:
$Count desc
Total de conexões de saída
metadata.event_type = "NETWORK_CONNECTION"
network.direction = "OUTBOUND"
outcome:
$Count = count_distinct(target.ip)
Os 10 principais usuários por falhas de login
metadata.event_type = "USER_LOGIN"
security_result.action = "BLOCK"
target.user.userid != ""
$User = target.user.userid
match:
$User
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
Distribuição de criptografia TLS
network.tls.cipher != /1(\.|_)?(2|3)/ nocase
$TLS_Cipher = network.tls.cipher
$TLS_Cipher != ""
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
match:
$TLS_Cipher, $Date
outcome:
$Count = count(metadata.id)
order:
$Count desc
Violações da DLP por gravidade
metadata.log_type = /DLP/ nocase
metadata.product_event_type = /Violation/ nocase
$Severity = security_result.severity
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
match:
$Severity
outcome:
$Count = count(metadata.id)
order:
$Severity desc
Vulnerabilidades por idade
(timestamp.as_unix_seconds(additional.fields["first_found"]) > 0
or extensions.vulns.vulnerabilities.first_found.seconds > 0
or principal.asset.vulnerabilities.first_found.seconds > 0)
$Vulnerability = strings.coalesce(
if(principal.asset.vulnerabilities.name != "" and principal.asset.vulnerabilities.description != "",
strings.concat(principal.asset.vulnerabilities.name, " : ", principal.asset.vulnerabilities.description),
strings.coalesce(principal.asset.vulnerabilities.name, principal.asset.vulnerabilities.description)),
if(additional.fields["ScanReference"] != "" and metadata.description != "",
strings.concat(additional.fields["ScanReference"], " : ", metadata.description),
strings.coalesce(additional.fields["ScanReference"], metadata.description)),
if(extensions.vulns.vulnerabilities.vendor_vulnerability_id != "" and extensions.vulns.vulnerabilities.description != "",
strings.concat(extensions.vulns.vulnerabilities.vendor_vulnerability_id, " : ", extensions.vulns.vulnerabilities.description),
strings.coalesce(extensions.vulns.vulnerabilities.vendor_vulnerability_id, extensions.vulns.vulnerabilities.description)
)
)
$Vulnerability != " : "
$Vulnerability != ""
$Log_Type = metadata.log_type
match:
$Vulnerability, $Log_Type
outcome:
$Age = max(cast.as_int((metadata.event_timestamp.seconds - if(timestamp.as_unix_seconds(additional.fields["first_found"]) > 0, timestamp.as_unix_seconds(additional.fields["first_found"]), if(extensions.vulns.vulnerabilities.first_found.seconds > 0, extensions.vulns.vulnerabilities.first_found.seconds, if(principal.asset.vulnerabilities.first_found.seconds > 0, principal.asset.vulnerabilities.first_found.seconds, metadata.event_timestamp.seconds)))) / 86400))
$Days_Range = if($Age <= 30, "0-30 Days",
if($Age <= 60, "31-60 Days",
if($Age <= 90, "61-90 Days", "> 90 Days")))
$Count = count(strings.coalesce(extensions.vulns.vulnerabilities.name, extensions.vulns.vulnerabilities.description, extensions.vulns.vulnerabilities.vendor_vulnerability_id, principal.asset.vulnerabilities.name, additional.fields["ScanReference"]))
order:
$Age desc
Alterar permissões das contas de usuário
metadata.event_type = "USER_CHANGE_PERMISSIONS"
principal.user.userid != ""
outcome:
$Count = count_distinct(metadata.id)
Os 10 principais endereços IP de saída
network.direction = "OUTBOUND"
$Log_Type = metadata.log_type
$Destination_IP = target.ip
match:
$Log_Type, $Destination_IP
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
10 principais usuários por ações privilegiadas
principal.user.attribute.roles.type = "ADMINISTRATOR"
or strings.coalesce(principal.user.attribute.roles.name, principal.user.userid) = /Admin|Root|Super/ nocase
$User = principal.user.userid
$Action = metadata.product_event_type
match:
$User, $Action
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
Monitoramento de atividade do firewall
Esse painel fornece informações sobre a atividade do firewall para melhorar a segurança
e o gerenciamento de desempenho. Ele fornece insights em tempo real sobre a segurança da rede ao rastrear várias métricas e eventos relacionados à atividade do firewall, ajudando os usuários a gerenciar e responder de maneira eficaz a possíveis ameaças.
Regras de firewall raras acionadas
As 10 principais regras de firewall acionadas
Conexões por geolocalização
Principais destinos de conexão
Fluxo de dados por IP
Saída de dados por IP
Principais origens de conexão
Tráfego bloqueado x permitido
10 principais IPs bloqueados
Nome do gráfico
Exemplo de consulta
Regras de firewall raras acionadas
$event_type = metadata.event_type
$event_type >= 16000 and $event_type <= 16007
$log_type = metadata.log_type
$rule_name = security_result.rule_name
$rule_name !=""
$date = timestamp.get_date(metadata.event_timestamp.seconds)
match:
$rule_name
outcome:
$Count = count($rule_name)
order: $Count asc
limit: 10
As 10 principais regras de firewall acionadas
$event_type = metadata.event_type
$event_type >= 16000 and $event_type <= 16007
$log_type = metadata.log_type
$rule_name = security_result.rule_name
$rule_name !=""
match:
$rule_name
outcome:
$Count = count(metadata.id)
order: $Count desc
limit: 10
Conexões por geolocalização
$event_type = metadata.event_type
$event_type >= 16000 and $event_type <= 16007
$log_type = metadata.log_type
$rule_name = security_result.rule_name
$rule_name !=""
$country = principal.location.country_or_region
$country != ""
$direction = network.direction
match:
$country
outcome:
$event_count = count_distinct($country)
$latitude = max(principal.location.region_coordinates.latitude)
$longitude = max(principal.location.region_coordinates.longitude)
Principais destinos de conexão
$event_type = metadata.event_type
$event_type >= 16000 and $event_type <= 16007
$log_type = metadata.log_type
$rule_name = security_result.rule_name
$Dest_IP = target.ip
$Dest_IP != ""
match:
$Dest_IP
outcome:
$event_count = count(metadata.id)
order: $event_count desc
limit: 10
Fluxo de dados por IP
$event_type = metadata.event_type
$event_type >= 16000 and $event_type <= 16007
$ruleN = security_result.rule_name
$IP = principal.ip
$byte = network.received_bytes
$byte != 0
$Vendor = metadata.vendor_name
$Vendor != ""
match:
$IP, $Vendor
outcome:
$byte_sum=sum($byte)
$Data_in_mb = math.round($byte_sum/1048576)
order: $Data_in_mb desc
limit: 10
Conexões por geolocalização
$event_type = metadata.event_type
$event_type >= 16000 and $event_type <= 16007
$log_type = metadata.log_type
$rule_name = security_result.rule_name
$rule_name !=""
$country = principal.location.country_or_region
$country != ""
$direction = network.direction
match:
$country
outcome:
$event_count = count_distinct($country)
$latitude = max(principal.location.region_coordinates.latitude)
$longitude = max(principal.location.region_coordinates.longitude)
Saída de dados por IP
$event_type = metadata.event_type
$event_type >= 16000 and $event_type <= 16007
$IP = principal.ip
$byte = network.sent_bytes
$byte != 0
$Vendor = metadata.vendor_name
metadata.vendor_name != ""
match:
$IP, $Vendor
outcome:
$byte_sum=sum($byte)
$data_in_mb = math.round($byte_sum/1048576)
order: $data_in_mb desc
limit:10
Regras de firewall raras acionadas
$event_type = metadata.event_type
$event_type >= 16000 and $event_type <= 16007
$log_type = metadata.log_type
$rule_name = security_result.rule_name
$rule_name !=""
$date = timestamp.get_date(metadata.event_timestamp.seconds)
match:
$rule_name
outcome:
$Count = count($rule_name)
order: $Count asc
limit: 10
Principais origens de conexão
$event_type = metadata.event_type
$event_type >= 16000 and $event_type <= 16007
$log_type = metadata.log_type
$rule_name = security_result.rule_name
$Src_IP = principal.ip
match:
$Src_IP
outcome:
$event_count = count(metadata.id)
order: $event_count desc
limit: 10
Tráfego bloqueado x permitido
$event_type = metadata.event_type
$event_type >= 16000 and $event_type <= 16007
$log_type = metadata.log_type
$rule_name = security_result.rule_name
$action = security_result.action
$action = "BLOCK" OR $action = "ALLOW"
match:
$action
outcome:
$event_count = count(metadata.id)
order: $event_count desc
As 10 principais regras de firewall acionadas
$event_type = metadata.event_type
$event_type >= 16000 and $event_type <= 16007
$log_type = metadata.log_type
$rule_name = security_result.rule_name
$rule_name !=""
match:
$rule_name
outcome:
$Count = count(metadata.id)
order: $Count desc
limit: 10
Tráfego bloqueado x permitido
$event_type = metadata.event_type
$event_type >= 16000 and $event_type <= 16007
$log_type = metadata.log_type
$rule_name = security_result.rule_name
$action = security_result.action
$action = "BLOCK" OR $action = "ALLOW"
match:
$action
outcome:
$event_count = count(metadata.id)
order: $event_count desc
Saída de dados por IP
$event_type = metadata.event_type
$event_type >= 16000 and $event_type <= 16007
$IP = principal.ip
$byte = network.sent_bytes
$byte != 0
$Vendor = metadata.vendor_name
metadata.vendor_name != ""
match:
$IP, $Vendor
outcome:
$byte_sum=sum($byte)
$data_in_mb = math.round($byte_sum/1048576)
order: $data_in_mb desc
limit:10
Fluxo de dados por IP
$event_type = metadata.event_type
$event_type >= 16000 and $event_type <= 16007
$ruleN = security_result.rule_name
$IP = principal.ip
$byte = network.received_bytes
$byte != 0
$Vendor = metadata.vendor_name
$Vendor != ""
match:
$IP, $Vendor
outcome:
$byte_sum=sum($byte)
$Data_in_mb = math.round($byte_sum/1048576)
order: $Data_in_mb desc
limit: 10
Principais origens de conexão
$event_type = metadata.event_type
$event_type >= 16000 and $event_type <= 16007
$log_type = metadata.log_type
$rule_name = security_result.rule_name
$Src_IP = principal.ip
$Src_IP != ""
match:
$Src_IP
outcome:
$event_count = count(metadata.id)
order: $event_count desc
limit: 10
Principais destinos de conexão
$event_type = metadata.event_type
$event_type >= 16000 and $event_type <= 16007
$log_type = metadata.log_type
$rule_name = security_result.rule_name
$Dest_IP = target.ip
$Dest_IP != "EMPTY"
match:
$Dest_IP
outcome:
$event_count = count(metadata.id)
order: $event_count desc
limit: 10
10 principais IPs bloqueados
$event_type = metadata.event_type
$event_type >= 16000 and $event_type <= 16007
$log_type = metadata.log_type
$rule_name = security_result.rule_name
$action = security_result.action
$action = "BLOCK"
$IP = principal.ip
match:
$IP, $action
outcome:
$event_count = count_distinct(metadata.id)
order: $event_count desc
limit: 10
10 principais IPs bloqueados
$event_type = metadata.event_type
$event_type >= 16000 and $event_type <= 16007
$log_type = metadata.log_type
$rule_name = security_result.rule_name
$action = security_result.action
$action = "BLOCK"
$IP = principal.ip
match:
$IP, $action
outcome:
$event_count = count_distinct(metadata.id)
order: $event_count desc
limit: 10
Governança de dados do GDPR
Esse painel oferece visibilidade do acesso aos dados em regiões da UE, incluindo tendências de acesso, tentativas de acesso de fora da UE e principais geolocalizações. Ela ajuda a monitorar a conformidade com as regulamentações do GDPR, detectar acesso aos dados não autorizado e garantir o tratamento seguro de dados da UE.
Observação : aplique filtros para mostrar resultados relevantes.
Contas privilegiadas que acessam recursos da UE
Distribuição de versão TLS fraca
Os 10 principais IPs de fora da UE que acessam recursos da UE
Os 10 principais usuários que acessam recursos da UE
Acesso aos dados da UE por geolocalização da origem
Eventos de exclusão e limpeza de dados em recursos da UE ao longo do tempo
Criptografia fraca em recursos da UE ao longo do tempo
Eventos de exclusão e limpeza de dados em recursos da UE
As 10 principais contas privilegiadas que acessam recursos da UE
Eventos da DLP com base na UE
Os 10 principais domínios externos que recebem dados da UE
Resumo de arquivos de malware
Eventos da DLP na UE ao longo do tempo
Eventos de acesso a dados da UE ao longo do tempo
10 principais políticas acionadas
Acesso não autorizado a recursos da UE
Acesso a recursos da UE de países de fora da UE
Os 10 principais países fora da UE que acessam dados da UE
Acesso privilegiado aos recursos da UE ao longo do tempo
Detecção de ameaças ao longo do tempo
Eventos de acesso a dados sensíveis
Nome do gráfico
Exemplo de consulta
Contas privilegiadas que acessam recursos da UE
strings.coalesce(target.location.country_or_region, target.ip_geo_artifact.location.country_or_region, target.location.name) = /Austria|Belgium|Bulgaria|Croatia|Cyprus|Czechia|Denmark|Estonia|Finland|France|Germany|Greece|Hungary|Ireland|Italy|Latvia|Lithuania|Luxembourg|Malta|Netherlands|Poland|Portugal|Romania|Slovakia|Slovenia|Spain|Sweden|eu-(west-1|west-3|central-1|north-1|south-1|south-2)|europe-(west1|west3|west4|west8|west9|west10|west12|central2|north1|north2|southwest1)|austriaeast|denmarkeast|francecentral|germanywestcentral|greececentral|italynorth|northeurope|spaincentral|swedencentral|westeurope|polandcentral/ nocase
(metadata.event_type = "RESOURCE_READ" OR metadata.event_type = "RESOURCE_WRITTEN" OR metadata.event_type = "RESOURCE_CREATION" OR metadata.event_type = "RESOURCE_DELETION" OR metadata.event_type = "RESOURCE_PERMISSIONS_CHANGE" OR metadata.event_type = "FILE_UNCATEGORIZED" OR metadata.event_type = "FILE_CREATION" OR metadata.event_type = "FILE_DELETION" OR metadata.event_type = "FILE_MODIFICATION" OR metadata.event_type = "FILE_READ" OR metadata.event_type = "FILE_COPY" OR metadata.event_type = "FILE_OPEN" OR metadata.event_type = "FILE_MOVE" OR metadata.event_type = "FILE_SYNC" OR metadata.event_type = "EVENTTYPE_UNSPECIFIED" OR metadata.event_type = "SETTING_UNCATEGORIZED" OR metadata.event_type = "USER_UNCATEGORIZED" OR metadata.event_type = "SYSTEM_AUDIT_LOG_UNCATEGORIZED" OR metadata.event_type = "SYSTEM_AUDIT_LOG_WIPE" OR metadata.event_type = "USER_RESOURCE_CREATION" OR metadata.event_type = "USER_RESOURCE_UPDATE_CONTENT" OR metadata.event_type = "USER_RESOURCE_UPDATE_PERMISSIONS" OR metadata.event_type = "USER_RESOURCE_ACCESS" OR metadata.event_type = "USER_RESOURCE_DELETION" OR metadata.log_type = "GENERIC_EVENT" OR metadata.event_type ="USER_LOGIN" or metadata.log_type = "USER_CHANGE_PERMISSIONS")
$User = strings.coalesce(principal.user.userid, principal.user.user_display_name, principal.user.email_addresses, target.user.userid,target.user.user_display_name,target.user.email_addresses)
($User = /admin|root|svc|adm|privilege/ nocase or principal.user.attribute.roles.type = "SERVICE_ACCOUNT" or principal.user.attribute.roles.type = "ADMINISTRATOR" or principal.user.account_type = "DOMAIN_ACCOUNT_TYPE" or principal.user.account_type = "SERVICE_ACCOUNT_TYPE")
$Target_EU_Country = strings.coalesce(target.location.country_or_region, target.ip_geo_artifact.location.country_or_region, target.location.name)
$Event_Type = metadata.event_type
$Source_IP = strings.coalesce(principal.ip,principal.asset.ip)
$Target_Resource = strings.coalesce(target.resource.name, target.file.full_path, target.resource.product_object_id, target.group.product_object_id, target.user.group_identifiers)
$Target_Resourcetype = target.resource.resource_type
$Action = security_result.action
match:
$Event_Type, $User,$Source_IP, $Target_EU_Country, $Target_Resource, $Target_Resourcetype, $Action
outcome:
$Count = count(metadata.id)
$Date = timestamp.get_timestamp(max(metadata.event_timestamp.seconds))
order:
$Count desc
Distribuição de versão TLS fraca
strings.coalesce(target.location.country_or_region, target.ip_geo_artifact.location.country_or_region, target.location.name) = /Austria|Belgium|Bulgaria|Croatia|Cyprus|Czechia|Denmark|Estonia|Finland|France|Germany|Greece|Hungary|Ireland|Italy|Latvia|Lithuania|Luxembourg|Malta|Netherlands|Poland|Portugal|Romania|Slovakia|Slovenia|Spain|Sweden|eu-(west-1|west-3|central-1|north-1|south-1|south-2)|europe-(west1|west3|west4|west8|west9|west10|west12|central2|north1|north2|southwest1)|austriaeast|denmarkeast|francecentral|germanywestcentral|greececentral|italynorth|northeurope|spaincentral|swedencentral|westeurope|polandcentral/ nocase
(metadata.event_type = "RESOURCE_READ" OR metadata.event_type = "RESOURCE_WRITTEN" OR metadata.event_type = "RESOURCE_CREATION" OR metadata.event_type = "RESOURCE_DELETION" OR metadata.event_type = "RESOURCE_PERMISSIONS_CHANGE" OR metadata.event_type = "FILE_UNCATEGORIZED" OR metadata.event_type = "FILE_CREATION" OR metadata.event_type = "FILE_DELETION" OR metadata.event_type = "FILE_MODIFICATION" OR metadata.event_type = "FILE_READ" OR metadata.event_type = "FILE_COPY" OR metadata.event_type = "FILE_OPEN" OR metadata.event_type = "FILE_MOVE" OR metadata.event_type = "FILE_SYNC" OR metadata.event_type = "EVENTTYPE_UNSPECIFIED" OR metadata.event_type = "SETTING_UNCATEGORIZED" OR metadata.event_type = "USER_UNCATEGORIZED" OR metadata.event_type = "SYSTEM_AUDIT_LOG_UNCATEGORIZED" OR metadata.event_type = "SYSTEM_AUDIT_LOG_WIPE" OR metadata.event_type = "USER_RESOURCE_CREATION" OR metadata.event_type = "USER_RESOURCE_UPDATE_CONTENT" OR metadata.event_type = "USER_RESOURCE_UPDATE_PERMISSIONS" OR metadata.event_type = "USER_RESOURCE_ACCESS" OR metadata.event_type = "USER_RESOURCE_DELETION" OR metadata.event_type = "GENERIC_EVENT")
network.tls.version != /1(\.|_)?(2|3)/ nocase
$TLS_Version = network.tls.version
$TLS_Version != ""
match:
$TLS_Version
outcome:
$Count = count(metadata.id)
Os 10 principais IPs de fora da UE que acessam recursos da UE
(strings.coalesce(target.location.country_or_region, target.ip_geo_artifact.location.country_or_region, target.location.name) = /Austria|Belgium|Bulgaria|Croatia|Cyprus|Czechia|Denmark|Estonia|Finland|France|Germany|Greece|Hungary|Ireland|Italy|Latvia|Lithuania|Luxembourg|Malta|Netherlands|Poland|Portugal|Romania|Slovakia|Slovenia|Spain|Sweden|eu-(west-1|west-3|central-1|north-1|south-1|south-2)|europe-(west1|west3|west4|west8|west9|west10|west12|central2|north1|north2|southwest1)|austriaeast|denmarkeast|francecentral|germanywestcentral|greececentral|italynorth|northeurope|spaincentral|swedencentral|westeurope|polandcentral/ nocase
and strings.coalesce(principal.location.country_or_region, principal.ip_geo_artifact.location.country_or_region, principal.location.name) != /Austria|Belgium|Bulgaria|Croatia|Cyprus|Czechia|Denmark|Estonia|Finland|France|Germany|Greece|Hungary|Ireland|Italy|Latvia|Lithuania|Luxembourg|Malta|Netherlands|Poland|Portugal|Romania|Slovakia|Slovenia|Spain|Sweden|eu-(west-1|west-3|central-1|north-1|south-1|south-2)|europe-(west1|west3|west4|west8|west9|west10|west12|central2|north1|north2|southwest1)|austriaeast|denmarkeast|francecentral|germanywestcentral|greececentral|italynorth|northeurope|spaincentral|swedencentral|westeurope|polandcentral/ nocase)
(metadata.event_type = "RESOURCE_READ" OR metadata.event_type = "RESOURCE_WRITTEN" OR metadata.event_type = "RESOURCE_CREATION" OR metadata.event_type = "RESOURCE_DELETION" OR metadata.event_type = "RESOURCE_PERMISSIONS_CHANGE" OR metadata.event_type = "FILE_UNCATEGORIZED" OR metadata.event_type = "FILE_CREATION" OR metadata.event_type = "FILE_DELETION" OR metadata.event_type = "FILE_MODIFICATION" OR metadata.event_type = "FILE_READ" OR metadata.event_type = "FILE_COPY" OR metadata.event_type = "FILE_OPEN" OR metadata.event_type = "FILE_MOVE" OR metadata.event_type = "FILE_SYNC" OR metadata.event_type = "EVENTTYPE_UNSPECIFIED" OR metadata.event_type = "SETTING_UNCATEGORIZED" OR metadata.event_type = "USER_UNCATEGORIZED" OR metadata.event_type = "SYSTEM_AUDIT_LOG_UNCATEGORIZED" OR metadata.event_type = "SYSTEM_AUDIT_LOG_WIPE" OR metadata.event_type = "USER_RESOURCE_CREATION" OR metadata.event_type = "USER_RESOURCE_UPDATE_CONTENT" OR metadata.event_type = "USER_RESOURCE_UPDATE_PERMISSIONS" OR metadata.event_type = "USER_RESOURCE_ACCESS" OR metadata.event_type = "USER_RESOURCE_DELETION" OR metadata.log_type = "GENERIC_EVENT" OR metadata.event_type ="USER_LOGIN" or metadata.log_type = "USER_CHANGE_PERMISSIONS")
$Principal_IP = strings.coalesce(principal.ip, principal.asset.ip)
$Principal_IP != ""
$Principal_Country = strings.coalesce(principal.location.country_or_region, principal.ip_geo_artifact.location.country_or_region, principal.location.name)
match:
$Principal_IP, $Principal_Country
outcome:
$Count = count(metadata.id)
order :
$Count desc
limit:
10
Os 10 principais usuários que acessam recursos da UE
strings.coalesce(target.location.country_or_region, target.ip_geo_artifact.location.country_or_region, target.location.name) = /Austria|Belgium|Bulgaria|Croatia|Cyprus|Czechia|Denmark|Estonia|Finland|France|Germany|Greece|Hungary|Ireland|Italy|Latvia|Lithuania|Luxembourg|Malta|Netherlands|Poland|Portugal|Romania|Slovakia|Slovenia|Spain|Sweden|eu-(west-1|west-3|central-1|north-1|south-1|south-2)|europe-(west1|west3|west4|west8|west9|west10|west12|central2|north1|north2|southwest1)|austriaeast|denmarkeast|francecentral|germanywestcentral|greececentral|italynorth|northeurope|spaincentral|swedencentral|westeurope|polandcentral/ nocase
(metadata.event_type = "RESOURCE_READ" OR metadata.event_type = "RESOURCE_WRITTEN" OR metadata.event_type = "RESOURCE_CREATION" OR metadata.event_type = "RESOURCE_DELETION" OR metadata.event_type = "RESOURCE_PERMISSIONS_CHANGE" OR metadata.event_type = "FILE_UNCATEGORIZED" OR metadata.event_type = "FILE_CREATION" OR metadata.event_type = "FILE_DELETION" OR metadata.event_type = "FILE_MODIFICATION" OR metadata.event_type = "FILE_READ" OR metadata.event_type = "FILE_COPY" OR metadata.event_type = "FILE_OPEN" OR metadata.event_type = "FILE_MOVE" OR metadata.event_type = "FILE_SYNC" OR metadata.event_type = "EVENTTYPE_UNSPECIFIED" OR metadata.event_type = "SETTING_UNCATEGORIZED" OR metadata.event_type = "USER_UNCATEGORIZED" OR metadata.event_type = "SYSTEM_AUDIT_LOG_UNCATEGORIZED" OR metadata.event_type = "SYSTEM_AUDIT_LOG_WIPE" OR metadata.event_type = "USER_RESOURCE_CREATION" OR metadata.event_type = "USER_RESOURCE_UPDATE_CONTENT" OR metadata.event_type = "USER_RESOURCE_UPDATE_PERMISSIONS" OR metadata.event_type = "USER_RESOURCE_ACCESS" OR metadata.event_type = "USER_RESOURCE_DELETION" OR metadata.event_type = "GENERIC_EVENT")
$User = strings.coalesce(principal.user.user_display_name, principal.user.userid, principal.user.email_addresses,target.user.userid,target.user.user_display_name,target.user.email_addresses)
$Source_Country = strings.coalesce(principal.location.country_or_region, principal.ip_geo_artifact.location.country_or_region, principal.location.name)
$User != ""
match:
$User, $Source_Country
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
Acesso aos dados da UE por geolocalização da origem
strings.coalesce(target.location.country_or_region, target.ip_geo_artifact.location.country_or_region, target.location.name) = /Austria|Belgium|Bulgaria|Croatia|Cyprus|Czechia|Denmark|Estonia|Finland|France|Germany|Greece|Hungary|Ireland|Italy|Latvia|Lithuania|Luxembourg|Malta|Netherlands|Poland|Portugal|Romania|Slovakia|Slovenia|Spain|Sweden|eu-(west-1|west-3|central-1|north-1|south-1|south-2)|europe-(west1|west3|west4|west8|west9|west10|west12|central2|north1|north2|southwest1)|austriaeast|denmarkeast|francecentral|germanywestcentral|greececentral|italynorth|northeurope|spaincentral|swedencentral|westeurope|polandcentral/ nocase
principal.ip_geo_artifact.location.region_coordinates.latitude != 0
principal.ip_geo_artifact.location.region_coordinates.longitude != 0
$Source_Country = strings.coalesce(principal.location.country_or_region, principal.ip_geo_artifact.location.country_or_region, principal.location.name)
match:
$Source_Country
outcome:
$Count = count(metadata.id)
$Latitude = max(principal.ip_geo_artifact.location.region_coordinates.latitude)
$Longitude = max(principal.ip_geo_artifact.location.region_coordinates.longitude)
Eventos de exclusão e limpeza de dados em recursos da UE ao longo do tempo
strings.coalesce(target.location.country_or_region, target.ip_geo_artifact.location.country_or_region, target.location.name) = /Austria|Belgium|Bulgaria|Croatia|Cyprus|Czechia|Denmark|Estonia|Finland|France|Germany|Greece|Hungary|Ireland|Italy|Latvia|Lithuania|Luxembourg|Malta|Netherlands|Poland|Portugal|Romania|Slovakia|Slovenia|Spain|Sweden|eu-(west-1|west-3|central-1|north-1|south-1|south-2)|europe-(west1|west3|west4|west8|west9|west10|west12|central2|north1|north2|southwest1)|austriaeast|denmarkeast|francecentral|germanywestcentral|greececentral|italynorth|northeurope|spaincentral|swedencentral|westeurope|polandcentral/ nocase
(metadata.event_type = "FILE_DELETION" or metadata.event_type = "RESOURCE_DELETION" OR metadata.event_type = "SYSTEM_AUDIT_LOG_WIPE" or metadata.event_type = "USER_RESOURCE_DELETION"
or metadata.product_event_type = /delete|purge/ nocase or security_result.summary = /delete|purge/ nocase or security_result.description = /delete|purge/ nocase)
security_result.action = "ALLOW"
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
$Log_Type = metadata.log_type
match:
$Date, $Log_Type
outcome:
$Count = count(metadata.id)
order:
$Date asc
Criptografia fraca em recursos da UE ao longo do tempo
strings.coalesce(target.location.country_or_region, target.ip_geo_artifact.location.country_or_region, target.location.name) = /Austria|Belgium|Bulgaria|Croatia|Cyprus|Czechia|Denmark|Estonia|Finland|France|Germany|Greece|Hungary|Ireland|Italy|Latvia|Lithuania|Luxembourg|Malta|Netherlands|Poland|Portugal|Romania|Slovakia|Slovenia|Spain|Sweden|eu-(west-1|west-3|central-1|north-1|south-1|south-2)|europe-(west1|west3|west4|west8|west9|west10|west12|central2|north1|north2|southwest1)|austriaeast|denmarkeast|francecentral|germanywestcentral|greececentral|italynorth|northeurope|spaincentral|swedencentral|westeurope|polandcentral/ nocase
(((target.resource.attribute.labels.key = "keyProperties_type" or target.resource.attribute.labels.key = "requestParameters.keySpec" or target.resource.attribute.labels.key = /key/ nocase) and target.resource.attribute.labels.value = /^(RSA-)|DES|RC4|MD5|SHA1|SHA-1/) or network.tls.cipher = /^(RSA-)|DES|RC4|MD5|SHA1|SHA-1/)
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
$Log_Type = metadata.log_type
match:
$Log_Type, $Date
outcome:
$Count = count(metadata.id)
order:
$Date asc
Eventos de exclusão e limpeza de dados em recursos da UE
strings.coalesce(target.location.country_or_region, target.ip_geo_artifact.location.country_or_region, target.location.name) = /Austria|Belgium|Bulgaria|Croatia|Cyprus|Czechia|Denmark|Estonia|Finland|France|Germany|Greece|Hungary|Ireland|Italy|Latvia|Lithuania|Luxembourg|Malta|Netherlands|Poland|Portugal|Romania|Slovakia|Slovenia|Spain|Sweden|eu-(west-1|west-3|central-1|north-1|south-1|south-2)|europe-(west1|west3|west4|west8|west9|west10|west12|central2|north1|north2|southwest1)|austriaeast|denmarkeast|francecentral|germanywestcentral|greececentral|italynorth|northeurope|spaincentral|swedencentral|westeurope|polandcentral/ nocase
(metadata.event_type = "FILE_DELETION" or metadata.event_type = "RESOURCE_DELETION" OR metadata.event_type = "SYSTEM_AUDIT_LOG_WIPE" or metadata.event_type = "USER_RESOURCE_DELETION"
or metadata.product_event_type = /delete|purge/ nocase or security_result.summary = /delete|purge/ nocase or security_result.description = /delete|purge/ nocase)
security_result.action = "ALLOW"
$Description = strings.coalesce(security_result.summary, security_result.description, metadata.description, security_result.action_details)
$Product_Event_Type = metadata.product_event_type
$Event_Type = metadata.event_type
$Log_Type = metadata.log_type
$Target_Resource = strings.coalesce(target.resource.name, target.file.full_path, target.resource.product_object_id, target.group.product_object_id, target.user.group_identifiers)
$User = strings.coalesce(principal.user.user_display_name, principal.user.userid, principal.user.email_addresses, target.user.userid,target.user.user_display_name,target.user.email_addresses)
match:
$User, $Log_Type, $Target_Resource, $Description, $Product_Event_Type, $Event_Type
outcome:
$Date = timestamp.get_timestamp(max(metadata.event_timestamp.seconds))
$Count = count(metadata.id)
order:
$Date desc, $Count desc
As 10 principais contas privilegiadas que acessam recursos da UE
strings.coalesce(target.location.country_or_region, target.ip_geo_artifact.location.country_or_region, target.location.name) = /Austria|Belgium|Bulgaria|Croatia|Cyprus|Czechia|Denmark|Estonia|Finland|France|Germany|Greece|Hungary|Ireland|Italy|Latvia|Lithuania|Luxembourg|Malta|Netherlands|Poland|Portugal|Romania|Slovakia|Slovenia|Spain|Sweden|eu-(west-1|west-3|central-1|north-1|south-1|south-2)|europe-(west1|west3|west4|west8|west9|west10|west12|central2|north1|north2|southwest1)|austriaeast|denmarkeast|francecentral|germanywestcentral|greececentral|italynorth|northeurope|spaincentral|swedencentral|westeurope|polandcentral/ nocase
(metadata.event_type = "RESOURCE_READ" OR metadata.event_type = "RESOURCE_WRITTEN" OR metadata.event_type = "RESOURCE_CREATION" OR metadata.event_type = "RESOURCE_DELETION" OR metadata.event_type = "RESOURCE_PERMISSIONS_CHANGE" OR metadata.event_type = "FILE_UNCATEGORIZED" OR metadata.event_type = "FILE_CREATION" OR metadata.event_type = "FILE_DELETION" OR metadata.event_type = "FILE_MODIFICATION" OR metadata.event_type = "FILE_READ" OR metadata.event_type = "FILE_COPY" OR metadata.event_type = "FILE_OPEN" OR metadata.event_type = "FILE_MOVE" OR metadata.event_type = "FILE_SYNC" OR metadata.event_type = "EVENTTYPE_UNSPECIFIED" OR metadata.event_type = "SETTING_UNCATEGORIZED" OR metadata.event_type = "USER_UNCATEGORIZED" OR metadata.event_type = "SYSTEM_AUDIT_LOG_UNCATEGORIZED" OR metadata.event_type = "SYSTEM_AUDIT_LOG_WIPE" OR metadata.event_type = "USER_RESOURCE_CREATION" OR metadata.event_type = "USER_RESOURCE_UPDATE_CONTENT" OR metadata.event_type = "USER_RESOURCE_UPDATE_PERMISSIONS" OR metadata.event_type = "USER_RESOURCE_ACCESS" OR metadata.event_type = "USER_RESOURCE_DELETION" OR metadata.event_type = "GENERIC_EVENT" OR metadata.event_type ="USER_LOGIN" or metadata.event_type = "USER_CHANGE_PERMISSIONS")
$User = strings.coalesce(principal.user.userid, principal.user.user_display_name, principal.user.email_addresses, target.user.userid,target.user.user_display_name,target.user.email_addresses)
($User = /admin|root|svc|adm|privilege/ nocase or principal.user.attribute.roles.type = "SERVICE_ACCOUNT" or principal.user.attribute.roles.type = "ADMINISTRATOR" or principal.user.account_type = "DOMAIN_ACCOUNT_TYPE" or principal.user.account_type = "SERVICE_ACCOUNT_TYPE")
$Target_EU_Country = strings.coalesce(target.location.country_or_region, target.ip_geo_artifact.location.country_or_region, target.location.name)
match:
$User, $Target_EU_Country
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
Eventos da DLP com base na UE
strings.coalesce(target.location.country_or_region, target.ip_geo_artifact.location.country_or_region, target.location.name) = /Austria|Belgium|Bulgaria|Croatia|Cyprus|Czechia|Denmark|Estonia|Finland|France|Germany|Greece|Hungary|Ireland|Italy|Latvia|Lithuania|Luxembourg|Malta|Netherlands|Poland|Portugal|Romania|Slovakia|Slovenia|Spain|Sweden|eu-(west-1|west-3|central-1|north-1|south-1|south-2)|europe-(west1|west3|west4|west8|west9|west10|west12|central2|north1|north2|southwest1)|austriaeast|denmarkeast|francecentral|germanywestcentral|greececentral|italynorth|northeurope|spaincentral|swedencentral|westeurope|polandcentral/ nocase
(metadata.event_type = "RESOURCE_READ" OR metadata.event_type = "RESOURCE_WRITTEN" OR metadata.event_type = "RESOURCE_CREATION" OR metadata.event_type = "RESOURCE_DELETION" OR metadata.event_type = "RESOURCE_PERMISSIONS_CHANGE" OR metadata.event_type = "FILE_UNCATEGORIZED" OR metadata.event_type = "FILE_CREATION" OR metadata.event_type = "FILE_DELETION" OR metadata.event_type = "FILE_MODIFICATION" OR metadata.event_type = "FILE_READ" OR metadata.event_type = "FILE_COPY" OR metadata.event_type = "FILE_OPEN" OR metadata.event_type = "FILE_MOVE" OR metadata.event_type = "FILE_SYNC" OR metadata.event_type = "EVENTTYPE_UNSPECIFIED" OR metadata.event_type = "SETTING_UNCATEGORIZED" OR metadata.event_type = "USER_UNCATEGORIZED" OR metadata.event_type = "SYSTEM_AUDIT_LOG_UNCATEGORIZED" OR metadata.event_type = "SYSTEM_AUDIT_LOG_WIPE" OR metadata.event_type = "USER_RESOURCE_CREATION" OR metadata.event_type = "USER_RESOURCE_UPDATE_CONTENT" OR metadata.event_type = "USER_RESOURCE_UPDATE_PERMISSIONS" OR metadata.event_type = "USER_RESOURCE_ACCESS" OR metadata.event_type = "USER_RESOURCE_DELETION" OR metadata.event_type = "GENERIC_EVENT" OR metadata.event_type = "NETWORK_UNCATEGORIZED" OR metadata.event_type = "NETWORK_FLOW" OR metadata.event_type = "NETWORK_CONNECTION" OR metadata.event_type = "NETWORK_FTP" OR metadata.event_type = "NETWORK_DHCP" OR metadata.event_type = "NETWORK_DNS" OR metadata.event_type = "NETWORK_HTTP" OR metadata.event_type = "NETWORK_SMTP")
(metadata.log_type = /DLP|ACCELLION|CODE42_INCYDR|GUARDIUM|TRIPWIRE_FIM/ nocase OR metadata.product_event_type = /dlp/ nocase OR security_result.outcomes.value = /dlp/ nocase OR security_result.rule_type = /dlp/ nocase OR security_result.rule_name = /dlp/ nocase OR security_result.category_details = /dlp|data loss prevention/ nocase OR security_result.category = "DATA_EXFILTRATION" or security_result.category = "DATA_DESTRUCTION")
outcome:
$Count = count(metadata.id)
Os 10 principais domínios externos que recebem dados da UE
strings.coalesce(principal.location.country_or_region, principal.ip_geo_artifact.location.country_or_region, principal.location.name) = /Austria|Belgium|Bulgaria|Croatia|Cyprus|Czechia|Denmark|Estonia|Finland|France|Germany|Greece|Hungary|Ireland|Italy|Latvia|Lithuania|Luxembourg|Malta|Netherlands|Poland|Portugal|Romania|Slovakia|Slovenia|Spain|Sweden|eu-(west-1|west-3|central-1|north-1|south-1|south-2)|europe-(west1|west3|west4|west8|west9|west10|west12|central2|north1|north2|southwest1)|austriaeast|denmarkeast|francecentral|germanywestcentral|greececentral|italynorth|northeurope|spaincentral|swedencentral|westeurope|polandcentral/ nocase
(metadata.event_type = "RESOURCE_READ" OR metadata.event_type = "RESOURCE_WRITTEN" OR metadata.event_type = "RESOURCE_CREATION" OR metadata.event_type = "RESOURCE_DELETION" OR metadata.event_type = "RESOURCE_PERMISSIONS_CHANGE" OR metadata.event_type = "FILE_UNCATEGORIZED" OR metadata.event_type = "FILE_CREATION" OR metadata.event_type = "FILE_DELETION" OR metadata.event_type = "FILE_MODIFICATION" OR metadata.event_type = "FILE_READ" OR metadata.event_type = "FILE_COPY" OR metadata.event_type = "FILE_OPEN" OR metadata.event_type = "FILE_MOVE" OR metadata.event_type = "FILE_SYNC" OR metadata.event_type = "EVENTTYPE_UNSPECIFIED" OR metadata.event_type = "SETTING_UNCATEGORIZED" OR metadata.event_type = "USER_UNCATEGORIZED" OR metadata.event_type = "SYSTEM_AUDIT_LOG_UNCATEGORIZED" OR metadata.event_type = "SYSTEM_AUDIT_LOG_WIPE" OR metadata.event_type = "USER_RESOURCE_CREATION" OR metadata.event_type = "USER_RESOURCE_UPDATE_CONTENT" OR metadata.event_type = "USER_RESOURCE_UPDATE_PERMISSIONS" OR metadata.event_type = "USER_RESOURCE_ACCESS" OR metadata.event_type = "USER_RESOURCE_DELETION" OR metadata.event_type = "GENERIC_EVENT" OR metadata.event_type = "NETWORK_UNCATEGORIZED" OR metadata.event_type = "NETWORK_FLOW" OR metadata.event_type = "NETWORK_CONNECTION" OR metadata.event_type = "NETWORK_FTP" OR metadata.event_type = "NETWORK_DHCP" OR metadata.event_type = "NETWORK_DNS" OR metadata.event_type = "NETWORK_HTTP"
OR metadata.event_type = "NETWORK_SMTP")
network.direction = "OUTBOUND"
network.sent_bytes > 0
$Target_Domain = re.capture(strings.coalesce(target.url, target.administrative_domain), `^(?:https?:\/\/)?(?:www\.)?([^\/:]+)`)
$Target_Domain != ""
$Target_EU_Country = strings.coalesce(target.location.country_or_region, target.ip_geo_artifact.location.country_or_region, target.location.name)
match:
$Target_Domain, $Target_EU_Country
outcome:
$Size_in_MB = math.round((sum(network.sent_bytes)/1000000), 2)
order :
$Size_in_MB desc
limit:
10
Resumo de arquivos de malware
strings.coalesce(target.location.country_or_region, target.ip_geo_artifact.location.country_or_region, target.location.name) = /Austria|Belgium|Bulgaria|Croatia|Cyprus|Czechia|Denmark|Estonia|Finland|France|Germany|Greece|Hungary|Ireland|Italy|Latvia|Lithuania|Luxembourg|Malta|Netherlands|Poland|Portugal|Romania|Slovakia|Slovenia|Spain|Sweden|eu-(west-1|west-3|central-1|north-1|south-1|south-2)|europe-(west1|west3|west4|west8|west9|west10|west12|central2|north1|north2|southwest1)|austriaeast|denmarkeast|francecentral|germanywestcentral|greececentral|italynorth|northeurope|spaincentral|swedencentral|westeurope|polandcentral/ nocase
(metadata.event_type = "RESOURCE_READ" OR metadata.event_type = "RESOURCE_WRITTEN" OR metadata.event_type = "RESOURCE_CREATION" OR metadata.event_type = "RESOURCE_DELETION" OR metadata.event_type = "RESOURCE_PERMISSIONS_CHANGE" OR metadata.event_type = "FILE_UNCATEGORIZED" OR metadata.event_type = "FILE_CREATION" OR metadata.event_type = "FILE_DELETION" OR metadata.event_type = "FILE_MODIFICATION" OR metadata.event_type = "FILE_READ" OR metadata.event_type = "FILE_COPY" OR metadata.event_type = "FILE_OPEN" OR metadata.event_type = "FILE_MOVE" OR metadata.event_type = "FILE_SYNC" OR metadata.event_type = "EVENTTYPE_UNSPECIFIED" OR metadata.event_type = "SETTING_UNCATEGORIZED" OR metadata.event_type = "USER_UNCATEGORIZED" OR metadata.event_type = "SYSTEM_AUDIT_LOG_UNCATEGORIZED" OR metadata.event_type = "SYSTEM_AUDIT_LOG_WIPE" OR metadata.event_type = "USER_RESOURCE_CREATION" OR metadata.event_type = "USER_RESOURCE_UPDATE_CONTENT" OR metadata.event_type = "USER_RESOURCE_UPDATE_PERMISSIONS" OR metadata.event_type = "USER_RESOURCE_ACCESS" OR metadata.event_type = "USER_RESOURCE_DELETION" OR metadata.event_type = "GENERIC_EVENT")
(metadata.product_event_type = /malware/ nocase or security_result.summary = /malware/ nocase or security_result.category_details = /malware/ nocase or metadata.description = /malware/ nocase or security_result.threat_name = /malware/ nocase or security_result.rule_name = /malware/ nocase or security_result.category = "SOFTWARE_MALICIOUS")
$Source_User = strings.coalesce(principal.user.user_display_name, principal.user.userid, principal.user.email_addresses)
$File_Name = strings.coalesce(target.file.full_path, about.file.full_path)
$File_Name != ""
$File_Type = target.file.file_type
$Severity = security_result.severity
$Action = security_result.action
$Hostname = strings.coalesce(principal.hostname, principal.asset.hostname)
$Threat_Name = security_result.threat_name
match :
$Hostname,$File_Name, $File_Type, $Threat_Name, $Source_User, $Severity, $Action
outcome:
$Count = count(metadata.id)
$Date = timestamp.get_timestamp(max(metadata.event_timestamp.seconds), "%F %T")
order:
$Count desc
Eventos da DLP na UE ao longo do tempo
strings.coalesce(target.location.country_or_region, target.ip_geo_artifact.location.country_or_region, target.location.name) = /Austria|Belgium|Bulgaria|Croatia|Cyprus|Czechia|Denmark|Estonia|Finland|France|Germany|Greece|Hungary|Ireland|Italy|Latvia|Lithuania|Luxembourg|Malta|Netherlands|Poland|Portugal|Romania|Slovakia|Slovenia|Spain|Sweden|eu-(west-1|west-3|central-1|north-1|south-1|south-2)|europe-(west1|west3|west4|west8|west9|west10|west12|central2|north1|north2|southwest1)|austriaeast|denmarkeast|francecentral|germanywestcentral|greececentral|italynorth|northeurope|spaincentral|swedencentral|westeurope|polandcentral/ nocase
(metadata.event_type = "RESOURCE_READ" OR metadata.event_type = "RESOURCE_WRITTEN" OR metadata.event_type = "RESOURCE_CREATION" OR metadata.event_type = "RESOURCE_DELETION" OR metadata.event_type = "RESOURCE_PERMISSIONS_CHANGE" OR metadata.event_type = "FILE_UNCATEGORIZED" OR metadata.event_type = "FILE_CREATION" OR metadata.event_type = "FILE_DELETION" OR metadata.event_type = "FILE_MODIFICATION" OR metadata.event_type = "FILE_READ" OR metadata.event_type = "FILE_COPY" OR metadata.event_type = "FILE_OPEN" OR metadata.event_type = "FILE_MOVE" OR metadata.event_type = "FILE_SYNC" OR metadata.event_type = "EVENTTYPE_UNSPECIFIED" OR metadata.event_type = "SETTING_UNCATEGORIZED" OR metadata.event_type = "USER_UNCATEGORIZED" OR metadata.event_type = "SYSTEM_AUDIT_LOG_UNCATEGORIZED" OR metadata.event_type = "SYSTEM_AUDIT_LOG_WIPE" OR metadata.event_type = "USER_RESOURCE_CREATION" OR metadata.event_type = "USER_RESOURCE_UPDATE_CONTENT" OR metadata.event_type = "USER_RESOURCE_UPDATE_PERMISSIONS" OR metadata.event_type = "USER_RESOURCE_ACCESS" OR metadata.event_type = "USER_RESOURCE_DELETION" OR metadata.event_type = "GENERIC_EVENT" OR metadata.event_type = "NETWORK_UNCATEGORIZED" OR metadata.event_type = "NETWORK_FLOW" OR metadata.event_type = "NETWORK_CONNECTION" OR metadata.event_type = "NETWORK_FTP" OR metadata.event_type = "NETWORK_DHCP" OR metadata.event_type = "NETWORK_DNS" OR metadata.event_type = "NETWORK_HTTP" OR metadata.event_type = "NETWORK_SMTP")
(metadata.log_type = /DLP|ACCELLION|CODE42_INCYDR|GUARDIUM|TRIPWIRE_FIM/ nocase OR metadata.product_event_type = /dlp/ nocase OR security_result.outcomes.value = /dlp/ nocase OR security_result.rule_type = /dlp/ nocase OR security_result.rule_name = /dlp/ nocase OR security_result.category_details = /dlp|data loss prevention/ nocase OR security_result.category = "DATA_EXFILTRATION" or security_result.category = "DATA_DESTRUCTION")
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
$Log_Type = metadata.log_type
match:
$Date, $Log_Type
outcome:
$Count = count(metadata.id)
order:
$Date asc
Eventos de acesso a dados da UE ao longo do tempo
strings.coalesce(target.location.country_or_region, target.ip_geo_artifact.location.country_or_region, target.location.name) = /Austria|Belgium|Bulgaria|Croatia|Cyprus|Czechia|Denmark|Estonia|Finland|France|Germany|Greece|Hungary|Ireland|Italy|Latvia|Lithuania|Luxembourg|Malta|Netherlands|Poland|Portugal|Romania|Slovakia|Slovenia|Spain|Sweden|eu-(west-1|west-3|central-1|north-1|south-1|south-2)|europe-(west1|west3|west4|west8|west9|west10|west12|central2|north1|north2|southwest1)|austriaeast|denmarkeast|francecentral|germanywestcentral|greececentral|italynorth|northeurope|spaincentral|swedencentral|westeurope|polandcentral/ nocase
(metadata.event_type = "RESOURCE_READ" OR metadata.event_type = "RESOURCE_WRITTEN" OR metadata.event_type = "RESOURCE_CREATION" OR metadata.event_type = "RESOURCE_DELETION" OR metadata.event_type = "RESOURCE_PERMISSIONS_CHANGE" OR metadata.event_type = "FILE_UNCATEGORIZED" OR metadata.event_type = "FILE_CREATION" OR metadata.event_type = "FILE_DELETION" OR metadata.event_type = "FILE_MODIFICATION" OR metadata.event_type = "FILE_READ" OR metadata.event_type = "FILE_COPY" OR metadata.event_type = "FILE_OPEN" OR metadata.event_type = "FILE_MOVE" OR metadata.event_type = "FILE_SYNC" OR metadata.event_type = "EVENTTYPE_UNSPECIFIED" OR metadata.event_type = "SETTING_UNCATEGORIZED" OR metadata.event_type = "USER_UNCATEGORIZED" OR metadata.event_type = "SYSTEM_AUDIT_LOG_UNCATEGORIZED" OR metadata.event_type = "SYSTEM_AUDIT_LOG_WIPE" OR metadata.event_type = "USER_RESOURCE_CREATION" OR metadata.event_type = "USER_RESOURCE_UPDATE_CONTENT" OR metadata.event_type = "USER_RESOURCE_UPDATE_PERMISSIONS" OR metadata.event_type = "USER_RESOURCE_ACCESS" OR metadata.event_type = "USER_RESOURCE_DELETION" OR metadata.event_type = "GENERIC_EVENT")
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
$Action = security_result.action
match:
$Date, $Action
outcome:
$Count = count(metadata.id)
order:
$Date asc
10 principais políticas acionadas
strings.coalesce(target.location.country_or_region, target.ip_geo_artifact.location.country_or_region, target.location.name) = /Austria|Belgium|Bulgaria|Croatia|Cyprus|Czechia|Denmark|Estonia|Finland|France|Germany|Greece|Hungary|Ireland|Italy|Latvia|Lithuania|Luxembourg|Malta|Netherlands|Poland|Portugal|Romania|Slovakia|Slovenia|Spain|Sweden|eu-(west-1|west-3|central-1|north-1|south-1|south-2)|europe-(west1|west3|west4|west8|west9|west10|west12|central2|north1|north2|southwest1)|austriaeast|denmarkeast|francecentral|germanywestcentral|greececentral|italynorth|northeurope|spaincentral|swedencentral|westeurope|polandcentral/ nocase
(metadata.event_type = "RESOURCE_READ" OR metadata.event_type = "RESOURCE_WRITTEN" OR metadata.event_type = "RESOURCE_CREATION" OR metadata.event_type = "RESOURCE_DELETION" OR metadata.event_type = "RESOURCE_PERMISSIONS_CHANGE" OR metadata.event_type = "FILE_UNCATEGORIZED" OR metadata.event_type = "FILE_CREATION" OR metadata.event_type = "FILE_DELETION" OR metadata.event_type = "FILE_MODIFICATION" OR metadata.event_type = "FILE_READ" OR metadata.event_type = "FILE_COPY" OR metadata.event_type = "FILE_OPEN" OR metadata.event_type = "FILE_MOVE" OR metadata.event_type = "FILE_SYNC" OR metadata.event_type = "EVENTTYPE_UNSPECIFIED" OR metadata.event_type = "SETTING_UNCATEGORIZED" OR metadata.event_type = "USER_UNCATEGORIZED" OR metadata.event_type = "SYSTEM_AUDIT_LOG_UNCATEGORIZED" OR metadata.event_type = "SYSTEM_AUDIT_LOG_WIPE" OR metadata.event_type = "USER_RESOURCE_CREATION" OR metadata.event_type = "USER_RESOURCE_UPDATE_CONTENT" OR metadata.event_type = "USER_RESOURCE_UPDATE_PERMISSIONS" OR metadata.event_type = "USER_RESOURCE_ACCESS" OR metadata.event_type = "USER_RESOURCE_DELETION" OR metadata.event_type = "GENERIC_EVENT")
security_result.rule_name = /Policy/ nocase
$Policy = security_result.rule_name
$Policy != ""
$Target_EU_Country = strings.coalesce(target.location.country_or_region, target.ip_geo_artifact.location.country_or_region, target.location.name)
match:
$Policy, $Target_EU_Country
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
Acesso não autorizado a recursos da UE
strings.coalesce(target.location.country_or_region, target.ip_geo_artifact.location.country_or_region, target.location.name) = /Austria|Belgium|Bulgaria|Croatia|Cyprus|Czechia|Denmark|Estonia|Finland|France|Germany|Greece|Hungary|Ireland|Italy|Latvia|Lithuania|Luxembourg|Malta|Netherlands|Poland|Portugal|Romania|Slovakia|Slovenia|Spain|Sweden|eu-(west-1|west-3|central-1|north-1|south-1|south-2)|europe-(west1|west3|west4|west8|west9|west10|west12|central2|north1|north2|southwest1)|austriaeast|denmarkeast|francecentral|germanywestcentral|greececentral|italynorth|northeurope|spaincentral|swedencentral|westeurope|polandcentral/ nocase
(metadata.event_type = "RESOURCE_READ" OR metadata.event_type = "RESOURCE_WRITTEN" OR metadata.event_type = "RESOURCE_CREATION" OR metadata.event_type = "RESOURCE_DELETION" OR metadata.event_type = "RESOURCE_PERMISSIONS_CHANGE" OR metadata.event_type = "FILE_UNCATEGORIZED" OR metadata.event_type = "FILE_CREATION" OR metadata.event_type = "FILE_DELETION" OR metadata.event_type = "FILE_MODIFICATION" OR metadata.event_type = "FILE_READ" OR metadata.event_type = "FILE_COPY" OR metadata.event_type = "FILE_OPEN" OR metadata.event_type = "FILE_MOVE" OR metadata.event_type = "FILE_SYNC" OR metadata.event_type = "EVENTTYPE_UNSPECIFIED" OR metadata.event_type = "SETTING_UNCATEGORIZED" OR metadata.event_type = "USER_UNCATEGORIZED" OR metadata.event_type = "SYSTEM_AUDIT_LOG_UNCATEGORIZED" OR metadata.event_type = "SYSTEM_AUDIT_LOG_WIPE" OR metadata.event_type = "USER_RESOURCE_CREATION" OR metadata.event_type = "USER_RESOURCE_UPDATE_CONTENT" OR metadata.event_type = "USER_RESOURCE_UPDATE_PERMISSIONS" OR metadata.event_type = "USER_RESOURCE_ACCESS" OR metadata.event_type = "USER_RESOURCE_DELETION" OR metadata.event_type = "GENERIC_EVENT")
$User = strings.coalesce(principal.user.userid, principal.user.user_display_name, principal.user.email_addresses,target.user.userid, target.user.user_display_name, target.user.email_addresses)
$Source_IP = strings.coalesce(principal.ip, principal.asset.ip)
$Hostname = strings.coalesce(principal.hostname, principal.asset.hostname)
$Action = security_result.action
$Action != "ALLOW"
$Summary = strings.coalesce(security_result.summary, metadata.description, security_result.description)
$Severity = security_result.severity
match:
$Summary, $User, $Source_IP ,$Action , $Severity, $Hostname
outcome :
$Count = count(metadata.id)
$Date = timestamp.get_timestamp(max(metadata.event_timestamp.seconds))
order:
$Count desc
Acesso a recursos da UE de países de fora da UE
(strings.coalesce(target.location.country_or_region, target.ip_geo_artifact.location.country_or_region, target.location.name) = /Austria|Belgium|Bulgaria|Croatia|Cyprus|Czechia|Denmark|Estonia|Finland|France|Germany|Greece|Hungary|Ireland|Italy|Latvia|Lithuania|Luxembourg|Malta|Netherlands|Poland|Portugal|Romania|Slovakia|Slovenia|Spain|Sweden|eu-(west-1|west-3|central-1|north-1|south-1|south-2)|europe-(west1|west3|west4|west8|west9|west10|west12|central2|north1|north2|southwest1)|austriaeast|denmarkeast|francecentral|germanywestcentral|greececentral|italynorth|northeurope|spaincentral|swedencentral|westeurope|polandcentral/ nocase
and strings.coalesce(principal.location.country_or_region, principal.ip_geo_artifact.location.country_or_region, principal.location.name) != /Austria|Belgium|Bulgaria|Croatia|Cyprus|Czechia|Denmark|Estonia|Finland|France|Germany|Greece|Hungary|Ireland|Italy|Latvia|Lithuania|Luxembourg|Malta|Netherlands|Poland|Portugal|Romania|Slovakia|Slovenia|Spain|Sweden|eu-(west-1|west-3|central-1|north-1|south-1|south-2)|europe-(west1|west3|west4|west8|west9|west10|west12|central2|north1|north2|southwest1)|austriaeast|denmarkeast|francecentral|germanywestcentral|greececentral|italynorth|northeurope|spaincentral|swedencentral|westeurope|polandcentral/ nocase)
(metadata.event_type = "RESOURCE_READ" OR metadata.event_type = "RESOURCE_WRITTEN" OR metadata.event_type = "RESOURCE_CREATION" OR metadata.event_type = "RESOURCE_DELETION" OR metadata.event_type = "RESOURCE_PERMISSIONS_CHANGE" OR metadata.event_type = "FILE_UNCATEGORIZED" OR metadata.event_type = "FILE_CREATION" OR metadata.event_type = "FILE_DELETION" OR metadata.event_type = "FILE_MODIFICATION" OR metadata.event_type = "FILE_READ" OR metadata.event_type = "FILE_COPY" OR metadata.event_type = "FILE_OPEN" OR metadata.event_type = "FILE_MOVE" OR metadata.event_type = "FILE_SYNC" OR metadata.event_type = "EVENTTYPE_UNSPECIFIED" OR metadata.event_type = "SETTING_UNCATEGORIZED" OR metadata.event_type = "USER_UNCATEGORIZED" OR metadata.event_type = "SYSTEM_AUDIT_LOG_UNCATEGORIZED" OR metadata.event_type = "SYSTEM_AUDIT_LOG_WIPE" OR metadata.event_type = "USER_RESOURCE_CREATION" OR metadata.event_type = "USER_RESOURCE_UPDATE_CONTENT" OR metadata.event_type = "USER_RESOURCE_UPDATE_PERMISSIONS" OR metadata.event_type = "USER_RESOURCE_ACCESS" OR metadata.event_type = "USER_RESOURCE_DELETION" OR metadata.event_type = "GENERIC_EVENT")
$Source_Country = strings.coalesce(principal.location.country_or_region, principal.ip_geo_artifact.location.country_or_region, principal.location.name)
$Target_EU_Country = strings.coalesce(target.location.country_or_region, target.ip_geo_artifact.location.country_or_region, target.location.name)
$Target_EU_Resource = strings.coalesce(target.resource.name, target.file.full_path, target.resource.product_object_id, target.group.product_object_id, target.user.group_identifiers)
$Event_Type = metadata.event_type
$Description = strings.coalesce(metadata.description,security_result.description,security_result.summary,metadata.product_event_type)
$HTTP_Method = network.http.method
$Log_Type = metadata.log_type
$Action = security_result.action
$User = strings.coalesce(principal.user.user_display_name, principal.user.userid, principal.user.email_addresses,target.user.userid,target.user.user_display_name,target.user.email_addresses)
$Source_Country != ""
match:
$User, $Description, $Event_Type, $Log_Type, $Source_Country, $Target_EU_Resource, $Target_EU_Country, $HTTP_Method, $Action
outcome:
$Count = count(metadata.id)
$Date = timestamp.get_timestamp(max(metadata.event_timestamp.seconds))
order:
$Count desc
Os 10 principais países fora da UE que acessam dados da UE
(strings.coalesce(target.location.country_or_region, target.ip_geo_artifact.location.country_or_region, target.location.name) = /Austria|Belgium|Bulgaria|Croatia|Cyprus|Czechia|Denmark|Estonia|Finland|France|Germany|Greece|Hungary|Ireland|Italy|Latvia|Lithuania|Luxembourg|Malta|Netherlands|Poland|Portugal|Romania|Slovakia|Slovenia|Spain|Sweden|eu-(west-1|west-3|central-1|north-1|south-1|south-2)|europe-(west1|west3|west4|west8|west9|west10|west12|central2|north1|north2|southwest1)|austriaeast|denmarkeast|francecentral|germanywestcentral|greececentral|italynorth|northeurope|spaincentral|swedencentral|westeurope|polandcentral/ nocase
and strings.coalesce(principal.location.country_or_region, principal.ip_geo_artifact.location.country_or_region, principal.location.name) != /Austria|Belgium|Bulgaria|Croatia|Cyprus|Czechia|Denmark|Estonia|Finland|France|Germany|Greece|Hungary|Ireland|Italy|Latvia|Lithuania|Luxembourg|Malta|Netherlands|Poland|Portugal|Romania|Slovakia|Slovenia|Spain|Sweden|eu-(west-1|west-3|central-1|north-1|south-1|south-2)|europe-(west1|west3|west4|west8|west9|west10|west12|central2|north1|north2|southwest1)|austriaeast|denmarkeast|francecentral|germanywestcentral|greececentral|italynorth|northeurope|spaincentral|swedencentral|westeurope|polandcentral/ nocase)
(metadata.event_type = "RESOURCE_READ" OR metadata.event_type = "RESOURCE_WRITTEN" OR metadata.event_type = "RESOURCE_CREATION" OR metadata.event_type = "RESOURCE_DELETION" OR metadata.event_type = "RESOURCE_PERMISSIONS_CHANGE" OR metadata.event_type = "FILE_UNCATEGORIZED" OR metadata.event_type = "FILE_CREATION" OR metadata.event_type = "FILE_DELETION" OR metadata.event_type = "FILE_MODIFICATION" OR metadata.event_type = "FILE_READ" OR metadata.event_type = "FILE_COPY" OR metadata.event_type = "FILE_OPEN" OR metadata.event_type = "FILE_MOVE" OR metadata.event_type = "FILE_SYNC" OR metadata.event_type = "EVENTTYPE_UNSPECIFIED" OR metadata.event_type = "SETTING_UNCATEGORIZED" OR metadata.event_type = "USER_UNCATEGORIZED" OR metadata.event_type = "SYSTEM_AUDIT_LOG_UNCATEGORIZED" OR metadata.event_type = "SYSTEM_AUDIT_LOG_WIPE" OR metadata.event_type = "USER_RESOURCE_CREATION" OR metadata.event_type = "USER_RESOURCE_UPDATE_CONTENT" OR metadata.event_type = "USER_RESOURCE_UPDATE_PERMISSIONS" OR metadata.event_type = "USER_RESOURCE_ACCESS" OR metadata.event_type = "USER_RESOURCE_DELETION" OR metadata.event_type = "GENERIC_EVENT")
$Source_Country = strings.coalesce(principal.location.country_or_region, principal.ip_geo_artifact.location.country_or_region, principal.location.name)
$Log_Type = metadata.log_type
$Source_Country != ""
match:
$Source_Country, $Log_Type
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
Acesso privilegiado aos recursos da UE ao longo do tempo
strings.coalesce(target.location.country_or_region, target.ip_geo_artifact.location.country_or_region, target.location.name) = /Austria|Belgium|Bulgaria|Croatia|Cyprus|Czechia|Denmark|Estonia|Finland|France|Germany|Greece|Hungary|Ireland|Italy|Latvia|Lithuania|Luxembourg|Malta|Netherlands|Poland|Portugal|Romania|Slovakia|Slovenia|Spain|Sweden|eu-(west-1|west-3|central-1|north-1|south-1|south-2)|europe-(west1|west3|west4|west8|west9|west10|west12|central2|north1|north2|southwest1)|austriaeast|denmarkeast|francecentral|germanywestcentral|greececentral|italynorth|northeurope|spaincentral|swedencentral|westeurope|polandcentral/ nocase
(metadata.event_type = "RESOURCE_READ" OR metadata.event_type = "RESOURCE_WRITTEN" OR metadata.event_type = "RESOURCE_CREATION" OR metadata.event_type = "RESOURCE_DELETION" OR metadata.event_type = "RESOURCE_PERMISSIONS_CHANGE" OR metadata.event_type = "FILE_UNCATEGORIZED" OR metadata.event_type = "FILE_CREATION" OR metadata.event_type = "FILE_DELETION" OR metadata.event_type = "FILE_MODIFICATION" OR metadata.event_type = "FILE_READ" OR metadata.event_type = "FILE_COPY" OR metadata.event_type = "FILE_OPEN" OR metadata.event_type = "FILE_MOVE" OR metadata.event_type = "FILE_SYNC" OR metadata.event_type = "EVENTTYPE_UNSPECIFIED" OR metadata.event_type = "SETTING_UNCATEGORIZED" OR metadata.event_type = "USER_UNCATEGORIZED" OR metadata.event_type = "SYSTEM_AUDIT_LOG_UNCATEGORIZED" OR metadata.event_type = "SYSTEM_AUDIT_LOG_WIPE" OR metadata.event_type = "USER_RESOURCE_CREATION" OR metadata.event_type = "USER_RESOURCE_UPDATE_CONTENT" OR metadata.event_type = "USER_RESOURCE_UPDATE_PERMISSIONS" OR metadata.event_type = "USER_RESOURCE_ACCESS" OR metadata.event_type = "USER_RESOURCE_DELETION" OR metadata.event_type = "GENERIC_EVENT" OR metadata.event_type ="USER_LOGIN" or metadata.event_type = "USER_CHANGE_PERMISSIONS")
$User = strings.coalesce(principal.user.userid,principal.user.user_display_name,principal.user.email_addresses,target.user.userid,target.user.user_display_name,target.user.email_addresses)
($User = /admin|root|svc|adm|privilege/ nocase or principal.user.attribute.roles.type = "SERVICE_ACCOUNT" or principal.user.attribute.roles.type = "ADMINISTRATOR" or principal.user.account_type = "DOMAIN_ACCOUNT_TYPE" or principal.user.account_type = "SERVICE_ACCOUNT_TYPE")
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
$Target_EU_Country = strings.coalesce(target.location.country_or_region, target.ip_geo_artifact.location.country_or_region, target.location.name)
match:
$Target_EU_Country, $Date
outcome:
$Count = count(metadata.id)
order:
$Date asc
Detecção de ameaças ao longo do tempo
strings.coalesce(target.location.country_or_region, target.ip_geo_artifact.location.country_or_region, target.location.name) = /Austria|Belgium|Bulgaria|Croatia|Cyprus|Czechia|Denmark|Estonia|Finland|France|Germany|Greece|Hungary|Ireland|Italy|Latvia|Lithuania|Luxembourg|Malta|Netherlands|Poland|Portugal|Romania|Slovakia|Slovenia|Spain|Sweden|eu-(west-1|west-3|central-1|north-1|south-1|south-2)|europe-(west1|west3|west4|west8|west9|west10|west12|central2|north1|north2|southwest1)|austriaeast|denmarkeast|francecentral|germanywestcentral|greececentral|italynorth|northeurope|spaincentral|swedencentral|westeurope|polandcentral/ nocase
(metadata.event_type = "RESOURCE_READ" OR metadata.event_type = "RESOURCE_WRITTEN" OR metadata.event_type = "RESOURCE_CREATION" OR metadata.event_type = "RESOURCE_DELETION" OR metadata.event_type = "RESOURCE_PERMISSIONS_CHANGE" OR metadata.event_type = "FILE_UNCATEGORIZED" OR metadata.event_type = "FILE_CREATION" OR metadata.event_type = "FILE_DELETION" OR metadata.event_type = "FILE_MODIFICATION" OR metadata.event_type = "FILE_READ" OR metadata.event_type = "FILE_COPY" OR metadata.event_type = "FILE_OPEN" OR metadata.event_type = "FILE_MOVE" OR metadata.event_type = "FILE_SYNC" OR metadata.event_type = "EVENTTYPE_UNSPECIFIED" OR metadata.event_type = "SETTING_UNCATEGORIZED" OR metadata.event_type = "USER_UNCATEGORIZED" OR metadata.event_type = "SYSTEM_AUDIT_LOG_UNCATEGORIZED" OR metadata.event_type = "SYSTEM_AUDIT_LOG_WIPE" OR metadata.event_type = "USER_RESOURCE_CREATION" OR metadata.event_type = "USER_RESOURCE_UPDATE_CONTENT" OR metadata.event_type = "USER_RESOURCE_UPDATE_PERMISSIONS" OR metadata.event_type = "USER_RESOURCE_ACCESS" OR metadata.event_type = "USER_RESOURCE_DELETION" OR metadata.event_type = "GENERIC_EVENT")
$Threat_Name = security_result.threat_name
$Threat_Name != ""
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
match:
$Threat_Name, $Date
outcome:
$Count = count(metadata.id)
order:
$Date asc
Eventos de acesso a dados sensíveis
strings.coalesce(principal.location.country_or_region, principal.ip_geo_artifact.location.country_or_region, principal.location.name) = /Austria|Belgium|Bulgaria|Croatia|Cyprus|Czechia|Denmark|Estonia|Finland|France|Germany|Greece|Hungary|Ireland|Italy|Latvia|Lithuania|Luxembourg|Malta|Netherlands|Poland|Portugal|Romania|Slovakia|Slovenia|Spain|Sweden|eu-(west-1|west-3|central-1|north-1|south-1|south-2)|europe-(west1|west3|west4|west8|west9|west10|west12|central2|north1|north2|southwest1)|austriaeast|denmarkeast|francecentral|germanywestcentral|greececentral|italynorth|northeurope|spaincentral|swedencentral|westeurope|polandcentral/ nocase
(metadata.event_type = "RESOURCE_READ" OR metadata.event_type = "RESOURCE_WRITTEN" OR metadata.event_type = "RESOURCE_CREATION" OR metadata.event_type = "RESOURCE_DELETION" OR metadata.event_type = "RESOURCE_PERMISSIONS_CHANGE" OR metadata.event_type = "FILE_UNCATEGORIZED" OR metadata.event_type = "FILE_CREATION" OR metadata.event_type = "FILE_DELETION" OR metadata.event_type = "FILE_MODIFICATION" OR metadata.event_type = "FILE_READ" OR metadata.event_type = "FILE_COPY" OR metadata.event_type = "FILE_OPEN" OR metadata.event_type = "FILE_MOVE" OR metadata.event_type = "FILE_SYNC" OR metadata.event_type = "EVENTTYPE_UNSPECIFIED" OR metadata.event_type = "SETTING_UNCATEGORIZED" OR metadata.event_type = "USER_UNCATEGORIZED" OR metadata.event_type = "SYSTEM_AUDIT_LOG_UNCATEGORIZED" OR metadata.event_type = "SYSTEM_AUDIT_LOG_WIPE" OR metadata.event_type = "USER_RESOURCE_CREATION" OR metadata.event_type = "USER_RESOURCE_UPDATE_CONTENT" OR metadata.event_type = "USER_RESOURCE_UPDATE_PERMISSIONS" OR metadata.event_type = "USER_RESOURCE_ACCESS" OR metadata.event_type = "USER_RESOURCE_DELETION" OR metadata.log_type = "GENERIC_EVENT" OR metadata.event_type ="USER_LOGIN" or metadata.log_type = "USER_CHANGE_PERMISSIONS")
(metadata.product_event_type = /SENSITIVE/ nocase OR security_result.rule_name = /SENSITIVE/ nocase OR metadata.description = /SENSITIVE/ nocase OR security_result.summary = /SENSITIVE/ nocase OR security_result.description = /SENSITIVE/ nocase)
$Description = strings.coalesce(security_result.summary, security_result.description,metadata.description)
$Source_User = strings.coalesce(principal.user.userid,principal.user.user_display_name,principal.user.email_addresses)
$Target_User = strings.coalesce(target.user.userid,target.user.user_display_name,target.user.email_addresses)
$Source_Country = strings.coalesce(principal.location.country_or_region, principal.ip_geo_artifact.location.country_or_region, principal.location.name)
$Source_IP = strings.coalesce(principal.ip, principal.asset.ip)
$Destination_IP = strings.coalesce(target.ip, target.asset.ip)
$Protocol = network.application_protocol
$Action = security_result.action
$Log_Type = metadata.log_type
match:
$Description,$Source_User, $Target_User, $Source_IP,$Source_Country, $Destination_IP ,$Protocol , $Log_Type, $Action
outcome:
$Count = count(metadata.id)
$Date = timestamp.get_timestamp(max(metadata.event_timestamp.seconds))
order:
$Count desc
Alertas do Google Workspace
Esse painel oferece uma visão geral dos eventos de segurança e possíveis ameaças, rastreando alertas críticos e tendências relacionadas à atividade do usuário no espaço de trabalho.
Os 10 principais alertas de gravidade alta
10 principais alertas
Alertas ao longo do tempo
Detalhes do alerta recente
Alerta por gravidade
Os 10 principais usuários por número de alertas
Nome do gráfico
Exemplo de consulta
Os 10 principais alertas de gravidade alta
metadata.log_type = "WORKSPACE_ALERTS"
security_result.severity = "HIGH"
security_result.summary != ""
$Alert = security_result.summary
$Alert != ""
match:
$Alert
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
10 principais alertas
metadata.log_type = "WORKSPACE_ALERTS"
security_result.summary != ""
$Alert = security_result.summary
$Alert != ""
match:
$Alert
outcome:
$Count = count(security_result.summary)
order:
$Count desc
limit:
10
Alertas ao longo do tempo
metadata.log_type = "WORKSPACE_ALERTS"
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
match:
$Date
outcome:
$Count = count(metadata.id)
order:
$Date desc
Detalhes do alerta recente
metadata.log_type = "WORKSPACE_ALERTS"
$Alert = security_result.summary
$Category_Details = security_result.category_details
$Category = security_result.category
$Severity = security_result.severity
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
match:
$Date, $Alert, $Category, $Category_Details, $Severity
outcome:
$Count = count(metadata.id)
order:
$Date desc
limit:
50
Alerta por gravidade
metadata.log_type = "WORKSPACE_ALERTS"
$Severity = security_result.severity
match:
$Severity
outcome:
$Count = count(metadata.id)
order:
$Count desc
Os 10 principais usuários por número de alertas
metadata.log_type = "WORKSPACE_ALERTS"
target.user.userid != ""
$User = target.user.userid
match:
$User
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
Google Workspace Drive
Esse painel oferece uma visão abrangente da atividade do usuário e do gerenciamento de recursos. Ele destaca eventos, usuários e padrões de acesso importantes em vários locais, permitindo que as equipes de segurança garantam a conformidade e reduzam possíveis riscos.
Observação : aplique filtros para refinar os resultados e receber insights direcionados.
Resumo da DLP para eventos de download
Baixar eventos ao longo do tempo
Os 10 principais usuários em eventos de download
Eventos de exclusão de recursos ao longo do tempo
10 principais eventos
Eventos de criação de recursos ao longo do tempo
10 principais locais
Visão geral da geolocalização de origem
Resumo da DLP para eventos de upload
Eventos ao longo do tempo por ação
10 principais recursos acessados
Os 10 principais usuários em eventos de upload
10 principais usuários
Nome do gráfico
Exemplo de consulta
Resumo da DLP para eventos de download
metadata.product_event_type = "download"
target.resource.attribute.labels.key = "dlp_info"
$DLP_Signature = target.resource.attribute.labels.value
$URL = target.url
$Source_IP = principal.ip
$User = strings.coalesce(principal.user.userid, principal.user.user_display_name, principal.user.email_addresses)
match:
$DLP_Signature,$User,$Source_IP, $URL
outcome:
$Storage_Used_in_MB = max(math.round(cast.as_float(additional.fields["storage_usage_in_bytes"])/(1000*1000), 2))
$Date = timestamp.get_timestamp(max(metadata.event_timestamp.seconds), "%F %T")
$Count = count(metadata.id)
order:
$Date desc
Baixar eventos ao longo do tempo
metadata.product_event_type = "download"
$User = strings.coalesce(principal.user.userid, principal.user.user_display_name, principal.user.email_addresses)
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
match:
$Date,$User
outcome:
$Count = count(metadata.id)
order:
$Date asc
Os 10 principais usuários em eventos de download
metadata.product_event_type = "download"
$User = strings.coalesce(principal.user.userid, principal.user.user_display_name, principal.user.email_addresses)
match:
$User
outcome:
$Storage_Used_in_MB = sum(math.round(cast.as_float(additional.fields["storage_usage_in_bytes"])/(1000*1000), 2))
order:
$Storage_Used_in_MB desc
limit:
10
Eventos de exclusão de recursos ao longo do tempo
(metadata.event_type = "RESOURCE_DELETION" or metadata.event_type = "USER_RESOURCE_DELETION")
(metadata.product_event_type = "trash" or metadata.product_event_type = "delete")
$User = strings.coalesce(principal.user.userid, principal.user.user_display_name, principal.user.email_addresses)
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
match:
$Date,$User
outcome:
$Count = count(metadata.id)
order:
$Date asc
10 principais eventos
$Security_Event_Type = metadata.product_event_type
$User = strings.coalesce(principal.user.userid, principal.user.user_display_name, principal.user.email_addresses, target.user.userid, target.user.user_display_name, target.user.email_addresses)
match:
$Security_Event_Type,$User
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
Eventos de criação de recursos ao longo do tempo
(metadata.event_type = "RESOURCE_CREATION" or metadata.event_type = "USER_RESOURCE_CREATION")
metadata.product_event_type = "create"
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
$User = strings.coalesce(principal.user.userid, principal.user.user_display_name, principal.user.email_addresses)
match:
$Date,$User
outcome:
$Count = count(metadata.id)
order:
$Date asc
10 principais locais
$Location = strings.coalesce(principal.location.country_or_region, principal.ip_geo_artifact.location.country_or_region)
match:
$Location
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
Visão geral da geolocalização de origem
(metadata.event_type = "USER_RESOURCE_ACCESS" or metadata.event_type = "RESOURCE_READ" or metadata.event_type = "USER_RESOURCE_UPDATE_CONTENT")
$Country = principal.ip_geo_artifact.location.country_or_region
$Country !=""
match:
$Country
outcome:
$Count = count(metadata.id)
$Latitude = max(principal.ip_geo_artifact.location.region_coordinates.latitude)
$Longitude = max(principal.ip_geo_artifact.location.region_coordinates.longitude)
order:
$Count desc
Resumo da DLP para eventos de upload
metadata.product_event_type = "upload"
target.resource.attribute.labels.key = "dlp_info"
$DLP_Signature = target.resource.attribute.labels.value
$URL = target.url
$Source_IP = principal.ip
$User = strings.coalesce(principal.user.userid, principal.user.user_display_name, principal.user.email_addresses)
match:
$DLP_Signature,$User,$Source_IP, $URL
outcome:
$Storage_Used_in_MB = max(math.round(cast.as_float(additional.fields["storage_usage_in_bytes"])/(1000*1000), 2))
$Date = timestamp.get_timestamp(max(metadata.event_timestamp.seconds), "%F %T")
$Count = count(metadata.id)
order:
$Date desc
Eventos ao longo do tempo por ação
$Security_Event_Type = metadata.product_event_type
$Action = security_result.action
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
match:
$Date ,$Action
outcome:
$Count = count(metadata.id)
order:
$Date asc
10 principais recursos acessados
(metadata.event_type = "USER_RESOURCE_ACCESS" or metadata.event_type = "RESOURCE_READ" or metadata.event_type = "USER_RESOURCE_UPDATE_CONTENT")
$Security_Event_Type = metadata.product_event_type
$Resource_Id = target.resource.product_object_id
$Resource_Id != ""
$Source_User = strings.coalesce(principal.user.email_addresses, principal.user.userid, principal.user.user_display_name)
$Source_IP = strings.coalesce(principal.ip,principal.asset.ip)
$Action = security_result.action
match:
$Resource_Id,$Source_User,$Source_IP ,$Security_Event_Type, $Action
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
Os 10 principais usuários em eventos de upload
metadata.product_event_type = "upload"
$User = strings.coalesce(principal.user.userid, principal.user.user_display_name, principal.user.email_addresses)
match:
$User
outcome:
$Storage_Used_in_MB = sum(math.round(cast.as_float(additional.fields["storage_usage_in_bytes"])/(1000*1000), 2))
order:
$Storage_Used_in_MB desc
limit:
10
10 principais usuários
$User = strings.coalesce(principal.user.userid, principal.user.user_display_name, principal.user.email_addresses)
$Action = security_result.action
match:
$User, $Action
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
Gerenciamento de identidade do Google Workspace
Esse painel oferece uma visão geral das atividades de usuários e grupos, com insights sobre padrões de login, modificações e mudanças de permissão, além de acompanhar tendências ao longo do tempo.
Eventos de modificações de grupo ao longo do tempo
Eventos de exclusão de usuários ao longo do tempo
Eventos de mudanças de permissão ao longo do tempo
Logins bem-sucedidos x com falha
Os 10 principais administradores que realizam tarefas de gerenciamento
Tendência dos 10 principais logins de usuário com falha
Eventos de criação de usuários ao longo do tempo
Tendência dos 10 principais logins de usuários bem-sucedidos
Nome do gráfico
Exemplo de consulta
Eventos de modificações de grupo ao longo do tempo
metadata.log_type = "WORKSPACE_ACTIVITY"
metadata.product_event_type = /modify_group/ nocase
$Event = metadata.product_event_type
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
match:
$Date, $Event
outcome:
$Count = count(metadata.id)
order:
$Date desc
Eventos de exclusão de usuários ao longo do tempo
metadata.log_type = "WORKSPACE_ACTIVITY"
metadata.product_event_type = /delete_user/ nocase
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
match:
$Date
outcome:
$Count = count(target.user.email_addresses)
order:
$Count desc
Eventos de mudanças de permissão ao longo do tempo
metadata.log_type = "WORKSPACE_ACTIVITY"
metadata.event_type = "RESOURCE_PERMISSIONS_CHANGE"
or metadata.event_type = "USER_CHANGE_PERMISSIONS"
or metadata.event_type = "USER_RESOURCE_UPDATE_PERMISSIONS"
$Permission = metadata.event_type
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
match:
$Permission, $Date
outcome:
$Count = count(metadata.id)
order:
$Date desc
Logins bem-sucedidos x com falha
metadata.log_type = "WORKSPACE_ACTIVITY"
metadata.product_event_type = "LOGIN_SUCCESS"
or metadata.product_event_type = "LOGIN_FAILURE"
$User_Login = metadata.product_event_type
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
match:
$Date, $User_Login
outcome:
$Count = count(metadata.id)
order:
$Count desc
Os 10 principais administradores que realizam tarefas de gerenciamento
metadata.log_type = "WORKSPACE_ACTIVITY"
target.application = /admin/ nocase
$Event = metadata.event_type
$Admin = principal.user.email_addresses
match:
$Admin, $Event
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
Tendência dos 10 principais logins de usuário com falha
metadata.log_type = "WORKSPACE_ACTIVITY"
metadata.product_event_type = "LOGIN_FAILURE"
principal.user.email_addresses != ""
$User_Account = principal.user.email_addresses
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
match:
$User_Account, $Date
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
Eventos de criação de usuários ao longo do tempo
metadata.log_type = "WORKSPACE_ACTIVITY"
metadata.product_event_type = /create_user/ nocase
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
match:
$Date
outcome:
$Count = count(target.user.email_addresses)
order:
$Count desc
Tendência dos 10 principais logins de usuários bem-sucedidos
metadata.log_type = "WORKSPACE_ACTIVITY"
metadata.product_event_type = "LOGIN_SUCCESS"
principal.user.email_addresses != ""
$User_Account = principal.user.email_addresses
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
match:
$User_Account, $Date
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
Resumo da atividade em grupo
Esse painel oferece uma visão detalhada das interações de usuários e grupos, rastreando usuários, grupos e mudanças de associação distintos. Ele destaca os usuários e grupos mais ativos, as mudanças nos grupos e monitora as tendências de atividade dos grupos.
Observação : aplique filtros para refinar os resultados e receber insights direcionados.
Grupos criados ao longo do tempo
Os 10 principais hosts por evento de gerenciamento de grupo
Grupos criados
Usuários removidos de grupos
Grupos excluídos recentemente
Eventos de grupo bloqueados ao longo do tempo
Usuários adicionados ao grupo de administradores
Usuários removidos recentemente de grupos
Contagem de atividades de mudança de grupo
10 principais usuários bloqueados em eventos de grupo
Grupos excluídos
Grupos criados recentemente
Os 10 principais hosts ativos
Os 10 principais usuários que excluem grupos
10 principais ações em grupo
Os 10 principais usuários por evento de login
Número de usuários adicionados a grupos
Os 10 principais IPs de origem bloqueados em eventos de grupo
Usuários únicos em eventos de login
Os 10 principais IPs de origem que modificam grupos
Total de usuários adicionados ao grupo de administradores
Atividade em grupo ao longo do tempo
Novos grupos adicionados
Usuários adicionados recentemente a grupos
Grupos modificados ao longo do tempo
Grupos modificados recentemente
Os 10 principais usuários que criaram grupos
Os 10 principais usuários que modificam grupos
Usuários adicionados a grupos
Os 10 principais IPs de origem que excluem grupos
Contagem de logins de usuários únicos
Os 10 principais IPs de origem que criam grupos
10 principais grupos ativos
Nº de usuários removidos de grupos
Grupos excluídos ao longo do tempo
Os 10 principais grupos por contagem de eventos
Os 10 principais logins de usuários ativos
Nome do gráfico
Exemplo de consulta
Grupos criados ao longo do tempo
metadata.event_type = "GROUP_CREATION"
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
match:
$Date
outcome:
$Count = count(metadata.id)
order:
$Count desc
Os 10 principais hosts por evento de gerenciamento de grupo
metadata.event_type = "GROUP_UNCATEGORIZED"
or metadata.event_type = "GROUP_CREATION"
or metadata.event_type = "GROUP_DELETION"
or metadata.event_type = "GROUP_MODIFICATION"
$Hostname = principal.hostname
$Hostname != ""
$Event_Type = metadata.event_type
match:
$Hostname, $Event_Type
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
Grupos criados
metadata.event_type = "GROUP_CREATION"
outcome:
$Count = count_distinct(target.group.group_display_name)
Usuários removidos de grupos
$event.metadata.product_event_type = /4733|4729|4757/
or $event.metadata.product_event_type = /remove.*(?:user|member).*(?:from|to).*group/ nocase
$Initiator = strings.coalesce($event.principal.user.windows_sid, $event.principal.user.userid)
$AffectedUser = strings.coalesce($event.target.user.windows_sid, $event.target.user.userid)
$Group = $event.target.group.group_display_name
$Description = strings.coalesce($event.metadata.description, $event.security_result.summary)
match:
$Initiator, $Group, $AffectedUser, $Description
outcome:
$Date = timestamp.get_timestamp(max($event.metadata.event_timestamp.seconds))
order:
$Date desc
limit:
50
Grupos excluídos recentemente
metadata.event_type = "GROUP_DELETION"
or metadata.product_event_type = /delete(?:\s)?group/ nocase
security_result.action = "ALLOW"
$Log_Type = metadata.log_type
$Group = target.group.group_display_name
$Initiator = strings.coalesce(principal.user.windows_sid, principal.user.userid, principal.user.email_addresses)
$IP_Address = principal.ip
$Date = timestamp.get_timestamp(metadata.event_timestamp.seconds, "%F %T ")
match:
$Date, $Log_Type, $Initiator, $IP_Address, $Group
order:
$Date desc
Eventos de grupo bloqueados ao longo do tempo
metadata.event_type = "GROUP_CREATION"
or metadata.event_type = "GROUP_DELETION"
or metadata.product_event_type = /add group/ nocase
or metadata.product_event_type = /delete group/ nocase
or metadata.event_type = "GROUP_MODIFICATION"
or metadata.product_event_type = /(RemoveUserFrom|AddUserTo|Add member to |Remove member from )|(?:group)/ nocase
security_result.action = "BLOCK"
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
match:
$Date
outcome:
$Count = count(metadata.id)
order:
$Date desc
Usuários adicionados ao grupo de administradores
metadata.product_event_type = /4732|4728|4756/
or metadata.product_event_type = /add.*(?:user|member).*to.*group/ nocase
$Initiator = strings.coalesce(principal.user.user_display_name, principal.user.userid, principal.user.windows_sid, target.user.userid, re.capture(additional.fields["Message"], `Account Name:(?:\W?)([A-Za-z0-9._%+-]+)`))
$Affected_User = strings.coalesce(re.capture(additional.fields["Message"], `Member Name:(?:\W?)([A-Za-z0-9._%+-]+)`), re.capture(security_result.description, `\b[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\.[A-Za-z]+`), target.user.user_display_name, target.user.userid, target.user.windows_sid)
$Group = strings.coalesce(target.group.group_display_name, re.capture(security_result.description, `group\W([A-Za-z0-9._%+-]+\W+[A-Za-z0-9._%+-]+)`), re.capture(additional.fields["Message"], `Group Name:(?:\W?)([A-Za-z0-9._%+-]+)`))
$Group = /admin/ nocase
$Description = strings.coalesce(metadata.description, security_result.summary)
$Date = timestamp.get_timestamp((metadata.event_timestamp.seconds))
match:
$Date, $Initiator, $Group, $Affected_User, $Description
order:
$Date desc
Usuários removidos recentemente de grupos
metadata.product_event_type = /4733|4729|4757/
or metadata.product_event_type = /remove.*(?:user|member).*(?:from|to).*group/ nocase
$Initiator = strings.coalesce(principal.user.user_display_name, principal.user.userid, principal.user.windows_sid, target.user.userid, re.capture(additional.fields["Message"], `Account Name:(?:\W?)([A-Za-z0-9._%+-]+)`))
$Affected_User = strings.coalesce(re.capture(additional.fields["Message"], `Member Name:(?:\W?)([A-Za-z0-9._%+-]+)`), re.capture(security_result.description, `\b[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\.[A-Za-z]+`), target.user.user_display_name, target.user.userid, target.user.windows_sid)
$Group = strings.coalesce(target.group.group_display_name, re.capture(security_result.description, `group\W([A-Za-z0-9._%+-]+\W+[A-Za-z0-9._%+-]+)`), re.capture(additional.fields["Message"], `Group Name:(?:\W?)([A-Za-z0-9._%+-]+)`))
$Description = strings.coalesce(metadata.description, security_result.summary)
$Date = timestamp.get_timestamp((metadata.event_timestamp.seconds))
match:
$Date, $Initiator, $Group, $Affected_User, $Description
order:
$Date desc
Contagem de atividades de mudança de grupo
metadata.event_type = "GROUP_CREATION"
or metadata.event_type = "GROUP_DELETION"
or metadata.event_type = "GROUP_MODIFICATION"
outcome:
$Count = count(metadata.id)
10 principais usuários bloqueados em eventos de grupo
metadata.event_type = "GROUP_CREATION"
or metadata.event_type = "GROUP_DELETION"
or metadata.product_event_type = /add group/ nocase
or metadata.product_event_type = /delete group/ nocase
or metadata.event_type = "GROUP_MODIFICATION"
or metadata.product_event_type = /(RemoveUserFrom|AddUserTo|Add member to |Remove member from )|(?:group)/ nocase
security_result.action = "BLOCK"
$Event_Type = metadata.event_type
$User = strings.coalesce(principal.user.windows_sid, principal.user.userid, principal.user.email_addresses)
match:
$Event_Type, $User
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
Grupos excluídos
$event.metadata.event_type = "GROUP_DELETION"
outcome:
$Count = count_distinct($event.target.group.group_display_name)
Grupos criados recentemente
metadata.event_type = "GROUP_CREATION"
or metadata.product_event_type = /(?:add|create)(?:\s)?group/ nocase
security_result.action = "ALLOW"
$Log_Type = metadata.log_type
$Group = target.group.group_display_name
$Initiator = strings.coalesce(principal.user.windows_sid, principal.user.userid, principal.user.email_addresses)
$IP_Address = principal.ip
$Date = timestamp.get_timestamp(metadata.event_timestamp.seconds, "%F %T ")
match:
$Date, $Log_Type, $Initiator, $IP_Address, $Group
order:
$Date desc
Os 10 principais hosts ativos
$event.metadata.event_type = "GROUP_UNCATEGORIZED"
or $event.metadata.event_type = "GROUP_CREATION"
or $event.metadata.event_type = "GROUP_DELETION"
or $event.metadata.event_type = "GROUP_MODIFICATION"
$Hostname = $event.principal.hostname
$Hostname != ""
$Event_Type = $event.metadata.event_type
$Log_type = $event.metadata.log_type
match:
$Hostname, $Event_Type, $Log_type
outcome:
$Count = count($event.metadata.id)
order:
$Count desc
limit:
10
Os 10 principais usuários que excluem grupos
metadata.event_type = "GROUP_DELETION"
or metadata.product_event_type = /delete(?:\s)?group/ nocase
security_result.action = "ALLOW"
$Log_Type = metadata.log_type
$User = strings.coalesce(principal.user.windows_sid, principal.user.userid, principal.user.email_addresses)
match:
$Log_Type, $User
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
10 principais ações em grupo
metadata.event_type = "GROUP_CREATION"
or metadata.event_type = "GROUP_DELETION"
or metadata.event_type = "GROUP_MODIFICATION"
$Description = strings.coalesce(metadata.description, security_result.summary)
$Description != ""
match:
$Description
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
Os 10 principais usuários por evento de login
metadata.event_type = "USER_LOGIN"
$User = strings.concat(target.user.userid, " ")
$User != " "
match:
$User
outcome:
$Count = count(target.user.userid)
order:
$Count desc
limit:
10
Número de usuários adicionados a grupos
$event.metadata.event_type = "GROUP_MODIFICATION"
$event.metadata.product_event_type = /4720|4728|4732|4746|4751|4756|4761|4785/
or $event.metadata.product_event_type = /add.*(?:user|member).*to.*group/ nocase
outcome:
$Count = count($event.metadata.id)
Os 10 principais IPs de origem bloqueados em eventos de grupo
metadata.event_type = "GROUP_CREATION"
or metadata.event_type = "GROUP_DELETION"
or metadata.product_event_type = /add group/ nocase
or metadata.product_event_type = /delete group/ nocase
or metadata.event_type = "GROUP_MODIFICATION"
or metadata.product_event_type = /(RemoveUserFrom|AddUserTo|Add member to |Remove member from )|(?:group)/ nocase
security_result.action = "BLOCK"
$Event_Type = metadata.event_type
$IP_Address = principal.ip
match:
$Event_Type, $IP_Address
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
Usuários únicos em eventos de login
metadata.event_type = "USER_LOGIN"
outcome:
$Count = count_distinct(principal.user.userid)
Os 10 principais IPs de origem que modificam grupos
metadata.event_type = "GROUP_MODIFICATION"
$Log_Type = metadata.log_type
$IP_Address = principal.ip
match:
$IP_Address, $Log_Type
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
Total de usuários adicionados ao grupo de administradores
metadata.product_event_type = /4732|4728|4756/
or metadata.product_event_type = /add.*(?:user|member).*to.*group/ nocase
$Group = strings.coalesce(target.group.group_display_name, re.capture(security_result.description, `group\W([A-Za-z0-9._%+-]+\W+[A-Za-z0-9._%+-]+)`), re.capture(additional.fields["Message"], `Group Name:(?:\W?)([A-Za-z0-9._%+-]+)`))
$Group = /admin/ nocase
outcome:
$Count = count(metadata.id)
Atividade em grupo ao longo do tempo
$event.metadata.event_type = "GROUP_CREATION"
or $event.metadata.event_type = "GROUP_DELETION"
or $event.metadata.event_type = "GROUP_MODIFICATION"
or $event.metadata.event_type = "GROUP_UNCATEGORIZED"
$User = $event.target.user.windows_sid
$Hostname = $event.principal.hostname
$Group = $event.target.group.group_display_name
$Event = $event.metadata.event_type
$Action = $event.metadata.description
$Action != "A security-enabled local group membership was enumerated"
match:
$Event, $User, $Hostname, $Group, $Action
outcome:
$Date = timestamp.get_timestamp(max($event.metadata.event_timestamp.seconds))
order:
$Date desc
limit:
50
Novos grupos adicionados
$event.metadata.event_type = "GROUP_CREATION"
outcome:
$Count = count_distinct($event.target.group.group_display_name)
Grupos excluídos
metadata.event_type = "GROUP_DELETION"
outcome:
$Count = count_distinct(target.group.group_display_name)
Usuários adicionados recentemente a grupos
metadata.product_event_type = /4732|4728|4756/
or metadata.product_event_type = /add.*(?:user|member).*to.*group/ nocase
$Initiator = strings.coalesce(principal.user.user_display_name, principal.user.userid, principal.user.windows_sid, target.user.userid, re.capture(additional.fields["Message"], `Account Name:(?:\W?)([A-Za-z0-9._%+-]+)`))
$Affected_User = strings.coalesce(re.capture(additional.fields["Message"], `Member Name:(?:\W?)([A-Za-z0-9._%+-]+)`), re.capture(security_result.description, `\b[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\.[A-Za-z]+`), target.user.user_display_name, target.user.userid, target.user.windows_sid)
$Group = strings.coalesce(target.group.group_display_name, re.capture(security_result.description, `group\W([A-Za-z0-9._%+-]+\W+[A-Za-z0-9._%+-]+)`), re.capture(additional.fields["Message"], `Group Name:(?:\W?)([A-Za-z0-9._%+-]+)`))
$Description = strings.coalesce(metadata.description, security_result.summary)
$Date = timestamp.get_timestamp((metadata.event_timestamp.seconds))
match:
$Date, $Initiator, $Group, $Affected_User, $Description
order:
$Date desc
Grupos modificados ao longo do tempo
metadata.event_type = "GROUP_MODIFICATION"
or metadata.product_event_type = /(RemoveUserFrom|AddUserTo|Add member to |Remove member from )|(?:group)/ nocase
security_result.action = "ALLOW"
$Log_Type = metadata.log_type
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
match:
$Log_Type, $Date
outcome:
$Count = count(metadata.id)
order:
$Date desc
Grupos modificados recentemente
metadata.event_type = "GROUP_MODIFICATION"
or metadata.product_event_type = /(RemoveUserFrom|AddUserTo|Add member to |Remove member from )|(?:group)/ nocase
security_result.action = "ALLOW"
$Log_Type = metadata.log_type
$Event = metadata.product_event_type
$Initiator = strings.coalesce(principal.user.windows_sid, principal.user.userid, principal.user.email_addresses)
$IP_Address = principal.ip
$User = strings.coalesce(target.user.userid, target.user.email_addresses)
$Group = target.group.group_display_name
$Description = strings.coalesce(metadata.description, security_result.summary)
$Date = timestamp.get_timestamp(metadata.event_timestamp.seconds, "%F %T ")
match:
$Date, $Log_Type, $Initiator, $IP_Address, $User, $Group, $Event, $Description
order:
$Date desc
Usuários removidos de grupos
metadata.event_type = "GROUP_MODIFICATION"
metadata.product_event_type = /4729|4733|4747|4752|4757|4762|4786/
or metadata.product_event_type = /remove.*(?:user|member).*to.*group/ nocase
outcome:
$Count = count(metadata.id)
Os 10 principais usuários que criaram grupos
metadata.event_type = "GROUP_CREATION"
or metadata.product_event_type = /(?:add|create)(?:\s)?group/ nocase
security_result.action = "ALLOW"
$Log_Type = metadata.log_type
$User = strings.coalesce(principal.user.windows_sid, principal.user.userid, principal.user.email_addresses)
match:
$Log_Type, $User
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
Os 10 principais usuários que modificam grupos
metadata.event_type = "GROUP_MODIFICATION"
$Log_Type = metadata.log_type
$User = principal.user.userid
match:
$User, $Log_Type
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
Usuários adicionados ao grupo de administradores
$event.metadata.product_event_type = /4732|4728|4756/
or $event.metadata.product_event_type = /add.*(?:user|member).*to.*group/ nocase
$Initiator = strings.coalesce($event.principal.user.windows_sid, $event.principal.user.userid)
$User = strings.coalesce($event.target.user.windows_sid, $event.target.user.userid)
$Group = $event.target.group.group_display_name
$Group = /admin/ nocase
$Description = strings.coalesce($event.metadata.description, $event.security_result.summary)
match:
$Initiator, $User, $Group, $Description
outcome:
$Date = timestamp.get_timestamp(max($event.metadata.event_timestamp.seconds))
order:
$Date desc
limit:
50
Contagem de atividades de mudança de grupo
$event.metadata.event_type = "GROUP_CREATION"
or $event.metadata.event_type = "GROUP_DELETION"
or $event.metadata.event_type = "GROUP_MODIFICATION"
outcome:
$Count = count($event.metadata.id)
Usuários adicionados a grupos
metadata.event_type = "GROUP_MODIFICATION"
metadata.product_event_type = /4720|4728|4732|4746|4751|4756|4761|4785/
or metadata.product_event_type = /add.*(?:user|member).*to.*group/ nocase
outcome:
$Count = count(metadata.id)
10 principais ações em grupo
$event.metadata.event_type = "GROUP_CREATION"
or $event.metadata.event_type = "GROUP_DELETION"
or $event.metadata.event_type = "GROUP_MODIFICATION"
$Description = strings.coalesce($event.metadata.description, $event.security_result.summary)
$Group_Name = $event.target.group.group_display_name
match:
$Description, $Group_Name
outcome:
$Count = count($event.metadata.id)
order:
$Count desc
limit:
10
Os 10 principais IPs de origem que excluem grupos
metadata.event_type = "GROUP_DELETION"
or metadata.product_event_type = /delete(?:\s)?group/ nocase
security_result.action = "ALLOW"
$Log_Type = metadata.log_type
$IP_Address = principal.ip
match:
$Log_Type, $IP_Address
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
Contagem de logins de usuários únicos
$event.metadata.event_type = "USER_LOGIN"
outcome:
$Count = count_distinct($event.principal.user.userid)
Os 10 principais IPs de origem que criam grupos
metadata.event_type = "GROUP_CREATION"
or metadata.product_event_type = /(?:add|create)(?:\s)?group/ nocase
security_result.action = "ALLOW"
$Log_Type = metadata.log_type
$IP_Address = principal.ip
match:
$Log_Type, $IP_Address
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
10 principais grupos ativos
$event.metadata.event_type = "GROUP_UNCATEGORIZED"
or $event.metadata.event_type = "GROUP_CREATION"
or $event.metadata.event_type = "GROUP_DELETION"
or $event.metadata.event_type = "GROUP_MODIFICATION"
$Log_Type = $event.metadata.log_type
$Event = $event.metadata.event_type
$Group_Name = $event.target.group.group_display_name
$Group_Name != ""
match:
$Group_Name, $Event, $Log_Type
outcome:
$Count = count($event.metadata.id)
order:
$Count desc
limit:
10
Nº de usuários removidos de grupos
$event.metadata.event_type = "GROUP_MODIFICATION"
$event.metadata.product_event_type = /4729|4733|4747|4752|4757|4762|4786/
or $event.metadata.product_event_type = /remove.*(?:user|member).*to.*group/ nocase
outcome:
$Count = count($event.metadata.id)
Grupos excluídos ao longo do tempo
metadata.event_type = "GROUP_DELETION"
or metadata.product_event_type = /delete(?:\s)?group/ nocase
security_result.action = "ALLOW"
$Log_Type = metadata.log_type
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
match:
$Log_Type, $Date
outcome:
$Count = count(metadata.id)
order:
$Date desc
Os 10 principais grupos por contagem de eventos
metadata.event_type = "GROUP_UNCATEGORIZED"
or metadata.event_type = "GROUP_CREATION"
or metadata.event_type = "GROUP_DELETION"
or metadata.event_type = "GROUP_MODIFICATION"
$Event_Type = metadata.event_type
$Group_Name = target.group.group_display_name
$Group_Name != ""
match:
$Group_Name, $Event_Type
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
Os 10 principais logins de usuários ativos
$event.metadata.event_type = "USER_LOGIN"
$Event_Type = $event.metadata.event_type
$User = strings.concat($event.target.user.userid, " ")
$User != " "
$Date = timestamp.get_date($event.metadata.event_timestamp.seconds)
match:
$User, $Event_Type, $Date over every day
outcome:
$Count = count($event.target.user.userid)
order:
$Date desc, $Count desc
limit:
10
Usuários adicionados a grupos
$event.metadata.product_event_type = /4732|4728|4756/
or $event.metadata.product_event_type = /add.*(?:user|member).*to.*group/ nocase
$Initiator = strings.coalesce($event.principal.user.windows_sid, $event.principal.user.userid)
$AffectedUser = strings.coalesce($event.target.user.windows_sid, $event.target.user.userid)
$Group = $event.target.group.group_display_name
$Description = strings.coalesce($event.metadata.description, $event.security_result.summary)
match:
$Initiator, $Group, $AffectedUser, $Description
outcome:
$Date = timestamp.get_timestamp(max($event.metadata.event_timestamp.seconds))
order:
$Date desc
limit:
50
Auditoria de gerenciamento de grupos
Este é um painel dedicado para auditar todo o ciclo de vida dos grupos de usuários.
Isso ajuda a garantir que as criações, modificações e exclusões de grupos sejam gerenciadas corretamente, evitando direitos de acesso não intencionais em grande escala.
Os 10 principais usuários que criaram grupos
Os 10 principais IPs de origem que criam grupos
Os 10 principais usuários que modificam grupos
Modificações recentes em grupos
Total de grupos únicos modificados
Grupos excluídos ao longo do tempo
Grupos criados ao longo do tempo
Grupos modificados ao longo do tempo
Eventos de grupo ao longo do tempo
Os 10 principais IPs de origem que excluem grupos
Total de grupos únicos criados
Exclusões recentes de grupos
Os 10 principais IPs de origem que modificam grupos
10 principais usuários bloqueados em eventos de grupo
Os 10 principais usuários que excluem grupos
Criações de grupos recentes
Os 10 principais IPs de origem bloqueados em eventos de grupo
Total de grupos únicos excluídos
Nome do gráfico
Exemplo de consulta
Os 10 principais usuários que criaram grupos
metadata.event_type = "GROUP_CREATION"
or metadata.product_event_type = /(?:add|create)(?:\s)?group/ nocase
security_result.action = "ALLOW"
$Log_Type = metadata.log_type
$User = strings.coalesce(principal.user.windows_sid, principal.user.userid, principal.user.email_addresses)
match:
$Log_Type, $User
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
Os 10 principais IPs de origem que criam grupos
metadata.event_type = "GROUP_CREATION"
or metadata.product_event_type = /(?:add|create)(?:\s)?group/ nocase
security_result.action = "ALLOW"
$Log_Type = metadata.log_type
$IP_Address = principal.ip
match:
$Log_Type, $IP_Address
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
Os 10 principais usuários que modificam grupos
metadata.event_type = "GROUP_MODIFICATION"
or metadata.product_event_type = /(RemoveUserFrom|AddUserTo|Add member to |Remove member from )|(?:group)/ nocase
security_result.action = "ALLOW"
$Log_Type = metadata.log_type
$User = strings.coalesce(principal.user.windows_sid, principal.user.userid, principal.user.email_addresses)
match:
$Log_Type, $User
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
Modificações recentes em grupos
metadata.event_type = "GROUP_MODIFICATION"
or metadata.product_event_type = /(RemoveUserFrom|AddUserTo|Add member to |Remove member from )|(?:group)/ nocase
security_result.action = "ALLOW"
$Log_Type = metadata.log_type
$Event = metadata.product_event_type
$Initiator = strings.coalesce(principal.user.windows_sid, principal.user.userid, principal.user.email_addresses)
$IP_Address = principal.ip
$User = strings.coalesce(target.user.userid, target.user.email_addresses)
$Group = target.group.group_display_name
$Description = strings.coalesce(metadata.description, security_result.summary)
$Date = timestamp.get_timestamp(metadata.event_timestamp.seconds, "%F %T ")
match:
$Date, $Log_Type, $Initiator, $IP_Address, $User, $Group, $Event, $Description
order:
$Date desc
Total de grupos únicos modificados
metadata.event_type = "GROUP_MODIFICATION"
or metadata.product_event_type = /(RemoveUserFrom|AddUserTo|Add member to |Remove member from )|(?:group)/ nocase
security_result.action = "ALLOW"
outcome:
$Count = count_distinct(target.group.group_display_name)
Grupos excluídos ao longo do tempo
metadata.event_type = "GROUP_DELETION"
or metadata.product_event_type = /delete(?:\s)?group/ nocase
security_result.action = "ALLOW"
$Log_Type = metadata.log_type
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
match:
$Log_Type, $Date
outcome:
$Count = count(metadata.id)
order:
$Date desc
Grupos criados ao longo do tempo
metadata.event_type = "GROUP_CREATION"
or metadata.product_event_type = /(?:add|create)(?:\s)?group/ nocase
security_result.action = "ALLOW"
$Log_Type = metadata.log_type
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
match:
$Log_Type, $Date
outcome:
$Count = count(metadata.id)
order:
$Date desc
Grupos modificados ao longo do tempo
metadata.event_type = "GROUP_MODIFICATION"
or metadata.product_event_type = /(RemoveUserFrom|AddUserTo|Add member to |Remove member from )|(?:group)/ nocase
security_result.action = "ALLOW"
$Log_Type = metadata.log_type
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
match:
$Log_Type, $Date
outcome:
$Count = count(metadata.id)
order:
$Date desc
Eventos de grupo ao longo do tempo
metadata.event_type = "GROUP_CREATION"
or metadata.event_type = "GROUP_DELETION"
or metadata.product_event_type = /(?:add|create|delete)(?:\s)?group/ nocase
or metadata.event_type = "GROUP_MODIFICATION"
or metadata.product_event_type = /(RemoveUserFrom|AddUserTo|Add member to |Remove member from )|(?:group)/ nocase
security_result.action = "ALLOW"
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
$Event = metadata.event_type
match:
$Date, $Event
outcome:
$Count = count(metadata.id)
order:
$Date desc
Os 10 principais IPs de origem que excluem grupos
metadata.event_type = "GROUP_DELETION"
or metadata.product_event_type = /delete(?:\s)?group/ nocase
security_result.action = "ALLOW"
$Log_Type = metadata.log_type
$IP_Address = principal.ip
match:
$Log_Type, $IP_Address
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
Total de grupos únicos criados
metadata.event_type = "GROUP_CREATION"
or metadata.product_event_type = /(?:add|create)(?:\s)?group/ nocase
security_result.action = "ALLOW"
outcome:
$Count = count_distinct(target.group.group_display_name)
Exclusões recentes de grupos
metadata.event_type = "GROUP_DELETION"
or metadata.product_event_type = /delete(?:\s)?group/ nocase
security_result.action = "ALLOW"
$Log_Type = metadata.log_type
$Group = target.group.group_display_name
$Initiator = strings.coalesce(principal.user.windows_sid, principal.user.userid, principal.user.email_addresses)
$IP_Address = principal.ip
$Date = timestamp.get_timestamp(metadata.event_timestamp.seconds, "%F %T ")
match:
$Date, $Log_Type, $Initiator, $IP_Address, $Group
order:
$Date desc
Os 10 principais IPs de origem que modificam grupos
metadata.event_type = "GROUP_MODIFICATION"
or metadata.product_event_type = /(RemoveUserFrom|AddUserTo|Add member to |Remove member from )|(?:group)/ nocase
security_result.action = "ALLOW"
$Log_Type = metadata.log_type
$IP_Address = principal.ip
match:
$Log_Type, $IP_Address
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
10 principais usuários bloqueados em eventos de grupo
metadata.event_type = "GROUP_CREATION"
or metadata.event_type = "GROUP_DELETION"
or metadata.product_event_type = /add group/ nocase
or metadata.product_event_type = /delete group/ nocase
or metadata.event_type = "GROUP_MODIFICATION"
or metadata.product_event_type = /(RemoveUserFrom|AddUserTo|Add member to |Remove member from )|(?:group)/ nocase
security_result.action = "BLOCK"
$Event_Type = metadata.event_type
$User = strings.coalesce(principal.user.windows_sid, principal.user.userid, principal.user.email_addresses)
match:
$Event_Type, $User
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
Os 10 principais usuários que excluem grupos
metadata.event_type = "GROUP_DELETION"
or metadata.product_event_type = /delete(?:\s)?group/ nocase
security_result.action = "ALLOW"
$Log_Type = metadata.log_type
$User = strings.coalesce(principal.user.windows_sid, principal.user.userid, principal.user.email_addresses)
match:
$Log_Type, $User
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
Criações de grupos recentes
metadata.event_type = "GROUP_CREATION"
or metadata.product_event_type = /(?:add|create)(?:\s)?group/ nocase
security_result.action = "ALLOW"
$Log_Type = metadata.log_type
$Group = target.group.group_display_name
$Initiator = strings.coalesce(principal.user.windows_sid, principal.user.userid, principal.user.email_addresses)
$IP_Address = principal.ip
$Date = timestamp.get_timestamp(metadata.event_timestamp.seconds, "%F %T ")
match:
$Date, $Log_Type, $Initiator, $IP_Address, $Group
order:
$Date desc
Os 10 principais IPs de origem bloqueados em eventos de grupo
metadata.event_type = "GROUP_CREATION"
or metadata.event_type = "GROUP_DELETION"
or metadata.product_event_type = /add group/ nocase
or metadata.product_event_type = /delete group/ nocase
or metadata.event_type = "GROUP_MODIFICATION"
or metadata.product_event_type = /(RemoveUserFrom|AddUserTo|Add member to |Remove member from )|(?:group)/ nocase
security_result.action = "BLOCK"
$Event_Type = metadata.event_type
$IP_Address = principal.ip
match:
$Event_Type, $IP_Address
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
Total de grupos únicos excluídos
metadata.event_type = "GROUP_DELETION"
or metadata.product_event_type = /delete group/ nocase
security_result.action = "ALLOW"
outcome:
$Count = count_distinct(target.group.group_display_name)
Painel da HIPAA
Esse painel oferece monitoramento em tempo real das métricas de segurança e compliance para garantir a adesão às regulamentações da HIPAA. Ela oferece visibilidade sobre possíveis riscos, violações e atividades de acesso aos dados que envolvem Informações protegidas de saúde (PHI). Isso permite o gerenciamento proativo de riscos e ajuda a manter a confidencialidade, a integridade e a disponibilidade de dados de saúde sensíveis. Esse painel usa a tabela de dados ePHI_assets.Hostname para definir o escopo dos dados de acordo com os padrões da HIPAA. Os gráficos neste painel não são carregados até que as tabelas de dados necessárias sejam criadas.
Vulnerabilidades por gravidade
Mudanças de permissão ao longo do tempo por tipo de registro
Eventos de MFA ao longo do tempo por ação
Eventos de login ao longo do tempo por ação
10 principais hosts de ePHI por violações da DLP
Alertas de EDR ao longo do tempo por gravidade
Eventos de backup ao longo do tempo por ação
Mudanças de senha ao longo do tempo por ação
Eventos de backup recentes (últimas 24 horas)
Alertas recentes de EDR (últimas 24 horas)
Criações recentes de contas de usuário (últimas 24 horas)
Comunicação criptografada fraca ao longo do tempo por tipo de registro
Alteração recente da senha do usuário (últimas 24 horas)
Os 10 principais aplicativos SaaS
10 principais operações de chave
Nome do gráfico
Exemplo de consulta
Vulnerabilidades por gravidade
metadata.log_type = /ARMIS_VULNERABILITIES|FINGERPRINT_JS|NUCLEUS_VULNERABILITY|QUALYS_ASSET_CONTEXT|QUALYS_SCAN|QUALYS_VIRTUAL_SCANNER|QUALYS_VM|RAPID7_INSIGHT|RAPID7_NEXPOSE|SNYK_SDLC|SPUR_FEEDS|STACKHAWK|SUBLIMESECURITY|SYMANTEC_SA|TENABLE_IO|TENABLE_OT|TENABLE_SC|TRENDMICRO_VISION_ONE_CONTAINER_VULNERABILITIES|UPGUARD|URLSCAN_IO/ nocase
strings.coalesce(principal.hostname, principal.asset.hostname, target.hostname, target.asset.hostname) in %ePHI_assets.Hostname
$Severity =
if (principal.asset.vulnerabilities.severity != "UNKNOWN_SEVERITY",
principal.asset.vulnerabilities.severity,
if (target.asset.vulnerabilities.severity != "UNKNOWN_SEVERITY",
target.asset.vulnerabilities.severity,
if (extensions.vulns.vulnerabilities.severity != "UNKNOWN_SEVERITY",
extensions.vulns.vulnerabilities.severity,
"UNKNOWN_SEVERITY")))
match:
$Severity
outcome:
$Count = count(strings.coalesce(extensions.vulns.vulnerabilities.name, extensions.vulns.vulnerabilities.description, extensions.vulns.vulnerabilities.vendor_vulnerability_id,
principal.asset.vulnerabilities.name, target.asset.vulnerabilities.name, additional.fields["ScanReference"]))
order:
$Severity desc
Mudanças de permissão ao longo do tempo por tipo de registro
metadata.event_type = "RESOURCE_PERMISSIONS_CHANGE"
or metadata.event_type = "USER_CHANGE_PERMISSIONS"
or metadata.event_type = "USER_RESOURCE_UPDATE_PERMISSIONS"
security_result.action = "ALLOW"
strings.coalesce(principal.hostname, principal.asset.hostname, target.hostname, target.asset.hostname) in %ePHI_assets.Hostname
$Log_Type = metadata.log_type
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
match:
$Date, $Log_Type
outcome:
$Count = count(metadata.id)
order:
$Date asc
Eventos de MFA ao longo do tempo por ação
(re.regex(metadata.product_name, "MULTI-FACTOR_AUTHENTICATION") or re.regex(additional.fields["AuthenticationRequirement"], `multiFactorAuthentication`) nocase or re.regex(security_result.detection_fields.value, `MFA`) nocase )
strings.coalesce(principal.hostname, principal.asset.hostname, target.hostname,target.asset.hostname) in %ePHI_assets.Hostname
$Action = security_result.action
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
match:
$Date, $Action
outcome:
$Count = count(metadata.id)
order:
$Date asc
Eventos de login ao longo do tempo por ação
metadata.event_type = "USER_LOGIN"
strings.coalesce(principal.hostname, principal.asset.hostname, target.hostname, target.asset.hostname) in %ePHI_assets.Hostname
$Action = security_result.action
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
match:
$Date, $Action
outcome:
$Count = count(metadata.id)
order:
$Date asc
10 principais hosts de ePHI por violações da DLP
metadata.log_type = /DLP|ACCELLION|CODE42_INCYDR|GUARDIUM|TRIPWIRE_FIM/ nocase
metadata.product_event_type = /Violation/ nocase
strings.coalesce(principal.hostname, principal.asset.hostname, target.hostname, target.asset.hostname) in %ePHI_assets.Hostname
$Severity = security_result.severity
$Hostname= strings.coalesce(principal.hostname, principal.asset.hostname, target.hostname, target.asset.hostname)
match:
$Hostname, $Severity
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
Alertas de EDR ao longo do tempo por gravidade
metadata.log_type = /EDR|CS_ALERTS|CS_DETECTS|FIREEYE_HX|MICROSOFT_DEFENDER_ENDPOINT|MICROSOFT_DEFENDER_IDENTITY|SENTINEL_DV/ nocase
strings.coalesce(security_result.rule_name, security_result.threat_name) != ""
strings.coalesce(principal.hostname, principal.asset.hostname, target.hostname, target.asset.hostname) in %ePHI_assets.Hostname
$Severity = security_result.severity
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
match:
$Date, $Severity
outcome:
$Count = count(metadata.id)
order:
$Date asc
Eventos de backup ao longo do tempo por ação
(metadata.log_type = /COHESITY|DRUVA_BACKUP|VEEAM|VERITAS_NETBACKUP/ nocase or metadata.log_type = "RUBRIK")
strings.coalesce(principal.hostname, principal.asset.hostname, target.hostname, target.asset.hostname) in %ePHI_assets.Hostname
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
$Action = security_result.action
match:
$Date, $Action
outcome:
$Count = count(metadata.id)
order:
$Date asc
Mudanças de senha ao longo do tempo por ação
metadata.event_type = "USER_CHANGE_PASSWORD"
strings.coalesce(principal.hostname, principal.asset.hostname, target.hostname, target.asset.hostname) in %ePHI_assets.Hostname
$Log_Type = metadata.log_type
$Action = security_result.action
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
match :
$Date, $Action
outcome :
$Count = count(metadata.id)
order:
$Date asc
Eventos de backup recentes (últimas 24 horas)
(metadata.log_type = /COHESITY|DRUVA_BACKUP|VEEAM|VERITAS_NETBACKUP/ nocase or metadata.log_type = "RUBRIK")
strings.coalesce(principal.hostname, principal.asset.hostname, target.hostname, target.asset.hostname) in %ePHI_assets.Hostname
$Description = strings.coalesce(metadata.description, security_result.description, security_result.summary)
$Log_Type = metadata.log_type
$Event_Type = metadata.event_type
$Security_Event_Type = metadata.product_event_type
$Action = security_result.action
match:
$Description, $Security_Event_Type, $Event_Type, $Action, $Log_Type
outcome:
$Count = count(metadata.id)
$Date = timestamp.get_timestamp(max(metadata.event_timestamp.seconds), "%F %T ")
order:
$Date desc
Alertas recentes de EDR (últimas 24 horas)
metadata.log_type = /EDR|CS_ALERTS|CS_DETECTS|FIREEYE_HX|MICROSOFT_DEFENDER_ENDPOINT|MICROSOFT_DEFENDER_IDENTITY|SENTINEL_DV/ nocase
strings.coalesce(principal.hostname, principal.asset.hostname, target.hostname, target.asset.hostname) in %ePHI_assets.Hostname
$Log_Type = metadata.log_type
$EDR_Alerts = strings.coalesce(security_result.rule_name, security_result.threat_name)
$EDR_Alerts != ""
$Severity = security_result.severity
$User = strings.coalesce(principal.user.user_display_name, principal.user.email_addresses, principal.user.userid, target.user.userid, target.user.user_display_name, target.user.email_addresses)
$Hostname = strings.coalesce(principal.hostname, principal.asset.hostname, target.hostname, target.asset.hostname)
match:
$EDR_Alerts, $Hostname, $User, $Severity, $Log_Type
outcome:
$Count = count(metadata.id)
$Date = timestamp.get_timestamp(max(metadata.event_timestamp.seconds), "%F %T")
order:
$Date desc
Criações recentes de contas de usuário (últimas 24 horas)
metadata.event_type = "USER_CREATION"
strings.coalesce(principal.hostname, principal.asset.hostname, target.hostname, target.asset.hostname) in %ePHI_assets.Hostname
$Log_Type = metadata.log_type
$Source_IP = strings.coalesce(principal.ip, principal.asset.ip)
$Source_Hostname = strings.coalesce(principal.hostname, principal.asset.hostname)
$Initiator = strings.coalesce(principal.user.userid, principal.user.user_display_name, principal.user.email_addresses)
$User_Created = strings.coalesce(target.user.userid, target.user.user_display_name, target.user.email_addresses)
$Action = security_result.action
match:
$Initiator, $User_Created, $Source_Hostname, $Source_IP, $Action, $Log_Type
outcome:
$Count = count(metadata.id)
$Date = timestamp.get_timestamp(max(metadata.event_timestamp.seconds), "%F %T ")
order:
$Date desc
Comunicação criptografada fraca ao longo do tempo por tipo de registro
(((target.resource.attribute.labels.key = "keyProperties_type" or target.resource.attribute.labels.key = "requestParameters.keySpec" or target.resource.attribute.labels.key = /key/ nocase) and target.resource.attribute.labels.value = /^(RSA-)|DES|RC4|MD5|SHA1|SHA-1/) or network.tls.cipher = /^(RSA-)|DES|RC4|MD5|SHA1|SHA-1/)
strings.coalesce(principal.hostname, principal.asset.hostname, target.hostname, target.asset.hostname) in %ePHI_assets.Hostname
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
$Log_Type = metadata.log_type
match:
$Date, $Log_Type
outcome:
$Count = count(metadata.id)
order:
$Date asc
Alteração recente da senha do usuário (últimas 24 horas)
metadata.event_type = "USER_CHANGE_PASSWORD"
strings.coalesce(principal.hostname, principal.asset.hostname, target.hostname, target.asset.hostname) in %ePHI_assets.Hostname
$Log_Type = metadata.log_type
$Security_Event_Type = metadata.product_event_type
$User = strings.coalesce(principal.user.userid, principal.user.user_display_name, principal.user.email_addresses, target.user.userid, target.user.user_display_name, target.user.email_addresses)
$Source_Hostname = strings.coalesce(principal.hostname, principal.asset.hostname)
$Source_IP = strings.coalesce(principal.ip, principal.asset.ip)
$Action = security_result.action
match :
$User, $Source_Hostname, $Source_IP, $Security_Event_Type, $Action, $Log_Type
outcome :
$Date = timestamp.get_timestamp(max(metadata.event_timestamp.seconds ), "%F %T")
$Count = count(metadata.id)
order :
$Date desc
Os 10 principais aplicativos SaaS
strings.coalesce(security_result.category_details, security_result.rule_name) = /saas/ nocase
strings.coalesce(principal.hostname, principal.asset.hostname, target.hostname, target.asset.hostname) in %ePHI_assets.Hostname
$Application = target.application
$Log_Type = metadata.log_type
match:
$Application, $Log_Type
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
10 principais operações de chave
(metadata.log_type = /AZURE_KEYVAULT_AUDIT|AKEYLESS_VAULT|GCP_CLOUDAUDIT/ or target.application = "kms.amazonaws.com")
strings.coalesce(principal.hostname, principal.asset.hostname, target.hostname, target.asset.hostname) in %ePHI_assets.Hostname
$Security_Event_Type = metadata.product_event_type
$Log_Type = strings.coalesce(metadata.log_type, target.application)
match:
$Security_Event_Type, $Log_Type
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
Investigação do host
Esse painel oferece uma visão geral abrangente das atividades do host e dos eventos de segurança. Os widgets principais rastreiam a comunicação de rede, as mudanças de autenticação, o malware, os principais eventos e os processos raros. Ele também monitora a criação de serviços e tarefas programadas, além de possíveis ameaças à segurança.
Observação : o nome do host precisa ser especificado no filtro para que os gráficos sejam preenchidos
de maneira adequada.
10 principais eventos
Tendência de eventos ao longo do tempo
Malware e invasão
Mapa de saída de comunicação de rede
Processos raros
Criação de serviços
Comunicação de rede
Autenticação e mudanças
Mapa de entrada de comunicação de rede
Criação de tarefas programadas
Nome do gráfico
Exemplo de consulta
10 principais eventos
$Event_Type = metadata.event_type
$User = strings.coalesce(principal.user.userid, principal.user.user_display_name, principal.user.email_addresses)
match:
$Event_Type,$User
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
Tendência de eventos ao longo do tempo
$Event_Type = metadata.event_type
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
match:
$Date, $Event_Type
outcome:
$Count = count(metadata.id)
order:
$Date asc
Malware e invasão
$Log_Type = metadata.log_type
$Category = security_result.category
($Category = "UNKNOWN_CATEGORY" or $Category = "SOFTWARE_MALICIOUS" or $Category = "SOFTWARE_SUSPICIOUS" or $Category = "SOFTWARE_PUA" or $Category = "NETWORK_MALICIOUS"or $Category = "NETWORK_SUSPICIOUS" or $Category = "NETWORK_CATEGORIZED_CONTENT" or $Category = "NETWORK_DENIAL_OF_SERVICE" or $Category = "NETWORK_RECON" or $Category = "NETWORK_COMMAND_AND_CONTROL" or $Category = "ACL_VIOLATION" or $Category = "AUTH_VIOLATION" or $Category = "EXPLOIT" or $Category = "DATA_EXFILTRATION" or $Category = "DATA_AT_REST" or $Category = "DATA_DESTRUCTION" or $Category = "TOR_EXIT_NODE" or $Category = "MAIL_SPAM" or $Category = "MAIL_PHISHING" or $Category = "MAIL_SPOOFING" or $Category = "POLICY_VIOLATION" or $Category = "SOCIAL_ENGINEERING" or $Category = "PHISHING")
$Hostname = strings.coalesce(principal.hostname,principal.asset.hostname,intermediary.hostname,target.hostname,target.asset.hostname)
$Hostname !=""
$Description = strings.coalesce(metadata.description,security_result.summary)
$Action = security_result.action
$File_Path = target.file.full_path
match:
$Hostname, $Log_Type, $Category, $Description, $Action,$File_Path
outcome:
$Count = count(metadata.id)
order:
$Count desc
Mapa de saída de comunicação de rede
(metadata.event_type = "NETWORK_UNCATEGORIZED"
or metadata.event_type = "NETWORK_FLOW"
or metadata.event_type = "NETWORK_CONNECTION"
or metadata.event_type = "NETWORK_FTP"
or metadata.event_type = "NETWORK_DHCP"
or metadata.event_type = "NETWORK_DNS"
or metadata.event_type = "NETWORK_HTTP"
or metadata.event_type = "NETWORK_SMTP")
network.direction = "OUTBOUND"
$Hostname = strings.coalesce(principal.hostname, intermediary.hostname, observer.hostname, principal.asset.hostname, principal.asset.ip)
$Country = target.ip_geo_artifact.location.country_or_region
match:
$Country
outcome:
$Latitude = max(target.ip_geo_artifact.location.region_coordinates.latitude)
$Longitude = max(target.ip_geo_artifact.location.region_coordinates.longitude)
$Count = count(metadata.id)
Processos raros
(metadata.event_type = "PROCESS_LAUNCH"
or metadata.event_type = "PROCESS_INJECTION"
or metadata.event_type = "PROCESS_PRIVILEGE_ESCALATION"
or metadata.event_type = "PROCESS_TERMINATION"
or metadata.event_type = "PROCESS_OPEN"
or metadata.event_type = "PROCESS_MODULE_LOAD")
$Process_Name = strings.coalesce(if(principal.application != "", principal.application, ""), if(re.capture(target.process.file.full_path, `.*\\(\S+\.\w+)`) != "", re.capture(target.process.file.full_path, `.*\\(\S+\.\w+)`), ""))
$Process_Name != ""
$Severity = security_result.severity
$Action = security_result.action
$User = strings.coalesce(principal.user.userid, principal.user.user_display_name, principal.user.email_addresses, target.user.userid, target.user.user_display_name, target.user.email_addresses)
match:
$Process_Name,$User,$Severity,$Action
outcome:
$Count = count(metadata.id)
order:
$Count asc
Criação de serviços
(metadata.event_type = "SERVICE_CREATION" or metadata.event_type = "SERVICE_UNSPECIFIED")
$Username = strings.coalesce(principal.user.userid, principal.user.user_display_name, principal.user.email_addresses)
$Hostname = strings.coalesce(principal.hostname,principal.asset.hostname,intermediary.hostname,target.hostname,target.asset.hostname)
$Application = target.application
$Path = target.process.file.full_path
match:
$Hostname, $Application, $Username, $Path
outcome:
$Count = count(metadata.id)
order:
$Count desc
Comunicação de rede
(metadata.event_type = "NETWORK_UNCATEGORIZED"
or metadata.event_type = "NETWORK_FLOW"
or metadata.event_type = "NETWORK_CONNECTION"
or metadata.event_type = "NETWORK_FTP"
or metadata.event_type = "NETWORK_DHCP"
or metadata.event_type = "NETWORK_DNS"
or metadata.event_type = "NETWORK_HTTP"
or metadata.event_type = "NETWORK_SMTP")
$Source_Port = principal.port
$Destination_Port = target.port
$Source_IP = principal.ip
$Destination_IP = target.ip
$Direction = network.direction
$Direction != "UNKNOWN_DIRECTION"
$Hostname = strings.coalesce(principal.hostname,principal.asset.hostname,intermediary.hostname,target.hostname,target.asset.hostname)
$Hostname != ""
$Bytes_Sent = network.sent_bytes
$Bytes_Received = network.received_bytes
match:
$Hostname, $Source_IP, $Source_Port, $Direction, $Destination_IP, $Destination_Port,$Bytes_Sent,$Bytes_Received
outcome:
$Count = count(metadata.id)
order:
$Count desc
Autenticação e mudanças
$Event_Type = metadata.event_type
($Event_Type = "USER_LOGIN" or $Event_Type = "USER_LOGOUT" or $Event_Type = "USER_BADGE_IN" or $Event_Type= "USER_CHANGE_PASSWORD" or $Event_Type = "USER_CHANGE_PERMISSIONS" or $Event_Type = "USER_CREATION" or $Event_Type = "USER_DELETION" or $Event_Type = "USER_RESOURCE_CREATION" or $Event_Type = "USER_RESOURCE_DELETION" or $Event_Type= "USER_RESOURCE_UPDATE_CONTENT" or $Event_Type = "USER_RESOURCE_UPDATE_PERMISSIONS" or $Event_Type = "SERVICE_CREATION" or $Event_Type = "SERVICE_DELETION" or $Event_Type = "SERVICE_MODIFICATION" or $Event_Type = "SETTING_CREATION" or $Event_Type = "SETTING_DELETION" or $Event_Type = "SETTING_MODIFICATION" or $Event_Type = "DEVICE_CONFIG_UPDATE")
$Log_Type = metadata.log_type
$Security_Event_Type = metadata.product_event_type
$Description = strings.coalesce(metadata.description,security_result.description)
$Hostname = strings.coalesce(principal.hostname,principal.asset.hostname,intermediary.hostname,target.hostname,target.asset.hostname)
$Hostname !=""
$Action = security_result.action
match:
$Hostname, $Log_Type, $Event_Type,$Security_Event_Type, $Description, $Action
outcome:
$Count = count(metadata.id)
$Date = timestamp.get_timestamp(max(metadata.event_timestamp.seconds), "%F %T")
order:
$Count desc
Mapa de entrada de comunicação de rede
(metadata.event_type = "NETWORK_UNCATEGORIZED"
or metadata.event_type = "NETWORK_FLOW"
or metadata.event_type = "NETWORK_CONNECTION"
or metadata.event_type = "NETWORK_FTP"
or metadata.event_type = "NETWORK_DHCP"
or metadata.event_type = "NETWORK_DNS"
or metadata.event_type = "NETWORK_HTTP"
or metadata.event_type = "NETWORK_SMTP")
network.direction = "INBOUND"
$Country = principal.ip_geo_artifact.location.country_or_region
match:
$Country
outcome:
$Latitude = max(principal.ip_geo_artifact.location.region_coordinates.latitude)
$Longitude = max(principal.ip_geo_artifact.location.region_coordinates.longitude)
$Count = count(metadata.id)
Criação de tarefas programadas
metadata.event_type = "SCHEDULED_TASK_CREATION"
$Username = strings.coalesce(principal.user.userid, principal.user.user_display_name, principal.user.email_addresses)
$Hostname = strings.coalesce(principal.hostname,principal.asset.hostname,intermediary.hostname,target.hostname,target.asset.hostname)
$Task_Name = target.resource.name
match:
$Hostname, $Task_Name, $Username
outcome:
$Count = count(metadata.id)
order:
$Count desc
Operações de segurança do IAM
Este painel é uma visão geral de alto nível para monitoramento diário. Ele se concentra em anomalias em tempo real, ameaças ativas e eventos de alto risco para permitir a detecção e resposta rápidas a incidentes.
Observação : use os filtros disponíveis para restringir os resultados conforme necessário.
Conta de usuário excluída recentemente
Falhas e sucessos de login em contas privilegiadas
Total de contas de usuários únicos modificadas
Os 10 principais logins de contas de usuário
Funções excluídas recentemente
Os 10 principais IPs de origem bloqueados em eventos do usuário
Primeiro acesso de uma nova origem
Os 10 principais aplicativos acessados pelos usuários
KPI do ciclo de vida do usuário
Os 10 principais usuários bloqueados em eventos do usuário
Mudanças de senha ao longo do tempo
Os 10 principais usuários bloqueados em eventos de função
Viagem impossível
Total de contas de usuários únicos excluídas
Total de contas de usuários únicos criadas
Nome do gráfico
Exemplo de consulta
Conta de usuário excluída recentemente
metadata.event_type = "USER_DELETION"
security_result.action = "ALLOW"
$Log_Type = metadata.log_type
$Initiator = strings.coalesce(principal.user.windows_sid, principal.user.userid, principal.user.email_addresses)
$User = strings.coalesce(target.user.userid, target.user.email_addresses)
$Date = timestamp.get_timestamp(metadata.event_timestamp.seconds, "%F %T ")
$IP_Address = principal.ip
match:
$Date, $Log_Type, $Initiator, $IP_Address, $User
order:
$Date desc
Falhas e sucessos de login em contas privilegiadas
metadata.event_type = "USER_LOGIN"
strings.coalesce(principal.user.attribute.roles.name, principal.resource.name, target.user.attribute.roles.name, target.resource.name) = /admin/ nocase
if(security_result.action = "ALLOW", "Success", if(security_result.action = "BLOCK", "Failed", "Unknown")) != ""
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
$User = if(strings.coalesce(principal.user.attribute.roles.name, principal.resource.name) = /admin/ nocase, strings.coalesce(principal.user.windows_sid, principal.user.userid, principal.user.email_addresses),
if(strings.coalesce(target.user.attribute.roles.name, target.resource.name) = /admin/ nocase, strings.coalesce(target.user.windows_sid, target.user.userid, target.user.email_addresses), ""))
$Login_Status = if(security_result.action = "ALLOW", "Success", if(security_result.action = "BLOCK", "Failed", "Unknown"))
$Hostname = strings.coalesce(principal.asset.hostname, principal.hostname)
$Privilege_Type = principal.user.attribute.roles.name
$Privilege_Type != ""
$Source_IP = strings.coalesce(principal.asset.ip, principal.ip)
match:
$Date, $User, $Login_Status, $Privilege_Type, $Hostname, $Source_IP
outcome:
$Count = count(metadata.id)
order:
$Date desc
Total de contas de usuários únicos modificadas
metadata.event_type = "USER_CHANGE_PERMISSIONS"
or metadata.event_type = "USER_CHANGE_PASSWORD"
or metadata.event_type = "USER_RESOURCE_UPDATE_PERMISSIONS"
security_result.action = "ALLOW"
outcome:
$Count = count_distinct(strings.coalesce(target.user.userid, target.user.email_addresses))
Os 10 principais logins de contas de usuário
metadata.event_type = "USER_LOGIN"
security_result.action = "ALLOW"
$Log_Type = metadata.log_type
$User = target.user.userid
match:
$Log_Type, $User
outcome:
$Count = count(target.user.userid)
order:
$Count desc
limit:
10
Funções excluídas recentemente
metadata.product_event_type = /\bDelete.?Role/ nocase
or
(security_result.category_details = /RoleManagement/ nocase
and metadata.product_event_type = /delete role definition/ nocase)
security_result.action = "ALLOW"
$Log_Type = metadata.log_type
$Initiator = strings.coalesce(principal.user.windows_sid, principal.user.userid, principal.user.email_addresses)
$Date = timestamp.get_timestamp(metadata.event_timestamp.seconds, "%F %T ")
$IP_Address = principal.ip
$Role = strings.coalesce(target.user.attribute.roles.name, target.resource.name)
match:
$Date, $Log_Type, $Initiator, $IP_Address, $Role
order:
$Date desc
Os 10 principais IPs de origem bloqueados em eventos do usuário
metadata.event_type = "USER_CREATION"
or metadata.event_type = "USER_DELETION"
or metadata.event_type = "USER_CHANGE_PERMISSIONS"
or metadata.event_type = "USER_CHANGE_PASSWORD"
or metadata.event_type = "USER_RESOURCE_UPDATE_PERMISSIONS"
security_result.action = "BLOCK"
$Event_Type = metadata.event_type
$IP_Address = principal.ip
match:
$Event_Type, $IP_Address
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
Primeiro acesso de uma nova origem
metadata.event_type = "USER_LOGIN"
security_result.action = "ALLOW"
$Source_IP = principal.ip
$User = target.user.userid
$Country = principal.location.country_or_region
$City = principal.location.city
$City != ""
$ASN = principal.ip_geo_artifact.network.asn
$ASN != ""
match:
$Source_IP, $User, $Country, $City, $ASN
outcome:
$Count = count(metadata.id)
$FirstTime_Access = earliest(metadata.event_timestamp)
order:
$FirstTime_Access desc
Os 10 principais aplicativos acessados pelos usuários
metadata.event_type = "USER_LOGIN"
security_result.action = "ALLOW"
$Log_Type = metadata.log_type
$Application = target.application
$Application != ""
match:
$Log_Type, $Application
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
KPI do ciclo de vida do usuário
metadata.event_type = "USER_CREATION"
or metadata.event_type = "USER_DELETION"
or metadata.event_type = "USER_RESOURCE_DELETION"
or metadata.event_type = "RESOURCE_PERMISSIONS_CHANGE"
or metadata.event_type = "USER_CHANGE_PERMISSIONS"
or metadata.event_type = "USER_RESOURCE_UPDATE_PERMISSIONS"
$User_Action = if(metadata.event_type = "USER_CREATION", "Total Creation", if(metadata.event_type = "USER_DELETION" or metadata.event_type = "USER_RESOURCE_DELETION", "Total Deletion", if(metadata.event_type = "RESOURCE_PERMISSIONS_CHANGE" or metadata.event_type = "USER_CHANGE_PERMISSIONS" or metadata.event_type = "USER_RESOURCE_UPDATE_PERMISSIONS", "Total Modification")))
match:
$User_Action
outcome:
$Count = count(metadata.id)
order:
$Count asc
Os 10 principais usuários bloqueados em eventos do usuário
metadata.event_type = "USER_CREATION"
or metadata.event_type = "USER_DELETION"
or metadata.event_type = "USER_CHANGE_PERMISSIONS"
or metadata.event_type = "USER_CHANGE_PASSWORD"
or metadata.event_type = "USER_RESOURCE_UPDATE_PERMISSIONS"
security_result.action = "BLOCK"
$Event_Type = metadata.event_type
$User = strings.coalesce(principal.user.windows_sid, principal.user.userid, principal.user.email_addresses)
match:
$Event_Type, $User
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
Mudanças de senha ao longo do tempo
metadata.event_type = "USER_CHANGE_PASSWORD"
security_result.action = "ALLOW"
$Log_Type = metadata.log_type
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
match:
$Log_Type, $Date
outcome:
$Count = count(metadata.id)
order:
$Date desc
Os 10 principais usuários bloqueados em eventos de função
(metadata.product_event_type = /Create.?Role/ nocase
or
(security_result.category_details = /RoleManagement/ nocase
and metadata.product_event_type = /add role definition/ nocase))
or
(metadata.product_event_type = /Update.?Role/ nocase
or
(security_result.category_details = /RoleManagement/ nocase
and metadata.product_event_type = /update role definition/ nocase))
or
(metadata.product_event_type = /\bDelete.?Role/ nocase
or
(security_result.category_details = /RoleManagement/ nocase
and metadata.product_event_type = /delete role definition/ nocase))
security_result.action = "BLOCK"
$User = strings.coalesce(principal.user.windows_sid, principal.user.userid, principal.user.email_addresses)
$Event = metadata.product_event_type
match:
$User, $Event
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
Viagem impossível
$first_login.metadata.event_type = "USER_LOGIN"
$first_login.security_result.action = "ALLOW"
$first_login.principal.ip_geo_artifact.location.state != "" and $Country1 = $first_login.principal.ip_geo_artifact.location.state
$Time = timestamp.get_timestamp($first_login.metadata.event_timestamp.seconds, "%F %T ")
$User = strings.coalesce($first_login.target.user.userid, $first_login.target.user.email_addresses)
$User != ""
$Latitude1 = $first_login.principal.ip_geo_artifact.location.region_coordinates.latitude
$Longitude1 = $first_login.principal.ip_geo_artifact.location.region_coordinates.longitude
$second_login.metadata.event_type = "USER_LOGIN"
$second_login.security_result.action = "ALLOW"
$second_login.principal.ip_geo_artifact.location.state != "" and $Country2 = $second_login.principal.ip_geo_artifact.location.state
$Time2 = timestamp.get_timestamp($second_login.metadata.event_timestamp.seconds, "%F %T ")
$User = strings.coalesce($second_login.target.user.userid, $second_login.target.user.email_addresses)
$User != ""
$Latitude2 = $second_login.principal.ip_geo_artifact.location.region_coordinates.latitude
$Longitude2 = $second_login.principal.ip_geo_artifact.location.region_coordinates.longitude
$first_login.metadata.event_timestamp.seconds < $second_login.metadata.event_timestamp.seconds
($Latitude1 != $Latitude2)
($Longitude1 != $Longitude2)
match:
$User, $Time, $Country1, $Time2, $Country2 over 1h
outcome:
$distance_kilometers = math.ceil(max(math.geo_distance($Latitude1, $Longitude1, $Latitude2, $Longitude2)) /1000)
condition:
$first_login and $second_login and $distance_kilometers != 0
Total de contas de usuários únicos excluídas
metadata.event_type = "USER_DELETION"
security_result.action = "ALLOW"
outcome:
$Count = count_distinct(strings.coalesce(target.user.userid, target.user.email_addresses))
Total de contas de usuários únicos criadas
metadata.event_type = "USER_CREATION"
security_result.action = "ALLOW"
outcome:
$Count = count_distinct(strings.coalesce(target.user.userid, target.user.email_addresses))
Visão geral do evento do SDI / IPS
Esse painel oferece um resumo abrangente dos eventos de segurança detectados pelos sistemas de detecção e prevenção de intrusão.
Eventos do SDI / IPS por categorias
Os 10 principais IPs por contagem de eventos
Eventos do SDI / IPS por destino
Eventos do SDI / IPS por origem
Principais eventos de IDS / IPS por regra e ação
Eventos do SDI / IPS ao longo do tempo por gravidade
Os 10 principais eventos de alta gravidade SDI / IPS
Eventos do SDI / IPS por assinatura
Nome do gráfico
Exemplo de consulta
Eventos do SDI / IPS por categorias
$event_type = metadata.event_type
(($event_type = "SCAN_UNCATEGORIZED" or $event_type = "SCAN_NETWORK") or ($event_type >= 16000 and $event_type <= 16007))
$category = security_result.category
$category != "UNKNOWN_CATEGORY"
match:
$category
outcome:
$event_count = count(metadata.id)
order:
$event_count desc
Os 10 principais IPs por contagem de eventos
$event_type = metadata.event_type
(($event_type = "SCAN_UNCATEGORIZED" or $event_type = "SCAN_NETWORK" or $event_type = "SCAN_VULN_NETWORK") or ($event_type >= 16000 and $event_type <= 16007))
$source_ip = principal.ip
$rule_name = security_result.rule_name
$rule_name != ""
$date = timestamp.get_date(metadata.event_timestamp.seconds)
match:
$rule_name, $source_ip
outcome:
$event_count = count(metadata.id)
order:
$event_count desc
limit:
10
Eventos do SDI / IPS por destino
$event_type = metadata.event_type
(($event_type = "SCAN_UNCATEGORIZED" or $event_type = "SCAN_NETWORK" or $event_type = "SCAN_VULN_NETWORK") or ($event_type >= 16000 and $event_type <= 16007))
$vendor = metadata.vendor_name
$destination_ip = target.ip
$action = security_result.action
$rule_name = security_result.rule_name
$rule_name != ""
$security_event_type = metadata.product_event_type
$security_event_type != ""
$security_event_type != /NetworkSecurityGroupFlowEvents|fileinfo|flow/ nocase
match:
$destination_ip, $rule_name, $vendor, $action
outcome:
$event_count = count(metadata.id)
order:
$event_count desc
Eventos do SDI / IPS por origem
$event_type = metadata.event_type
(($event_type = "SCAN_UNCATEGORIZED" or $event_type = "SCAN_NETWORK" or $event_type = "SCAN_VULN_NETWORK") or ($event_type >= 16000 and $event_type <= 16007))
$action = security_result.action
$action != "UNKNOWN_ACTION"
$hostname = principal.hostname
$rule_name = strings.coalesce(security_result.rule_name, metadata.description)
$rule_name != ""
$vendor = metadata.vendor_name
$security_event_type = metadata.product_event_type
$security_event_type != ""
$security_event_type != /NetworkSecurityGroupFlowEvents|fileinfo|flow/ nocase
match:
$hostname, $rule_name, $vendor, $action
outcome:
$event_count = count(metadata.id)
order:
$event_count desc
Principais eventos de IDS / IPS por regra e ação
$event_type = metadata.event_type
(($event_type = "SCAN_UNCATEGORIZED" or $event_type = "SCAN_NETWORK") or ($event_type >= 16000 and $event_type <= 16007))
$rule_name = security_result.rule_name
not $rule_name in %known_signatures
$rule_name != ""
$action = security_result.action
$action != "UNKNOWN_ACTION"
match:
$rule_name, $action
outcome:
$event_count = count(metadata.id)
order:
$event_count desc
Eventos do SDI / IPS ao longo do tempo por gravidade
$event_type = metadata.event_type
(($event_type = "SCAN_UNCATEGORIZED" or $event_type = "SCAN_NETWORK") or ($event_type >= 16000 and $event_type <= 16007))
$severity = security_result.severity
$severity != "UNKNOWN_SEVERITY"
$date = timestamp.get_date(metadata.event_timestamp.seconds)
match:
$severity, $date
outcome:
$event_count = count(metadata.id)
order:
$date asc
Os 10 principais eventos de alta gravidade SDI / IPS
$event_type = metadata.event_type
(($event_type = "SCAN_UNCATEGORIZED" or $event_type = "SCAN_NETWORK") or ($event_type >= 16000 and $event_type <= 16007))
$action = security_result.action
$rule_name = strings.coalesce(security_result.rule_name, metadata.description)
$rule_name != ""
$severity = security_result.severity
$severity = "HIGH"
match:
$rule_name, $action
outcome:
$event_count = count(metadata.id)
order:
$event_count desc
limit:
10
Eventos do SDI / IPS por assinatura
$event_type = metadata.event_type
(($event_type = "SCAN_UNCATEGORIZED" or $event_type = "SCAN_NETWORK") or ($event_type >= 16000 and $event_type <= 16007))
$destination_ip = target.ip
$source_ip = principal.ip
$action = security_result.action
$rule_name = security_result.rule_name
$rule_name != ""
$date = timestamp.get_date(metadata.event_timestamp.seconds)
match:
$rule_name , $source_ip , $destination_ip , $action
outcome:
$event_count = count(metadata.id)
order:
$event_count desc
ISO27001: controles organizacionais
Esse painel oferece visibilidade dos controles de segurança e da performance de compliance da organização com base nos padrões ISO 27001. Ele ajuda as equipes de segurança a monitorar a implementação de controles, acompanhar os resultados de auditorias e identificar áreas de melhoria. Ao centralizar as principais métricas de compliance, o painel ajuda no alinhamento contínuo com os requisitos ISO 27001 e fortalece o gerenciamento geral de segurança da informação da organização. Observação: este painel exige o uso de filtros.
Observação : aplique os filtros disponíveis para refinar os resultados.
Violações da DLP por gravidade
10 principais regras da DLP
Criações, modificações e exclusões recentes de funções
Mudanças recentes de permissão
Tráfego de rede bloqueado ao longo do tempo por motivo
Eventos do usuário ao longo do tempo
10 principais aplicativos acessados
10 principais IPs de saída por volume de tráfego
Dispositivos ao longo do tempo
Mudanças de senha ao longo do tempo
Nome do gráfico
Exemplo de consulta
Violações da DLP por gravidade
strings.coalesce(metadata.product_event_type, security_result.rule_name, security_result.summary, metadata.description) = /Violation/ nocase
$Severity = security_result.severity
$Severity != "UNKNOWN_SEVERITY"
match:
$Severity
outcome:
$Count = count(metadata.id)
order:
$Count desc
10 principais regras da DLP
strings.coalesce(metadata.product_event_type, security_result.rule_name, security_result.summary, metadata.description) = /Violation/ nocase
$Violation = strings.coalesce(security_result.rule_name, metadata.product_event_type, security_result.summary, metadata.description)
match:
$Violation
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
Criações, modificações e exclusões recentes de funções
metadata.product_event_type = /CreateRole|add role definition/ nocase
or metadata.product_event_type = /UpdateRole|update role(?: definition)?/ nocase
or metadata.product_event_type = /DeleteRole|delete role definition/ nocase
security_result.action = "ALLOW"
$Date = timestamp.get_timestamp(metadata.event_timestamp.seconds)
$Product_Event = metadata.product_event_type
$Source_IP = strings.coalesce(principal.asset.ip, principal.ip)
$Hostname = strings.coalesce(principal.asset.hostname, principal.hostname)
$Initiator = principal.user.userid
$Role = strings.coalesce(target.user.attribute.roles.name, target.resource.product_object_id, target.resource.name)
match:
$Date, $Product_Event, $Source_IP, $Hostname, $Initiator, $Role
order:
$Date desc
Mudanças recentes de permissão
metadata.event_type = "RESOURCE_PERMISSIONS_CHANGE"
or metadata.event_type = "USER_CHANGE_PERMISSIONS"
or metadata.event_type = "USER_RESOURCE_UPDATE_PERMISSIONS"
security_result.action = "ALLOW"
$Date = timestamp.get_timestamp(metadata.event_timestamp.seconds)
$Log_Source = metadata.log_type
$Source_IP = strings.coalesce(principal.asset.ip, principal.ip)
$Hostname = strings.coalesce(principal.asset.hostname, principal.hostname)
$Initiator = principal.user.userid
$Description = metadata.description
match:
$Date, $Log_Source, $Source_IP, $Hostname, $Initiator, $Description
order:
$Date desc
Tráfego de rede bloqueado ao longo do tempo por motivo
metadata.event_type = "NETWORK_UNCATEGORIZED"
or metadata.event_type = "NETWORK_FLOW"
or metadata.event_type = "NETWORK_CONNECTION"
or metadata.event_type = "NETWORK_FTP"
or metadata.event_type = "NETWORK_DHCP"
or metadata.event_type = "NETWORK_DNS"
or metadata.event_type = "NETWORK_HTTP"
or metadata.event_type = "NETWORK_SMTP"
security_result.action = "BLOCK"
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
$Reason = security_result.summary
match:
$Date, $Reason
outcome:
$Count = count(metadata.id)
order:
$Date desc
Eventos do usuário ao longo do tempo
metadata.event_type = "USER_CREATION"
or metadata.event_type = "USER_DELETION"
or metadata.event_type = "USER_CHANGE_PERMISSIONS"
or metadata.event_type = "USER_CHANGE_PASSWORD"
or metadata.event_type = "USER_RESOURCE_UPDATE_PERMISSIONS"
security_result.action = "ALLOW"
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
$Event_Type = metadata.event_type
match:
$Date, $Event_Type
outcome:
$Count = count(metadata.id)
order:
$Date desc
10 principais aplicativos acessados
$Log_Type = metadata.log_type
$Application = target.application
$Application != ""
match:
$Log_Type, $Application
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
10 principais IPs de saída por volume de tráfego
network.direction = "OUTBOUND"
$Log_Type = metadata.log_type
$Destination_IP = target.ip
match:
$Log_Type, $Destination_IP
outcome:
$Total_Bytes = sum(network.received_bytes + network.sent_bytes)/(1000*1000*1000)
order:
$Total_Bytes desc
limit:
10
Dispositivos ao longo do tempo
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
$Device = group(principal.asset.hostname, principal.hostname, target.asset.hostname, target.hostname)
match:
$Date
outcome:
$Count = count_distinct($Device)
order:
$Date desc
Mudanças de senha ao longo do tempo
metadata.event_type = "USER_CHANGE_PASSWORD"
security_result.action = "ALLOW"
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
$Log_Type = metadata.log_type
match:
$Date, $Log_Type
outcome:
$Count = count(metadata.id)
order:
$Date desc
ISO27001: controles físicos
Esse painel centraliza dados sobre a conformidade com as categorias de segurança física, oferecendo às equipes de segurança uma visão clara da eficácia do controle. Ele apresenta métricas importantes sobre a eficácia do controle de acesso e eventos de mídia removível, que são cruciais para identificar rapidamente vulnerabilidades e priorizar ações de correção. O painel permite a tomada de decisões baseadas em dados para reduzir riscos e melhorar continuamente a postura de segurança física da sua organização de acordo com os padrões ISO 27001.
Observação : aplique os filtros disponíveis para refinar os resultados.
Acesso remoto por gravidade
Eventos recentes de mídia removível
Entregas de crachás de usuários ao longo do tempo
10 principais inserções de selos de usuários recentes
10 principais locais de sensores
Locais dos sensores ao longo do tempo
Nome do gráfico
Exemplo de consulta
Acesso remoto por gravidade
metadata.event_type = "NETWORK_CONNECTION"
target.port = 22
or target.port = 3389
$Severity = security_result.severity
$Severity != "UNKNOWN_SEVERITY"
match:
$Severity
outcome:
$Count = count(metadata.id)
order:
$Count desc
Eventos recentes de mídia removível
strings.coalesce(metadata.product_event_type, security_result.summary) = /\busb\b/ nocase
$Date = timestamp.get_timestamp(metadata.event_timestamp.seconds)
$USB_Event = strings.coalesce(metadata.product_event_type, security_result.summary)
$Category = strings.coalesce(security_result.category_details, security_result.detection_fields["Category"])
$Source_IP = strings.coalesce(principal.asset.ip, principal.ip)
$Hostname = strings.coalesce(principal.asset.hostname, principal.hostname)
$User = strings.coalesce(principal.user.userid, principal.user.user_display_name, principal.user.email_addresses, target.user.userid, target.user.user_display_name, target.user.email_addresses)
match:
$Date, $USB_Event, $User, $Hostname, $Source_IP, $Category
order:
$Date desc
Entregas de crachás de usuários ao longo do tempo
metadata.event_type = "USER_BADGE_IN"
or metadata.event_type = "USER_RESOURCE_ACCESS"
or metadata.event_type = "USER_UNCATEGORIZED"
strings.coalesce(metadata.description, security_result.action_details, security_result.description, security_result.summary, additional.fields["plasectrxEvtypename"]) = /(?:access\sgranted|badge\sin)/ nocase
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
match:
$Date
outcome:
$Count = count(metadata.id)
order:
$Date desc
10 principais inserções de selos de usuários recentes
metadata.event_type = "USER_BADGE_IN"
or metadata.event_type = "USER_RESOURCE_ACCESS"
or metadata.event_type = "USER_UNCATEGORIZED"
strings.coalesce(metadata.description, security_result.action_details, security_result.description, security_result.summary, additional.fields["plasectrxEvtypename"]) = /(?:access\sgranted|badge\sin)/ nocase
$User = strings.coalesce(principal.user.user_display_name, principal.user.email_addresses, additional.fields["person"], principal.user.userid)
$Location = strings.coalesce(security_result.rule_labels["Place"], additional.fields["site"], target.location.name, principal.resource.name)
$Date = timestamp.get_timestamp(metadata.event_timestamp.seconds)
match:
$Date, $User, $Location
order:
$Date desc
limit:
10
10 principais locais de sensores
metadata.event_type = "USER_BADGE_IN"
or metadata.event_type = "USER_RESOURCE_ACCESS"
or metadata.event_type = "USER_UNCATEGORIZED"
$Location = strings.coalesce(security_result.rule_labels["Place"], additional.fields["site"], target.location.name, principal.resource.name)
$Location != ""
match:
$Location
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
Locais dos sensores ao longo do tempo
metadata.event_type = "USER_BADGE_IN"
or metadata.event_type = "USER_RESOURCE_ACCESS"
or metadata.event_type = "USER_UNCATEGORIZED"
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
$Location = strings.coalesce(security_result.rule_labels["Place"], additional.fields["site"], target.location.name, principal.resource.name)
$Location != ""
match:
$Date, $Location
outcome:
$Count = count(metadata.id)
order:
$Date desc
Atividade de Living Off the Land
Esse painel fornece insights importantes sobre o possível uso indevido de ferramentas e processos confiáveis do sistema por invasores. Esse painel rastreia e mostra a atividade relacionada a utilitários do sistema, como rundll32, regsvr32, mshta.exe e outros, que são comumente usados por ameaças avançadas para evitar a detecção.
Execução suspeita de msiexec
Criação de processo suspeito mshta.exe
Execução suspeita do Regsvr32
Conexões de saída iniciadas por Rundll32.exe
Execução suspeita de Rundll32
Comandos suspeitos do CertUtil
Scripts WMI suspeitos
Conexões de rede Regsvr32 suspeitas
Nome do gráfico
Exemplo de consulta
Execução suspeita de msiexec
metadata.event_type = "PROCESS_UNCATEGORIZED"
or metadata.event_type = "PROCESS_LAUNCH"
or metadata.event_type = "PROCESS_INJECTION"
or metadata.event_type = "PROCESS_PRIVILEGE_ESCALATION"
or metadata.event_type = "PROCESS_TERMINATION"
or metadata.event_type = "PROCESS_OPEN"
or metadata.event_type = "PROCESS_MODULE_LOAD"
target.process.file.full_path = /msiexec/
target.process.command_line = /:\/\//
$Hostname = principal.hostname
$Parent_Process = principal.process.file.full_path
$Target_Process = target.process.file.full_path
$Command_Line = target.process.command_line
$Timestamp = timestamp.get_timestamp(metadata.event_timestamp.seconds)
match:
$Hostname, $Parent_Process, $Target_Process, $Command_Line, $Timestamp
order:
$Timestamp desc
limit:
50
Criação de processo suspeito mshta.exe
metadata.event_type = "PROCESS_UNCATEGORIZED"
or metadata.event_type = "PROCESS_LAUNCH"
or metadata.event_type = "PROCESS_INJECTION"
or metadata.event_type = "PROCESS_PRIVILEGE_ESCALATION"
or metadata.event_type = "PROCESS_TERMINATION"
or metadata.event_type = "PROCESS_OPEN"
or metadata.event_type = "PROCESS_MODULE_LOAD"
principal.process.file.full_path = /(cmd|cscript|powershell|pwsh|regsvr32|rundll32|wscript)\.exe/
target.process.file.full_path = /mshta.exe/
$Hostname = principal.hostname
$Parent_Process = principal.process.file.full_path
$Target_Process = target.process.file.full_path
$Command_Line = target.process.command_line
$timestamp = timestamp.get_timestamp(metadata.event_timestamp.seconds)
match:
$Hostname, $Parent_Process, $Target_Process, $Command_Line, $timestamp
order:
$timestamp desc
limit:
50
Execução suspeita do Regsvr32
metadata.event_type = "PROCESS_UNCATEGORIZED"
or metadata.event_type = "PROCESS_LAUNCH"
or metadata.event_type = "PROCESS_INJECTION"
or metadata.event_type = "PROCESS_PRIVILEGE_ESCALATION"
or metadata.event_type = "PROCESS_TERMINATION"
or metadata.event_type = "PROCESS_OPEN"
or metadata.event_type = "PROCESS_MODULE_LOAD"
target.process.command_line = /regsvr32/ nocase
target.process.command_line = /ProgramData|Temp\b|Users\\Public|Windows\\Temp|AppData\\Local\\Temp|AppData\\Roaming/ nocase
$Hostname = principal.hostname
$Parent_Process = principal.process.file.full_path
$Target_Process = target.process.file.full_path
$Command_Line = target.process.command_line
$timestamp = timestamp.get_timestamp(metadata.event_timestamp.seconds)
match:
$Hostname, $Parent_Process, $Target_Process, $Command_Line, $timestamp
order:
$timestamp desc
limit:
50
Conexões de saída iniciadas por Rundll32.exe
metadata.event_type = "NETWORK_CONNECTION"
principal.process.file.full_path = /rundll32/ nocase
network.direction = "OUTBOUND"
target.ip != /^(10\b|127|192\.168|172\.(1[6-9]|2[0-9]|3[01]))/
principal.process.command_line != /PcaSvc\.dll|PcaPatchSdbTask/ nocase
$Hostname = principal.hostname
$Process_Name = principal.process.file.full_path
$Destination_IP = target.ip
$Command_Line = principal.process.command_line
$timestamp = timestamp.get_timestamp(metadata.event_timestamp.seconds)
match:
$Hostname, $Process_Name, $Destination_IP, $Command_Line, $timestamp
order:
$timestamp desc
limit:
50
Execução suspeita de Rundll32
metadata.event_type = "PROCESS_UNCATEGORIZED"
or metadata.event_type = "PROCESS_LAUNCH"
or metadata.event_type = "PROCESS_INJECTION"
or metadata.event_type = "PROCESS_PRIVILEGE_ESCALATION"
or metadata.event_type = "PROCESS_TERMINATION"
or metadata.event_type = "PROCESS_OPEN"
or metadata.event_type = "PROCESS_MODULE_LOAD"
principal.process.command_line != /Shell32\.dll|Control_RunDLL|\.cpl/ nocase
target.process.command_line = /rundll32.*(javascript|\.RegisterXLL|OpenURL|OpenURLA|FileProtocolHandler|(url|zipfldr|shell32|mshtml|advpack|ieadvpack|ieframe|shdocvw|syssetup|setupapi|pcwutl|dfshim|scrobj|shimgvw|comsvcs)\.dll|RouteTheCall|Control_RunDLL|ShellExec_RunDLL|PrintHTML|LaunchINFSection|RegisterOCX|SetupInfObjectInstallAction|InstallHinfSection|LaunchApplication|ShOpenVerbApplication|http|ImageView_Fullscreen|MiniDump)/ nocase
$Hostname = principal.hostname
$Parent_Process = strings.coalesce(principal.process.file.full_path, principal.file.full_path)
$Target_Process = strings.coalesce(target.process.file.full_path, target.file.full_path)
$Command_Line = target.process.command_line
$timestamp = timestamp.get_timestamp(metadata.event_timestamp.seconds)
match:
$Hostname, $Parent_Process, $Target_Process, $Command_Line, $timestamp
order:
$timestamp desc
limit:
50
Comandos suspeitos do CertUtil
target.process.command_line = /certutil.*(decode|encode|urlcache|verifyctl|encodehex|decodehex)/
$Hostname = principal.hostname
$Parent_Process = principal.process.file.full_path
$Target_Process = target.process.file.full_path
$Command_Line = target.process.command_line
$Timestamp = timestamp.get_timestamp(metadata.event_timestamp.seconds)
match:
$Hostname, $Parent_Process, $Target_Process, $Command_Line, $Timestamp
order:
$Timestamp desc
limit:
50
Scripts WMI suspeitos
target.process.command_line = /(jscript|vbscript)\.dll|format:/
target.process.file.full_path = /wmi.*\.exe/ nocase
$Hostname = principal.hostname
$Parent_Process = principal.process.file.full_path
$Target_Process = target.process.file.full_path
$Command_Line = target.process.command_line
$Timestamp = timestamp.get_timestamp(metadata.event_timestamp.seconds)
match:
$Hostname, $Parent_Process, $Target_Process, $Command_Line, $Timestamp
order:
$Timestamp
limit:
50
Conexões de rede Regsvr32 suspeitas
metadata.event_type = "NETWORK_CONNECTION"
principal.process.file.full_path = /regsvr32/
target.ip != /^(10\b|127|169\.254|172\.16|224|100\.64|198\.(18|51\.100)|203\.0\.113|240|192\.(0\.2|0\.0\.(8|9|10|170|171)|0|31\.196|52\.193|168|88\.99|175\.48))/
$Hostname = principal.hostname
$Process_Name = principal.process.file.full_path
$Command_Line = principal.process.command_line
$Destination_IP = target.ip
$timestamp = timestamp.get_timestamp(metadata.event_timestamp.seconds)
match:
$Hostname, $Process_Name, $Destination_IP, $Command_Line, $timestamp
order:
$timestamp desc
limit:
50
Eventos marcados do MITRE ATT&CK
Esse painel oferece uma visão geral das atividades de detecção com base no framework MITRE ATT&CK, rastreando detecções e destacando tendências para identificar ameaças emergentes. Ela ajuda uma organização e as equipes de segurança a entender melhor o ambiente mostrando e mapeando táticas, técnicas e procedimentos (TTPs), aprimorando a detecção e a resposta a ameaças e garantindo uma defesa proativa contra ameaças cibernéticas.
Novas táticas e técnicas: últimos sete dias
Tendência de técnicas ao longo do tempo
As 10 principais técnicas identificadas
Tendência de táticas ao longo do tempo
Total de alertas de fornecedores por tática
Táticas identificadas pelo usuário
Técnicas identificadas por nome do host
Táticas identificadas por nome do host
Técnicas identificadas pelo usuário
Distribuição de gravidade dos eventos do MITRE
Eventos por tática e técnica
Nome do gráfico
Exemplo de consulta
Novas táticas e técnicas: últimos sete dias
strings.coalesce(security_result.attack_details.tactics.id, security_result.detection_fields["Tactic ID"]) != ""
strings.coalesce(security_result.attack_details.tactics.name, security_result.detection_fields["Tactic"]) != ""
strings.coalesce(security_result.attack_details.techniques.id, security_result.detection_fields["Technique ID"]) != ""
strings.coalesce(security_result.attack_details.techniques.name, security_result.detection_fields["Technique"]) != ""
$Tactic = strings.concat(strings.coalesce(security_result.attack_details.tactics.id, security_result.detection_fields["Tactic ID"])," - ", strings.coalesce(security_result.attack_details.tactics.name, security_result.detection_fields["Tactic"]))
$Tactic != "-"
$Technique = strings.concat(strings.coalesce(security_result.attack_details.techniques.id, security_result.detection_fields["Technique ID"])," - ", strings.coalesce(security_result.attack_details.techniques.name, security_result.detection_fields["Technique"]))
$Technique != "-"
match:
$Tactic, $Technique
outcome:
$First_Seen = timestamp.get_timestamp(min(metadata.event_timestamp.seconds), "%F %T")
$Last_Seen = timestamp.get_timestamp(max(metadata.event_timestamp.seconds), "%F %T")
$Diff_First_Seen = timestamp.diff(timestamp.current_seconds(), min(metadata.event_timestamp.seconds), "DAY")
order:
$Diff_First_Seen asc
Tendência de técnicas ao longo do tempo
strings.coalesce(security_result.attack_details.techniques.id, security_result.detection_fields["Technique ID"]) != ""
strings.coalesce(security_result.attack_details.techniques.name, security_result.detection_fields["Technique"]) != ""
$Technique = strings.concat(strings.coalesce(security_result.attack_details.techniques.id, security_result.detection_fields["Technique ID"])," - ", strings.coalesce(security_result.attack_details.techniques.name, security_result.detection_fields["Technique"]))
$Technique != "-"
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
match:
$Date, $Technique
outcome:
$Count = count(strings.coalesce(security_result.attack_details.techniques.name, security_result.detection_fields["Technique"]))
order:
$Date asc
As 10 principais técnicas identificadas
strings.coalesce(security_result.attack_details.techniques.id, security_result.detection_fields["Technique ID"]) != ""
strings.coalesce(security_result.attack_details.techniques.name, security_result.detection_fields["Technique"]) != ""
$Technique = strings.concat(strings.coalesce(security_result.attack_details.techniques.id, security_result.detection_fields["Technique ID"])," - ", strings.coalesce(security_result.attack_details.techniques.name, security_result.detection_fields["Technique"]))
$Technique != "-"
match:
$Technique
outcome:
$Count = count(strings.concat(strings.coalesce(security_result.attack_details.techniques.id, security_result.detection_fields["Technique ID"])," - ", strings.coalesce(security_result.attack_details.techniques.name, security_result.detection_fields["Technique"])))
order:
$Count desc
limit:
10
As 10 principais técnicas identificadas
strings.coalesce(security_result.attack_details.techniques.id, security_result.detection_fields["Technique ID"]) != ""
strings.coalesce(security_result.attack_details.techniques.name, security_result.detection_fields["Technique"]) != ""
$Technique = strings.concat(strings.coalesce(security_result.attack_details.techniques.id, security_result.detection_fields["Technique ID"])," - ", strings.coalesce(security_result.attack_details.techniques.name, security_result.detection_fields["Technique"]))
$Technique != "-"
match:
$Technique
outcome:
$Count = count(strings.concat(strings.coalesce(security_result.attack_details.techniques.id, security_result.detection_fields["Technique ID"])," - ", strings.coalesce(security_result.attack_details.techniques.name, security_result.detection_fields["Technique"])))
order:
$Count desc
limit:
10
Tendência de táticas ao longo do tempo
strings.coalesce(security_result.attack_details.tactics.id, security_result.detection_fields["Tactic ID"]) != ""
strings.coalesce(security_result.attack_details.tactics.name, security_result.detection_fields["Tactic"]) != ""
$Tactic = strings.concat(strings.coalesce(security_result.attack_details.tactics.id, security_result.detection_fields["Tactic ID"])," - ", strings.coalesce(security_result.attack_details.tactics.name, security_result.detection_fields["Tactic"]))
$Tactic != "-"
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
match:
$Date, $Tactic
outcome:
$Count = count(strings.coalesce(security_result.attack_details.tactics.name, security_result.detection_fields["Tactic"]))
order:
$Date asc
Tendência de táticas ao longo do tempo
strings.coalesce(security_result.attack_details.tactics.id, security_result.detection_fields["Tactic ID"]) != ""
strings.coalesce(security_result.attack_details.tactics.name, security_result.detection_fields["Tactic"]) != ""
$Tactic = strings.concat(strings.coalesce(security_result.attack_details.tactics.id, security_result.detection_fields["Tactic ID"])," - ", strings.coalesce(security_result.attack_details.tactics.name, security_result.detection_fields["Tactic"]))
$Tactic != "-"
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
match:
$Date, $Tactic
outcome:
$Count = count(strings.coalesce(security_result.attack_details.tactics.name, security_result.detection_fields["Tactic"]))
order:
$Date asc
Total de alertas de fornecedores por tática
strings.coalesce(security_result.attack_details.tactics.id, security_result.detection_fields["Tactic ID"]) != ""
strings.coalesce(security_result.attack_details.tactics.name, security_result.detection_fields["Tactic"]) != ""
$Tactic = strings.concat(strings.coalesce(security_result.attack_details.tactics.id, security_result.detection_fields["Tactic ID"])," - ", strings.coalesce(security_result.attack_details.tactics.name, security_result.detection_fields["Tactic"]))
$Tactic != "-"
$Alert = strings.coalesce(security_result.rule_name, security_result.threat_name, security_result.summary, security_result.description)
match:
$Tactic, $Alert
outcome:
$Count = count(strings.concat(strings.coalesce(security_result.attack_details.tactics.id, security_result.detection_fields["Tactic ID"])," - ", strings.coalesce(security_result.attack_details.tactics.name, security_result.detection_fields["Tactic"])))
order:
$Tactic asc
Táticas identificadas pelo usuário
strings.coalesce(security_result.attack_details.tactics.id, security_result.detection_fields["Tactic ID"]) != ""
strings.coalesce(security_result.attack_details.tactics.name, security_result.detection_fields["Tactic"]) != ""
$Tactic = strings.concat(strings.coalesce(security_result.attack_details.tactics.id, security_result.detection_fields["Tactic ID"])," - ", strings.coalesce(security_result.attack_details.tactics.name, security_result.detection_fields["Tactic"]))
$Tactic != "-"
$Username = strings.coalesce(principal.user.user_display_name, principal.user.userid)
$Username != ""
$Hostname = strings.coalesce(principal.hostname, principal.asset.hostname)
$Hostname != ""
match:
$Username, $Hostname, $Tactic
outcome:
$Count = count(strings.concat(strings.coalesce(security_result.attack_details.tactics.id, security_result.detection_fields["Tactic ID"])," - ", strings.coalesce(security_result.attack_details.tactics.name, security_result.detection_fields["Tactic"])))
order:
$Count desc
Técnicas identificadas por nome do host
strings.coalesce(security_result.attack_details.techniques.id, security_result.detection_fields["Technique ID"]) != ""
strings.coalesce(security_result.attack_details.techniques.name, security_result.detection_fields["Technique"]) != ""
$Technique = strings.concat(strings.coalesce(security_result.attack_details.techniques.id, security_result.detection_fields["Technique ID"])," - ", strings.coalesce(security_result.attack_details.techniques.name, security_result.detection_fields["Technique"]))
$Technique != "-"
$Hostname = strings.coalesce(principal.hostname, principal.asset.hostname)
$Hostname != ""
$IP_Address = strings.coalesce(principal.ip, principal.asset.ip)
match:
$Hostname, $IP_Address, $Technique
outcome:
$Count = count(strings.concat(strings.coalesce(security_result.attack_details.techniques.id, security_result.detection_fields["Technique ID"])," - ", strings.coalesce(security_result.attack_details.techniques.name, security_result.detection_fields["Technique"])))
order:
$Count desc
Técnicas identificadas por nome do host
strings.coalesce(security_result.attack_details.techniques.id, security_result.detection_fields["Technique ID"]) != ""
strings.coalesce(security_result.attack_details.techniques.name, security_result.detection_fields["Technique"]) != ""
$Technique = strings.concat(strings.coalesce(security_result.attack_details.techniques.id, security_result.detection_fields["Technique ID"])," - ", strings.coalesce(security_result.attack_details.techniques.name, security_result.detection_fields["Technique"]))
$Technique != "-"
$Hostname = strings.coalesce(principal.hostname, principal.asset.hostname)
$Hostname != ""
$IP_Address = strings.coalesce(principal.ip, principal.asset.ip)
match:
$Hostname, $IP_Address, $Technique
outcome:
$Count = count(strings.concat(strings.coalesce(security_result.attack_details.techniques.id, security_result.detection_fields["Technique ID"])," - ", strings.coalesce(security_result.attack_details.techniques.name, security_result.detection_fields["Technique"])))
order:
$Count desc
Táticas identificadas por nome do host
strings.coalesce(security_result.attack_details.tactics.id, security_result.detection_fields["Tactic ID"]) != ""
strings.coalesce(security_result.attack_details.tactics.name, security_result.detection_fields["Tactic"]) != ""
$Tactic = strings.concat(strings.coalesce(security_result.attack_details.tactics.id, security_result.detection_fields["Tactic ID"])," - ", strings.coalesce(security_result.attack_details.tactics.name, security_result.detection_fields["Tactic"]))
$Tactic != "-"
$Hostname = strings.coalesce(principal.hostname, principal.asset.hostname)
$Hostname != ""
$IP_Address = strings.coalesce(principal.ip, principal.asset.ip)
match:
$Hostname, $IP_Address, $Tactic
outcome:
$Count = count(strings.concat(strings.coalesce(security_result.attack_details.tactics.id, security_result.detection_fields["Tactic ID"])," - ", strings.coalesce(security_result.attack_details.tactics.name, security_result.detection_fields["Tactic"])))
order:
$Count desc
Técnicas identificadas pelo usuário
strings.coalesce(security_result.attack_details.techniques.id, security_result.detection_fields["Technique ID"]) != ""
strings.coalesce(security_result.attack_details.techniques.name, security_result.detection_fields["Technique"]) != ""
strings.coalesce(principal.user.user_display_name, principal.user.userid) != ""
strings.coalesce(principal.hostname, principal.asset.hostname) != ""
$Technique = strings.concat(strings.coalesce(security_result.attack_details.techniques.id, security_result.detection_fields["Technique ID"])," - ", strings.coalesce(security_result.attack_details.techniques.name, security_result.detection_fields["Technique"]))
$Technique != "-"
$Username = strings.coalesce(principal.user.user_display_name, principal.user.userid)
$Hostname = strings.coalesce(principal.hostname, principal.asset.hostname)
match:
$Username, $Hostname, $Technique
outcome:
$Count = count(strings.concat(strings.coalesce(security_result.attack_details.techniques.id, security_result.detection_fields["Technique ID"])," - ", strings.coalesce(security_result.attack_details.techniques.name, security_result.detection_fields["Technique"])))
order:
$Count desc
Técnicas identificadas pelo usuário
strings.coalesce(security_result.attack_details.techniques.id, security_result.detection_fields["Technique ID"]) != ""
strings.coalesce(security_result.attack_details.techniques.name, security_result.detection_fields["Technique"]) != ""
strings.coalesce(principal.user.user_display_name, principal.user.userid) != ""
strings.coalesce(principal.hostname, principal.asset.hostname) != ""
$Technique = strings.concat(strings.coalesce(security_result.attack_details.techniques.id, security_result.detection_fields["Technique ID"])," - ", strings.coalesce(security_result.attack_details.techniques.name, security_result.detection_fields["Technique"]))
$Technique != "-"
$Username = strings.coalesce(principal.user.user_display_name, principal.user.userid)
$Hostname = strings.coalesce(principal.hostname, principal.asset.hostname)
match:
$Username, $Hostname, $Technique
outcome:
$Count = count(strings.concat(strings.coalesce(security_result.attack_details.techniques.id, security_result.detection_fields["Technique ID"])," - ", strings.coalesce(security_result.attack_details.techniques.name, security_result.detection_fields["Technique"])))
order:
$Count desc
Total de alertas de fornecedores por tática
strings.coalesce(security_result.attack_details.tactics.id, security_result.detection_fields["Tactic ID"]) != ""
strings.coalesce(security_result.attack_details.tactics.name, security_result.detection_fields["Tactic"]) != ""
$Tactic = strings.concat(strings.coalesce(security_result.attack_details.tactics.id, security_result.detection_fields["Tactic ID"])," - ", strings.coalesce(security_result.attack_details.tactics.name, security_result.detection_fields["Tactic"]))
$Tactic != "-"
$Alert = strings.coalesce(security_result.rule_name, security_result.threat_name, security_result.summary, security_result.description)
match:
$Tactic, $Alert
outcome:
$Count = count(strings.concat(strings.coalesce(security_result.attack_details.tactics.id, security_result.detection_fields["Tactic ID"])," - ", strings.coalesce(security_result.attack_details.tactics.name, security_result.detection_fields["Tactic"])))
order:
$Tactic asc
Novas táticas e técnicas: últimos sete dias
strings.coalesce(security_result.attack_details.tactics.id, security_result.detection_fields["Tactic ID"]) != ""
strings.coalesce(security_result.attack_details.tactics.name, security_result.detection_fields["Tactic"]) != ""
strings.coalesce(security_result.attack_details.techniques.id, security_result.detection_fields["Technique ID"]) != ""
strings.coalesce(security_result.attack_details.techniques.name, security_result.detection_fields["Technique"]) != ""
$Tactic = strings.concat(strings.coalesce(security_result.attack_details.tactics.id, security_result.detection_fields["Tactic ID"])," - ", strings.coalesce(security_result.attack_details.tactics.name, security_result.detection_fields["Tactic"]))
$Tactic != "-"
$Technique = strings.concat(strings.coalesce(security_result.attack_details.techniques.id, security_result.detection_fields["Technique ID"])," - ", strings.coalesce(security_result.attack_details.techniques.name, security_result.detection_fields["Technique"]))
$Technique != "-"
match:
$Tactic, $Technique
outcome:
$First_Seen = timestamp.get_timestamp(min(metadata.event_timestamp.seconds), "%F %T")
$Last_Seen = timestamp.get_timestamp(max(metadata.event_timestamp.seconds), "%F %T")
$First_Seen_Time = min(metadata.event_timestamp.seconds)
$Last_Seen_Time = max(metadata.event_timestamp.seconds)
$Diff_First_Seen = math.round(($Last_Seen_Time - $First_Seen_Time)/86400)
order:
$Diff_First_Seen asc
unselect:
$First_Seen_Time, $Last_Seen_Time
Táticas identificadas por nome do host
strings.coalesce(security_result.attack_details.tactics.id, security_result.detection_fields["Tactic ID"]) != ""
strings.coalesce(security_result.attack_details.tactics.name, security_result.detection_fields["Tactic"]) != ""
$Tactic = strings.concat(strings.coalesce(security_result.attack_details.tactics.id, security_result.detection_fields["Tactic ID"])," - ", strings.coalesce(security_result.attack_details.tactics.name, security_result.detection_fields["Tactic"]))
$Tactic != "-"
$Hostname = strings.coalesce(principal.hostname, principal.asset.hostname)
$Hostname != ""
$IP_Address = strings.coalesce(principal.ip, principal.asset.ip)
match:
$Hostname, $IP_Address, $Tactic
outcome:
$Count = count(strings.concat(strings.coalesce(security_result.attack_details.tactics.id, security_result.detection_fields["Tactic ID"])," - ", strings.coalesce(security_result.attack_details.tactics.name, security_result.detection_fields["Tactic"])))
order:
$Count desc
Distribuição de gravidade dos eventos do MITRE
strings.coalesce(security_result.attack_details.techniques.id, security_result.detection_fields["Technique ID"]) != ""
strings.coalesce(security_result.attack_details.techniques.name, security_result.detection_fields["Technique"]) != ""
$Severity = security_result.severity
match:
$Severity
outcome:
$Count = count(strings.concat(strings.coalesce(security_result.attack_details.techniques.id, security_result.detection_fields["Technique ID"])," - ", strings.coalesce(security_result.attack_details.techniques.name, security_result.detection_fields["Technique"])))
order:
$Count desc
Tendência de técnicas ao longo do tempo
strings.coalesce(security_result.attack_details.techniques.id, security_result.detection_fields["Technique ID"]) != ""
strings.coalesce(security_result.attack_details.techniques.name, security_result.detection_fields["Technique"]) != ""
$Technique = strings.concat(strings.coalesce(security_result.attack_details.techniques.id, security_result.detection_fields["Technique ID"])," - ", strings.coalesce(security_result.attack_details.techniques.name, security_result.detection_fields["Technique"]))
$Technique != "-"
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
match:
$Date, $Technique
outcome:
$Count = count(strings.coalesce(security_result.attack_details.techniques.name, security_result.detection_fields["Technique"]))
order:
$Date asc
Eventos por tática e técnica
strings.coalesce(security_result.attack_details.tactics.id, security_result.detection_fields["Tactic ID"]) != ""
strings.coalesce(security_result.attack_details.tactics.name, security_result.detection_fields["Tactic"]) != ""
strings.coalesce(security_result.attack_details.techniques.id, security_result.detection_fields["Technique ID"]) != ""
strings.coalesce(security_result.attack_details.techniques.name, security_result.detection_fields["Technique"]) != ""
$Tactic = strings.concat(strings.coalesce(security_result.attack_details.tactics.id, security_result.detection_fields["Tactic ID"])," - ", strings.coalesce(security_result.attack_details.tactics.name, security_result.detection_fields["Tactic"]))
$Tactic != "-"
$Technique = strings.concat(strings.coalesce(security_result.attack_details.techniques.id, security_result.detection_fields["Technique ID"])," - ", strings.coalesce(security_result.attack_details.techniques.name, security_result.detection_fields["Technique"]))
$Technique != "-"
match:
$Tactic, $Technique
outcome:
$Count = count(metadata.id)
order:
$Tactic asc
Táticas identificadas pelo usuário
strings.coalesce(security_result.attack_details.tactics.id, security_result.detection_fields["Tactic ID"]) != ""
strings.coalesce(security_result.attack_details.tactics.name, security_result.detection_fields["Tactic"]) != ""
$Tactic = strings.concat(strings.coalesce(security_result.attack_details.tactics.id, security_result.detection_fields["Tactic ID"])," - ", strings.coalesce(security_result.attack_details.tactics.name, security_result.detection_fields["Tactic"]))
$Tactic != "-"
$Username = strings.coalesce(principal.user.user_display_name, principal.user.userid)
$Username != ""
$Hostname = strings.coalesce(principal.hostname, principal.asset.hostname)
$Hostname != ""
match:
$Username, $Hostname, $Tactic
outcome:
$Count = count(strings.concat(strings.coalesce(security_result.attack_details.tactics.id, security_result.detection_fields["Tactic ID"])," - ", strings.coalesce(security_result.attack_details.tactics.name, security_result.detection_fields["Tactic"])))
order:
$Count desc
Microsoft 365: SharePoint e OneDrive
Esse painel oferece uma visão detalhada da atividade do usuário, do acesso aos dados e dos eventos de segurança nas duas plataformas. Ele oferece às organizações insights valiosos para acompanhar operações de arquivos, tendências de acesso e comportamento do usuário. Esse painel ajuda a identificar acessos não autorizados ou atividades incomuns, como locais de login inesperados ou anomalias nos padrões de usuários.
Observação : aplique os filtros disponíveis para refinar os resultados.
Atividades do usuário
Modificação das políticas de compartilhamento
Os 10 sites do SharePoint mais acessados
Os 10 principais usuários ativos
As 10 principais atividades de contas privilegiadas
As 10 principais operações de arquivo
Mapa de geolocalização no acesso do usuário
Os 10 principais endereços IP de origem
Tendências de atividade ao longo do tempo
Número de downloads de arquivos ao longo do tempo
Downloads de arquivos
Nome do gráfico
Exemplo de consulta
Atividades do usuário
$Source_IP = strings.coalesce(principal.ip, principal.asset.ip)
$Security_Event_Type = metadata.product_event_type
$User = strings.coalesce(principal.user.userid,principal.user.user_display_name,principal.user.email_addresses)
$Application = strings.coalesce(principal.application, target.application, intermediary.application)
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
match:
$Date,$User,$Source_IP, $Application,$Security_Event_Type
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
Modificação das políticas de compartilhamento
metadata.product_event_type = "SharingPolicyChanged"
$Application = strings.coalesce(principal.application, target.application, intermediary.application)
$User = strings.coalesce(principal.user.userid, principal.user.user_display_name, principal.user.email_addresses)
$Role = principal.user.attribute.roles.name
$Policy = target.labels.key
$Action = target.labels.value
($Action = "True" or $Action = "False")
$Date = timestamp.get_timestamp(metadata.event_timestamp.seconds, "%F %T ")
match:
$Date, $User, $Role, $Policy, $Action, $Application
outcome:
$Count = count(metadata.id)
order:
$Count desc
Os 10 sites do SharePoint mais acessados
$Sites = strings.coalesce(target.url,network.http.referral_url,principal.url)
$User = strings.coalesce(principal.user.userid, principal.user.user_display_name, principal.user.email_addresses)
match:
$Sites, $User
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
Os 10 principais usuários ativos
$User = strings.coalesce(principal.user.userid,principal.user.user_display_name,principal.user.email_addresses)
$Application = strings.coalesce(principal.application, target.application, intermediary.application)
match:
$User, $Application
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
As 10 principais atividades de contas privilegiadas
principal.user.attribute.roles.name = /Admin|DcAdmin|Administrator|Root/ nocase //It will be updated as per the client's environment.
$Role = principal.user.attribute.roles.name
$Security_Event_Type = metadata.product_event_type
$User = strings.coalesce(principal.user.userid, principal.user.user_display_name, principal.user.email_addresses)
$Resource = if(target.resource.name = "Unknown",target.url,target.resource.name)
$Application = strings.coalesce(principal.application, target.application, intermediary.application)
match:
$Role, $Security_Event_Type, $Application
outcome:
$Username = array_distinct($User)
$Count = count(metadata.id)
order:
$Count desc
limit:
10
As 10 principais operações de arquivo
metadata.product_event_type = /File/ nocase
$Security_Event_Type = metadata.product_event_type
$Action = security_result.action
match:
$Security_Event_Type, $Action
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
Mapa de geolocalização no acesso do usuário
$User = strings.coalesce(principal.user.userid, principal.user.user_display_name, principal.user.email_addresses)
$Country = strings.coalesce(principal.location.country_or_region, principal.ip_geo_artifact.location.country_or_region)
$Country != ""
match:
$Country
outcome:
$Count = count($User)
$Latitude = max(principal.ip_geo_artifact.location.region_latitude)
$Longitude = max(principal.ip_geo_artifact.location.region_longitude)
order:
$Count desc
Os 10 principais endereços IP de origem
$Source_IP = strings.coalesce(principal.ip, principal.asset.ip)
$User = strings.coalesce(principal.user.userid, principal.user.user_display_name, principal.user.email_addresses)
match:
$Source_IP, $User
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
Tendências de atividade ao longo do tempo
$Application = strings.coalesce(principal.application, target.application, intermediary.application)
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
match:
$Application, $Date
outcome:
$Count = count(metadata.id)
order:
$Date asc
Número de downloads de arquivos ao longo do tempo
metadata.product_event_type = "FileDownloaded"
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
$User = strings.coalesce(principal.user.userid, principal.user.user_display_name, principal.user.email_addresses)
match:
$Date, $User
outcome:
$Count = count(metadata.id)
order:
$Date asc
Downloads de arquivos
metadata.product_event_type = "FileDownloaded"
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
$Downloaded_File = strings.coalesce(src.url,src.file.full_path)
$User = strings.coalesce(principal.user.userid, principal.user.user_display_name, principal.user.email_addresses)
$Role = principal.user.attribute.roles.name
match:
$Date, $User,$Role,$Downloaded_File
outcome:
$Count = count(metadata.id)
order:
$Count asc
Alertas do Microsoft 365
Esse painel oferece uma visão geral dos eventos de segurança e possíveis ameaças, rastreando alertas críticos e tendências relacionadas à atividade do usuário.
10 principais usuários por alertas
10 principais alertas
Os 10 principais alertas de gravidade alta
Detalhes do alerta recente
Distribuição da gravidade dos alertas
Alertas ao longo do tempo
Nome do gráfico
Exemplo de consulta
10 principais usuários por alertas
metadata.log_type = "MICROSOFT_GRAPH_ALERT"
metadata.product_name = "Office 365 Security and Compliance"
security_result.summary = /threat(?:\s)?management/ nocase
target.user.userid != ""
$User = target.user.userid
match:
$User
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
10 principais alertas
metadata.log_type = "MICROSOFT_GRAPH_ALERT"
metadata.product_name = "Office 365 Security and Compliance"
security_result.summary = /threat(?:\s)?management/ nocase
security_result.rule_name != ""
$Alert = security_result.rule_name
match:
$Alert
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
Os 10 principais alertas de gravidade alta
metadata.log_type = "MICROSOFT_GRAPH_ALERT"
metadata.product_name = "Office 365 Security and Compliance"
security_result.severity = "HIGH"
security_result.summary = /threat(?:\s)?management/ nocase
security_result.rule_name != ""
$Alert = security_result.rule_name
match:
$Alert
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
Detalhes do alerta recente
metadata.log_type = "MICROSOFT_GRAPH_ALERT"
metadata.product_name = "Office 365 Security and Compliance"
security_result.summary = /threat(?:\s)?management/ nocase
$Alert = security_result.rule_name
$Description = security_result.description
$Severity = security_result.severity
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
match:
$Date, $Alert, $Description, $Severity
outcome:
$Count = count(metadata.id)
order:
$Date desc
limit:
50
Distribuição da gravidade dos alertas
metadata.log_type = "MICROSOFT_GRAPH_ALERT"
metadata.product_name = "Office 365 Security and Compliance"
security_result.summary = /threat(?:\s)?management/ nocase
$Severity = security_result.severity
match:
$Severity
outcome:
$Count = count(metadata.id)
order:
$Severity desc
Alertas ao longo do tempo
metadata.log_type = "MICROSOFT_GRAPH_ALERT"
metadata.product_name = "Office 365 Security and Compliance"
security_result.summary = /threat(?:\s)?management/ nocase
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
match:
$Date
outcome:
$Count = count(metadata.id)
order:
$Date asc
Gerenciamento de dispositivos móveis
Esse painel ajuda as equipes de segurança a monitorar dispositivos móveis organizacionais, fornecendo insights sobre conformidade, tendências de ameaças, distribuições de gravidade e atividade do usuário para entender a postura geral de segurança. Ele permite tomar decisões informadas para lidar com vulnerabilidades, aplicar políticas de segurança e mitigar ameaças emergentes de forma eficaz.
Observação : aplique os filtros disponíveis para refinar os resultados.
Dispositivos com versões de SO desatualizadas / vulneráveis
10 principais recursos modificados
Distribuição do SO
As 10 principais ameaças a dispositivos
10 principais locais de dispositivos
Dispositivos que não estão em compliance ao longo do tempo
Os 10 principais usuários por falha de login
Dispositivos com ameaças recentes ao longo do tempo
Dispositivos corrigidos ao longo do tempo
Dispositivos críticos ao longo do tempo
Ameaças detectadas ao longo do tempo
Distribuição de gravidade do dispositivo
Integração/remoção de dispositivos ao longo do tempo
Eventos ao longo do tempo
Nome do gráfico
Exemplo de consulta
Dispositivos com versões de SO desatualizadas / vulneráveis
(principal.asset.platform_software.platform_version = /Android|IOS|Windows|mac(?:os)?/ nocase
and not principal.asset.platform_software.platform_version = /Android(?:\s|\/)1[3-6]|IOS(?:\s|\/)1[5-8]|Windows(?:\s|\/)1[0-1]|mac(?:OS)?(?:\s|\/)1[3-5]/ nocase)
or (target.resource.attribute.labels["OS"] = /Android/ nocase
and not (target.resource.attribute.labels["Version"] = /1[3-6]/
or target.resource.attribute.labels["OSversion"] = /1[3-6]/))
or (target.resource.attribute.labels["OS"] = /IOS/ nocase
and not (target.resource.attribute.labels["Version"] = /1[5-8]/
or target.resource.attribute.labels["OSversion"] = /(15|16|17|18).*/))
or (target.resource.attribute.labels["OS"] = /Windows/ nocase
and not (target.resource.attribute.labels["Version"] = /10|11/
or target.resource.attribute.labels["OSversion"] = /10|11/))
or (target.resource.attribute.labels["OS"] = /mac(?:OS)?/ nocase
and not (target.resource.attribute.labels["Version"] = /1[3-5]/
or target.resource.attribute.labels["OSversion"] = /1[3-5]/))
$Device = strings.coalesce(principal.asset.hostname, principal.hostname)
$OS = strings.coalesce(principal.asset.platform_software.platform_version, target.resource.attribute.labels["OS"])
$Version = strings.coalesce(target.resource.attribute.labels["Version"], target.resource.attribute.labels["OSversion"])
match:
$Device, $OS, $Version
10 principais recursos modificados
metadata.event_type = "USER_RESOURCE_UPDATE_CONTENT"
or metadata.event_type = "USER_RESOURCE_UPDATE_PERMISSIONS"
metadata.product_event_type = /Patch MobileApp|Patch ManagedDevice|Patch DeviceConfiguration|(Application|Profile)Modified/ nocase
$Resource_Name = principal.hostname
$Resource_Name != ""
match:
$Resource_Name
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
Distribuição do SO
$Platform = principal.platform
match:
$Platform
outcome:
$Count = count(metadata.id)
order:
$Count desc
As 10 principais ameaças a dispositivos
metadata.product_event_type = "THREAT_DETECTED"
or additional.fields["CompromisedStatus"] = /^Compromised/ nocase
or security_result.description = /Threat|Compromised/ nocase
$Threat_Event = strings.coalesce(metadata.product_event_type, security_result.category_details, security_result.description)
match:
$Threat_Event
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
10 principais locais de dispositivos
$Country = principal.ip_geo_artifact.location.country_or_region
$Latitude = principal.ip_geo_artifact.location.region_coordinates.latitude
$Latitude != 0
$Longitude = principal.ip_geo_artifact.location.region_coordinates.longitude
$Longitude != 0
match:
$Country, $Latitude, $Longitude
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
Dispositivos que não estão em compliance ao longo do tempo
additional.fields["ComplianceState"] = /Not Compliant/ nocase
or target.resource.attribute.labels["Status"] = /NonCompliant/ nocase
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
match:
$Date
outcome:
$Count = count_distinct(principal.hostname)
order:
$Date desc
Os 10 principais usuários por falha de login
(metadata.event_type = "USER_LOGIN"
or metadata.product_event_type = /user(?:\s|\S|)?login/ nocase
and security_result.action = "BLOCK" or target.resource.attribute.labels["Status"] = /Failure/ nocase)
or metadata.product_event_type = /user(?:\s|\S)?login.*(?:failed)?/ nocase
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
$User = principal.user.userid
$User != ""
match:
$User
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
Dispositivos com ameaças recentes ao longo do tempo
metadata.product_event_type = "THREAT_DETECTED"
or additional.fields["CompromisedStatus"] = /^Compromised/ nocase
or security_result.description = /Threat|Compromised/ nocase
$Device = principal.hostname
$Device != ""
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
match:
$Date, $Device
outcome:
$Count = count(metadata.id)
order:
$Date desc
Dispositivos corrigidos ao longo do tempo
metadata.event_type = "USER_RESOURCE_UPDATE_CONTENT"
or metadata.event_type = "USER_RESOURCE_UPDATE_PERMISSIONS"
metadata.product_event_type = /Patch MobileApp|Patch ManagedDevice|Patch DeviceConfiguration|(Application|Profile)Modified/ nocase
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
match:
$Date
outcome:
$Count = count(metadata.id)
order:
$Date desc
Dispositivos críticos ao longo do tempo
security_result.severity = "CRITICAL"
or security_result.severity = "HIGH"
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
match:
$Date
outcome:
$Count = count_distinct(principal.hostname)
order:
$Date desc
Ameaças detectadas ao longo do tempo
metadata.product_event_type = "THREAT_DETECTED"
or additional.fields["CompromisedStatus"] = /^Compromised/ nocase
or security_result.description = /Threat|Compromised/ nocase
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
$Threat_Event = strings.coalesce(metadata.product_event_type, security_result.category_details, security_result.description)
match:
$Date, $Threat_Event
outcome:
$Count = count(metadata.id)
order:
$Date desc
Distribuição de gravidade do dispositivo
$Severity = security_result.severity
match:
$Severity
outcome:
$Count = count_distinct(principal.hostname)
order:
$Count desc
Integração/remoção de dispositivos ao longo do tempo
metadata.event_type = "USER_RESOURCE_CREATION"
or metadata.product_event_type = /DEVICE_ENROLLMENT|DeviceEnrolled/ nocase
or metadata.event_type = "USER_RESOURCE_DELETION"
or metadata.product_event_type = /^(Deviceun(?:enrolled|enrollment)|BreakMDMConfirmed|Delete\s?(?:ManagedDevice|Device)(?:Requested)?|Retire\s?ManageDevice|DeviceWipeRequested)$/ nocase
$Enrollment = if(metadata.product_event_type = /DEVICE_ENROLLMENT|DeviceEnrolled/ nocase, "Onboard", if(metadata.product_event_type = /^(Deviceun(?:enrolled|enrollment)|BreakMDMConfirmed|Delete\s?(?:ManagedDevice|Device)(?:Requested)?|Retire\s?ManageDevice|DeviceWipeRequested)$/ nocase, "Offboard"))
$Enrollment != ""
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
match:
$Date, $Enrollment
outcome:
$Count = count_distinct(principal.hostname)
order:
$Date desc
Eventos ao longo do tempo
$Event_Type = metadata.event_type
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
match:
$Date, $Event_Type
outcome:
$Count = count(metadata.id)
order:
$Date desc
Monitoramento da autenticação multifator (MFA)
Esse painel oferece uma análise detalhada da implementação e da eficácia da MFA em toda a organização. Ele oferece insights em tempo real e históricos sobre tendências de uso da MFA, alertas de falha e status de inscrição. Ao monitorar esses aspectos principais, o painel ajuda as organizações a identificar possíveis vulnerabilidades, acompanhar o desempenho da autenticação e garantir a conformidade com os protocolos de segurança, fortalecendo a segurança geral de acesso e o gerenciamento de usuários.
Detecção de bypass da MFA do Okta
Taxa de falha de MFA
Tentativas de MFA bloqueadas por motivo
Tentativas de MFA ao longo do tempo
Tentativas de MFA por local
Os cinco principais usuários por tentativas de MFA com falha
Tendências de uso da MFA
Os cinco principais aplicativos acessados via MFA
Taxa de sucesso da MFA
Status do registro da MFA
Alertas de falha na MFA
Nome do gráfico
Exemplo de consulta
Detecção de bypass da MFA do Okta
$event_type = metadata.event_type
$event_type = "USER_UNCATEGORIZED"
$vendor = metadata.vendor_name
$vendor = /Okta/ nocase
$security_event_type = metadata.product_event_type
$security_event_type = "user.mfa.attempt_bypass"
$User = principal.user.user_display_name
$Summary = security_result.summary
$Action = security_result.action
$Action != "UNKNOWN_ACTION"
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
match:
$User, $Action, $Date,$Summary, $security_event_type
outcome:
$Count = count(metadata.id)
Taxa de falha de MFA
$event_type = metadata.event_type
$event_type = "USER_LOGIN"
$product_name = metadata.product_name
$security_event_type = metadata.product_event_type
$requirement = additional.fields["AuthenticationRequirement"]
$result_value = security_result.detection_fields.value
(re.regex($product_name, "MULTI-FACTOR_AUTHENTICATION") or re.regex($security_event_type, `user.mfa`) or re.regex($requirement, `multiFactorAuthentication`) or re.regex($result_value, `MFA`))
$user = strings.coalesce(target.user.userid, principal.user.userid)
$user != ""
$email_id =strings.coalesce(target.user.email_addresses, principal.user.email_addresses)
$action = security_result.action
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
match:
$Date
outcome:
$total_attempts = count(metadata.id)
$failure_attempts = sum(if(any security_result.action = "BLOCK", 1, 0)) // Sums only failure MFA attempts
$failure_rate = (($failure_attempts / $total_attempts) * 100 )
order:
$Date asc
Tentativas de MFA bloqueadas por motivo
$product_name = metadata.product_name
$security_event_type = metadata.product_event_type
$requirement = additional.fields["AuthenticationRequirement"]
$result_value = security_result.detection_fields.value
(re.regex($product_name, "MULTI-FACTOR_AUTHENTICATION") or re.regex($security_event_type, `user.mfa`) nocase or re.regex($requirement, `multiFactorAuthentication`) nocase or re.regex($result_value, `MFA`) nocase)
$user = strings.coalesce(target.user.userid, principal.user.userid)
$user != ""
$action = security_result.action
$action = "BLOCK"
$Reason = security_result.summary
$Reason != ""
$Location = principal.location.country_or_region
match:
$Reason, $Location
outcome:
$Count = count(metadata.id)
order:
$Count desc
Tentativas de MFA ao longo do tempo
$event_type = metadata.event_type
$event_type = "USER_LOGIN"
$product_name = metadata.product_name
$security_event_type = metadata.product_event_type
$requirement = additional.fields["AuthenticationRequirement"]
$result_value = security_result.detection_fields.value
(re.regex($product_name, "MULTI-FACTOR_AUTHENTICATION") or re.regex($security_event_type, `user.mfa`) nocase or re.regex($requirement, `multiFactorAuthentication`) nocase or re.regex($result_value, `MFA`) nocase)
$user = strings.coalesce(target.user.userid, principal.user.userid)
$user != ""
$email_id = strings.coalesce(target.user.email_addresses, principal.user.email_addresses)
$action = security_result.action
$action != "UNKNOWN_ACTION"
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
$Location = principal.location.country_or_region
match:
$Date, $Location
outcome:
$Count = count(metadata.id)
order:
$Date asc
Tentativas de MFA por local
$event_type = metadata.event_type
$event_type = "USER_LOGIN"
$product_name = metadata.product_name
$security_event_type = metadata.product_event_type
$requirement = additional.fields["AuthenticationRequirement"]
$result_value = security_result.detection_fields.value
(re.regex($product_name, "MULTI-FACTOR_AUTHENTICATION") or re.regex($security_event_type, `user.mfa`) or re.regex($requirement, `multiFactorAuthentication`) or re.regex($result_value, `MFA`))
$User = target.user.userid
$User != ""
$Action = security_result.action
$Action !="UNKNOWN_ACTION"
$Vendor = metadata.vendor_name
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
$Latitude = principal.location.region_coordinates.latitude
$Longitude = principal.location.region_coordinates.longitude
$Location = strings.coalesce(target.location.country_or_region, principal.location.country_or_region)
match:
$Vendor, $Date, $Location, $Latitude, $Longitude
outcome:
$Count = count(metadata.id)
Tentativas de MFA por local
$event_type = metadata.event_type
$event_type = "USER_LOGIN"
$product_name = metadata.product_name
$security_event_type = metadata.product_event_type
$requirement = additional.fields["AuthenticationRequirement"]
$result_value = security_result.detection_fields.value
(re.regex($product_name, "MULTI-FACTOR_AUTHENTICATION") or re.regex($security_event_type, `user.mfa`) nocase or re.regex($requirement, `multiFactorAuthentication`) nocase or re.regex($result_value, `MFA`) nocase)
$User = target.user.userid
$User != ""
$Action = security_result.action
$Action !="UNKNOWN_ACTION"
$Vendor = metadata.vendor_name
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
$Latitude = principal.location.region_coordinates.latitude
$Longitude = principal.location.region_coordinates.longitude
$Location = strings.coalesce(target.location.country_or_region, principal.location.country_or_region)
match:
$Vendor, $Date, $Location, $Latitude, $Longitude
outcome:
$Count = count(metadata.id)
Os cinco principais usuários por tentativas de MFA com falha
$event_type = metadata.event_type
$event_type = "USER_LOGIN"
$product_name = metadata.product_name
$security_event_type = metadata.product_event_type
$requirement = additional.fields["AuthenticationRequirement"]
$result_value = security_result.detection_fields.value
(re.regex($product_name, "MULTI-FACTOR_AUTHENTICATION") or re.regex($security_event_type, `user.mfa`) nocase or re.regex($requirement, `multiFactorAuthentication`) nocase or re.regex($result_value, `MFA`) nocase)
$User = strings.coalesce(target.user.userid, principal.user.userid)
$User != ""
$email_id = strings.coalesce(target.user.email_addresses,principal.user.email_addresses)
$Action = security_result.action
$Action = "BLOCK"
$date = timestamp.get_date(metadata.event_timestamp.seconds)
match:
$User, $Action
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:5
Tendências de uso da MFA
$event_type = metadata.event_type
$event_type = "USER_LOGIN"
$product_name = metadata.product_name
$security_event_type = metadata.product_event_type
$requirement = additional.fields["AuthenticationRequirement"]
$result_value = security_result.detection_fields.value
(re.regex($product_name, "MULTI-FACTOR_AUTHENTICATION") or re.regex($security_event_type, `user.mfa`) nocase or re.regex($requirement, `multiFactorAuthentication`) nocase or re.regex($result_value, `MFA`) nocase)
$user = strings.coalesce(target.user.userid, principal.user.userid)
$user != ""
$email_id = strings.coalesce(target.user.email_addresses, principal.user.email_addresses)
$action = security_result.action
$action != "UNKNOWN_ACTION"
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
match:
$event_type, $Date
outcome:
$Count = count($event_type)
order:
$Date asc
Os cinco principais aplicativos acessados via MFA
$event_type = metadata.event_type
$event_type = "USER_LOGIN"
$product_name = metadata.product_name
$security_event_type = metadata.product_event_type
$requirement = additional.fields["AuthenticationRequirement"]
$result_value = security_result.detection_fields.value
(re.regex($product_name, "MULTI-FACTOR_AUTHENTICATION") or re.regex($security_event_type, `user.mfa`) or re.regex($requirement, `multiFactorAuthentication`) or re.regex($result_value, `MFA`))
$user = strings.coalesce(target.user.userid, principal.user.userid)
$user != ""
$email_id = strings.coalesce(target.user.email_addresses, principal.user.email_addresses)
$Application = target.application
$Application != ""
match:
$Application
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit : 5
Taxa de sucesso da MFA
$event_type = metadata.event_type
$event_type = "USER_LOGIN"
$product_name = metadata.product_name
$security_event_type = metadata.product_event_type
$requirement = additional.fields["AuthenticationRequirement"]
$result_value = security_result.detection_fields.value
(re.regex($product_name, "MULTI-FACTOR_AUTHENTICATION") or re.regex($security_event_type, `user.mfa`) nocase or re.regex($requirement, `multiFactorAuthentication`) nocase or re.regex($result_value, `MFA`) nocase)
$user = strings.coalesce(target.user.userid,principal.user.userid)
$user !=""
$email_id =strings.coalesce(target.user.email_addresses,principal.user.email_addresses)
$action = security_result.action
$vendor = metadata.vendor_name
$date = timestamp.get_date(metadata.event_timestamp.seconds)
match:
$date
outcome:
$total_attempts = count(metadata.id)
$successful_attempts = sum(if(any security_result.action = "ALLOW", 1, 0)) // Sums only successful MFA attempts
$success_rate = (($successful_attempts / $total_attempts) * 100 )
order: $date asc
Taxa de sucesso da MFA
$event_type = metadata.event_type
$event_type = "USER_LOGIN"
$product_name = metadata.product_name
$security_event_type = metadata.product_event_type
$requirement = additional.fields["AuthenticationRequirement"]
$result_value = security_result.detection_fields.value
(re.regex($product_name, "MULTI-FACTOR_AUTHENTICATION") or re.regex($security_event_type, `user.mfa`) or re.regex($requirement, `multiFactorAuthentication`) or re.regex($result_value, `MFA`))
$user = strings.coalesce(target.user.userid,principal.user.userid)
$user !=""
$email_id =strings.coalesce(target.user.email_addresses,principal.user.email_addresses)
$action = security_result.action
$vendor = metadata.vendor_name
$date = timestamp.get_date(metadata.event_timestamp.seconds)
match:
$date
outcome:
$total_attempts = count(metadata.id)
$successful_attempts = sum(if(any security_result.action = "ALLOW", 1, 0)) // Sums only successful MFA attempts
$success_rate = (($successful_attempts / $total_attempts) * 100 )
order: $date asc
Os cinco principais aplicativos acessados via MFA
$event_type = metadata.event_type
$event_type = "USER_LOGIN"
$product_name = metadata.product_name
$security_event_type = metadata.product_event_type
$requirement = additional.fields["AuthenticationRequirement"]
$result_value = security_result.detection_fields.value
(re.regex($product_name, "MULTI-FACTOR_AUTHENTICATION") or re.regex($security_event_type, `user.mfa`) nocase or re.regex($requirement, `multiFactorAuthentication`) nocase or re.regex($result_value, `MFA`) nocase)
$user = strings.coalesce(target.user.userid, principal.user.userid)
$user != ""
$email_id = strings.coalesce(target.user.email_addresses, principal.user.email_addresses)
$Application = target.application
match:
$Application
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit : 5
Tentativas de MFA bloqueadas por motivo
$product_name = metadata.product_name
$security_event_type = metadata.product_event_type
$requirement = additional.fields["AuthenticationRequirement"]
$result_value = security_result.detection_fields.value
(re.regex($product_name, "MULTI-FACTOR_AUTHENTICATION") or re.regex($security_event_type, `user.mfa`) or re.regex($requirement, `multiFactorAuthentication`) or re.regex($result_value, `MFA`))
$user = strings.coalesce(target.user.userid, principal.user.userid)
$user != ""
$action = security_result.action
$action = "BLOCK"
$Reason = security_result.summary
$Reason != ""
$Location = principal.location.country_or_region
match:
$Reason, $Location
outcome:
$Count = count(metadata.id)
order:
$Count desc
Status do registro da MFA
$event_type = metadata.event_type
$event_type = "USER_CREATION"
$security_event_type = metadata.product_event_type
$security_event_type = "enrollment"
$product_name = metadata.product_name
$requirement = additional.fields["AuthenticationRequirement"]
$result_value = security_result.detection_fields.value
(re.regex($product_name, "MULTI-FACTOR_AUTHENTICATION") or re.regex($requirement, `multiFactorAuthentication`) or re.regex($result_value, `MFA`))
$summary = security_result.summary
$summary != ""
$user = strings.coalesce(target.user.userid, principal.user.userid)
$user != ""
$email_id = strings.coalesce(target.user.email_addresses, principal.user.email_addresses)
$action = security_result.action
$vendor = metadata.vendor_name
$date = timestamp.get_date(metadata.event_timestamp.seconds)
match:
$summary
outcome:
$event_count = count(metadata.id)
order:
$event_count desc
Taxa de falha de MFA
$event_type = metadata.event_type
$event_type = "USER_LOGIN"
$product_name = metadata.product_name
$security_event_type = metadata.product_event_type
$requirement = additional.fields["AuthenticationRequirement"]
$result_value = security_result.detection_fields.value
(re.regex($product_name, "MULTI-FACTOR_AUTHENTICATION") or re.regex($security_event_type, `user.mfa`) nocase or re.regex($requirement, `multiFactorAuthentication`) nocase or re.regex($result_value, `MFA`) nocase)
$user = strings.coalesce(target.user.userid, principal.user.userid)
$user != ""
$email_id =strings.coalesce(target.user.email_addresses, principal.user.email_addresses)
$action = security_result.action
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
match:
$Date
outcome:
$total_attempts = count(metadata.id)
$failure_attempts = sum(if(any security_result.action = "BLOCK", 1, 0)) // Sums only failure MFA attempts
$failure_rate = (($failure_attempts / $total_attempts) * 100 )
order:
$Date asc
Detecção de bypass da MFA do Okta
$event_type = metadata.event_type
$event_type = "USER_UNCATEGORIZED"
$vendor = metadata.vendor_name
$vendor = /Okta/
$security_event_type = metadata.product_event_type
$security_event_type = "user.mfa.attempt_bypass"
$User = principal.user.user_display_name
$Summary = security_result.summary
$Action = security_result.action
$Action != "UNKNOWN_ACTION"
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
match:
$User, $Action, $Date,$Summary, $security_event_type
outcome:
$Count = count(metadata.id)
order:
$Count desc
Os cinco principais usuários por tentativas de MFA com falha
$event_type = metadata.event_type
$event_type = "USER_LOGIN"
$product_name = metadata.product_name
$security_event_type = metadata.product_event_type
$requirement = additional.fields["AuthenticationRequirement"]
$result_value = security_result.detection_fields.value
(re.regex($product_name, "MULTI-FACTOR_AUTHENTICATION") or re.regex($security_event_type, `user.mfa`) or re.regex($requirement, `multiFactorAuthentication`) or re.regex($result_value, `MFA`))
$User = strings.coalesce(target.user.userid, principal.user.userid)
$User != ""
$email_id = strings.coalesce(target.user.email_addresses,principal.user.email_addresses)
$Action = security_result.action
$Action = "BLOCK"
$date = timestamp.get_date(metadata.event_timestamp.seconds)
match:
$User, $Action
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:5
Tentativas de MFA ao longo do tempo
$event_type = metadata.event_type
$event_type = "USER_LOGIN"
$product_name = metadata.product_name
$security_event_type = metadata.product_event_type
$requirement = additional.fields["AuthenticationRequirement"]
$result_value = security_result.detection_fields.value
(re.regex($product_name, "MULTI-FACTOR_AUTHENTICATION") or re.regex($security_event_type, `user.mfa`) or re.regex($requirement, `multiFactorAuthentication`) or re.regex($result_value, `MFA`))
$user = strings.coalesce(target.user.userid, principal.user.userid)
$user != ""
$email_id = strings.coalesce(target.user.email_addresses, principal.user.email_addresses)
$action = security_result.action
$action != "UNKNOWN_ACTION"
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
$Location = principal.location.country_or_region
match:
$Date, $Location
outcome:
$Count = count(metadata.id)
order:
$Date asc
Alertas de falha na MFA
$event_type = metadata.event_type
$event_type = "USER_LOGIN"
$product_name = metadata.product_name
$security_event_type = metadata.product_event_type
$requirement = additional.fields["AuthenticationRequirement"]
$result_value = security_result.detection_fields.value
(re.regex($product_name, "MULTI-FACTOR_AUTHENTICATION") or re.regex($security_event_type, `user.mfa`) or re.regex($requirement, `multiFactorAuthentication`) or re.regex($result_value, `MFA`))
$user = strings.coalesce(target.user.userid, principal.user.userid)
$user != ""
$email_id = strings.coalesce(target.user.email_addresses, principal.user.email_addresses)
$action = security_result.action
$action = "BLOCK"
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
match:
$Date
outcome:
$Count = count(metadata.id)
$Action = array_distinct($action)
order:
$Date asc
Alertas de falha na MFA
$event_type = metadata.event_type
$event_type = "USER_LOGIN"
$product_name = metadata.product_name
$security_event_type = metadata.product_event_type
$requirement = additional.fields["AuthenticationRequirement"]
$result_value = security_result.detection_fields.value
(re.regex($product_name, "MULTI-FACTOR_AUTHENTICATION") or re.regex($security_event_type, `user.mfa`) nocase or re.regex($requirement, `multiFactorAuthentication`) nocase or re.regex($result_value, `MFA`) nocase)
$user = strings.coalesce(target.user.userid, principal.user.userid)
$user != ""
$email_id = strings.coalesce(target.user.email_addresses, principal.user.email_addresses)
$action = security_result.action
$action = "BLOCK"
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
match:
$Date
outcome:
$Count = count(metadata.id)
$Action = array_distinct($action)
order:
$Date asc
Status do registro da MFA
$event_type = metadata.event_type
$event_type = "USER_CREATION"
$security_event_type = metadata.product_event_type
$security_event_type = "enrollment"
$product_name = metadata.product_name
$requirement = additional.fields["AuthenticationRequirement"]
$result_value = security_result.detection_fields.value
(re.regex($product_name, "MULTI-FACTOR_AUTHENTICATION") or re.regex($requirement, `multiFactorAuthentication`) nocase or re.regex($result_value, `MFA`) nocase)
$summary = security_result.summary
$summary != ""
$user = strings.coalesce(target.user.userid, principal.user.userid)
$user != ""
$email_id = strings.coalesce(target.user.email_addresses, principal.user.email_addresses)
$action = security_result.action
$vendor = metadata.vendor_name
$date = timestamp.get_date(metadata.event_timestamp.seconds)
match:
$summary
outcome:
$event_count = count(metadata.id)
order:
$event_count desc
Tendências de uso da MFA
$event_type = metadata.event_type
$event_type = "USER_LOGIN"
$product_name = metadata.product_name
$security_event_type = metadata.product_event_type
$requirement = additional.fields["AuthenticationRequirement"]
$result_value = security_result.detection_fields.value
(re.regex($product_name, "MULTI-FACTOR_AUTHENTICATION") or re.regex($security_event_type, `user.mfa`) or re.regex($requirement, `multiFactorAuthentication`) or re.regex($result_value, `MFA`))
$user = strings.coalesce(target.user.userid, principal.user.userid)
$user != ""
$email_id = strings.coalesce(target.user.email_addresses, principal.user.email_addresses)
$action = security_result.action
$action != "UNKNOWN_ACTION"
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
match:
$event_type, $Date
outcome:
$Count = count($event_type)
order:
$Date asc
NIST 800-53: controle de acesso
Esse painel oferece uma visão geral abrangente das atividades de controle de acesso alinhadas aos padrões NIST 800-53. Ele rastreia tendências de acesso em várias fontes, políticas e geolocalizações para identificar riscos, simplificar o monitoramento e fortalecer o gerenciamento de controle de acesso. Este painel usa a lista de referência nist_compliance_assets para restringir os dados ao ambiente do NIST.
Observação : os gráficos neste painel não são carregados até que as listas de referência necessárias sejam criadas.
Bloqueios de conta de usuário
Falhas de login recentes (últimas 24 horas)
Nome do gráfico
Exemplo de consulta
Bloqueios de conta de usuário
metadata.description = /locked out/ nocase
$Summary = metadata.description
$Log_Type = metadata.log_type
$Hostname = strings.coalesce(principal.hostname,principal.asset.hostname,target.hostname,target.asset.hostname)
$User = strings.coalesce(principal.user.userid, principal.user.user_display_name, principal.user.email_addresses,target.user.userid,target.user.user_display_name,target.user.email_addresses )
//If the user requires any inclusions for specific assets, these lines will need to be enabled in the query and update the NIST_Compliance_Assets reference list as needed.
//$Source_IP = strings.coalesce(principal.asset.ip, principal.ip)
//strings.coalesce($Hostname, $Source_IP) in %NIST_Compliance_Assets
match:
$Summary, $User, $Hostname, $Log_Type
outcome:
$Date = timestamp.get_timestamp(max(metadata.event_timestamp.seconds ), "%F %T")
$Count = count(metadata.id)
order:
$Count desc
Falhas de login recentes (últimas 24 horas)
metadata.event_type = "USER_LOGIN"
security_result.action = "BLOCK"
$Log_Type = metadata.log_type
$Source_IP = strings.coalesce(principal.ip, principal.asset.ip)
$Summary = strings.coalesce(security_result.summary, security_result.description, metadata.description, security_result.rule_name)
$Hostname = strings.coalesce(principal.hostname,principal.asset.hostname,target.hostname,target.asset.hostname)
$User = strings.coalesce(principal.user.userid, principal.user.user_display_name, principal.user.email_addresses,target.user.userid,target.user.user_display_name,target.user.email_addresses )
//If the user requires any inclusions for specific assets, these lines will need to be enabled in the query and update the NIST_Compliance_Assets reference list as needed.
//$Destination_IP = strings.coalesce(principal.asset.ip, principal.ip)
//strings.coalesce($Hostname, $Source_IP, $Destination_IP) in %NIST_Compliance_Assets
match:
$Summary, $User,$Hostname, $Source_IP, $Log_Type
outcome:
$Date = timestamp.get_timestamp(max(metadata.event_timestamp.seconds ), "%F %T")
$Count = count(metadata.id)
order:
$Count desc
NIST 800-53: auditoria e responsabilidade
Esse painel oferece uma visão geral abrangente do gerenciamento de registros, alinhada aos padrões NIST 800-53, permitindo monitorar e gerenciar registros de auditoria de maneira eficaz para fins de segurança e compliance.
NIST 800-53: identificação e autenticação
Esse painel oferece uma visão geral abrangente das atividades de identidade e autenticação, alinhadas aos padrões NIST 800-53. Ele rastreia métricas importantes, como alterações de senha, gerenciamento de contas, atualizações de permissões e atividade de autenticação multifator (MFA). Essa ferramenta ajuda a garantir a conformidade com os processos de identidade e autenticação, protegendo sistemas e dados sensíveis.
Taxa de sucesso da MFA
Mudanças de permissão ao longo do tempo
Os 10 principais iniciadores que criam contas de usuário
Os 10 principais iniciadores que excluíram contas de usuário
Os 10 principais iniciadores de criação de grupos
Eventos do usuário ao longo do tempo
Eventos ao longo do tempo
Modificações recentes de papéis
Criações de grupos recentes
Os 10 principais iniciadores que excluem papéis
Exclusões recentes de contas de usuário
Os 10 principais iniciadores que excluem grupos
Taxa de falha de MFA
Mudanças recentes de permissão
Exclusões recentes de grupos
Os 10 principais iniciadores que modificam papéis
Criações recentes de contas de usuário
Exclusões de função recentes
Os 10 principais iniciadores que criam papéis
Modificações recentes na conta de usuários
Mudanças de senha ao longo do tempo
10 principais iniciadores que modificam grupos
Criações de função recentes
Status do registro da MFA
Os 10 principais iniciadores que modificam contas de usuário
Eventos de função ao longo do tempo
Modificações recentes em grupos
Eventos de grupo ao longo do tempo
Nome do gráfico
Exemplo de consulta
Taxa de sucesso da MFA
metadata.product_name = "MULTI-FACTOR_AUTHENTICATION"
or metadata.product_event_type = /mfa(?:\S)?auth|auth(?:.*)?mfa/ nocase
$Log_Type = metadata.log_type
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
//If the user requires any inclusions for specific assets, these lines will need to be enabled in the query and update the NIST_Compliance_Assets reference list as needed.
//$Hostname = strings.coalesce(principal.asset.hostname, principal.hostname)
//$Source_IP = strings.coalesce(principal.asset.ip, principal.ip)
//strings.coalesce($Hostname, $Source_IP) in %NIST_Compliance_Assets
match:
$Date, $Log_Type
outcome:
$Count = count(metadata.id)
$Successful_Attempts = sum(if(security_result.action = "ALLOW", 1, 0))
$Success_Rate = (($Successful_Attempts / $Count) * 100)
order:
$Date desc
Mudanças de permissão ao longo do tempo
metadata.event_type = "RESOURCE_PERMISSIONS_CHANGE"
or metadata.event_type = "USER_CHANGE_PERMISSIONS"
or metadata.event_type = "USER_RESOURCE_UPDATE_PERMISSIONS"
security_result.action = "ALLOW"
$Log_Type = metadata.log_type
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
//If the user requires any inclusions for specific assets, these lines will need to be enabled in the query and update the NIST_Compliance_Assets reference list as needed.
//$Hostname = strings.coalesce(principal.asset.hostname, principal.hostname)
//$Source_IP = strings.coalesce(principal.asset.ip, principal.ip)
//strings.coalesce($Hostname, $Source_IP) in %NIST_Compliance_Assets
match:
$Date, $Log_Type
outcome:
$Count = count(metadata.id)
order:
$Date desc
Os 10 principais iniciadores que criam contas de usuário
metadata.event_type = "USER_CREATION"
security_result.action = "ALLOW"
$Log_Source = metadata.log_type
$Initiator = principal.user.userid
//If the user requires any inclusions for specific assets, these lines will need to be enabled in the query and update the NIST_Compliance_Assets reference list as needed.
//$Source_IP = strings.coalesce(principal.asset.ip, principal.ip)
//$Hostname = strings.coalesce(principal.asset.hostname, principal.hostname)
//strings.coalesce($Hostname, $Source_IP) in %NIST_Compliance_Assets
match:
$Initiator, $Log_Source
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
Os 10 principais iniciadores que excluíram contas de usuário
metadata.event_type = "USER_DELETION"
security_result.action = "ALLOW"
$Log_Source = metadata.log_type
$Initiator = principal.user.userid
//If the user requires any inclusions for specific assets, these lines will need to be enabled in the query and update the NIST_Compliance_Assets reference list as needed.
//$Source_IP = strings.coalesce(principal.asset.ip, principal.ip)
//$Hostname = strings.coalesce(principal.asset.hostname, principal.hostname)
//strings.coalesce($Hostname, $Source_IP) in %NIST_Compliance_Assets
match:
$Initiator, $Log_Source
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
Os 10 principais iniciadores de criação de grupos
metadata.event_type = "GROUP_CREATION"
or metadata.product_event_type = /add group/ nocase
security_result.action = "ALLOW"
$Log_Source = metadata.log_type
$Initiator = principal.user.userid
//If the user requires any inclusions for specific assets, these lines will need to be enabled in the query and update the NIST_Compliance_Assets reference list as needed.
//$Source_IP = strings.coalesce(principal.asset.ip, principal.ip)
//$Hostname = strings.coalesce(principal.asset.hostname, principal.hostname)
//strings.coalesce($Hostname, $Source_IP) in %NIST_Compliance_Assets
match:
$Initiator, $Log_Source
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
Eventos do usuário ao longo do tempo
metadata.event_type = "USER_CREATION"
or metadata.event_type = "USER_DELETION"
or metadata.event_type = "USER_CHANGE_PERMISSIONS"
or metadata.event_type = "USER_CHANGE_PASSWORD"
or metadata.event_type = "USER_RESOURCE_UPDATE_PERMISSIONS"
security_result.action = "ALLOW"
$Event_Type = metadata.event_type
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
//If the user requires any inclusions for specific assets, these lines will need to be enabled in the query and update the NIST_Compliance_Assets reference list as needed.
//$Hostname = strings.coalesce(principal.asset.hostname, principal.hostname)
//$Source_IP = strings.coalesce(principal.asset.ip, principal.ip)
//strings.coalesce($Hostname, $Source_IP) in %NIST_Compliance_Assets
match:
$Date, $Event_Type
outcome:
$Count = count(metadata.id)
order:
$Date desc
Eventos ao longo do tempo
metadata.event_type = "USER_CREATION"
or metadata.event_type = "USER_DELETION"
or metadata.event_type = "USER_CHANGE_PERMISSIONS"
or metadata.event_type = "USER_CHANGE_PASSWORD"
or metadata.event_type = "USER_RESOURCE_UPDATE_PERMISSIONS"
or metadata.event_type = "GROUP_CREATION"
or metadata.event_type = "GROUP_DELETION"
or metadata.event_type = "GROUP_MODIFICATION"
security_result.action = "ALLOW"
$Event_Type = metadata.event_type
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
//If the user requires any inclusions for specific assets, these lines will need to be enabled in the query and update the NIST_Compliance_Assets reference list as needed.
//$Hostname = strings.coalesce(principal.asset.hostname, principal.hostname)
//$Source_IP = strings.coalesce(principal.asset.ip, principal.ip)
//strings.coalesce($Hostname, $Source_IP) in %NIST_Compliance_Assets
match:
$Date, $Event_Type
outcome:
$Count = count(metadata.id)
order:
$Date desc
Modificações recentes de papéis
metadata.product_event_type = /UpdateRole|update role(?: definition)?/ nocase
security_result.action = "ALLOW"
$Date = timestamp.get_timestamp(metadata.event_timestamp.seconds, "%F %T ")
$Log_Source = metadata.log_type
$Source_IP = strings.coalesce(principal.asset.ip, principal.ip)
$Hostname = strings.coalesce(principal.asset.hostname, principal.hostname)
$Initiator = principal.user.userid
$Role_Modified = strings.coalesce(target.user.attribute.roles.name, target.resource.product_object_id, target.resource.name)
//If the user requires any inclusions for specific assets, these lines will need to be enabled in the query and update the NIST_Compliance_Assets reference list as needed.
//strings.coalesce($Hostname, $Source_IP) in %NIST_Compliance_Assets
match:
$Date, $Log_Source, $Source_IP, $Hostname, $Initiator, $Role_Modified
order:
$Date desc
Criações de grupos recentes
metadata.event_type = "GROUP_CREATION"
or metadata.product_event_type = /add group/ nocase
security_result.action = "ALLOW"
$Date = timestamp.get_timestamp(metadata.event_timestamp.seconds, "%F %T ")
$Log_Source = metadata.log_type
$Source_IP = strings.coalesce(principal.asset.ip, principal.ip)
$Hostname = strings.coalesce(principal.asset.hostname, principal.hostname)
$Product_Event = metadata.product_event_type
$Group_Name = target.group.group_display_name
//If the user requires any inclusions for specific assets, these lines will need to be enabled in the query and update the NIST_Compliance_Assets reference list as needed.
//strings.coalesce($Hostname, $Source_IP) in %NIST_Compliance_Assets
match:
$Date, $Log_Source, $Source_IP, $Hostname, $Product_Event, $Group_Name
order:
$Date desc
Os 10 principais iniciadores que excluem papéis
metadata.product_event_type = /DeleteRole|delete role definition/ nocase
security_result.action = "ALLOW"
$Log_Source = metadata.log_type
$Initiator = principal.user.userid
//If the user requires any inclusions for specific assets, these lines will need to be enabled in the query and update the NIST_Compliance_Assets reference list as needed.
//$Source_IP = strings.coalesce(principal.asset.ip, principal.ip)
//$Hostname = strings.coalesce(principal.asset.hostname, principal.hostname)
//strings.coalesce($Hostname, $Source_IP) in %NIST_Compliance_Assets
match:
$Initiator, $Log_Source
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
Exclusões recentes de contas de usuário
metadata.event_type = "USER_DELETION"
security_result.action = "ALLOW"
$Date = timestamp.get_timestamp(metadata.event_timestamp.seconds, "%F %T ")
$Log_Source = metadata.log_type
$Source_IP = strings.coalesce(principal.asset.ip, principal.ip)
$Hostname = strings.coalesce(principal.asset.hostname, principal.hostname)
$Initiator = principal.user.userid
$User_Deleted = target.user.userid
//If the user requires any inclusions for specific assets, these lines will need to be enabled in the query and update the NIST_Compliance_Assets reference list as needed.
//strings.coalesce($Hostname, $Source_IP) in %NIST_Compliance_Assets
match:
$Date, $Log_Source, $Source_IP, $Hostname, $Initiator, $User_Deleted
order:
$Date desc
Os 10 principais iniciadores que excluem grupos
metadata.event_type = "GROUP_DELETION"
or metadata.product_event_type = /delete group/ nocase
security_result.action = "ALLOW"
$Log_Source = metadata.log_type
$Initiator = principal.user.userid
//If the user requires any inclusions for specific assets, these lines will need to be enabled in the query and update the NIST_Compliance_Assets reference list as needed.
//$Source_IP = strings.coalesce(principal.asset.ip, principal.ip)
//$Hostname = strings.coalesce(principal.asset.hostname, principal.hostname)
//strings.coalesce($Hostname, $Source_IP) in %NIST_Compliance_Assets
match:
$Initiator, $Log_Source
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
Taxa de falha de MFA
metadata.product_name = "MULTI-FACTOR_AUTHENTICATION"
or metadata.product_event_type = /mfa(?:\S)?auth|auth(?:.*)?mfa/ nocase
$Log_Type = metadata.log_type
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
//If the user requires any inclusions for specific assets, these lines will need to be enabled in the query and update the NIST_Compliance_Assets reference list as needed.
//$Hostname = strings.coalesce(principal.asset.hostname, principal.hostname)
//$Source_IP = strings.coalesce(principal.asset.ip, principal.ip)
//strings.coalesce($Hostname, $Source_IP) in %NIST_Compliance_Assets
match:
$Date, $Log_Type
outcome:
$Count = count(metadata.id)
$Failed_Attempts = sum(if(security_result.action = "BLOCK", 1, 0))
$Failure_Rate = (($Failed_Attempts / $Count) * 100 )
order:
$Date desc
Mudanças recentes de permissão
metadata.event_type = "RESOURCE_PERMISSIONS_CHANGE"
or metadata.event_type = "USER_CHANGE_PERMISSIONS"
or metadata.event_type = "USER_RESOURCE_UPDATE_PERMISSIONS"
security_result.action = "ALLOW"
$Date = timestamp.get_timestamp(metadata.event_timestamp.seconds, "%F %T ")
$Log_Source = metadata.log_type
$Source_IP = strings.coalesce(principal.asset.ip, principal.ip)
$Hostname = strings.coalesce(principal.asset.hostname, principal.hostname)
$Initiator = principal.user.userid
$Description = metadata.description
//If the user requires any inclusions for specific assets, these lines will need to be enabled in the query and update the NIST_Compliance_Assets reference list as needed.
//strings.coalesce($Hostname, $Source_IP) in %NIST_Compliance_Assets
match:
$Date, $Log_Source, $Source_IP, $Hostname, $Initiator, $Description
order:
$Date desc
Exclusões recentes de grupos
metadata.event_type = "GROUP_DELETION"
or metadata.product_event_type = /delete group/ nocase
security_result.action = "ALLOW"
$Date = timestamp.get_timestamp(metadata.event_timestamp.seconds, "%F %T ")
$Log_Source = metadata.log_type
$Source_IP = strings.coalesce(principal.asset.ip, principal.ip)
$Hostname = strings.coalesce(principal.asset.hostname, principal.hostname)
$Product_Event = metadata.product_event_type
$Group_Name = target.group.group_display_name
//If the user requires any inclusions for specific assets, these lines will need to be enabled in the query and update the NIST_Compliance_Assets reference list as needed.
//strings.coalesce($Hostname, $Source_IP) in %NIST_Compliance_Assets
match:
$Date, $Log_Source, $Source_IP, $Hostname, $Product_Event, $Group_Name
order:
$Date desc
Os 10 principais iniciadores que modificam papéis
metadata.product_event_type = /UpdateRole|update role(?: definition)?/ nocase
security_result.action = "ALLOW"
$Log_Source = metadata.log_type
$Initiator = principal.user.userid
//If the user requires any inclusions for specific assets, these lines will need to be enabled in the query and update the NIST_Compliance_Assets reference list as needed.
//$Source_IP = strings.coalesce(principal.asset.ip, principal.ip)
//$Hostname = strings.coalesce(principal.asset.hostname, principal.hostname)
//strings.coalesce($Hostname, $Source_IP) in %NIST_Compliance_Assets
match:
$Initiator, $Log_Source
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
Criações recentes de contas de usuário
metadata.event_type = "USER_CREATION"
security_result.action = "ALLOW"
$Date = timestamp.get_timestamp(metadata.event_timestamp.seconds, "%F %T ")
$Log_Source = metadata.log_type
$Source_IP = strings.coalesce(principal.asset.ip, principal.ip)
$Hostname = strings.coalesce(principal.asset.hostname, principal.hostname)
$Initiator = principal.user.userid
$User_Created = target.user.userid
//If the user requires any inclusions for specific assets, these lines will need to be enabled in the query and update the NIST_Compliance_Assets reference list as needed.
//strings.coalesce($Hostname, $Source_IP) in %NIST_Compliance_Assets
match:
$Date, $Log_Source, $Source_IP, $Hostname, $Initiator, $User_Created
order:
$Date desc
Exclusões de função recentes
metadata.product_event_type = /DeleteRole|delete role definition/ nocase
security_result.action = "ALLOW"
$Date = timestamp.get_timestamp(metadata.event_timestamp.seconds, "%F %T ")
$Log_Source = metadata.log_type
$Source_IP = strings.coalesce(principal.asset.ip, principal.ip)
$Hostname = strings.coalesce(principal.asset.hostname, principal.hostname)
$Initiator = principal.user.userid
$Role_Deleted = strings.coalesce(target.user.attribute.roles.name, target.resource.product_object_id, target.resource.name)
//If the user requires any inclusions for specific assets, these lines will need to be enabled in the query and update the NIST_Compliance_Assets reference list as needed.
//strings.coalesce($Hostname, $source_IP) in %NIST_Compliance_Assets
match:
$Date, $Log_Source, $Source_IP, $Hostname, $Initiator, $Role_Deleted
order:
$Date desc
Os 10 principais iniciadores que criam papéis
metadata.product_event_type = /CreateRole|add role definition/ nocase
security_result.action = "ALLOW"
$Log_Source = metadata.log_type
$Initiator = principal.user.userid
//If the user requires any inclusions for specific assets, these lines will need to be enabled in the query and update the NIST_Compliance_Assets reference list as needed.
//$Source_IP = strings.coalesce(principal.asset.ip, principal.ip)
//$Hostname = strings.coalesce(principal.asset.hostname, principal.hostname)
//strings.coalesce($Hostname, $Source_IP) in %NIST_Compliance_Assets
match:
$Initiator, $Log_Source
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
Modificações recentes na conta de usuários
metadata.event_type = "USER_CHANGE_PERMISSIONS"
or metadata.event_type = "USER_CHANGE_PASSWORD"
or metadata.event_type = "USER_RESOURCE_UPDATE_PERMISSIONS"
security_result.action = "ALLOW"
$Date = timestamp.get_timestamp(metadata.event_timestamp.seconds, "%F %T ")
$Log_Source = metadata.log_type
$Source_IP = strings.coalesce(principal.asset.ip, principal.ip)
$Hostname = strings.coalesce(principal.asset.hostname, principal.hostname)
$Initiator = principal.user.userid
$User_Modified = target.user.userid
$Event_Type = metadata.event_type
//If the user requires any inclusions for specific assets, these lines will need to be enabled in the query and update the NIST_Compliance_Assets reference list as needed.
//strings.coalesce($Hostname, $Source_IP) in %NIST_Compliance_Assets
match:
$Date, $Log_Source, $Source_IP, $Hostname, $Initiator, $Event_Type, $User_Modified
order:
$Date desc
Mudanças de senha ao longo do tempo
metadata.event_type = "USER_CHANGE_PASSWORD"
security_result.action = "ALLOW"
$Log_Type = metadata.log_type
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
//If the user requires any inclusions for specific assets, these lines will need to be enabled in the query and update the NIST_Compliance_Assets reference list as needed.
//$Hostname = strings.coalesce(principal.asset.hostname, principal.hostname)
//$Source_IP = strings.coalesce(principal.asset.ip, principal.ip)
//strings.coalesce($Hostname, $Source_IP) in %NIST_Compliance_Assets
match:
$Date, $Log_Type
outcome:
$Count = count(metadata.id)
order:
$Date desc
10 principais iniciadores que modificam grupos
metadata.event_type = "GROUP_MODIFICATION"
and metadata.product_event_type = /(RemoveUserFrom|AddUserTo|Add member to |Remove member from )|(?:group)/ nocase
security_result.action = "ALLOW"
$Log_Source = metadata.log_type
$Initiator = principal.user.userid
//If the user requires any inclusions for specific assets, these lines will need to be enabled in the query and update the NIST_Compliance_Assets reference list as needed.
//$Source_IP = strings.coalesce(principal.asset.ip, principal.ip)
//$Hostname = strings.coalesce(principal.asset.hostname, principal.hostname)
//strings.coalesce($Hostname, $Source_IP) in %NIST_Compliance_Assets
match:
$Initiator, $Log_Source
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
Criações de função recentes
metadata.product_event_type = /CreateRole|add role definition/ nocase
security_result.action = "ALLOW"
$Date = timestamp.get_timestamp(metadata.event_timestamp.seconds, "%F %T ")
$Log_Source = metadata.log_type
$Source_IP = strings.coalesce(principal.asset.ip, principal.ip)
$Hostname = strings.coalesce(principal.asset.hostname, principal.hostname)
$Initiator = principal.user.userid
$Role_Created = strings.coalesce(target.user.attribute.roles.name, target.resource.product_object_id, target.resource.name)
//If the user requires any inclusions for specific assets, these lines will need to be enabled in the query and update the NIST_Compliance_Assets reference list as needed.
//strings.coalesce($Hostname, $Source_IP) in %NIST_Compliance_Assets
match:
$Date, $Log_Source, $Source_IP, $Hostname, $Initiator, $Role_Created
order:
$Date desc
Status do registro da MFA
metadata.product_name = "MULTI-FACTOR_AUTHENTICATION"
or strings.coalesce(additional.fields["AuthenticationRequirement"], security_result.detection_fields.value) = /mfa|multi(?:\s|\S)?factor(?:\s|\S)?authentication|/ nocase
metadata.product_event_type = "enrollment"
or target.resource_ancestors.resource_subtype = "AuthenticatorEnrollment"
$Result = security_result.summary
//If the user requires any inclusions for specific assets, these lines will need to be enabled in the query and update the NIST_Compliance_Assets reference list as needed.
//$Hostname = strings.coalesce(principal.asset.hostname, principal.hostname)
//$Source_IP = strings.coalesce(principal.asset.ip, principal.ip)
//strings.coalesce($Hostname, $Source_IP) in %NIST_Compliance_Assets
match:
$Result
outcome:
$Count = count(metadata.id)
order:
$Count desc
Os 10 principais iniciadores que modificam contas de usuário
metadata.event_type = "USER_CHANGE_PERMISSIONS"
or metadata.event_type = "USER_CHANGE_PASSWORD"
or metadata.event_type = "USER_RESOURCE_UPDATE_PERMISSIONS"
security_result.action = "ALLOW"
$Log_Source = metadata.log_type
$Initiator = principal.user.userid
//If the user requires any inclusions for specific assets, these lines will need to be enabled in the query and update the NIST_Compliance_Assets reference list as needed.
//$Source_IP = strings.coalesce(principal.asset.ip, principal.ip)
//$Hostname = strings.coalesce(principal.asset.hostname, principal.hostname)
//strings.coalesce($Hostname, $Source_IP) in %NIST_Compliance_Assets
match:
$Initiator, $Log_Source
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
Eventos de função ao longo do tempo
metadata.product_event_type = /CreateRole|add role definition/ nocase
or metadata.product_event_type = /DeleteRole|delete role definition/ nocase
or metadata.product_event_type = /UpdateRole|update role(?: definition)?/ nocase
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
$Product_Event = metadata.product_event_type
//If the user requires any inclusions for specific assets, these lines will need to be enabled in the query and update the NIST_Compliance_Assets reference list as needed.
//$Hostname = strings.coalesce(principal.asset.hostname, principal.hostname)
//$Source_IP = strings.coalesce(principal.asset.ip, principal.ip)
//strings.coalesce($Hostname, $Source_IP) in %NIST_Compliance_Assets
match:
$Date, $Product_Event
outcome:
$Count = count(metadata.id)
order:
$Date desc
Modificações recentes em grupos
metadata.event_type = "GROUP_MODIFICATION"
and metadata.product_event_type = /(RemoveUserFrom|AddUserTo|Add member to |Remove member from )|(?:group)/ nocase
security_result.action = "ALLOW"
$Date = timestamp.get_timestamp(metadata.event_timestamp.seconds, "%F %T ")
$Log_Source = metadata.log_type
$Source_IP = strings.coalesce(principal.asset.ip, principal.ip)
$Hostname = strings.coalesce(principal.asset.hostname, principal.hostname)
$Product_Event = metadata.product_event_type
$Group_Name = target.group.group_display_name
//If the user requires any inclusions for specific assets, these lines will need to be enabled in the query and update the NIST_Compliance_Assets reference list as needed.
//strings.coalesce($Hostname, $Source_IP) in %NIST_Compliance_Assets
match:
$Date, $Log_Source, $Source_IP, $Hostname, $Product_Event, $Group_Name
order:
$Date desc
Eventos de grupo ao longo do tempo
metadata.event_type = "GROUP_CREATION"
or metadata.event_type = "GROUP_DELETION"
or metadata.product_event_type = /add group/ nocase
or metadata.product_event_type = /delete group/ nocase
or (metadata.event_type = "GROUP_MODIFICATION"
and metadata.product_event_type = /(RemoveUserFrom|AddUserTo|Add member to |Remove member from )|(?:group)/ nocase)
$Event_Type = metadata.event_type
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
//If the user requires any inclusions for specific assets, these lines will need to be enabled in the query and update the NIST_Compliance_Assets reference list as needed.
//$Hostname = strings.coalesce(principal.asset.hostname, principal.hostname)
//$Source_IP = strings.coalesce(principal.asset.ip, principal.ip)
//strings.coalesce($Hostname, $Source_IP) in %NIST_Compliance_Assets
match:
$Date, $Event_Type
outcome:
$Count = count(metadata.id)
order:
$Date desc
Esse painel oferece uma visão geral abrangente das atividades de proteção de mídia, alinhadas aos padrões NIST 800-53. Ele rastreia eventos de segurança por ação e frequência, destacando tendências importantes, como regras acionadas com frequência, principais hosts, endereços IP e usuários. Essa ferramenta ajuda você a aplicar a conformidade para proteger recursos de mídia sensíveis.
10 principais usuários por ação
10 principais nomes de host de origem por ação
10 principais locais de alerta de fornecedor
Alertas recentes de fornecedores
10 principais alertas de fornecedor por ação
10 principais IPs de origem por ação
Eventos ao longo do tempo por ação
Nome do gráfico
Exemplo de consulta
10 principais usuários por ação
strings.coalesce(metadata.product_event_type, security_result.rule_name, security_result.summary) = /\busb|removable|drive\b/ nocase
$Action = security_result.action
$User = principal.user.userid
$User != ""
//If the user requires any inclusions for specific assets, these lines will need to be enabled in the query and update the NIST_Compliance_Assets reference list as needed.
//$Hostname = strings.coalesce(principal.asset.hostname, principal.hostname)
//$Source_IP = strings.coalesce(principal.asset.ip, principal.ip)
//strings.coalesce($Hostname, $Source_IP) in %NIST_Compliance_Assets
match:
$User, $Action
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
10 principais nomes de host de origem por ação
strings.coalesce(metadata.product_event_type, security_result.rule_name, security_result.summary) = /\busb|removable|drive\b/ nocase
$Action = security_result.action
$Hostname = principal.hostname
$Hostname != ""
//If the user requires any inclusions for specific assets, these lines will need to be enabled in the query and update the NIST_Compliance_Assets reference list as needed.
//$Hostname = strings.coalesce(principal.asset.hostname, principal.hostname)
//$Source_IP = strings.coalesce(principal.asset.ip, principal.ip)
//strings.coalesce($Hostname, $Source_IP) in %NIST_Compliance_Assets
match:
$Hostname, $Action
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
10 principais locais de alerta de fornecedor
strings.coalesce(metadata.product_event_type, security_result.rule_name, security_result.summary) = /\busb|removable|drive\b/ nocase
$Alert = strings.coalesce(metadata.product_event_type, security_result.rule_name, security_result.summary)
$Country = target.location.country_or_region
$Latitude = target.location.region_coordinates.latitude
$Longitude = target.location.region_coordinates.longitude
//If the user requires any inclusions for specific assets, these lines will need to be enabled in the query and update the NIST_Compliance_Assets reference list as needed.
//$Hostname = strings.coalesce(principal.asset.hostname, principal.hostname)
//$Source_IP = strings.coalesce(principal.asset.ip, principal.ip)
//strings.coalesce($Hostname, $Source_IP) in %NIST_Compliance_Assets
match:
$Alert, $Country, $Latitude, $Longitude
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
Alertas recentes de fornecedores
strings.coalesce(metadata.product_event_type, security_result.rule_name, security_result.summary) = /\busb|drive\b/ nocase
$Vendor_Alert = strings.coalesce(metadata.product_event_type, security_result.rule_name, security_result.summary)
$User = strings.coalesce(principal.user.user_display_name, target.user.user_display_name)
$Source_IP = strings.coalesce(principal.asset.ip, principal.ip)
$File_Name = target.file.full_path
$Action = security_result.action
$Date = timestamp.get_timestamp(metadata.event_timestamp.seconds, "%F %T ")
//If the user requires any inclusions for specific assets, these lines will need to be enabled in the query and update the NIST_Compliance_Assets reference list as needed.
//$Hostname = strings.coalesce(principal.asset.hostname, principal.hostname)
//strings.coalesce($Hostname, $Source_IP) in %NIST_Compliance_Assets
match:
$Date, $Vendor_Alert, $Source_IP, $User, $File_Name, $Action
order:
$Date desc
10 principais alertas de fornecedor por ação
strings.coalesce(metadata.product_event_type, security_result.rule_name, security_result.summary) = /\busb|removable|drive\b/ nocase
$Action = security_result.action
$Alerts = strings.coalesce(metadata.product_event_type, security_result.rule_name, security_result.summary)
//If the user requires any inclusions for specific assets, these lines will need to be enabled in the query and update the NIST_Compliance_Assets reference list as needed.
//$Hostname = strings.coalesce(principal.asset.hostname, principal.hostname)
//$Source_IP = strings.coalesce(principal.asset.ip, principal.ip)
//strings.coalesce($Hostname, $Source_IP) in %NIST_Compliance_Assets
match:
$Alerts, $Action
outcome:
$Count = count_distinct(metadata.id)
order:
$Count desc
limit:
10
10 principais IPs de origem por ação
strings.coalesce(metadata.product_event_type, security_result.rule_name, security_result.summary) = /\busb|removable|drive\b/ nocase
$Action = security_result.action
$IP_Address = principal.ip
$IP_Address != ""
//If the user requires any inclusions for specific assets, these lines will need to be enabled in the query and update the NIST_Compliance_Assets reference list as needed.
//$Hostname = strings.coalesce(principal.asset.hostname, principal.hostname)
//$Source_IP = strings.coalesce(principal.asset.ip, principal.ip)
//strings.coalesce($Hostname, $Source_IP) in %NIST_Compliance_Assets
match:
$IP_Address, $Action
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
Eventos ao longo do tempo por ação
strings.coalesce(metadata.product_event_type, security_result.rule_name, security_result.summary) = /\busb|removable|drive\b/ nocase
$Action = security_result.action
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
//If the user requires any inclusions for specific assets, these lines will need to be enabled in the query and update the NIST_Compliance_Assets reference list as needed.
//$Hostname = strings.coalesce(principal.asset.hostname, principal.hostname)
//$Source_IP = strings.coalesce(principal.asset.ip, principal.ip)
//strings.coalesce($Hostname, $Source_IP) in %NIST_Compliance_Assets
match:
$Date, $Action
outcome:
$Count = count(metadata.id)
order:
$Date desc
NIST 800-53: proteção de sistemas e comunicações
Esse painel de controle aumenta a segurança e a conformidade ao fornecer insights sobre as defesas do sistema e da rede. Ele monitora a atividade do sensor EDR, eventos do SDI/IPS, DDOS e anomalias de tráfego de rede para detectar possíveis ameaças, garantindo a adesão aos padrões de segurança do NIST. Ele usa a lista de referência nist_compliance_assets para restringir os dados ao ambiente do NIST.
Observação : os gráficos neste painel não são carregados até que as listas de referência necessárias sejam criadas.
Eventos do SDI / IPS por categoria
Atividades de DDoS
Tráfego de rede ao longo do tempo por ação
Tráfego de entrada bloqueado por geolocalização
Eventos de USB
Atividades maliciosas com base na rede
Alertas de fornecedores de EDR
Comunicação criptografada fraca ao longo do tempo por tipo de registro
Os 10 principais alertas de fornecedores SDI / IPS por gravidade
10 principais hosts em eventos de EDR por tipo de registro
Tráfego de saída bloqueado por geolocalização
Tráfego de rede ao longo do tempo por direção
Nome do gráfico
Exemplo de consulta
Eventos do SDI / IPS por categoria
metadata.event_type = "SCAN_UNCATEGORIZED"
or metadata.event_type = "SCAN_NETWORK"
or metadata.event_type = "NETWORK_UNCATEGORIZED"
or metadata.event_type = "NETWORK_FLOW"
or metadata.event_type = "NETWORK_CONNECTION"
or metadata.event_type = "NETWORK_FTP"
or metadata.event_type = "NETWORK_DHCP"
or metadata.event_type = "NETWORK_DNS"
or metadata.event_type = "NETWORK_HTTP"
or metadata.event_type = "NETWORK_SMTP"
$Category = security_result.category
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
//If the user requires any inclusions for specific assets, these lines will need to be enabled in the query and update the NIST_Compliance_Assets reference list as needed.
//$Hostname = strings.coalesce(principal.asset.hostname, principal.hostname, target.asset.hostname, target.hostname)
//$Source_IP = strings.coalesce(principal.asset.ip, principal.ip)
//$Destination_IP = strings.coalesce(target.asset.ip, target.ip)
//strings.coalesce($Hostname, $Destination_IP, $Source_IP) in %NIST_Compliance_Assets
match:
$Category
outcome:
$Count = count(metadata.id)
Atividades de DDoS
(metadata.log_type = /ddos/ nocase or (security_result.description = /ddos/ nocase or security_result.summary = /ddos/ nocase or metadata.description = /ddos/ nocase or security_result.rule_name = /ddos/ nocase or metadata.product_event_type = /ddos/ nocase))
$Summary = strings.coalesce(security_result.description, security_result.summary, metadata.description, security_result.rule_name, metadata.product_event_type)
$Action = security_result.action
$Log_Type = metadata.log_type
$Hostname = strings.coalesce(principal.hostname, principal.asset.hostname, target.asset.hostname, target.hostname)
$Source_IP = strings.coalesce(principal.asset.ip, principal.ip)
$Destination_IP = strings.coalesce(target.asset.ip, target.ip)
//If the user requires any inclusions for specific assets, these lines will need to be enabled in the query and update the NIST_Compliance_Assets reference list as needed.
//strings.coalesce($Hostname, $Source_IP, $Destination_IP) in %NIST_Compliance_Assets
match:
$Summary, $Hostname, $Source_IP, $Destination_IP, $Action, $Log_Type
outcome:
$Count = count(metadata.id)
$Date = timestamp.get_timestamp(max(metadata.event_timestamp.seconds), "%F %T")
order:
$Count desc
Tráfego de rede ao longo do tempo por ação
metadata.event_type = "NETWORK_UNCATEGORIZED"
or metadata.event_type = "NETWORK_FLOW"
or metadata.event_type = "NETWORK_CONNECTION"
or metadata.event_type = "NETWORK_FTP"
or metadata.event_type = "NETWORK_DHCP"
or metadata.event_type = "NETWORK_DNS"
or metadata.event_type = "NETWORK_HTTP"
or metadata.event_type = "NETWORK_SMTP"
$Action = security_result.action
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
//If the user requires any inclusions for specific assets, these lines will need to be enabled in the query and update the NIST_Compliance_Assets reference list as needed.
//$Hostname = strings.coalesce(principal.asset.hostname, principal.hostname,target.hostname, target.asset.hostname)
//$Source_IP = strings.coalesce(principal.asset.ip, principal.ip)
//$Destination_IP = strings.coalesce(target.asset.ip, target.ip)
//strings.coalesce($Hostname, $Source_IP) in %NIST_Compliance_Assets
match:
$Date, $Action
outcome:
$Count = count(metadata.id)
Tráfego de entrada bloqueado por geolocalização
metadata.event_type = "NETWORK_UNCATEGORIZED"
or metadata.event_type = "NETWORK_FLOW"
or metadata.event_type = "NETWORK_CONNECTION"
or metadata.event_type = "NETWORK_FTP"
or metadata.event_type = "NETWORK_DHCP"
or metadata.event_type = "NETWORK_DNS"
or metadata.event_type = "NETWORK_HTTP"
or metadata.event_type = "NETWORK_SMTP"
security_result.action = "BLOCK"
network.direction = "INBOUND"
$Country = principal.location.country_or_region
$Country != ""
//If the user requires any inclusions for specific assets, these lines will need to be enabled in the query and update the NIST_Compliance_Assets reference list as needed.
//$Hostname = strings.coalesce(principal.asset.hostname, principal.hostname, target.asset.hostname, target.hostname)
//$Source_IP = strings.coalesce(principal.asset.ip, principal.ip)
//$Destination_IP = strings.coalesce(target.asset.ip, target.ip)
//strings.coalesce($Hostname, $Source_IP, $Destination_IP) in %NIST_Compliance_Assets
match:
$Country
outcome:
$Count = count(metadata.id)
$Latitude = max(principal.location.region_coordinates.latitude)
$Longitude = max(principal.location.region_coordinates.longitude)
order:
$Count desc
Eventos de USB
(metadata.product_event_type = /usb/ nocase or security_result.summary = /usb/ nocase )
$Log_Type = metadata.log_type
$USB_Event = strings.coalesce(metadata.product_event_type, security_result.summary)
$Category = security_result.category_details
$Source_IP = strings.coalesce(principal.ip, principal.asset.ip)
$Hostname = strings.coalesce(principal.asset.hostname, principal.hostname)
$User = strings.coalesce(principal.user.userid, principal.user.user_display_name, principal.user.email_addresses, target.user.userid, target.user.user_display_name, target.user.email_addresses)
//If the user requires any inclusions for specific assets, these lines will need to be enabled in the query and update the NIST_Compliance_Assets reference list as needed.
//strings.coalesce($Hostname, $Source_IP) in %NIST_Compliance_Assets
match:
$Log_Type, $USB_Event, $User, $Hostname, $Source_IP, $Category
outcome:
$Count = count(metadata.id)
$Date = timestamp.get_timestamp(max(metadata.event_timestamp.seconds), "%F %T")
order:
$Count desc
Atividades maliciosas com base na rede
metadata.event_type = "NETWORK_UNCATEGORIZED"
or metadata.event_type = "NETWORK_FLOW"
or metadata.event_type = "NETWORK_CONNECTION"
or metadata.event_type = "NETWORK_FTP"
or metadata.event_type = "NETWORK_DHCP"
or metadata.event_type = "NETWORK_DNS"
or metadata.event_type = "NETWORK_HTTP"
or metadata.event_type = "NETWORK_SMTP"
(security_result.category = "NETWORK_DENIAL_OF_SERVICE" or security_result.category = "NETWORK_MALICIOUS" or security_result.category = "NETWORK_SUSPICIOUS" or security_result.category = "SOFTWARE_MALICIOUS" or security_result.category = "SOFTWARE_SUSPICIOUS" or security_result.category = "NETWORK_RECON")
$Log_Type = metadata.log_type
$Category = security_result.category
$Summary = strings.coalesce(security_result.description, security_result.summary, metadata.description, security_result.rule_name, metadata.product_event_type)
$Hostname = strings.coalesce(principal.asset.hostname, principal.hostname, target.hostname, target.asset.hostname)
//If the user requires any inclusions for specific assets, these lines will need to be enabled in the query and update the NIST_Compliance_Assets reference list as needed.
//$Source_IP = strings.coalesce(principal.asset.ip, principal.ip)
//$Destination_IP = strings.coalesce(principal.asset.ip, principal.ip)
//strings.coalesce($Hostname, $Source_IP, $Destination_IP) in %NIST_Compliance_Assets
match:
$Summary, $Category, $Hostname, $Log_Type
outcome:
$Count = count(metadata.id)
$Date = timestamp.get_timestamp(max(metadata.event_timestamp.seconds), "%F %T")
order:
$Count desc
Alertas de fornecedores de EDR
$Log_Type = metadata.log_type
$Rule_Name = security_result.rule_name
$Severity = security_result.severity
$User = strings.coalesce(principal.user.user_display_name, principal.user.email_addresses, principal.user.userid, target.user.userid, target.user.user_display_name, target.user.email_addresses)
//If the user requires any inclusions for specific assets, these lines will need to be enabled in the query and update the NIST_Compliance_Assets reference list as needed.
//$Hostname = strings.coalesce(principal.asset.hostname, principal.hostname)
//$Source_IP = strings.coalesce(principal.asset.ip, principal.ip)
//strings.coalesce($Hostname, $Source_IP) in %NIST_Compliance_Assets
match:
$Rule_Name, $Severity, $User, $Log_Type
outcome:
$Count = count(metadata.id)
$Date = timestamp.get_timestamp(max(metadata.event_timestamp.seconds), "%F %T")
order:
$Count desc
Comunicação criptografada fraca ao longo do tempo por tipo de registro
network.tls.cipher = /RSA|DES|RC4|SHA-1|3DES|MD5/ nocase
$Log_Type = metadata.log_type
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
//If the user requires any inclusions for specific assets, these lines will need to be enabled in the query and update the NIST_Compliance_Assets reference list as needed.
//$Hostname = strings.coalesce(principal.asset.hostname, principal.hostname, target.asset.hostname, target.hostname)
//$Source_IP = strings.coalesce(principal.asset.ip, principal.ip)
//$Destination_IP = strings.coalesce(target.asset.ip, target.ip)
//strings.coalesce($Hostname, $Source_IP, Destination_IP) in %NIST_Compliance_Assets
match:
$Date, $Log_Type
outcome:
$Count = count(metadata.id)
Os 10 principais alertas de fornecedores SDI / IPS por gravidade
metadata.event_type = "SCAN_UNCATEGORIZED"
or metadata.event_type = "SCAN_NETWORK"
or metadata.event_type = "NETWORK_UNCATEGORIZED"
or metadata.event_type = "NETWORK_FLOW"
or metadata.event_type = "NETWORK_CONNECTION"
or metadata.event_type = "NETWORK_FTP"
or metadata.event_type = "NETWORK_DHCP"
or metadata.event_type = "NETWORK_DNS"
or metadata.event_type = "NETWORK_HTTP"
or metadata.event_type = "NETWORK_SMTP"
(security_result.severity = "HIGH" or security_result.severity = "CRITICAL")
$Rule_Name = security_result.rule_name
$Rule_Name != ""
$Severity = security_result.severity
//If the user requires any inclusions for specific assets, these lines will need to be enabled in the query and update the NIST_Compliance_Assets reference list as needed.
//$Hostname = strings.coalesce(principal.asset.hostname, principal.hostname, target.asset.hostname, target.hostname)
//$Source_IP = strings.coalesce(principal.asset.ip, principal.ip)
//$Destination_IP = strings.coalesce(target.asset.ip, target.ip)
//strings.coalesce($Hostname, $Destination_IP, $Source_IP) in %NIST_Compliance_Assets
match:
$Rule_Name, $Severity
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
10 principais hosts em eventos de EDR por tipo de registro
$Hostname = strings.coalesce(principal.hostname, principal.asset.hostname)
$Hostname != ""
$Log_Type = metadata.log_type
//If the user requires any inclusions for specific assets, these lines will need to be enabled in the query and update the NIST_Compliance_Assets reference list as needed.
//$Source_IP = strings.coalesce(principal.asset.ip, principal.ip)
//strings.coalesce($Hostname, $Source_IP) in %NIST_Compliance_Assets
match:
$Hostname, $Log_Type
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
Tráfego de saída bloqueado por geolocalização
metadata.event_type = "NETWORK_UNCATEGORIZED"
or metadata.event_type = "NETWORK_FLOW"
or metadata.event_type = "NETWORK_CONNECTION"
or metadata.event_type = "NETWORK_FTP"
or metadata.event_type = "NETWORK_DHCP"
or metadata.event_type = "NETWORK_DNS"
or metadata.event_type = "NETWORK_HTTP"
or metadata.event_type = "NETWORK_SMTP"
security_result.action = "BLOCK"
network.direction = "OUTBOUND"
$Country = principal.location.country_or_region
$Country != ""
//If the user requires any inclusions for specific assets, these lines will need to be enabled in the query and update the NIST_Compliance_Assets reference list as needed.
//$Hostname = strings.coalesce(principal.asset.hostname, principal.hostname, target.asset.hostname, target.hostname)
//$Source_IP = strings.coalesce(principal.asset.ip, principal.ip)
//$Destination_IP = strings.coalesce(target.asset.ip, target.ip)
//strings.coalesce($Hostname, $Source_IP, $Destination_IP) in %NIST_Compliance_Assets
match:
$Country
outcome:
$Count = count(metadata.id)
$Latitude = max(principal.location.region_coordinates.latitude)
$Longitude = max(principal.location.region_coordinates.longitude)
order:
$Count desc
Tráfego de rede ao longo do tempo por direção
metadata.event_type = "NETWORK_UNCATEGORIZED"
or metadata.event_type = "NETWORK_FLOW"
or metadata.event_type = "NETWORK_CONNECTION"
or metadata.event_type = "NETWORK_FTP"
or metadata.event_type = "NETWORK_DHCP"
or metadata.event_type = "NETWORK_DNS"
or metadata.event_type = "NETWORK_HTTP"
or metadata.event_type = "NETWORK_SMTP"
//If the user requires any inclusions for specific assets, these lines will need to be enabled in the query and update the NIST_Compliance_Assets reference list as needed.
//$Hostname = strings.coalesce(principal.asset.hostname, principal.hostname, target.asset.hostname, target.hostname)
//$Source_IP = strings.coalesce(principal.asset.ip, principal.ip)
//$Destination_IP = strings.coalesce(target.asset.ip, target.ip)
//strings.coalesce($Hostname, $Source_IP, $Destination_IP) in %NIST_Compliance_Assets
$Direction = network.direction
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
match:
$Direction, $Date
outcome:
$Total_Volume = sum(network.sent_bytes) + sum(network.received_bytes)
$Total_Volume_GB = math.round($Total_Volume/ (1000 * 1000 * 1000), 2)
Visão geral do tráfego de rede
Esse painel oferece monitoramento em tempo real do tráfego de rede na nuvem e local por endereço IP, protocolo, fornecedor, alerta e região, permitindo uma análise eficaz do volume de tráfego e de possíveis problemas.
Eventos de rede
Os 10 principais IPs de origem nos alertas de fornecedores
Os 10 principais usuários bloqueados
10 principais eventos por bytes enviados
Alertas de fornecedores ao longo do tempo por ação
Eventos ao longo do tempo por tipo de registro
10 principais IPs de saída por volume de tráfego
Alertas do fornecedor ao longo do tempo por tipo de registro
Os 10 principais endereços IP de origem
10 principais alertas de fornecedores
IPs de destino distintos
Uso de versões TLS fracas ao longo do tempo
Os 10 principais usuários por volume de tráfego
10 principais aplicativos por bytes enviados
Volume de tráfego de entrada x saída ao longo do tempo
Média de bytes
Volume de tráfego por IP ao longo do tempo
10 principais locais de origem do volume de tráfego
Eventos por gravidade
Mapa de calor de local do tráfego de entrada
Os 10 principais serviços por volume de tráfego
10 principais portas por tráfego de saída
IPs de origem distintos
Volume de tráfego por tipo de registro ao longo do tempo
Total de bytes enviados
Bytes de desvio padrão
Mapa de calor de local do tráfego de saída
Os 10 principais IPs de origem bloqueados para IPs de destino
10 principais portas por tráfego de entrada
Os 10 principais países bloqueados
Os 10 principais endereços IP de destino
Distribuição de protocolos de rede ao longo do tempo
Os 10 principais arquivos de destino suspeitos
10 principais usuários em alertas de fornecedores
10 principais URLs
Tráfego de rede permitido x bloqueado
10 principais hosts por tamanho do tráfego
Porta de destino por protocolo
As 10 principais conexões permitidas
Tráfego de entrada ao longo do tempo por ação
Média de bytes
Os 10 principais países bloqueados
Tráfego de saída ao longo do tempo por ação
Categoria dos 10 principais eventos
10 principais IPs de entrada por volume de tráfego
As 10 principais conexões de rede
Os 10 principais endereços IP de origem bloqueados
Nome do gráfico
Exemplo de consulta
Eventos de rede
$event.metadata.event_type = "NETWORK_FLOW"
or $event.metadata.event_type = "NETWORK_CONNECTION"
or $event.metadata.event_type = "NETWORK_FTP"
or $event.metadata.event_type = "NETWORK_DHCP"
or $event.metadata.event_type = "NETWORK_DNS"
or $event.metadata.event_type = "NETWORK_HTTP"
or $event.metadata.event_type = "NETWORK_SMTP"
outcome:
$Count = count($event.metadata.id)
Os 10 principais IPs de origem nos alertas de fornecedores
metadata.event_type = "NETWORK_UNCATEGORIZED"
or metadata.event_type = "NETWORK_FLOW"
or metadata.event_type = "NETWORK_CONNECTION"
or metadata.event_type = "NETWORK_FTP"
or metadata.event_type = "NETWORK_DHCP"
or metadata.event_type = "NETWORK_DNS"
or metadata.event_type = "NETWORK_HTTP"
or metadata.event_type = "NETWORK_SMTP"
security_result.rule_name != ""
$Source_IP = strings.coalesce(principal.ip, principal.asset.ip)
match:
$Source_IP
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
Os 10 principais usuários bloqueados
metadata.event_type = "NETWORK_UNCATEGORIZED"
or metadata.event_type = "NETWORK_FLOW"
or metadata.event_type = "NETWORK_CONNECTION"
or metadata.event_type = "NETWORK_FTP"
or metadata.event_type = "NETWORK_DHCP"
or metadata.event_type = "NETWORK_DNS"
or metadata.event_type = "NETWORK_HTTP"
or metadata.event_type = "NETWORK_SMTP"
(security_result.action = "BLOCK" or security_result.action = "FAIL" or security_result.action_details = /fail|block/ nocase)
$User = strings.coalesce(principal.user.userid, principal.user.user_display_name, principal.user.email_addresses)
match:
$User
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
10 principais eventos por bytes enviados
$Source_IP = principal.ip
$Event_Type = metadata.event_type
match:
$Event_Type, $Source_IP
outcome:
$Bytes_Sent = sum(network.sent_bytes) / (1000*1000*1000)
order:
$Bytes_Sent desc
limit:
10
Alertas de fornecedores ao longo do tempo por ação
metadata.event_type = "NETWORK_UNCATEGORIZED"
or metadata.event_type = "NETWORK_FLOW"
or metadata.event_type = "NETWORK_CONNECTION"
or metadata.event_type = "NETWORK_FTP"
or metadata.event_type = "NETWORK_DHCP"
or metadata.event_type = "NETWORK_DNS"
or metadata.event_type = "NETWORK_HTTP"
or metadata.event_type = "NETWORK_SMTP"
security_result.rule_name != ""
$Action = security_result.action
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
match:
$Date, $Action
outcome:
$Count = count(metadata.id)
order:
$Count desc
Eventos ao longo do tempo por tipo de registro
metadata.event_type = "NETWORK_UNCATEGORIZED"
or metadata.event_type = "NETWORK_FLOW"
or metadata.event_type = "NETWORK_CONNECTION"
or metadata.event_type = "NETWORK_FTP"
or metadata.event_type = "NETWORK_DHCP"
or metadata.event_type = "NETWORK_DNS"
or metadata.event_type = "NETWORK_HTTP"
or metadata.event_type = "NETWORK_SMTP"
$Log_type = metadata.log_type
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
match:
$Date, $Log_type
outcome:
$Count = count(metadata.id)
order:
$Date asc
10 principais IPs de saída por volume de tráfego
network.direction = "OUTBOUND"
$Log_Type = metadata.log_type
$Destination_IP = target.ip
match:
$Log_Type, $Destination_IP
outcome:
$Total_Bytes = sum(network.received_bytes + network.sent_bytes) / (1000*1000*1000)
order:
$Total_Bytes desc
limit:
10
Alertas do fornecedor ao longo do tempo por tipo de registro
metadata.event_type = "NETWORK_UNCATEGORIZED"
or metadata.event_type = "NETWORK_FLOW"
or metadata.event_type = "NETWORK_CONNECTION"
or metadata.event_type = "NETWORK_FTP"
or metadata.event_type = "NETWORK_DHCP"
or metadata.event_type = "NETWORK_DNS"
or metadata.event_type = "NETWORK_HTTP"
or metadata.event_type = "NETWORK_SMTP"
security_result.rule_name != ""
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
$Log_Type = metadata.log_type
match:
$Date , $Log_Type
outcome:
$Count = count(security_result.rule_name)
order:
$Date asc
Os 10 principais endereços IP de origem
$event.metadata.event_type = "NETWORK_FLOW"
or $event.metadata.event_type = "NETWORK_CONNECTION"
or $event.metadata.event_type = "NETWORK_FTP"
or $event.metadata.event_type = "NETWORK_DHCP"
or $event.metadata.event_type = "NETWORK_DNS"
or $event.metadata.event_type = "NETWORK_HTTP"
or $event.metadata.event_type = "NETWORK_SMTP"
$Event_Type = $event.metadata.event_type
$Source_IP = $event.principal.ip
$Source_IP != ""
match:
$Source_IP, $Event_Type
outcome:
$Count = count($event.metadata.id)
order:
$Count desc
limit:
10
10 principais alertas de fornecedores
metadata.event_type = "NETWORK_UNCATEGORIZED"
or metadata.event_type = "NETWORK_FLOW"
or metadata.event_type = "NETWORK_CONNECTION"
or metadata.event_type = "NETWORK_FTP"
or metadata.event_type = "NETWORK_DHCP"
or metadata.event_type = "NETWORK_DNS"
or metadata.event_type = "NETWORK_HTTP"
or metadata.event_type = "NETWORK_SMTP"
$Rule_Name = security_result.rule_name
match:
$Rule_Name
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
IPs de destino distintos
$event.metadata.event_type = "NETWORK_FLOW"
or $event.metadata.event_type = "NETWORK_CONNECTION"
or $event.metadata.event_type = "NETWORK_FTP"
or $event.metadata.event_type = "NETWORK_DHCP"
or $event.metadata.event_type = "NETWORK_DNS"
or $event.metadata.event_type = "NETWORK_HTTP"
or $event.metadata.event_type = "NETWORK_SMTP"
outcome:
$Count = count_distinct($event.target.ip)
Uso de versões TLS fracas ao longo do tempo
network.tls.version != /1(\.|_)?(2|3)/ nocase
$Cipher_Version = network.tls.version
$Cipher_Version != ""
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
match:
$Cipher_Version, $Date
outcome:
$Count = count(metadata.id)
order:
$Date desc
Os 10 principais usuários por volume de tráfego
$User = principal.user.userid
match:
$User
outcome:
$Total_Bytes = sum(network.sent_bytes + network.received_bytes) / (1000*1000*1000)
order:
$Total_Bytes desc
limit:
10
10 principais aplicativos por bytes enviados
$Source_IP = principal.ip
$Application = target.application
match:
$Application, $Source_IP
outcome:
$Total_Bytes = sum(network.sent_bytes) / (1000*1000*1000)
order:
$Total_Bytes desc
limit:
10
Volume de tráfego de entrada x saída ao longo do tempo
metadata.event_type = "NETWORK_UNCATEGORIZED"
or metadata.event_type = "NETWORK_FLOW"
or metadata.event_type = "NETWORK_CONNECTION"
or metadata.event_type = "NETWORK_FTP"
or metadata.event_type = "NETWORK_DHCP"
or metadata.event_type = "NETWORK_DNS"
or metadata.event_type = "NETWORK_HTTP"
or metadata.event_type = "NETWORK_SMTP"
$Direction = network.direction
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
match:
$Direction, $Date
outcome:
$Total_Volume = sum(network.sent_bytes) + sum(network.received_bytes)
$Total_Volume_GB = $Total_Volume/ (1000 * 1000 * 1000)
order:
$Date desc
Média de bytes
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
match:
$Date
outcome:
$Total_Bytes = sum(network.sent_bytes + network.received_bytes) / 2
$Mean_GB_Total = math.round($Total_Bytes / 1073741824, 2)
order:
$Date desc
Volume de tráfego por IP ao longo do tempo
$IP_Address = principal.ip
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
match:
$IP_Address, $Date
outcome:
$Total_Bytes = sum(network.sent_bytes + network.received_bytes) / (1000*1000*1000)
order:
$Date desc
10 principais locais de origem do volume de tráfego
$Country = principal.location.country_or_region
$Country != ""
$Latitude = principal.location.region_coordinates.latitude
$Longitude = principal.location.region_coordinates.longitude
match:
$Country, $Latitude, $Longitude
outcome:
$Total_Bytes = sum(network.received_bytes + network.sent_bytes) / (1000*1000*1000)
order:
$Total_Bytes desc
limit:
10
Eventos por gravidade
metadata.event_type = "NETWORK_UNCATEGORIZED"
or metadata.event_type = "NETWORK_FLOW"
or metadata.event_type = "NETWORK_CONNECTION"
or metadata.event_type = "NETWORK_FTP"
or metadata.event_type = "NETWORK_DHCP"
or metadata.event_type = "NETWORK_DNS"
or metadata.event_type = "NETWORK_HTTP"
or metadata.event_type = "NETWORK_SMTP"
$Severity = security_result.severity
match:
$Severity
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
Mapa de calor de local do tráfego de entrada
metadata.event_type = "NETWORK_UNCATEGORIZED"
or metadata.event_type = "NETWORK_FLOW"
or metadata.event_type = "NETWORK_CONNECTION"
or metadata.event_type = "NETWORK_FTP"
or metadata.event_type = "NETWORK_DHCP"
or metadata.event_type = "NETWORK_DNS"
or metadata.event_type = "NETWORK_HTTP"
or metadata.event_type = "NETWORK_SMTP"
network.direction = "INBOUND"
$Country = principal.ip_geo_artifact.location.country_or_region
match:
$Country
outcome:
$Count = count(metadata.id)
$Latitude = max(principal.ip_geo_artifact.location.region_coordinates.latitude)
$Longitude = max(principal.ip_geo_artifact.location.region_coordinates.longitude)
order:
$Count desc
Os 10 principais serviços por volume de tráfego
target.port != 0
network.ip_protocol != "UNKNOWN_IP_PROTOCOL"
$Service = strings.concat(target.port, "")
$Protocol = network.ip_protocol
match:
$Service, $Protocol
outcome:
$Total_Bytes = sum(network.received_bytes + network.sent_bytes) / (1000*1000*1000)
order:
$Total_Bytes desc
limit:
10
10 principais portas por tráfego de saída
metadata.event_type = "NETWORK_UNCATEGORIZED"
or metadata.event_type = "NETWORK_FLOW"
or metadata.event_type = "NETWORK_CONNECTION"
or metadata.event_type = "NETWORK_FTP"
or metadata.event_type = "NETWORK_DHCP"
or metadata.event_type = "NETWORK_DNS"
or metadata.event_type = "NETWORK_HTTP"
or metadata.event_type = "NETWORK_SMTP"
network.direction = "OUTBOUND"
$Port = strings.concat(target.port, "")
match:
$Port
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
IPs de origem distintos
$event.metadata.event_type = "NETWORK_FLOW"
or $event.metadata.event_type = "NETWORK_CONNECTION"
or $event.metadata.event_type = "NETWORK_FTP"
or $event.metadata.event_type = "NETWORK_DHCP"
or $event.metadata.event_type = "NETWORK_DNS"
or $event.metadata.event_type = "NETWORK_HTTP"
or $event.metadata.event_type = "NETWORK_SMTP"
outcome:
$Count = count_distinct($event.principal.ip)
Volume de tráfego por tipo de registro ao longo do tempo
$Log_Type = metadata.log_type
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
match:
$Date, $Log_Type
outcome:
$Total_Bytes = sum(network.sent_bytes + network.received_bytes) / (1000*1000*1000)
order:
$Date desc
Total de bytes enviados
outcome:
$Total_Bytes_Sent_GB = math.round(sum(network.sent_bytes) / (1000*1000*1000), 2)
Bytes de desvio padrão
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
match:
$Date
outcome:
$Stdev_Bytes = stddev(network.sent_bytes + network.received_bytes) / (1000*1000*1000)
order:
$Date desc
Mapa de calor de local do tráfego de saída
metadata.event_type = "NETWORK_UNCATEGORIZED"
or metadata.event_type = "NETWORK_FLOW"
or metadata.event_type = "NETWORK_CONNECTION"
or metadata.event_type = "NETWORK_FTP"
or metadata.event_type = "NETWORK_DHCP"
or metadata.event_type = "NETWORK_DNS"
or metadata.event_type = "NETWORK_HTTP"
or metadata.event_type = "NETWORK_SMTP"
network.direction = "OUTBOUND"
$Country = target.ip_geo_artifact.location.country_or_region
match:
$Country
outcome:
$Count = count(metadata.id)
$Latitude = max(target.ip_geo_artifact.location.region_coordinates.latitude)
$Longitude = max(target.ip_geo_artifact.location.region_coordinates.longitude)
order:
$Count desc
Os 10 principais IPs de origem bloqueados para IPs de destino
$event.metadata.event_type = "NETWORK_FLOW"
or $event.metadata.event_type = "NETWORK_CONNECTION"
or $event.metadata.event_type = "NETWORK_FTP"
or $event.metadata.event_type = "NETWORK_DHCP"
or $event.metadata.event_type = "NETWORK_DNS"
or $event.metadata.event_type = "NETWORK_HTTP"
or $event.metadata.event_type = "NETWORK_SMTP"
$Event_Type = $event.metadata.event_type
$Source_IP = $event.principal.ip
$Destination_IP = $event.target.ip
$Block = $event.security_result.action
$Block = "BLOCK"
match:
$Event_Type, $Source_IP, $Block, $Destination_IP
outcome:
$Count = count($event.metadata.id)
order:
$Count desc
limit:
10
10 principais portas por tráfego de entrada
metadata.event_type = "NETWORK_UNCATEGORIZED"
or metadata.event_type = "NETWORK_FLOW"
or metadata.event_type = "NETWORK_CONNECTION"
or metadata.event_type = "NETWORK_FTP"
or metadata.event_type = "NETWORK_DHCP"
or metadata.event_type = "NETWORK_DNS"
or metadata.event_type = "NETWORK_HTTP"
or metadata.event_type = "NETWORK_SMTP"
network.direction = "INBOUND"
$Port = strings.concat(target.port, "")
match:
$Port
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
Os 10 principais países bloqueados
metadata.event_type = "NETWORK_UNCATEGORIZED"
or metadata.event_type = "NETWORK_FLOW"
or metadata.event_type = "NETWORK_CONNECTION"
or metadata.event_type = "NETWORK_FTP"
or metadata.event_type = "NETWORK_DHCP"
or metadata.event_type = "NETWORK_DNS"
or metadata.event_type = "NETWORK_HTTP"
or metadata.event_type = "NETWORK_SMTP"
security_result.action = "BLOCK"
$Country = strings.coalesce(principal.location.country_or_region, principal.ip_geo_artifact.location.country_or_region)
match:
$Country
outcome:
$Count = count($Country)
order:
$Count desc
limit:
10
Os 10 principais endereços IP de destino
$event.metadata.event_type = "NETWORK_FLOW"
or $event.metadata.event_type = "NETWORK_CONNECTION"
or $event.metadata.event_type = "NETWORK_FTP"
or $event.metadata.event_type = "NETWORK_DHCP"
or $event.metadata.event_type = "NETWORK_DNS"
or $event.metadata.event_type = "NETWORK_HTTP"
or $event.metadata.event_type = "NETWORK_SMTP"
$Event_Type = $event.metadata.event_type
$Log_Type = $event.metadata.log_type
$Destination_IP = $event.target.ip
$Destination_IP != ""
match:
$Destination_IP, $Event_Type, $Log_Type
outcome:
$Count = count($event.metadata.id)
order:
$Count desc
limit:
10
Distribuição de protocolos de rede ao longo do tempo
metadata.event_type = "NETWORK_UNCATEGORIZED"
or metadata.event_type = "NETWORK_FLOW"
or metadata.event_type = "NETWORK_CONNECTION"
or metadata.event_type = "NETWORK_FTP"
or metadata.event_type = "NETWORK_DHCP"
or metadata.event_type = "NETWORK_DNS"
or metadata.event_type = "NETWORK_HTTP"
or metadata.event_type = "NETWORK_SMTP"
$Protocol = network.application_protocol
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
match:
$Date, $Protocol
outcome:
$Count = count(metadata.id)
order:
$Date asc
Os 10 principais arquivos de destino suspeitos
metadata.event_type = "NETWORK_UNCATEGORIZED"
or metadata.event_type = "NETWORK_FLOW"
or metadata.event_type = "NETWORK_CONNECTION"
or metadata.event_type = "NETWORK_FTP"
or metadata.event_type = "NETWORK_DHCP"
or metadata.event_type = "NETWORK_DNS"
or metadata.event_type = "NETWORK_HTTP"
or metadata.event_type = "NETWORK_SMTP"
$Files = target.file.full_path
$Files = /\.exe|\.scr|\.com|\.pif|\.dll|\.js|\.vbs|\.ps1|\.bat|\.cmd|\.wsf|\.hta|\.docm|\.xlsm|\.pptm|\.dotm|\.pdf|\.zip|\.rar|\.iso|\.img|\.lnk|\.url/ nocase
match:
$Files
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
10 principais usuários em alertas de fornecedores
metadata.event_type = "NETWORK_UNCATEGORIZED"
or metadata.event_type = "NETWORK_FLOW"
or metadata.event_type = "NETWORK_CONNECTION"
or metadata.event_type = "NETWORK_FTP"
or metadata.event_type = "NETWORK_DHCP"
or metadata.event_type = "NETWORK_DNS"
or metadata.event_type = "NETWORK_HTTP"
or metadata.event_type = "NETWORK_SMTP"
security_result.rule_name != ""
$Source_User = strings.coalesce(principal.user.userid, principal.user.user_display_name, principal.user.email_addresses)
match:
$Source_User
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
10 principais URLs
metadata.event_type = "NETWORK_UNCATEGORIZED"
or metadata.event_type = "NETWORK_FLOW"
or metadata.event_type = "NETWORK_CONNECTION"
or metadata.event_type = "NETWORK_FTP"
or metadata.event_type = "NETWORK_DHCP"
or metadata.event_type = "NETWORK_DNS"
or metadata.event_type = "NETWORK_HTTP"
or metadata.event_type = "NETWORK_SMTP"
$URL = target.url
match:
$URL
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
Tráfego de rede permitido x bloqueado
metadata.event_type = "NETWORK_UNCATEGORIZED"
or metadata.event_type = "NETWORK_FLOW"
or metadata.event_type = "NETWORK_CONNECTION"
or metadata.event_type = "NETWORK_FTP"
or metadata.event_type = "NETWORK_DHCP"
or metadata.event_type = "NETWORK_DNS"
or metadata.event_type = "NETWORK_HTTP"
or metadata.event_type = "NETWORK_SMTP"
$Action = security_result.action
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
match:
$Action, $Date
outcome:
$Count = count(metadata.id)
order:
$Date asc
10 principais hosts por tamanho do tráfego
$Hostname = principal.hostname
match:
$Hostname
outcome:
$Total_Bytes = sum(network.sent_bytes + network.received_bytes) / (1000*1000*1000)
order:
$Total_Bytes desc
limit:
10
Porta de destino por protocolo
metadata.event_type = "NETWORK_UNCATEGORIZED"
or metadata.event_type = "NETWORK_FLOW"
or metadata.event_type = "NETWORK_CONNECTION"
or metadata.event_type = "NETWORK_FTP"
or metadata.event_type = "NETWORK_DHCP"
or metadata.event_type = "NETWORK_DNS"
or metadata.event_type = "NETWORK_HTTP"
or metadata.event_type = "NETWORK_SMTP"
$Port = strings.concat(target.port, "")
$Protocol = network.application_protocol
match:
$Port, $Protocol
outcome:
$Count = count(metadata.id)
order:
$Count desc
As 10 principais conexões permitidas
$event.metadata.event_type = "NETWORK_FLOW"
or $event.metadata.event_type = "NETWORK_CONNECTION"
or $event.metadata.event_type = "NETWORK_FTP"
or $event.metadata.event_type = "NETWORK_DHCP"
or $event.metadata.event_type = "NETWORK_DNS"
or $event.metadata.event_type = "NETWORK_HTTP"
or $event.metadata.event_type = "NETWORK_SMTP"
$Event_Type = $event.metadata.event_type
$Hostname = $event.principal.hostname
$Asset_Type = $event.principal.asset.type
$OS_Version = $event.target.asset.platform_software.platform_version
$Source_IP = $event.principal.ip
$Mac_Add = $event.principal.mac
$Nat_IP = $event.principal.nat_ip
$Destination_IP = $event.target.ip
$Destination_IP != ""
$Connection = $event.security_result.action
$Connection = "ALLOW"
match:
$Event_Type, $Hostname, $OS_Version, $Source_IP, $Mac_Add, $Nat_IP, $Connection, $Destination_IP
outcome:
$Count = count($event.metadata.id)
order:
$Count desc
limit:
10
Tráfego de entrada ao longo do tempo por ação
metadata.event_type = "NETWORK_UNCATEGORIZED"
or metadata.event_type = "NETWORK_FLOW"
or metadata.event_type = "NETWORK_CONNECTION"
or metadata.event_type = "NETWORK_FTP"
or metadata.event_type = "NETWORK_DHCP"
or metadata.event_type = "NETWORK_DNS"
or metadata.event_type = "NETWORK_HTTP"
or metadata.event_type = "NETWORK_SMTP"
network.direction = "INBOUND"
$Action = security_result.action
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
match:
$Action, $Date
outcome:
$Count = count(metadata.id)
order:
$Date asc
Média de bytes
outcome:
$Average_Bytes = sum(network.sent_bytes + network.received_bytes) / 2
$Average_Bytes_GB = math.round($Average_Bytes / (1000*1000*1000), 2)
Os 10 principais países bloqueados
$event.metadata.event_type = "NETWORK_FLOW"
or $event.metadata.event_type = "NETWORK_CONNECTION"
or $event.metadata.event_type = "NETWORK_FTP"
or $event.metadata.event_type = "NETWORK_DHCP"
or $event.metadata.event_type = "NETWORK_DNS"
or $event.metadata.event_type = "NETWORK_HTTP"
or $event.metadata.event_type = "NETWORK_SMTP"
$event.security_result.action = "BLOCK"
$Countries = $event.principal.location.country_or_region
$Latitude = $event.principal.location.region_coordinates.latitude
$Longitude = $event.principal.location.region_coordinates.longitude
match:
$Countries, $Latitude, $Longitude
outcome:
$Count = count_distinct($Countries)
limit:
10
Tráfego de saída ao longo do tempo por ação
metadata.event_type = "NETWORK_UNCATEGORIZED"
or metadata.event_type = "NETWORK_FLOW"
or metadata.event_type = "NETWORK_CONNECTION"
or metadata.event_type = "NETWORK_FTP"
or metadata.event_type = "NETWORK_DHCP"
or metadata.event_type = "NETWORK_DNS"
or metadata.event_type = "NETWORK_HTTP"
or metadata.event_type = "NETWORK_SMTP"
network.direction = "OUTBOUND"
$Action = security_result.action
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
match:
$Action, $Date
outcome:
$Count = count(metadata.id)
order:
$Date asc
Categoria dos 10 principais eventos
metadata.event_type = "NETWORK_UNCATEGORIZED"
or metadata.event_type = "NETWORK_FLOW"
or metadata.event_type = "NETWORK_CONNECTION"
or metadata.event_type = "NETWORK_FTP"
or metadata.event_type = "NETWORK_DHCP"
or metadata.event_type = "NETWORK_DNS"
or metadata.event_type = "NETWORK_HTTP"
or metadata.event_type = "NETWORK_SMTP"
$Category = security_result.category
match:
$Category
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
10 principais IPs de entrada por volume de tráfego
network.direction = "INBOUND"
$Log_Type = metadata.log_type
$Source_IP = principal.ip
match:
$Log_Type, $Source_IP
outcome:
$Total_Bytes = sum(network.received_bytes + network.sent_bytes) / (1000*1000*1000)
order:
$Total_Bytes desc
limit:
10
As 10 principais conexões de rede
$event.metadata.event_type = "NETWORK_FLOW"
or $event.metadata.event_type = "NETWORK_CONNECTION"
or $event.metadata.event_type = "NETWORK_FTP"
or $event.metadata.event_type = "NETWORK_DHCP"
or $event.metadata.event_type = "NETWORK_DNS"
or $event.metadata.event_type = "NETWORK_HTTP"
or $event.metadata.event_type = "NETWORK_SMTP"
$Source_Port = $event.principal.port
$Destination_Port = $event.target.port
$Source_IP = $event.principal.ip
$Destination_IP = $event.target.ip
$OS = $event.target.asset.platform_software.platform_version
$Direction = $event.network.direction
$Hostname = $event.principal.hostname
$Direction != "UNKNOWN_DIRECTION"
$OS != ""
$Hostname != ""
match:
$Hostname, $OS, $Source_IP, $Source_Port, $Direction, $Destination_IP, $Destination_Port
outcome:
$Time = timestamp.get_timestamp(max($event.metadata.event_timestamp.seconds))
order:
$Time desc
limit:
10
Os 10 principais endereços IP de origem bloqueados
$event.metadata.event_type = "NETWORK_FLOW"
or $event.metadata.event_type = "NETWORK_CONNECTION"
or $event.metadata.event_type = "NETWORK_FTP"
or $event.metadata.event_type = "NETWORK_DHCP"
or $event.metadata.event_type = "NETWORK_DNS"
or $event.metadata.event_type = "NETWORK_HTTP"
or $event.metadata.event_type = "NETWORK_SMTP"
$Event_Type = $event.metadata.event_type
$Source_IP = $event.principal.ip
$Source_IP != ""
$Destination_IP = $event.target.ip
$Log_Type = $event.metadata.log_type
$Block = $event.security_result.action
$Block = "BLOCK"
match:
$Source_IP, $Block, $Destination_IP, $Log_Type
outcome:
$Count = count($event.metadata.id)
order:
$Count desc
limit:
10
Segurança de OT
Esse painel oferece uma visão detalhada da segurança em um ambiente de TO, permitindo rastrear e avaliar eventos de segurança. Ele identifica tendências, principais recursos, usuários e serviços, além de monitorar a atividade de rede e geográfica. Isso permite priorizar ameaças, otimizar estratégias de resposta e melhorar a segurança dos sistemas de TO.
10 principais protocolos não OT por tipo de registro
Os 10 principais recursos que usam o protocolo de texto não criptografado
10 principais CVEs
Sniffers de OT ao longo do tempo
As 10 principais entidades segmentadas por uma rede externa
Alertas de fornecedores ao longo do tempo por recurso
Distribuição de protocolo de texto sem formatação
10 principais alertas de fornecedor por usuário
As 10 principais entidades que iniciam redes externas
10 principais alertas de fornecedores por gravidade
Protocolos de aplicativo ao longo do tempo
Novos recursos de OT
Alertas de fornecedores ao longo do tempo
Total de novos recursos de OT
10 principais recursos de origem
Alertas do fornecedor por ação
Total de recursos de OT
Alertas do fornecedor ao longo do tempo por tipo de registro
10 principais alertas de fornecedor por categoria
Nome do gráfico
Exemplo de consulta
10 principais protocolos não OT por tipo de registro
network.application_protocol != "COAP"
network.application_protocol != "DNP3"
network.application_protocol != "MODBUS"
network.application_protocol != "MQTT"
network.application_protocol != "SNMP"
$Log_Type = metadata.log_type
$Protocol = network.application_protocol
match:
$Protocol, $Log_Type
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
Os 10 principais recursos que usam o protocolo de texto não criptografado
network.application_protocol = "MODBUS"
or network.application_protocol = "DNP3"
or network.application_protocol = "CIP"
or network.application_protocol = "IEC104"
or network.application_protocol = "SNMP"
or network.application_protocol = "COTP"
or network.application_protocol = "GOOSE"
or network.application_protocol = "SV"
or network.application_protocol = "DEVICE_NET"
or network.application_protocol = "PTP"
or network.application_protocol = "HTTP"
or network.application_protocol = "RLOGIN"
or network.application_protocol = "FINGER"
or network.application_protocol = "SMTP"
$Protocol = network.application_protocol
$Asset = strings.coalesce(target.asset.hostname, target.asset.ip, target.asset.mac, target.hostname)
$Asset != ""
match:
$Asset, $Protocol
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
10 principais CVEs
$CVE = principal.asset.vulnerabilities.cve_id
$CVE != ""
$Asset = principal.asset.hostname
match:
$CVE, $Asset
outcome:
$Count = count(principal.asset.vulnerabilities.cve_id)
order:
$Count desc
limit:
10
Sniffers de OT ao longo do tempo
$Log_Type = metadata.log_type
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
match:
$Date, $Log_Type
outcome:
$Count = count(observer.hostname)
order:
$Date desc
As 10 principais entidades segmentadas por uma rede externa
principal.ip != /^10\..|^172\.(1[6-9]|2\d|3[0-1])\..*|^192\.168\../
principal.ip != ""
$Entity = group(target.asset.hostname, target.asset.ip, target.asset.mac, target.user.userid)
$Entity != ""
match:
$Entity
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
Alertas de fornecedores ao longo do tempo por recurso
(metadata.log_type = /CLAROTY_CTD|CLAROTY_EMC/ nocase
and security_result.threat_id != "")
or (metadata.log_type = /NOZOMI_GUARDIAN/ nocase
and additional.fields["IsSecurity"] = "true")
or (metadata.log_type = /TENABLE_OT/ nocase
and security_result.category_details = /NetworkThreats/ nocase)
metadata.product_event_type != "Event"
metadata.product_event_type != "HealthCheck"
metadata.product_event_type != "Insight"
$Device = strings.coalesce(target.asset.hostname, target.asset.ip, target.asset.mac, target.hostname)
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
$Vendor_Alert = metadata.product_event_type
match:
$Date, $Device
outcome:
$Count = count($Vendor_Alert)
order:
$Count desc
Distribuição de protocolo de texto sem formatação
network.application_protocol = "MODBUS"
or network.application_protocol = "DNP3"
or network.application_protocol = "CIP"
or network.application_protocol = "IEC104"
or network.application_protocol = "SNMP"
or network.application_protocol = "COTP"
or network.application_protocol = "GOOSE"
or network.application_protocol = "SV"
or network.application_protocol = "DEVICE_NET"
or network.application_protocol = "PTP"
or network.application_protocol = "HTTP"
or network.application_protocol = "RLOGIN"
or network.application_protocol = "FINGER"
or network.application_protocol = "SMTP"
$Protocol = network.application_protocol
match:
$Protocol
outcome:
$Count = count(metadata.id)
order:
$Count desc
10 principais alertas de fornecedor por usuário
(metadata.log_type = /CLAROTY_CTD|CLAROTY_EMC/ nocase
and security_result.threat_id != "")
or (metadata.log_type = /NOZOMI_GUARDIAN/ nocase
and additional.fields["IsSecurity"] = "true")
or (metadata.log_type = /TENABLE_OT/ nocase
and security_result.category_details = /NetworkThreats/ nocase)
metadata.product_event_type != "Event"
metadata.product_event_type != "HealthCheck"
metadata.product_event_type != "Insight"
$Event = metadata.product_event_type
$User = principal.user.user_display_name
match:
$User, $Event
outcome:
$Count = count(if((metadata.log_type = /claroty/ nocase and security_result.threat_id != "") or (metadata.log_type = /nozomi/ nocase and additional.fields["IsSecurity"] = "true") or (metadata.log_type = /TENABLE_OT/ nocase and security_result.category_details = /NetworkThreats/ nocase), 1, 0))
order:
$Count desc
limit:
10
As 10 principais entidades que iniciam redes externas
target.ip != /^10\..|^172\.(1[6-9]|2\d|3[0-1])\..*|^192\.168\../
$Entity = group(principal.asset.hostname, principal.asset.ip, principal.asset.mac, principal.user.windows_sid, principal.user.userid)
$Entity != ""
match:
$Entity
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
10 principais alertas de fornecedores por gravidade
(metadata.log_type = /CLAROTY_CTD|CLAROTY_EMC/ nocase
and security_result.threat_id != "")
or (metadata.log_type = /NOZOMI_GUARDIAN/ nocase
and additional.fields["IsSecurity"] = "true")
or (metadata.log_type = /TENABLE_OT/ nocase
and security_result.category_details = /NetworkThreats/ nocase)
metadata.product_event_type != "Event"
metadata.product_event_type != "HealthCheck"
metadata.product_event_type != "Insight"
$Vendor_Alert = metadata.product_event_type
$Severity = security_result.severity
match:
$Severity, $Vendor_Alert
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
Protocolos de aplicativo ao longo do tempo
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
$Application_Protocol = network.application_protocol
match:
$Application_Protocol, $Date
outcome:
$Count = count(metadata.id)
order:
$Count desc
Novos recursos de OT
metadata.product_event_type = /New Asset|SIGN:DHCP-OPERATION/ nocase
$Hostname = strings.coalesce(target.asset.hostname, target.asset.ip, target.asset.mac, target.hostname)
$Hostname != ""
match:
$Hostname
Alertas de fornecedores ao longo do tempo
(metadata.log_type = /CLAROTY_CTD|CLAROTY_EMC/ nocase
and security_result.threat_id != "")
or (metadata.log_type = /NOZOMI_GUARDIAN/ nocase
and additional.fields["IsSecurity"] = "true")
or (metadata.log_type = /TENABLE_OT/ nocase
and security_result.category_details = /NetworkThreats/ nocase)
metadata.product_event_type != "Event"
metadata.product_event_type != "HealthCheck"
metadata.product_event_type != "Insight"
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
$Vendor_Alert = metadata.product_event_type
match:
$Date, $Vendor_Alert
outcome:
$Count = count(if((metadata.log_type = /claroty/ nocase and security_result.threat_id != "") or (metadata.log_type = /nozomi/ nocase and additional.fields["IsSecurity"] = "true") or (metadata.log_type = /TENABLE_OT/ nocase and security_result.category_details = /NetworkThreats/ nocase), 1, 0))
order:
$Count desc
Total de novos recursos de OT
metadata.product_event_type = /New Asset|SIGN:DHCP-OPERATION/ nocase
strings.coalesce(target.asset.hostname, target.asset.ip, target.asset.mac, target.hostname) != ""
outcome:
$Count = count_distinct(strings.coalesce(target.asset.hostname, target.asset.ip, target.asset.mac, target.hostname))
10 principais recursos de origem
$Hostname = strings.coalesce(principal.asset.hostname, principal.asset.ip, principal.asset.mac, principal.hostname)
$Hostname != ""
match:
$Hostname
outcome:
$Count = count_distinct(strings.coalesce(target.asset.ip, target.ip))
order:
$Count desc
limit:
10
Alertas do fornecedor por ação
(metadata.log_type = /CLAROTY_CTD|CLAROTY_EMC/ nocase
and security_result.threat_id != "")
or (metadata.log_type = /NOZOMI_GUARDIAN/ nocase
and additional.fields["IsSecurity"] = "true")
or (metadata.log_type = /TENABLE_OT/ nocase
and security_result.category_details = /NetworkThreats/ nocase)
metadata.product_event_type != "Event"
metadata.product_event_type != "HealthCheck"
metadata.product_event_type != "Insight"
security_result.action_details = "Succeeded"
or security_result.action_details = "Failed"
$Action = security_result.action_details
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
match:
$Date, $Action
outcome:
$Count = count(if((metadata.log_type = /claroty/ nocase and security_result.threat_id != "") or (metadata.log_type = /nozomi/ nocase and additional.fields["IsSecurity"] = "true") or (metadata.log_type = /TENABLE_OT/ nocase and security_result.category_details = /NetworkThreats/ nocase), 1, 0))
order:
$Date desc
Total de recursos de OT
outcome:
$Count = count_distinct(strings.coalesce(target.asset.hostname, target.asset.ip, target.asset.mac, target.hostname))
Alertas do fornecedor ao longo do tempo por tipo de registro
(metadata.log_type = /CLAROTY_CTD|CLAROTY_EMC/ nocase
and security_result.threat_id != "")
or (metadata.log_type = /NOZOMI_GUARDIAN/ nocase
and additional.fields["IsSecurity"] = "true")
or (metadata.log_type = /TENABLE_OT/ nocase
and security_result.category_details = /NetworkThreats/ nocase)
metadata.product_event_type != "Event"
metadata.product_event_type != "HealthCheck"
metadata.product_event_type != "Insight"
$Log_Type = metadata.log_type
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
$Vendor_Alert = metadata.product_event_type
match:
$Date, $Vendor_Alert, $Log_Type
outcome:
$Count = count(if((metadata.log_type = /claroty/ nocase and security_result.threat_id != "") or (metadata.log_type = /nozomi/ nocase and additional.fields["IsSecurity"] = "true") or (metadata.log_type = /TENABLE_OT/ nocase and security_result.category_details = /NetworkThreats/ nocase), 1, 0))
order:
$Date desc
10 principais alertas de fornecedor por categoria
(metadata.log_type = /CLAROTY_CTD|CLAROTY_EMC/ nocase
and security_result.threat_id != "")
or (metadata.log_type = /NOZOMI_GUARDIAN/ nocase
and additional.fields["IsSecurity"] = "true")
or (metadata.log_type = /TENABLE_OT/ nocase
and security_result.category_details = /NetworkThreats/ nocase)
metadata.product_event_type != "Event"
metadata.product_event_type != "HealthCheck"
metadata.product_event_type != "Insight"
$Event = metadata.product_event_type
$Category = security_result.category_details
match:
$Category, $Event
outcome:
$Count = count(if((metadata.log_type = /claroty/ nocase and security_result.threat_id != "") or (metadata.log_type = /nozomi/ nocase and additional.fields["IsSecurity"] = "true") or (metadata.log_type = /TENABLE_OT/ nocase and security_result.category_details = /NetworkThreats/ nocase), 1, 0))
order:
$Count desc
limit:
10
PCI: anti-malware
Esse painel mostra os recursos do setor de cartões de pagamento (PCI, na sigla em inglês) e as detecções de ameaças ativas. Ele usa a lista de referência pci_assets para restringir os dados ao ambiente de PCI.
Observação: os gráficos neste painel não são carregados até que as listas de referência necessárias sejam criadas.
Eventos bloqueados por tipo
Eventos permitidos por usuário
Resumo de eventos por ação
Total de eventos
Total de alertas de EDR por gravidade
10 principais tipos de evento
Total de alertas de EDR
Alertas de EDR por tática
Total de alertas de EDR ao longo do tempo
Eventos por gravidade
Outros eventos
Total de eventos por tipo ao longo do tempo
Eventos permitidos por endereço IP
Ações de eventos por tipo de registro
Eventos bloqueados por endereço IP
Eventos bloqueados por usuário
Eventos em quarentena
10 principais endpoints por local
Eventos bloqueados
Total de eventos ao longo do tempo
Eventos permitidos por tipo
Eventos permitidos
Nome do gráfico
Exemplo de consulta
Eventos bloqueados por tipo
$event.metadata.log_type = /_AV|EDR|BEYONDTRUST_ENDPOINT|BITDEFENDER|CISCO_AMP|CISCO_SECURE_WORKLOAD|CS_DETECTS|CS_IDP|CYBERARK_EPM|CYNET_360_AUTOXDR|ENDPOINT_PROTECTOR_DLP|FIREEYE_HX|HALCYON|IBM_SECURITY_VERIFY|JAMF_PRO|JAMF_PROTECT|JAMF_TELEMETRY|KOLIDE|LOOKOUT_MOBILE_ENDPOINT_SECURITY|MACOS|MACOS_ENDPOINT_SECURITY|MICROSOFT_DEFENDER_ENDPOINT|MICROSOFT_DEFENDER_ENDPOINT_IOS|MICROSOFT_DEFENDER_IDENTITY|MICROSOFT_GRAPH_ALERT|MICROSOFT_IAS|MICROSOFT_SCEP|MOBILEIRON|OPENPATH|PASSWORDSTATE|SAVIYNT_EIP|SENTINEL_DV|SENTINELONE_ALERT|SEP|SEQRITE_ENDPOINT|SOPHOS_CENTRAL|SPYCLOUD|TRENDMICRO_APEX_CENTRAL|TRENDMICRO_APEX_ONE|TRENDMICRO_DEEP_SECURITY|TRENDMICRO_STELLAR|TRENDMICRO_VISION_ONE|VENAFI_ZTPKI|WINDOWS_DEFENDER_ATP|WINEVTLOG|WINEVTLOG_XML/
strings.coalesce($event.principal.asset.hostname, $event.principal.hostname) in %PCI_Assets
$event.security_result.action = "BLOCK"
$Event_Type = $event.metadata.event_type
match:
$Event_Type
outcome:
$Count = count($event.security_result.action)
order:
$Count desc
Eventos permitidos por usuário
$event.metadata.log_type = /_AV|EDR|BEYONDTRUST_ENDPOINT|BITDEFENDER|CISCO_AMP|CISCO_SECURE_WORKLOAD|CS_DETECTS|CS_IDP|CYBERARK_EPM|CYNET_360_AUTOXDR|ENDPOINT_PROTECTOR_DLP|FIREEYE_HX|HALCYON|IBM_SECURITY_VERIFY|JAMF_PRO|JAMF_PROTECT|JAMF_TELEMETRY|KOLIDE|LOOKOUT_MOBILE_ENDPOINT_SECURITY|MACOS|MACOS_ENDPOINT_SECURITY|MICROSOFT_DEFENDER_ENDPOINT|MICROSOFT_DEFENDER_ENDPOINT_IOS|MICROSOFT_DEFENDER_IDENTITY|MICROSOFT_GRAPH_ALERT|MICROSOFT_IAS|MICROSOFT_SCEP|MOBILEIRON|OPENPATH|PASSWORDSTATE|SAVIYNT_EIP|SENTINEL_DV|SENTINELONE_ALERT|SEP|SEQRITE_ENDPOINT|SOPHOS_CENTRAL|SPYCLOUD|TRENDMICRO_APEX_CENTRAL|TRENDMICRO_APEX_ONE|TRENDMICRO_DEEP_SECURITY|TRENDMICRO_STELLAR|TRENDMICRO_VISION_ONE|VENAFI_ZTPKI|WINDOWS_DEFENDER_ATP|WINEVTLOG|WINEVTLOG_XML/
strings.coalesce($event.principal.asset.hostname, $event.principal.hostname) in %PCI_Assets
$event.security_result.action = "ALLOW"
$Event_Type = $event.metadata.event_type
$User = strings.coalesce($event.principal.user.user_display_name, $event.principal.user.userid)
match:
$User, $Event_Type
outcome:
$Count = count($event.security_result.action)
order:
$Count desc
limit:
50
Resumo de eventos por ação
$event.metadata.log_type = /_AV|EDR|BEYONDTRUST_ENDPOINT|BITDEFENDER|CISCO_AMP|CISCO_SECURE_WORKLOAD|CS_DETECTS|CS_IDP|CYBERARK_EPM|CYNET_360_AUTOXDR|ENDPOINT_PROTECTOR_DLP|FIREEYE_HX|HALCYON|IBM_SECURITY_VERIFY|JAMF_PRO|JAMF_PROTECT|JAMF_TELEMETRY|KOLIDE|LOOKOUT_MOBILE_ENDPOINT_SECURITY|MACOS|MACOS_ENDPOINT_SECURITY|MICROSOFT_DEFENDER_ENDPOINT|MICROSOFT_DEFENDER_ENDPOINT_IOS|MICROSOFT_DEFENDER_IDENTITY|MICROSOFT_GRAPH_ALERT|MICROSOFT_IAS|MICROSOFT_SCEP|MOBILEIRON|OPENPATH|PASSWORDSTATE|SAVIYNT_EIP|SENTINEL_DV|SENTINELONE_ALERT|SEP|SEQRITE_ENDPOINT|SOPHOS_CENTRAL|SPYCLOUD|TRENDMICRO_APEX_CENTRAL|TRENDMICRO_APEX_ONE|TRENDMICRO_DEEP_SECURITY|TRENDMICRO_STELLAR|TRENDMICRO_VISION_ONE|VENAFI_ZTPKI|WINDOWS_DEFENDER_ATP|WINEVTLOG|WINEVTLOG_XML/ nocase
strings.coalesce($event.principal.asset.hostname, $event.principal.hostname) in %PCI_Assets
$Action = $event.security_result.action
match:
$Action
outcome:
$Count = count($event.security_result.action)
order:
$Count desc
Total de eventos
$event.metadata.log_type = /_AV|EDR|BEYONDTRUST_ENDPOINT|BITDEFENDER|CISCO_AMP|CISCO_SECURE_WORKLOAD|CS_DETECTS|CS_IDP|CYBERARK_EPM|CYNET_360_AUTOXDR|ENDPOINT_PROTECTOR_DLP|FIREEYE_HX|HALCYON|IBM_SECURITY_VERIFY|JAMF_PRO|JAMF_PROTECT|JAMF_TELEMETRY|KOLIDE|LOOKOUT_MOBILE_ENDPOINT_SECURITY|MACOS|MACOS_ENDPOINT_SECURITY|MICROSOFT_DEFENDER_ENDPOINT|MICROSOFT_DEFENDER_ENDPOINT_IOS|MICROSOFT_DEFENDER_IDENTITY|MICROSOFT_GRAPH_ALERT|MICROSOFT_IAS|MICROSOFT_SCEP|MOBILEIRON|OPENPATH|PASSWORDSTATE|SAVIYNT_EIP|SENTINEL_DV|SENTINELONE_ALERT|SEP|SEQRITE_ENDPOINT|SOPHOS_CENTRAL|SPYCLOUD|TRENDMICRO_APEX_CENTRAL|TRENDMICRO_APEX_ONE|TRENDMICRO_DEEP_SECURITY|TRENDMICRO_STELLAR|TRENDMICRO_VISION_ONE|VENAFI_ZTPKI|WINDOWS_DEFENDER_ATP|WINEVTLOG|WINEVTLOG_XML/ nocase
strings.coalesce($event.principal.asset.hostname, $event.principal.hostname) in %PCI_Assets
outcome:
$Count = count($event.security_result.action)
Total de alertas de EDR por gravidade
$event.metadata.log_type = /EDR|CS_DETECTS|FIREEYE_HX|MICROSOFT_DEFENDER_ENDPOINT|MICROSOFT_DEFENDER_IDENTITY|SENTINEL_DV/
strings.coalesce($event.principal.asset.hostname, $event.principal.hostname) in %PCI_Assets
$Log_Type = $event.metadata.log_type
$Severity = $event.security_result.severity
$Rule_Name = strings.coalesce($event.security_result.rule_name, $event.security_result.description)
$Rule_Name != ""
$Description = $event.metadata.description
match:
$Rule_Name, $Description, $Log_Type, $Severity
outcome:
$Count = count($event.security_result.rule_name)
order:
$Severity desc
limit:
50
10 principais tipos de evento
$event.metadata.log_type = /_AV|EDR|BEYONDTRUST_ENDPOINT|BITDEFENDER|CISCO_AMP|CISCO_SECURE_WORKLOAD|CS_DETECTS|CS_IDP|CYBERARK_EPM|CYNET_360_AUTOXDR|ENDPOINT_PROTECTOR_DLP|FIREEYE_HX|HALCYON|IBM_SECURITY_VERIFY|JAMF_PRO|JAMF_PROTECT|JAMF_TELEMETRY|KOLIDE|LOOKOUT_MOBILE_ENDPOINT_SECURITY|MACOS|MACOS_ENDPOINT_SECURITY|MICROSOFT_DEFENDER_ENDPOINT|MICROSOFT_DEFENDER_ENDPOINT_IOS|MICROSOFT_DEFENDER_IDENTITY|MICROSOFT_GRAPH_ALERT|MICROSOFT_IAS|MICROSOFT_SCEP|MOBILEIRON|OPENPATH|PASSWORDSTATE|SAVIYNT_EIP|SENTINEL_DV|SENTINELONE_ALERT|SEP|SEQRITE_ENDPOINT|SOPHOS_CENTRAL|SPYCLOUD|TRENDMICRO_APEX_CENTRAL|TRENDMICRO_APEX_ONE|TRENDMICRO_DEEP_SECURITY|TRENDMICRO_STELLAR|TRENDMICRO_VISION_ONE|VENAFI_ZTPKI|WINDOWS_DEFENDER_ATP|WINEVTLOG|WINEVTLOG_XML/ nocase
strings.coalesce($event.principal.asset.hostname, $event.principal.hostname) in %PCI_Assets
$Event_Type = $event.metadata.event_type
match:
$Event_Type
outcome:
$Count = count($event.security_result.action)
order:
$Count desc
limit:
10
Total de alertas de EDR
$event.metadata.log_type = /EDR|CS_DETECTS|FIREEYE_HX|MICROSOFT_DEFENDER_ENDPOINT|MICROSOFT_DEFENDER_IDENTITY|SENTINEL_DV/ nocase
strings.coalesce($event.principal.asset.hostname, $event.principal.hostname) in %PCI_Assets
outcome:
$Count = count($event.security_result.rule_name)
Alertas de EDR por tática
$event.metadata.log_type = /EDR|CS_DETECTS|FIREEYE_HX|MICROSOFT_DEFENDER_ENDPOINT|MICROSOFT_DEFENDER_IDENTITY|SENTINEL_DV/
strings.coalesce($event.principal.asset.hostname, $event.principal.hostname) in %PCI_Assets
$Log_Type = $event.metadata.log_type
$Tactic_ID = strings.coalesce($event.security_result.attack_details.tactics.id, $event.security_result.detection_fields["Tactic ID"])
$Tactic_ID != ""
$Tactic_Name = strings.coalesce($event.security_result.attack_details.tactics.name, $event.security_result.detection_fields["Tactic"])
$Tactic_Name != ""
$Severity = $event.security_result.severity
match:
$Tactic_ID, $Tactic_Name, $Severity
outcome:
$Count = count($event.security_result.rule_name)
order:
$Severity desc
limit:
50
Total de alertas de EDR ao longo do tempo
$event.metadata.log_type = /EDR|CS_DETECTS|FIREEYE_HX|MICROSOFT_DEFENDER_ENDPOINT|MICROSOFT_DEFENDER_IDENTITY|SENTINEL_DV/
strings.coalesce($event.principal.asset.hostname, $event.principal.hostname) in %PCI_Assets
$Log_Type = $event.metadata.log_type
$Date = timestamp.get_date($event.metadata.event_timestamp.seconds)
match:
$Log_Type, $Date
outcome:
$Count = count($event.security_result.rule_name)
order:
$Date asc
Eventos por gravidade
$event.metadata.log_type = /_AV|EDR|BEYONDTRUST_ENDPOINT|BITDEFENDER|CISCO_AMP|CISCO_SECURE_WORKLOAD|CS_DETECTS|CS_IDP|CYBERARK_EPM|CYNET_360_AUTOXDR|ENDPOINT_PROTECTOR_DLP|FIREEYE_HX|HALCYON|IBM_SECURITY_VERIFY|JAMF_PRO|JAMF_PROTECT|JAMF_TELEMETRY|KOLIDE|LOOKOUT_MOBILE_ENDPOINT_SECURITY|MACOS|MACOS_ENDPOINT_SECURITY|MICROSOFT_DEFENDER_ENDPOINT|MICROSOFT_DEFENDER_ENDPOINT_IOS|MICROSOFT_DEFENDER_IDENTITY|MICROSOFT_GRAPH_ALERT|MICROSOFT_IAS|MICROSOFT_SCEP|MOBILEIRON|OPENPATH|PASSWORDSTATE|SAVIYNT_EIP|SENTINEL_DV|SENTINELONE_ALERT|SEP|SEQRITE_ENDPOINT|SOPHOS_CENTRAL|SPYCLOUD|TRENDMICRO_APEX_CENTRAL|TRENDMICRO_APEX_ONE|TRENDMICRO_DEEP_SECURITY|TRENDMICRO_STELLAR|TRENDMICRO_VISION_ONE|VENAFI_ZTPKI|WINDOWS_DEFENDER_ATP|WINEVTLOG|WINEVTLOG_XML/ nocase
strings.coalesce($event.principal.asset.hostname, $event.principal.hostname) in %PCI_Assets
$Event_Type = $event.metadata.event_type
$Log_Type = $event.metadata.log_type
$Severity = $event.security_result.severity
match:
$Event_Type, $Log_Type, $Severity
outcome:
$Count = count($event.security_result.action)
order:
$Severity desc
limit:
50
Outros eventos
$event.metadata.log_type = /_AV|EDR|BEYONDTRUST_ENDPOINT|BITDEFENDER|CISCO_AMP|CISCO_SECURE_WORKLOAD|CS_DETECTS|CS_IDP|CYBERARK_EPM|CYNET_360_AUTOXDR|ENDPOINT_PROTECTOR_DLP|FIREEYE_HX|HALCYON|IBM_SECURITY_VERIFY|JAMF_PRO|JAMF_PROTECT|JAMF_TELEMETRY|KOLIDE|LOOKOUT_MOBILE_ENDPOINT_SECURITY|MACOS|MACOS_ENDPOINT_SECURITY|MICROSOFT_DEFENDER_ENDPOINT|MICROSOFT_DEFENDER_ENDPOINT_IOS|MICROSOFT_DEFENDER_IDENTITY|MICROSOFT_GRAPH_ALERT|MICROSOFT_IAS|MICROSOFT_SCEP|MOBILEIRON|OPENPATH|PASSWORDSTATE|SAVIYNT_EIP|SENTINEL_DV|SENTINELONE_ALERT|SEP|SEQRITE_ENDPOINT|SOPHOS_CENTRAL|SPYCLOUD|TRENDMICRO_APEX_CENTRAL|TRENDMICRO_APEX_ONE|TRENDMICRO_DEEP_SECURITY|TRENDMICRO_STELLAR|TRENDMICRO_VISION_ONE|VENAFI_ZTPKI|WINDOWS_DEFENDER_ATP|WINEVTLOG|WINEVTLOG_XML/ nocase
strings.coalesce($event.principal.asset.hostname, $event.principal.hostname) in %PCI_Assets
outcome:
$Count = sum(if($event.security_result.action = "UNKNOWN_ACTION", 1, 0) + if($event.security_result.action = "FAIL", 1, 0) + if($event.security_result.action = "CHALLENGE", 1, 0))
Total de eventos por tipo ao longo do tempo
$event.metadata.log_type = /_AV|EDR|BEYONDTRUST_ENDPOINT|BITDEFENDER|CISCO_AMP|CISCO_SECURE_WORKLOAD|CS_DETECTS|CS_IDP|CYBERARK_EPM|CYNET_360_AUTOXDR|ENDPOINT_PROTECTOR_DLP|FIREEYE_HX|HALCYON|IBM_SECURITY_VERIFY|JAMF_PRO|JAMF_PROTECT|JAMF_TELEMETRY|KOLIDE|LOOKOUT_MOBILE_ENDPOINT_SECURITY|MACOS|MACOS_ENDPOINT_SECURITY|MICROSOFT_DEFENDER_ENDPOINT|MICROSOFT_DEFENDER_ENDPOINT_IOS|MICROSOFT_DEFENDER_IDENTITY|MICROSOFT_GRAPH_ALERT|MICROSOFT_IAS|MICROSOFT_SCEP|MOBILEIRON|OPENPATH|PASSWORDSTATE|SAVIYNT_EIP|SENTINEL_DV|SENTINELONE_ALERT|SEP|SEQRITE_ENDPOINT|SOPHOS_CENTRAL|SPYCLOUD|TRENDMICRO_APEX_CENTRAL|TRENDMICRO_APEX_ONE|TRENDMICRO_DEEP_SECURITY|TRENDMICRO_STELLAR|TRENDMICRO_VISION_ONE|VENAFI_ZTPKI|WINDOWS_DEFENDER_ATP|WINEVTLOG|WINEVTLOG_XML/ nocase
strings.coalesce($event.principal.asset.hostname, $event.principal.hostname) in %PCI_Assets
$Event_Type = $event.metadata.event_type
$Date = timestamp.get_date($event.metadata.event_timestamp.seconds)
match:
$Event_Type, $Date
outcome:
$Count = count($event.security_result.action)
order:
$Date asc
Eventos permitidos por endereço IP
$event.metadata.log_type = /_AV|EDR|BEYONDTRUST_ENDPOINT|BITDEFENDER|CISCO_AMP|CISCO_SECURE_WORKLOAD|CS_DETECTS|CS_IDP|CYBERARK_EPM|CYNET_360_AUTOXDR|ENDPOINT_PROTECTOR_DLP|FIREEYE_HX|HALCYON|IBM_SECURITY_VERIFY|JAMF_PRO|JAMF_PROTECT|JAMF_TELEMETRY|KOLIDE|LOOKOUT_MOBILE_ENDPOINT_SECURITY|MACOS|MACOS_ENDPOINT_SECURITY|MICROSOFT_DEFENDER_ENDPOINT|MICROSOFT_DEFENDER_ENDPOINT_IOS|MICROSOFT_DEFENDER_IDENTITY|MICROSOFT_GRAPH_ALERT|MICROSOFT_IAS|MICROSOFT_SCEP|MOBILEIRON|OPENPATH|PASSWORDSTATE|SAVIYNT_EIP|SENTINEL_DV|SENTINELONE_ALERT|SEP|SEQRITE_ENDPOINT|SOPHOS_CENTRAL|SPYCLOUD|TRENDMICRO_APEX_CENTRAL|TRENDMICRO_APEX_ONE|TRENDMICRO_DEEP_SECURITY|TRENDMICRO_STELLAR|TRENDMICRO_VISION_ONE|VENAFI_ZTPKI|WINDOWS_DEFENDER_ATP|WINEVTLOG|WINEVTLOG_XML/
strings.coalesce($event.principal.asset.hostname, $event.principal.hostname) in %PCI_Assets
$event.security_result.action = "ALLOW"
$Event_Type = $event.metadata.event_type
$IP = $event.principal.ip
match:
$IP, $Event_Type
outcome:
$Count = count($event.security_result.action)
order:
$Count desc
limit:
50
Ações de eventos por tipo de registro
$event.metadata.log_type = /_AV|EDR|BEYONDTRUST_ENDPOINT|BITDEFENDER|CISCO_AMP|CISCO_SECURE_WORKLOAD|CS_DETECTS|CS_IDP|CYBERARK_EPM|CYNET_360_AUTOXDR|ENDPOINT_PROTECTOR_DLP|FIREEYE_HX|HALCYON|IBM_SECURITY_VERIFY|JAMF_PRO|JAMF_PROTECT|JAMF_TELEMETRY|KOLIDE|LOOKOUT_MOBILE_ENDPOINT_SECURITY|MACOS|MACOS_ENDPOINT_SECURITY|MICROSOFT_DEFENDER_ENDPOINT|MICROSOFT_DEFENDER_ENDPOINT_IOS|MICROSOFT_DEFENDER_IDENTITY|MICROSOFT_GRAPH_ALERT|MICROSOFT_IAS|MICROSOFT_SCEP|MOBILEIRON|OPENPATH|PASSWORDSTATE|SAVIYNT_EIP|SENTINEL_DV|SENTINELONE_ALERT|SEP|SEQRITE_ENDPOINT|SOPHOS_CENTRAL|SPYCLOUD|TRENDMICRO_APEX_CENTRAL|TRENDMICRO_APEX_ONE|TRENDMICRO_DEEP_SECURITY|TRENDMICRO_STELLAR|TRENDMICRO_VISION_ONE|VENAFI_ZTPKI|WINDOWS_DEFENDER_ATP|WINEVTLOG|WINEVTLOG_XML/ nocase
strings.coalesce($event.principal.asset.hostname, $event.principal.hostname) in %PCI_Assets
$Log_Type = $event.metadata.log_type
$Action = $event.security_result.action
match:
$Action, $Log_Type
outcome:
$Count = count($event.security_result.action)
order:
$Count desc
limit:
10
Eventos bloqueados por endereço IP
$event.metadata.log_type = /_AV|EDR|BEYONDTRUST_ENDPOINT|BITDEFENDER|CISCO_AMP|CISCO_SECURE_WORKLOAD|CS_DETECTS|CS_IDP|CYBERARK_EPM|CYNET_360_AUTOXDR|ENDPOINT_PROTECTOR_DLP|FIREEYE_HX|HALCYON|IBM_SECURITY_VERIFY|JAMF_PRO|JAMF_PROTECT|JAMF_TELEMETRY|KOLIDE|LOOKOUT_MOBILE_ENDPOINT_SECURITY|MACOS|MACOS_ENDPOINT_SECURITY|MICROSOFT_DEFENDER_ENDPOINT|MICROSOFT_DEFENDER_ENDPOINT_IOS|MICROSOFT_DEFENDER_IDENTITY|MICROSOFT_GRAPH_ALERT|MICROSOFT_IAS|MICROSOFT_SCEP|MOBILEIRON|OPENPATH|PASSWORDSTATE|SAVIYNT_EIP|SENTINEL_DV|SENTINELONE_ALERT|SEP|SEQRITE_ENDPOINT|SOPHOS_CENTRAL|SPYCLOUD|TRENDMICRO_APEX_CENTRAL|TRENDMICRO_APEX_ONE|TRENDMICRO_DEEP_SECURITY|TRENDMICRO_STELLAR|TRENDMICRO_VISION_ONE|VENAFI_ZTPKI|WINDOWS_DEFENDER_ATP|WINEVTLOG|WINEVTLOG_XML/
strings.coalesce($event.principal.asset.hostname, $event.principal.hostname) in %PCI_Assets
$event.security_result.action = "BLOCK"
$Event_Type = $event.metadata.event_type
$IP = $event.principal.ip
match:
$IP, $Event_Type
outcome:
$Count = count($event.security_result.action)
order:
$Count desc
limit:
50
Eventos bloqueados por usuário
$event.metadata.log_type = /_AV|EDR|BEYONDTRUST_ENDPOINT|BITDEFENDER|CISCO_AMP|CISCO_SECURE_WORKLOAD|CS_DETECTS|CS_IDP|CYBERARK_EPM|CYNET_360_AUTOXDR|ENDPOINT_PROTECTOR_DLP|FIREEYE_HX|HALCYON|IBM_SECURITY_VERIFY|JAMF_PRO|JAMF_PROTECT|JAMF_TELEMETRY|KOLIDE|LOOKOUT_MOBILE_ENDPOINT_SECURITY|MACOS|MACOS_ENDPOINT_SECURITY|MICROSOFT_DEFENDER_ENDPOINT|MICROSOFT_DEFENDER_ENDPOINT_IOS|MICROSOFT_DEFENDER_IDENTITY|MICROSOFT_GRAPH_ALERT|MICROSOFT_IAS|MICROSOFT_SCEP|MOBILEIRON|OPENPATH|PASSWORDSTATE|SAVIYNT_EIP|SENTINEL_DV|SENTINELONE_ALERT|SEP|SEQRITE_ENDPOINT|SOPHOS_CENTRAL|SPYCLOUD|TRENDMICRO_APEX_CENTRAL|TRENDMICRO_APEX_ONE|TRENDMICRO_DEEP_SECURITY|TRENDMICRO_STELLAR|TRENDMICRO_VISION_ONE|VENAFI_ZTPKI|WINDOWS_DEFENDER_ATP|WINEVTLOG|WINEVTLOG_XML/
strings.coalesce($event.principal.asset.hostname, $event.principal.hostname) in %PCI_Assets
$event.security_result.action = "BLOCK"
$Event_Type = $event.metadata.event_type
$User = strings.coalesce($event.principal.user.user_display_name, $event.principal.user.userid)
match:
$User, $Event_Type
outcome:
$Count = count($event.security_result.action)
order:
$Count desc
limit:
50
Eventos em quarentena
$event.metadata.log_type = /_AV|EDR|BEYONDTRUST_ENDPOINT|BITDEFENDER|CISCO_AMP|CISCO_SECURE_WORKLOAD|CS_DETECTS|CS_IDP|CYBERARK_EPM|CYNET_360_AUTOXDR|ENDPOINT_PROTECTOR_DLP|FIREEYE_HX|HALCYON|IBM_SECURITY_VERIFY|JAMF_PRO|JAMF_PROTECT|JAMF_TELEMETRY|KOLIDE|LOOKOUT_MOBILE_ENDPOINT_SECURITY|MACOS|MACOS_ENDPOINT_SECURITY|MICROSOFT_DEFENDER_ENDPOINT|MICROSOFT_DEFENDER_ENDPOINT_IOS|MICROSOFT_DEFENDER_IDENTITY|MICROSOFT_GRAPH_ALERT|MICROSOFT_IAS|MICROSOFT_SCEP|MOBILEIRON|OPENPATH|PASSWORDSTATE|SAVIYNT_EIP|SENTINEL_DV|SENTINELONE_ALERT|SEP|SEQRITE_ENDPOINT|SOPHOS_CENTRAL|SPYCLOUD|TRENDMICRO_APEX_CENTRAL|TRENDMICRO_APEX_ONE|TRENDMICRO_DEEP_SECURITY|TRENDMICRO_STELLAR|TRENDMICRO_VISION_ONE|VENAFI_ZTPKI|WINDOWS_DEFENDER_ATP|WINEVTLOG|WINEVTLOG_XML/ nocase
strings.coalesce($event.principal.asset.hostname, $event.principal.hostname) in %PCI_Assets
$event.security_result.action = "QUARANTINE"
outcome:
$Count = count($event.security_result.action)
10 principais endpoints por local
$event.metadata.log_type = /_AV|EDR|BEYONDTRUST_ENDPOINT|BITDEFENDER|CISCO_AMP|CISCO_SECURE_WORKLOAD|CS_DETECTS|CS_IDP|CYBERARK_EPM|CYNET_360_AUTOXDR|ENDPOINT_PROTECTOR_DLP|FIREEYE_HX|HALCYON|IBM_SECURITY_VERIFY|JAMF_PRO|JAMF_PROTECT|JAMF_TELEMETRY|KOLIDE|LOOKOUT_MOBILE_ENDPOINT_SECURITY|MACOS|MACOS_ENDPOINT_SECURITY|MICROSOFT_DEFENDER_ENDPOINT|MICROSOFT_DEFENDER_ENDPOINT_IOS|MICROSOFT_DEFENDER_IDENTITY|MICROSOFT_GRAPH_ALERT|MICROSOFT_IAS|MICROSOFT_SCEP|MOBILEIRON|OPENPATH|PASSWORDSTATE|SAVIYNT_EIP|SENTINEL_DV|SENTINELONE_ALERT|SEP|SEQRITE_ENDPOINT|SOPHOS_CENTRAL|SPYCLOUD|TRENDMICRO_APEX_CENTRAL|TRENDMICRO_APEX_ONE|TRENDMICRO_DEEP_SECURITY|TRENDMICRO_STELLAR|TRENDMICRO_VISION_ONE|VENAFI_ZTPKI|WINDOWS_DEFENDER_ATP|WINEVTLOG|WINEVTLOG_XML/ nocase
strings.coalesce($event.principal.asset.hostname, $event.principal.hostname) in %PCI_Assets
$Countries = $event.principal.location.country_or_region
$Countries != ""
$Latitude = $event.principal.location.region_coordinates.latitude
$Longitude = $event.principal.location.region_coordinates.longitude
$Hostname = $event.target.asset.hostname
match:
$Countries, $Latitude, $Longitude, $Hostname
outcome:
$Count = count($event.principal.location.country_or_region)
limit:
10
Eventos bloqueados
$event.metadata.log_type = /_AV|EDR|BEYONDTRUST_ENDPOINT|BITDEFENDER|CISCO_AMP|CISCO_SECURE_WORKLOAD|CS_DETECTS|CS_IDP|CYBERARK_EPM|CYNET_360_AUTOXDR|ENDPOINT_PROTECTOR_DLP|FIREEYE_HX|HALCYON|IBM_SECURITY_VERIFY|JAMF_PRO|JAMF_PROTECT|JAMF_TELEMETRY|KOLIDE|LOOKOUT_MOBILE_ENDPOINT_SECURITY|MACOS|MACOS_ENDPOINT_SECURITY|MICROSOFT_DEFENDER_ENDPOINT|MICROSOFT_DEFENDER_ENDPOINT_IOS|MICROSOFT_DEFENDER_IDENTITY|MICROSOFT_GRAPH_ALERT|MICROSOFT_IAS|MICROSOFT_SCEP|MOBILEIRON|OPENPATH|PASSWORDSTATE|SAVIYNT_EIP|SENTINEL_DV|SENTINELONE_ALERT|SEP|SEQRITE_ENDPOINT|SOPHOS_CENTRAL|SPYCLOUD|TRENDMICRO_APEX_CENTRAL|TRENDMICRO_APEX_ONE|TRENDMICRO_DEEP_SECURITY|TRENDMICRO_STELLAR|TRENDMICRO_VISION_ONE|VENAFI_ZTPKI|WINDOWS_DEFENDER_ATP|WINEVTLOG|WINEVTLOG_XML/
strings.coalesce($event.principal.asset.hostname, $event.principal.hostname) in %PCI_Assets
$event.security_result.action = "BLOCK"
outcome:
$Count = count($event.security_result.action)
Total de eventos ao longo do tempo
$event.metadata.log_type = /_AV|EDR|BEYONDTRUST_ENDPOINT|BITDEFENDER|CISCO_AMP|CISCO_SECURE_WORKLOAD|CS_DETECTS|CS_IDP|CYBERARK_EPM|CYNET_360_AUTOXDR|ENDPOINT_PROTECTOR_DLP|FIREEYE_HX|HALCYON|IBM_SECURITY_VERIFY|JAMF_PRO|JAMF_PROTECT|JAMF_TELEMETRY|KOLIDE|LOOKOUT_MOBILE_ENDPOINT_SECURITY|MACOS|MACOS_ENDPOINT_SECURITY|MICROSOFT_DEFENDER_ENDPOINT|MICROSOFT_DEFENDER_ENDPOINT_IOS|MICROSOFT_DEFENDER_IDENTITY|MICROSOFT_GRAPH_ALERT|MICROSOFT_IAS|MICROSOFT_SCEP|MOBILEIRON|OPENPATH|PASSWORDSTATE|SAVIYNT_EIP|SENTINEL_DV|SENTINELONE_ALERT|SEP|SEQRITE_ENDPOINT|SOPHOS_CENTRAL|SPYCLOUD|TRENDMICRO_APEX_CENTRAL|TRENDMICRO_APEX_ONE|TRENDMICRO_DEEP_SECURITY|TRENDMICRO_STELLAR|TRENDMICRO_VISION_ONE|VENAFI_ZTPKI|WINDOWS_DEFENDER_ATP|WINEVTLOG|WINEVTLOG_XML/ nocase
strings.coalesce($event.principal.asset.hostname, $event.principal.hostname) in %PCI_Assets
$Log_Type = $event.metadata.log_type
$Date = timestamp.get_date($event.metadata.event_timestamp.seconds)
match:
$Log_Type, $Date
outcome:
$Count = count($event.security_result.action)
order:
$Date asc
Eventos permitidos por tipo
$event.metadata.log_type = /_AV|EDR|BEYONDTRUST_ENDPOINT|BITDEFENDER|CISCO_AMP|CISCO_SECURE_WORKLOAD|CS_DETECTS|CS_IDP|CYBERARK_EPM|CYNET_360_AUTOXDR|ENDPOINT_PROTECTOR_DLP|FIREEYE_HX|HALCYON|IBM_SECURITY_VERIFY|JAMF_PRO|JAMF_PROTECT|JAMF_TELEMETRY|KOLIDE|LOOKOUT_MOBILE_ENDPOINT_SECURITY|MACOS|MACOS_ENDPOINT_SECURITY|MICROSOFT_DEFENDER_ENDPOINT|MICROSOFT_DEFENDER_ENDPOINT_IOS|MICROSOFT_DEFENDER_IDENTITY|MICROSOFT_GRAPH_ALERT|MICROSOFT_IAS|MICROSOFT_SCEP|MOBILEIRON|OPENPATH|PASSWORDSTATE|SAVIYNT_EIP|SENTINEL_DV|SENTINELONE_ALERT|SEP|SEQRITE_ENDPOINT|SOPHOS_CENTRAL|SPYCLOUD|TRENDMICRO_APEX_CENTRAL|TRENDMICRO_APEX_ONE|TRENDMICRO_DEEP_SECURITY|TRENDMICRO_STELLAR|TRENDMICRO_VISION_ONE|VENAFI_ZTPKI|WINDOWS_DEFENDER_ATP|WINEVTLOG|WINEVTLOG_XML/
strings.coalesce($event.principal.asset.hostname, $event.principal.hostname) in %PCI_Assets
$event.security_result.action = "ALLOW"
or $event.security_result.action = "ALLOW_WITH_MODIFICATION"
$Event_Type = $event.metadata.event_type
match:
$Event_Type
outcome:
$Count = count($event.security_result.action)
order:
$Count desc
Eventos permitidos
$event.metadata.log_type = /_AV|EDR|BEYONDTRUST_ENDPOINT|BITDEFENDER|CISCO_AMP|CISCO_SECURE_WORKLOAD|CS_DETECTS|CS_IDP|CYBERARK_EPM|CYNET_360_AUTOXDR|ENDPOINT_PROTECTOR_DLP|FIREEYE_HX|HALCYON|IBM_SECURITY_VERIFY|JAMF_PRO|JAMF_PROTECT|JAMF_TELEMETRY|KOLIDE|LOOKOUT_MOBILE_ENDPOINT_SECURITY|MACOS|MACOS_ENDPOINT_SECURITY|MICROSOFT_DEFENDER_ENDPOINT|MICROSOFT_DEFENDER_ENDPOINT_IOS|MICROSOFT_DEFENDER_IDENTITY|MICROSOFT_GRAPH_ALERT|MICROSOFT_IAS|MICROSOFT_SCEP|MOBILEIRON|OPENPATH|PASSWORDSTATE|SAVIYNT_EIP|SENTINEL_DV|SENTINELONE_ALERT|SEP|SEQRITE_ENDPOINT|SOPHOS_CENTRAL|SPYCLOUD|TRENDMICRO_APEX_CENTRAL|TRENDMICRO_APEX_ONE|TRENDMICRO_DEEP_SECURITY|TRENDMICRO_STELLAR|TRENDMICRO_VISION_ONE|VENAFI_ZTPKI|WINDOWS_DEFENDER_ATP|WINEVTLOG|WINEVTLOG_XML/
strings.coalesce($event.principal.asset.hostname, $event.principal.hostname) in %PCI_Assets
$event.security_result.action = "ALLOW"
or $event.security_result.action = "ALLOW_WITH_MODIFICATION"
outcome:
$Count = count($event.security_result.action)
PCI: criptografia de dados
Este painel oferece uma visão geral das práticas de criptografia em todos os recursos da PCI. Esse painel aumenta a visibilidade do uso de chaves de criptografia, oferecendo insights sobre as atividades do serviço de gerenciamento de chaves (KMS), os registros do Azure Key Vault e os registros do Akeyless Vault. Ele usa a lista de referência pci_network_ranges para restringir os dados ao ambiente de PCI.
Observação : os gráficos neste painel não são carregados até que as listas de referência necessárias sejam criadas.
Rotação de chaves há mais de 30 dias
Falha na descriptografia da chave
Exclusão de chaves
Comunicação criptografada fraca / não criptografada
Comunicação criptografada fraca/ não criptografada por porta
Chave rotacionada
Chave ativada
Sucesso na descriptografia da chave
Nova chave
Comunicação criptografada fraca / não criptografada ao longo do tempo
Chave desativada há mais de 30 dias
Os 10 principais usuários com comunicação criptografada fraca/ não criptografada
10 principais operações de chave
Os 10 principais hosts com comunicação criptografada fraca / não criptografada
Nome do gráfico
Exemplo de consulta
Rotação de chaves há mais de 30 dias
$log_type = metadata.log_type
$app = target.application
($log_type = /AZURE_KEYVAULT_AUDIT|AKEYLESS_VAULT/ or $app = "kms.amazonaws.com")
principal.ip in cidr %PCI_Network_Ranges
$IP = principal.ip
$security_event_type = metadata.product_event_type
($security_event_type = "RotateKeyOnDemand" or $security_event_type = "RotateKey" or $security_event_type = "KeyRotate" or $security_event_type = /KeyRotationPolicy/ nocase or $security_event_type = "KeyRotateIfDue")
$difference = timestamp.diff(timestamp.current_seconds(), metadata.ingested_timestamp.seconds, "DAY")
$difference > 30
$label = principal.user.attribute.labels.key
$value = principal.user.attribute.labels.value
$user = strings.coalesce(principal.user.userid,principal.user.user_display_name,principal.user.email_addresses)
$key = target.resource.name
$target_key = target.resource.attribute.labels.key
$target_key = "Recipient Account Id"
$account_Id = target.resource.attribute.labels.value
$date = timestamp.get_date(metadata.ingested_timestamp.seconds)
match:
$date, $account_Id, $user, $IP, $key, $label, $value
outcome:
$age = max($difference)
order:
$age desc
Falha na descriptografia da chave
$log_type = metadata.log_type
$app = target.application
($log_type = /AZURE_KEYVAULT_AUDIT|AKEYLESS_VAULT/ or $app = "kms.amazonaws.com")
principal.ip in cidr %PCI_Network_Ranges
$IP = principal.ip
$security_event_type = metadata.product_event_type
($security_event_type = "Decrypt" or $security_event_type = "KeyDecrypt")
$summary = security_result.summary
$description = metadata.description
$result_type = additional.fields["resultType"]
(re.regex($summary, `Fail`) nocase or re.regex($result_type, `Fail`) nocase)
$message = strings.coalesce(security_result.summary, metadata.description)
$key = target.resource.name
$label = principal.user.attribute.labels.key
$label = "principalId"
$value = principal.user.attribute.labels.value
$role = principal.user.role_name
$user = strings.coalesce(principal.user.userid,principal.user.user_display_name,principal.user.email_addresses)
match:
$user, $IP, $key, $role, $message, $label, $value
outcome:
$event_count = count(metadata.id)
order:
$event_count desc
Exclusão de chaves
$log_type = metadata.log_type
$app = target.application
($log_type = /AZURE_KEYVAULT_AUDIT|AKEYLESS_VAULT/ or $app = "kms.amazonaws.com")
principal.ip in cidr %PCI_Network_Ranges
$IP = principal.ip
$security_event_type = metadata.product_event_type
($security_event_type = "KeyDelete" or $security_event_type = "ScheduleKeyDeletion" or $security_event_type = "Delete")
$label = principal.user.attribute.labels.key
$user = strings.coalesce(principal.user.attribute.labels.value, principal.user.userid, principal.user.user_display_name,principal.user.email_addresses)
$key = target.resource.name
$date = timestamp.get_date(metadata.event_timestamp.seconds)
match:
$user, $IP, $key, $label, $date
outcome:
$event_count = count(metadata.id)
order:
$date, $event_count desc
Comunicação criptografada fraca / não criptografada
$log_type = metadata.log_type
$app = target.application
($log_type = /AZURE_KEYVAULT_AUDIT|AKEYLESS_VAULT/ or $app = "kms.amazonaws.com")
principal.ip in cidr %PCI_Network_Ranges
$IP = principal.ip
$target_key = target.resource.attribute.labels.key
($target_key = "keyProperties_type" or $target_key = "requestParameters.keySpec")
$target_value = target.resource.attribute.labels.value
$target_value != /RSA|AES_256/ nocase
outcome:
$event_count = count_distinct(metadata.id)
Comunicação criptografada fraca/ não criptografada por porta
$IP = principal.ip
principal.ip in cidr %PCI_Network_Ranges
$event_type = metadata.event_type
($event_type >= 16000 and $event_type <= 16007)
$port = strings.concat(target.port, "")
$port = /(80|69|23|21|110|143|161|79|88)/
$direction = network.direction
match:
$port, $direction, $event_type
outcome:
$event_count = count(metadata.id)
order:
$event_count desc
limit:
10
Chave rotacionada
principal.ip in cidr %PCI_Network_Ranges
($log_type = /AZURE_KEYVAULT_AUDIT|AKEYLESS_VAULT/ or $app = "kms.amazonaws.com")
$log_type = metadata.log_type
$app = target.application
$IP = principal.ip
$security_event_type = metadata.product_event_type
($security_event_type = "RotateKeyOnDemand" or $security_event_type = "RotateKey" or $security_event_type = "KeyRotate" or $security_event_type = /KeyRotationPolicy/ nocase or $security_event_type = "KeyRotateIfDue")
$label = principal.user.attribute.labels.key
$value = principal.user.attribute.labels.value
$user = strings.coalesce(principal.user.userid, principal.user.user_display_name, principal.user.email_addresses)
$key = target.resource.name
match:
$user, $IP, $key, $label, $value
outcome:
$event_count = count(metadata.id)
order:
$event_count desc
Chave ativada
$log_type = metadata.log_type
$app = target.application
($log_type = /AZURE_KEYVAULT_AUDIT|AKEYLESS_VAULT/ or $app = "kms.amazonaws.com")
principal.ip in cidr %PCI_Network_Ranges
$IP = principal.ip
$security_event_type = metadata.product_event_type
($security_event_type = "EnableKey" or $security_event_type = "KeyEnable")
outcome:
$event_count = count(metadata.id)
Sucesso na descriptografia da chave
$log_type = metadata.log_type
$app = target.application
($log_type = /AZURE_KEYVAULT_AUDIT|AKEYLESS_VAULT/ or $app = "kms.amazonaws.com")
principal.ip in cidr %PCI_Network_Ranges
$IP = principal.ip
$security_event_type = metadata.product_event_type
($security_event_type = "Decrypt" or $security_event_type = "KeyDecrypt")
$summary = security_result.summary
$description = metadata.description
$result_type = additional.fields["resultType"]
(re.regex($summary, `Success`) nocase or re.regex($result_type, `Success`) nocase)
$message = strings.coalesce(security_result.summary, metadata.description)
$key = target.resource.name
$label = principal.user.attribute.labels.key
$value = principal.user.attribute.labels.value
$role = principal.user.role_name
$user = strings.coalesce(principal.user.userid,principal.user.user_display_name,principal.user.email_addresses)
match:
$user, $IP, $key, $role, $message, $label, $value
outcome:
$event_count = count(metadata.id)
order:
$event_count desc
limit:
50
Nova chave
$log_type = metadata.log_type
$app = target.application
($log_type = /AZURE_KEYVAULT_AUDIT|AKEYLESS_VAULT/ or $app = "kms.amazonaws.com")
principal.ip in cidr %PCI_Network_Ranges
$IP = principal.ip
$security_event_type = metadata.product_event_type
($security_event_type = "CreateKey" or $security_event_type = "KeyCreate")
outcome:
$event_count = count(metadata.id)
Comunicação criptografada fraca / não criptografada ao longo do tempo
$log_type = metadata.log_type
$app = target.application
($log_type = /AZURE_KEYVAULT_AUDIT|AKEYLESS_VAULT/ or $app = "kms.amazonaws.com")
principal.ip in cidr %PCI_Network_Ranges
$IP = principal.ip
$target_key = target.resource.attribute.labels.key
($target_key = "keyProperties_type" or $target_key = "requestParameters.keySpec")
$target_value = target.resource.attribute.labels.value
$target_value != /RSA|AES_256/ nocase
$date = timestamp.get_date(metadata.event_timestamp.seconds)
match:
$date
outcome:
$event_count = count(metadata.id)
order:
$date asc
Chave desativada há mais de 30 dias
$log_type = metadata.log_type
$app = target.application
($log_type = /AZURE_KEYVAULT_AUDIT|AKEYLESS_VAULT/ or $app = "kms.amazonaws.com")
principal.ip in cidr %PCI_Network_Ranges
$IP = principal.ip
$security_event_type = metadata.product_event_type
($security_event_type = "DisableKey" or $security_event_type = "Disable")
$difference = timestamp.diff(timestamp.current_seconds(), metadata.ingested_timestamp.seconds, "DAY")
$difference > 30
$account_id = target.resource.attribute.labels.value
$user = strings.coalesce(principal.user.userid, principal.user.user_display_name, principal.user.email_addresses)
$key = target.resource.name
match:
$account_id, $user, $IP, $key
outcome:
$age = max($difference)
order:
$age desc
Os 10 principais usuários com comunicação criptografada fraca/ não criptografada
$log_type = metadata.log_type
$app = target.application
($log_type = /AZURE_KEYVAULT_AUDIT|AKEYLESS_VAULT/ or $app = "kms.amazonaws.com")
principal.ip in cidr %PCI_Network_Ranges
$IP = principal.ip
$target_key = target.resource.attribute.labels.key
($target_key = "keyProperties_type" or $target_key = "requestParameters.keySpec")
$target_value = target.resource.attribute.labels.value
$target_value != /RSA|AES_256/ nocase
$user = strings.coalesce(principal.user.attribute.labels.value, principal.user.userid, principal.user.user_display_name,principal.user.email_addresses)
match:
$user
outcome:
$event_count = count(metadata.id)
order:
$event_count desc
limit :
10
10 principais operações de chave
$log_type = metadata.log_type
$app = target.application
($log_type = /AZURE_KEYVAULT_AUDIT|AKEYLESS_VAULT/ or $app = "kms.amazonaws.com")
principal.ip in cidr %PCI_Network_Ranges
$IP = principal.ip
$security_event_type = metadata.product_event_type
match:
$security_event_type
outcome:
$event_count = count(metadata.id)
order:
$event_count desc
limit:
10
Os 10 principais hosts com comunicação criptografada fraca / não criptografada
$log_type = metadata.log_type
$app = target.application
($log_type = /AZURE_KEYVAULT_AUDIT|AKEYLESS_VAULT/ or $app = "kms.amazonaws.com")
principal.ip in cidr %PCI_Network_Ranges
$IP = principal.ip
$target_key = target.resource.attribute.labels.key
($target_key = "keyProperties_type" or $target_key = "requestParameters.keySpec")
$target_value = target.resource.attribute.labels.value
$target_value != /RSA|AES_256/
$hostname = strings.coalesce(principal.hostname, principal.asset.hostname)
$hostname != ""
match:
$hostname
outcome:
$event_count = count(metadata.id)
order:
$event_count desc
limit:
10
PCI: visão geral dos alertas de EDR
Esse painel oferece uma visão detalhada de elementos críticos, como recursos, eventos e detecções de ameaças ativas. Ele usa a lista de referência pci_assets para restringir os dados ao ambiente de PCI.
Observação : os gráficos neste painel não são carregados até que as listas de referência necessárias sejam criadas.
Número de sensores de EDR
10 principais técnicas
Gravidade com base em alertas de EDR
Total de alertas de EDR ao longo do tempo
Os 10 principais usuários com base em alertas de EDR
10 principais táticas
10 principais alertas de EDR
Os 10 principais hosts com base em alertas de EDR
Sensores EDR ativos
Total de alertas de EDR
Nome do gráfico
Exemplo de consulta
Número de sensores de EDR
$event.metadata.log_type = /EDR|CS_DETECTS|FIREEYE_HX|MICROSOFT_DEFENDER_ENDPOINT|MICROSOFT_DEFENDER_IDENTITY|SENTINEL_DV/ nocase
strings.coalesce($event.principal.asset.hostname, $event.principal.hostname) in %PCI_Assets
outcome:
$Count = count_distinct($event.principal.asset.hostname)
10 principais técnicas
$event.metadata.log_type = /EDR|CS_DETECTS|FIREEYE_HX|MICROSOFT_DEFENDER_ENDPOINT|MICROSOFT_DEFENDER_IDENTITY|SENTINEL_DV/ nocase
strings.coalesce($event.principal.asset.hostname, $event.principal.hostname) in %PCI_Assets
$Technique_ID = strings.coalesce($event.security_result.attack_details.techniques.id, $event.security_result.detection_fields["Technique ID"])
$Technique_Name = strings.coalesce($event.security_result.attack_details.techniques.name, $event.security_result.detection_fields["Technique"])
$Technique_ID != ""
$Technique_Name != ""
match:
$Technique_Name
outcome:
$Count = count($event.security_result.summary)
order:
$Count desc
limit:
107
Gravidade com base em alertas de EDR
$event.metadata.log_type = /EDR|CS_DETECTS|FIREEYE_HX|MICROSOFT_DEFENDER_ENDPOINT|MICROSOFT_DEFENDER_IDENTITY|SENTINEL_DV/ nocase
strings.coalesce($event.principal.asset.hostname, $event.principal.hostname) in %PCI_Assets
$event.security_result.summary != ""
$Severity = $event.security_result.severity
match:
$Severity
outcome:
$Count = count($event.security_result.summary)
order:
$Severity asc
limit:
10
Total de alertas de EDR ao longo do tempo
$event.metadata.log_type = /EDR|CS_DETECTS|FIREEYE_HX|MICROSOFT_DEFENDER_ENDPOINT|MICROSOFT_DEFENDER_IDENTITY|SENTINEL_DV/ nocase
strings.coalesce($event.principal.asset.hostname, $event.principal.hostname) in %PCI_Assets
$Log_Type = $event.metadata.log_type
$Date = timestamp.get_date($event.metadata.event_timestamp.seconds)
match:
$Date, $Log_Type
outcome:
$Count = count($event.security_result.summary)
order:
$Date asc
Os 10 principais usuários com base em alertas de EDR
$event.metadata.log_type = /EDR|CS_DETECTS|FIREEYE_HX|MICROSOFT_DEFENDER_ENDPOINT|MICROSOFT_DEFENDER_IDENTITY|SENTINEL_DV/ nocase
strings.coalesce($event.principal.asset.hostname, $event.principal.hostname) in %PCI_Assets
$User = $event.principal.user.user_display_name
$User != ""
match:
$User
outcome:
$Count = count($event.security_result.summary)
order:
$Count desc
limit:
10
10 principais táticas
$event.metadata.log_type = /EDR|CS_DETECTS|FIREEYE_HX|MICROSOFT_DEFENDER_ENDPOINT|MICROSOFT_DEFENDER_IDENTITY|SENTINEL_DV/ nocase
strings.coalesce($event.principal.asset.hostname, $event.principal.hostname) in %PCI_Assets
$Tactic_ID = strings.coalesce($event.security_result.attack_details.tactics.id, $event.security_result.detection_fields["Tactic ID"])
$Tactic_Name = strings.coalesce($event.security_result.attack_details.tactics.name, $event.security_result.detection_fields["Tactic"])
$Tactic_ID != ""
$Tactic_Name != ""
match:
$Tactic_Name
outcome:
$Count = count($event.security_result.summary)
order:
$Count desc
limit:
10
10 principais alertas de EDR
$event.metadata.log_type = /EDR|CS_DETECTS|FIREEYE_HX|MICROSOFT_DEFENDER_ENDPOINT|MICROSOFT_DEFENDER_IDENTITY|SENTINEL_DV/ nocase
strings.coalesce($event.principal.asset.hostname, $event.principal.hostname) in %PCI_Assets
$Log_Type = $event.metadata.log_type
$Detection = $event.security_result.summary
$Detection != ""
match:
$Detection, $Log_Type
outcome:
$Count = count($event.security_result.summary)
order:
$Count desc
limit:
10
Os 10 principais hosts com base em alertas de EDR
$event.metadata.log_type = /EDR|CS_DETECTS|FIREEYE_HX|MICROSOFT_DEFENDER_ENDPOINT|MICROSOFT_DEFENDER_IDENTITY|SENTINEL_DV/ nocase
strings.coalesce($event.principal.asset.hostname, $event.principal.hostname) in %PCI_Assets
$Hostname = strings.coalesce($event.principal.asset.hostname, $event.principal.hostname)
$Hostname != ""
match:
$Hostname
outcome:
$Count = count($event.security_result.summary)
order:
$Count desc
limit:
10
Sensores EDR ativos
$event.metadata.log_type = /EDR|CS_DETECTS|FIREEYE_HX|MICROSOFT_DEFENDER_ENDPOINT|MICROSOFT_DEFENDER_IDENTITY|SENTINEL_DV/ nocase
strings.coalesce($event.principal.asset.hostname, $event.principal.hostname) in %PCI_Assets
$EDR_Asset = strings.coalesce($event.principal.asset.hostname, $event.principal.hostname)
match:
$EDR_Asset
limit:
50
Total de alertas de EDR
$event.metadata.log_type = /EDR|CS_DETECTS|FIREEYE_HX|MICROSOFT_DEFENDER_ENDPOINT|MICROSOFT_DEFENDER_IDENTITY|SENTINEL_DV/ nocase
strings.coalesce($event.principal.asset.hostname, $event.principal.hostname) in %PCI_Assets
outcome:
$Count = count($event.security_result.summary)
PCI: identidade e acesso
Esse painel oferece uma visão geral detalhada e em tempo real das atividades relacionadas à identidade e ao gerenciamento de acesso para oferecer suporte à conformidade com o PCI DSS. Ele consolida métricas e insights importantes, incluindo permissões de acesso do usuário, mudanças de senha e eventos de autenticação. Ele usa a lista de referência pci_assets para restringir os dados ao ambiente de PCI.
Observação : os gráficos neste painel não são carregados até que as listas de referência necessárias sejam criadas.
Contas com senhas que nunca expiram
Alterar permissões das contas de usuário
Contas de usuário criadas
Contas de usuário excluídas
Tentativas de mudança de senha pelos 10 principais usuários
Mudanças de senha ao longo do tempo
Nome do gráfico
Exemplo de consulta
Contas com senhas que nunca expiram
$event_type = metadata.event_type
$event_type >= 15000 and $event_type <= 15014
(principal.hostname in %PCI_Assets or principal.asset.hostname in %PCI_Assets or target.hostname in %PCI_Assets or target.asset.hostname in %PCI_Assets)
$hostname = strings.coalesce(principal.hostname,principal.asset.hostname,target.hostname,target.asset.hostname)
$vendor = metadata.vendor_name
$security_event_type = metadata.product_event_type
$key = principal.user.attribute.labels.key
$value = principal.user.attribute.labels.value
($key = /Password Never Expires/ nocase and $value = /true/ nocase)
$user = strings.coalesce(principal.user.userid,principal.user.user_display_name,principal.user.email_addresses)
$action = security_result.action
match:
$user, $hostname, $vendor, $action, $security_event_type
outcome:
$event_count = count_distinct(metadata.id)
order:
$event_count desc
Alterar permissões das contas de usuário
$event_type = metadata.event_type
$event_type = "USER_CHANGE_PERMISSIONS"
(principal.hostname in %PCI_Assets or principal.asset.hostname in %PCI_Assets or target.hostname in %PCI_Assets or target.asset.hostname in %PCI_Assets)
$hostname = strings.coalesce(principal.hostname,principal.asset.hostname,target.hostname,target.asset.hostname)
$vendor = metadata.vendor_name
$user = strings.coalesce(principal.user.userid,principal.user.user_display_name,principal.user.email_addresses)
$action = security_result.action
match:
$user, $hostname, $vendor, $action
outcome:
$event_count = count(metadata.id)
order:
$event_count desc
Contas de usuário criadas
$event_type = metadata.event_type
$event_type = "USER_CREATION"
(principal.hostname in %PCI_Assets or principal.asset.hostname in %PCI_Assets or target.hostname in %PCI_Assets or target.asset.hostname in %PCI_Assets)
outcome:
$event_count = count(metadata.id)
Contas de usuário criadas
$event_type = metadata.event_type
$event_type = "USER_CREATION"
(principal.hostname in %PCI_Assets or principal.asset.hostname in %PCI_Assets or target.hostname in %PCI_Assets or target.asset.hostname in %PCI_Assets)
$hostname = strings.coalesce(principal.hostname,principal.asset.hostname,target.hostname,target.asset.hostname)
$vendor = metadata.vendor_name
$user = strings.coalesce(principal.user.userid,principal.user.user_display_name,principal.user.email_addresses)
$action = security_result.action
match:
$user, $hostname, $vendor, $action
outcome:
$event_count = count(metadata.id)
order:
$event_count desc
Contas de usuário excluídas
$event_type = metadata.event_type
$event_type = "USER_DELETION"
(principal.hostname in %PCI_Assets or principal.asset.hostname in %PCI_Assets or target.hostname in %PCI_Assets or target.asset.hostname in %PCI_Assets)
$hostname = strings.coalesce(principal.hostname,principal.asset.hostname,target.hostname,target.asset.hostname)
$vendor = metadata.vendor_name
$user = strings.coalesce(principal.user.userid,principal.user.user_display_name,principal.user.email_addresses)
$action = security_result.action
match:
$user, $hostname, $vendor, $action
outcome:
$event_count = count(metadata.id)
order:
$event_count desc
Tentativas de mudança de senha pelos 10 principais usuários
$event_type = metadata.event_type
$event_type = "USER_CHANGE_PASSWORD"
(principal.hostname in %PCI_Assets or principal.asset.hostname in %PCI_Assets or target.hostname in %PCI_Assets or target.asset.hostname in %PCI_Assets)
$hostname = strings.coalesce(principal.hostname,principal.asset.hostname,target.hostname,target.asset.hostname)
$vendor = metadata.vendor_name
$user = strings.coalesce(principal.user.userid,principal.user.user_display_name,principal.user.email_addresses)
$action = security_result.action
match:
$user, $hostname, $vendor, $action
outcome:
$event_count = count(metadata.id)
order:
$event_count desc
limit:
10
Contas de usuário excluídas
$event_type = metadata.event_type
$event_type = "USER_DELETION"
(principal.hostname in %PCI_Assets or principal.asset.hostname in %PCI_Assets or target.hostname in %PCI_Assets or target.asset.hostname in %PCI_Assets)
outcome:
$event_count = count(metadata.id)
Alterar permissões das contas de usuário
$event_type = metadata.event_type
$event_type = "USER_CHANGE_PERMISSIONS"
(principal.hostname in %PCI_Assets or principal.asset.hostname in %PCI_Assets or target.hostname in %PCI_Assets or target.asset.hostname in %PCI_Assets)
outcome:
$event_count = count(metadata.id)
Mudanças de senha ao longo do tempo
$event_type = metadata.event_type
$event_type = "USER_CHANGE_PASSWORD"
(principal.hostname in %PCI_Assets or principal.asset.hostname in %PCI_Assets or target.hostname in %PCI_Assets or target.asset.hostname in %PCI_Assets)
$hostname = strings.coalesce(principal.hostname,principal.asset.hostname,target.hostname,target.asset.hostname)
$date = timestamp.get_date(metadata.event_timestamp.seconds)
match:
$date
outcome:
$event_count = count(metadata.id)
order:
$date asc
PCI: monitoramento e testes
Esse painel fornece monitoramento e rastreamento do acesso aos dados do titular do cartão de pagamento no ambiente PCI. Ele usa as listas de referência pci_assets e default_users para definir o escopo dos dados.
Observação : os gráficos neste painel não são carregados até que as listas de referência necessárias sejam criadas.
Eventos ao longo do tempo por tipo de evento
Principais acessos a recursos por origem
Acesso aos registros de auditoria
Acesso administrativo aos sistemas
10 principais usuários por ação
Usuários inativos (últimos sete dias)
Detecção de limpeza de registros (eventos do Windows)
Mudanças na política de auditoria
Eventos com falha
Total de eventos com falha por endereço IP de origem
Total de eventos por tipo de evento
Nome do gráfico
Exemplo de consulta
Eventos ao longo do tempo por tipo de evento
(metadata.event_type = "USER_UNCATEGORIZED"
or metadata.event_type = "USER_LOGIN"
or metadata.event_type = "USER_LOGOUT"
or metadata.event_type = "USER_CREATION"
or metadata.event_type = "USER_CHANGE_PASSWORD"
or metadata.event_type = "USER_CHANGE_PERMISSIONS"
or metadata.event_type = "USER_BADGE_IN"
or metadata.event_type = "USER_DELETION"
or metadata.event_type = "USER_RESOURCE_CREATION"
or metadata.event_type = "USER_RESOURCE_UPDATE_CONTENT"
or metadata.event_type = "USER_RESOURCE_UPDATE_PERMISSIONS"
or metadata.event_type = "USER_COMMUNICATION"
or metadata.event_type = "USER_RESOURCE_ACCESS"
or metadata.event_type = "USER_RESOURCE_DELETION")
(principal.hostname in %PCI_Assets or principal.asset.hostname in %PCI_Assets or target.hostname in %PCI_Assets or target.asset.hostname in %PCI_Assets)
$Event_Type = metadata.event_type
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
match:
$Date, $Event_Type
outcome:
$Count = count(metadata.id)
order:
$Date asc
Principais acessos a recursos por origem
(metadata.event_type = "USER_UNCATEGORIZED"
or metadata.event_type = "USER_LOGIN"
or metadata.event_type = "USER_LOGOUT"
or metadata.event_type = "USER_CREATION"
or metadata.event_type = "USER_CHANGE_PASSWORD"
or metadata.event_type = "USER_CHANGE_PERMISSIONS"
or metadata.event_type = "USER_BADGE_IN"
or metadata.event_type = "USER_DELETION"
or metadata.event_type = "USER_RESOURCE_CREATION"
or metadata.event_type = "USER_RESOURCE_UPDATE_CONTENT"
or metadata.event_type = "USER_RESOURCE_UPDATE_PERMISSIONS"
or metadata.event_type = "USER_COMMUNICATION"
or metadata.event_type = "USER_RESOURCE_ACCESS"
or metadata.event_type = "USER_RESOURCE_DELETION")
(principal.hostname in %PCI_Assets or principal.asset.hostname in %PCI_Assets or target.hostname in %PCI_Assets or target.asset.hostname in %PCI_Assets)
$Source_IP = strings.coalesce(principal.ip, principal.asset.ip)
$Hostname = strings.coalesce(principal.hostname, principal.asset.hostname, target.hostname, target.asset.hostname)
$Vendor = metadata.vendor_name
$Action = security_result.action
$Source_User = strings.coalesce(principal.user.userid, principal.user.user_display_name, principal.user.email_addresses)
$Destination_User = strings.coalesce(target.user.userid, target.user.user_display_name, target.user.email_addresses)
match:
$Source_IP, $Hostname, $Source_User, $Destination_User, $Vendor, $Action
outcome:
$Count = count(metadata.id)
$Date = timestamp.get_timestamp(max(metadata.event_timestamp.seconds), "%F %T")
order:
$Count desc
Acesso aos registros de auditoria
(metadata.event_type = "SYSTEM_AUDIT_LOG_UNCATEGORIZED" or metadata.event_type = "SYSTEM_AUDIT_LOG_WIPE")
(principal.hostname in %PCI_Assets or principal.asset.hostname in %PCI_Assets or target.hostname in %PCI_Assets or target.asset.hostname in %PCI_Assets)
$Vendor = metadata.vendor_name
$Source_User = strings.coalesce(principal.user.userid, principal.user.user_display_name, principal.user.email_addresses)
$Destination_User = strings.coalesce(target.user.userid, target.user.user_display_name, target.user.email_addresses)
match:
$Source_User, $Destination_User, $Vendor
outcome:
$Count = count(metadata.id)
$Date = timestamp.get_timestamp(max(metadata.event_timestamp.seconds ), "%F %T")
order:
$Count desc
Acesso administrativo aos sistemas
(principal.hostname in %PCI_Assets or principal.asset.hostname in %PCI_Assets or target.hostname in %PCI_Assets or target.asset.hostname in %PCI_Assets)
$Event_Type = metadata.event_type
$Hostname = strings.coalesce(principal.hostname, principal.asset.hostname, target.hostname, target.asset.hostname)
$Vendor = metadata.vendor_name
$User = strings.coalesce(principal.user.userid, principal.user.user_display_name, principal.user.email_addresses, target.user.userid, target.user.user_display_name, target.user.email_addresses)
$User in %Default_Users
match:
$User, $Hostname, $Vendor, $Event_Type
outcome:
$Count = count(metadata.id)
$Date = timestamp.get_timestamp(max(metadata.event_timestamp.seconds ), "%F %T")
order:
$Count desc
10 principais usuários por ação
(metadata.event_type = "USER_UNCATEGORIZED"
or metadata.event_type = "USER_LOGIN"
or metadata.event_type = "USER_LOGOUT"
or metadata.event_type = "USER_CREATION"
or metadata.event_type = "USER_CHANGE_PASSWORD"
or metadata.event_type = "USER_CHANGE_PERMISSIONS"
or metadata.event_type = "USER_BADGE_IN"
or metadata.event_type = "USER_DELETION"
or metadata.event_type = "USER_RESOURCE_CREATION"
or metadata.event_type = "USER_RESOURCE_UPDATE_CONTENT"
or metadata.event_type = "USER_RESOURCE_UPDATE_PERMISSIONS"
or metadata.event_type = "USER_COMMUNICATION"
or metadata.event_type = "USER_RESOURCE_ACCESS"
or metadata.event_type = "USER_RESOURCE_DELETION")
(principal.hostname in %PCI_Assets or principal.asset.hostname in %PCI_Assets or target.hostname in %PCI_Assets or target.asset.hostname in %PCI_Assets)
$User = strings.coalesce(principal.user.userid, principal.user.user_display_name, principal.user.email_addresses, target.user.userid, target.user.user_display_name, target.user.email_addresses)
$Action = security_result.action
match:
$User, $Action
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
Usuários inativos (últimos sete dias)
(metadata.event_type = "USER_UNCATEGORIZED"
or metadata.event_type = "USER_LOGIN"
or metadata.event_type = "USER_LOGOUT"
or metadata.event_type = "USER_CREATION"
or metadata.event_type = "USER_CHANGE_PASSWORD"
or metadata.event_type = "USER_CHANGE_PERMISSIONS"
or metadata.event_type = "USER_BADGE_IN"
or metadata.event_type = "USER_DELETION"
or metadata.event_type = "USER_RESOURCE_CREATION"
or metadata.event_type = "USER_RESOURCE_UPDATE_CONTENT"
or metadata.event_type = "USER_RESOURCE_UPDATE_PERMISSIONS"
or metadata.event_type = "USER_COMMUNICATION"
or metadata.event_type = "USER_RESOURCE_ACCESS"
or metadata.event_type = "USER_RESOURCE_DELETION")
(principal.hostname in %PCI_Assets or principal.asset.hostname in %PCI_Assets or target.hostname in %PCI_Assets or target.asset.hostname in %PCI_Assets)
principal.user.last_login_time.seconds > 0
$Event_Type = metadata.event_type
$User = strings.coalesce(principal.user.userid, principal.user.user_display_name, principal.user.email_addresses, target.user.userid, target.user.user_display_name, target.user.email_addresses)
$Time_Difference = cast.as_int((metadata.event_timestamp.seconds-principal.user.last_login_time.seconds)/86400)
match:
$User, $Time_Difference
outcome:
$Logtime = timestamp.get_timestamp(max(metadata.event_timestamp.seconds), "%F %T")
$Lastime = timestamp.get_timestamp(max(principal.user.last_login_time.seconds), "%F %T")
order:
$Time_Difference desc
Detecção de limpeza de registros (eventos do Windows)
metadata.log_type = "WINEVTLOG"
(metadata.product_event_type = "1102" or metadata.product_event_type = "104" or metadata.event_type = "SYSTEM_AUDIT_LOG_WIPE")
(principal.hostname in %PCI_Assets or principal.asset.hostname in %PCI_Assets or target.hostname in %PCI_Assets or target.asset.hostname in %PCI_Assets)
$Event_Type = metadata.event_type
$Security_Event_Type = metadata.product_event_type
$Hostname = strings.coalesce(principal.hostname,principal.asset.hostname,target.hostname,target.asset.hostname)
$Summary = strings.coalesce(metadata.description, security_result.summary, security_result.description)
match:
$Hostname, $Event_Type, $Security_Event_Type, $Summary
outcome:
$Count = count(metadata.id)
$Date = timestamp.get_timestamp(max(metadata.event_timestamp.seconds ), "%F %T")
order:
$Count desc
Mudanças na política de auditoria
metadata.event_type = "SYSTEM_AUDIT_LOG_UNCATEGORIZED" or metadata.event_type = "STATUS_UPDATE"
(security_result.category_details = /AuditPolicyChanges/ nocase or strings.coalesce(metadata.description, security_result.description, security_result.summary, metadata.product_event_type) = /policy change/ nocase)
(principal.hostname in %PCI_Assets or principal.asset.hostname in %PCI_Assets or target.hostname in %PCI_Assets or target.asset.hostname in %PCI_Assets)
$Security_Event_Type = metadata.product_event_type
$Policy_Change = strings.coalesce(metadata.description, security_result.description, security_result.summary, security_result.category_details)
$Source_User = strings.coalesce(principal.user.userid, principal.user.user_display_name, principal.user.email_addresses)
$Destination_User = strings.coalesce(target.user.userid, target.user.user_display_name, target.user.email_addresses)
match:
$Source_User, $Destination_User, $Security_Event_Type, $Policy_Change
outcome:
$Count = count(metadata.id)
$Date = timestamp.get_timestamp(max(metadata.event_timestamp.seconds ), "%F %T")
order:
$Count desc
Mudanças na política de auditoria
(metadata.event_type = "SYSTEM_AUDIT_LOG_UNCATEGORIZED" or metadata.event_type = "STATUS_UPDATE")
(security_result.category_details = /AuditPolicyChanges/ nocase or strings.coalesce(metadata.description, security_result.description, security_result.summary, metadata.product_event_type) = /policy change/ nocase)
(principal.hostname in %PCI_Assets or principal.asset.hostname in %PCI_Assets or target.hostname in %PCI_Assets or target.asset.hostname in %PCI_Assets)
outcome:
$Count = count(metadata.id)
Eventos com falha
(metadata.event_type = "USER_UNCATEGORIZED"
or metadata.event_type = "USER_LOGIN"
or metadata.event_type = "USER_LOGOUT"
or metadata.event_type = "USER_CREATION"
or metadata.event_type = "USER_CHANGE_PASSWORD"
or metadata.event_type = "USER_CHANGE_PERMISSIONS"
or metadata.event_type = "USER_BADGE_IN"
or metadata.event_type = "USER_DELETION"
or metadata.event_type = "USER_RESOURCE_CREATION"
or metadata.event_type = "USER_RESOURCE_UPDATE_CONTENT"
or metadata.event_type = "USER_RESOURCE_UPDATE_PERMISSIONS"
or metadata.event_type = "USER_COMMUNICATION"
or metadata.event_type = "USER_RESOURCE_ACCESS"
or metadata.event_type = "USER_RESOURCE_DELETION")
security_result.action = "BLOCK"
(principal.hostname in %PCI_Assets or principal.asset.hostname in %PCI_Assets or target.hostname in %PCI_Assets or target.asset.hostname in %PCI_Assets)
outcome:
$Count = count(metadata.id)
Total de eventos com falha por endereço IP de origem
(metadata.event_type = "USER_UNCATEGORIZED"
or metadata.event_type = "USER_LOGIN"
or metadata.event_type = "USER_LOGOUT"
or metadata.event_type = "USER_CREATION"
or metadata.event_type = "USER_CHANGE_PASSWORD"
or metadata.event_type = "USER_CHANGE_PERMISSIONS"
or metadata.event_type = "USER_BADGE_IN"
or metadata.event_type = "USER_DELETION"
or metadata.event_type = "USER_RESOURCE_CREATION"
or metadata.event_type = "USER_RESOURCE_UPDATE_CONTENT"
or metadata.event_type = "USER_RESOURCE_UPDATE_PERMISSIONS"
or metadata.event_type = "USER_COMMUNICATION"
or metadata.event_type = "USER_RESOURCE_ACCESS"
or metadata.event_type = "USER_RESOURCE_DELETION")
security_result.action = "BLOCK"
(principal.hostname in %PCI_Assets or principal.asset.hostname in %PCI_Assets or target.hostname in %PCI_Assets or target.asset.hostname in %PCI_Assets)
$Hostname = strings.coalesce(principal.hostname, principal.asset.hostname, target.hostname, target.asset.hostname)
$Vendor = metadata.vendor_name
$Source_IP = strings.coalesce(principal.ip, principal.asset.ip)
$Source_User = strings.coalesce(principal.user.userid, principal.user.user_display_name, principal.user.email_addresses)
$Destination_User = strings.coalesce(target.user.userid, target.user.user_display_name, target.user.email_addresses)
match:
$Source_IP, $Source_User, $Destination_User, $Hostname, $Vendor, metadata.event_type
outcome:
$Count = count(metadata.id)
$Date = timestamp.get_timestamp(max(metadata.event_timestamp.seconds ), "%F %T")
order:
$Count desc
Total de eventos por tipo de evento
(metadata.event_type = "USER_UNCATEGORIZED"
or metadata.event_type = "USER_LOGIN"
or metadata.event_type = "USER_LOGOUT"
or metadata.event_type = "USER_CREATION"
or metadata.event_type = "USER_CHANGE_PASSWORD"
or metadata.event_type = "USER_CHANGE_PERMISSIONS"
or metadata.event_type = "USER_BADGE_IN"
or metadata.event_type = "USER_DELETION"
or metadata.event_type = "USER_RESOURCE_CREATION"
or metadata.event_type = "USER_RESOURCE_UPDATE_CONTENT"
or metadata.event_type = "USER_RESOURCE_UPDATE_PERMISSIONS"
or metadata.event_type = "USER_COMMUNICATION"
or metadata.event_type = "USER_RESOURCE_ACCESS"
or metadata.event_type = "USER_RESOURCE_DELETION")
(principal.hostname in %PCI_Assets or principal.asset.hostname in %PCI_Assets or target.hostname in %PCI_Assets or target.asset.hostname in %PCI_Assets)
$Event_Type = metadata.event_type
$Vendor = metadata.vendor_name
$Action = security_result.action
match:
$Event_Type, $Vendor, $Action
outcome:
$Count = count(metadata.id)
order:
$Count desc
PCI – Rede
Esse painel oferece insights sobre o desempenho da rede de uma interface específica (origem ou destino), visibilidade em tempo real das principais atividades de rede e tendências e análises de tráfego. Ele usa a lista de referência pci_network_ranges para restringir os dados ao ambiente de PCI.
Observação : os gráficos neste painel não são carregados até que as listas de referência necessárias sejam criadas.
Contagem total de tráfego
Tráfego dos 10 principais destinos por local
Tráfego pelos 10 principais destinos
10 principais regras de rede acionadas
Tráfego pelas 10 principais portas de destino
10 principais atividades de rede
Resumo da atividade da porta
Tráfego pelos 10 principais protocolos
Dados de rede processados ao longo do tempo (bytes enviados)
Dados de rede processados ao longo do tempo (bytes recebidos)
Tráfego de rede ao longo do tempo
Tráfego pelas 10 principais portas de origem
Contagem de recursos de rede
Tráfego ao longo do tempo por protocolo
Tráfego ao longo do tempo por ação
Tráfego das 10 principais origens
Nome do gráfico
Exemplo de consulta
Contagem total de tráfego
$event.metadata.log_type = /ROUTER|SWITCH|DHCP|PROXY|NETWORK|VPN|FIREWALL|_FLOW|VPC|WIRELESS|IPS|IDS|ARUBA_EDGECONNECT_SDWAN|ARUBA_SWITCH|CISCO_APIC|CISCO_CALL_MANAGER|CISCO_DNAC|CISCO_ESTREAMER|CISCO_IOS|CISCO_PRIME|EFFICIENTIP_DDI|EXTREME_SWITCH|FORTINET_FORTIDDOS|FORTINET_FORTIMANAGER|ARUBA_CENTRAL|JUNIPER_JUNOS|JUNIPER_MIST|JUNIPER_SDWAN|NAGIOS|ARBOR_EDGE_DEFENSE|MICROSOFT_NPS|STEELHEAD|SHRUBBERY_TACACS|TRENDMICRO_DDI|VMWARE_NSX|WINDOWS_NET_POLICY_SERVER|ZYWALL|IMPERVA_FLEXPROTECT|PAN_IOT|NOZOMI_GUARDIAN|SURICATA_EVE|UMBRELLA_DNS|WINDOWS_SYSMON|COHESITY|RUBRIK|CISCO_MERAKI|CLAROTY_EMC|CLAROTY_CTD|HONEYD|AIRWATCH|IMPERVA_SECURESPHERE|SECURELINK|WALLIX_BASTION|CHECKPOINT_HARMONY|UNIFI_AP|DIGI_MODEMS|DESYNOVA_CONTIDO|CLOUDGENIX_SDWAN|JUNIPER_MX|SAP_WEBDISP|ADVA_FSP|HP_PROCURVE|VYOS|RSA_SECURID|HCNET_ACCOUNT_ADAPTER|INFOBLOX|VITALQIP|ASSET_STATIC_IP|BLUECAT_DDI|TWINGATE|SYMANTEC_VIP_AUTHHUB|ZSCALER_DECEPTION|BROCADE_SERVERIRON|KEMP_LOADBALANCER|A10_LOAD_BALANCER|AWS_ELB|F5_BIGIP_LTM|RADWARE_ALTEON|CITRIX_NETSCALER|AKAMAI_CLOUD_MONITOR|CISCO_ACE|GCP_LOADBALANCING|KERIOCONTROL|EXTRAHOP|NETFILTER_IPTABLES|CISCO_UMBRELLA_AUDIT|F5_AFM|NUTANIX_PRISM|SANGFOR_NGAF|VERCEL_WAF|PEPLINK_FW|NETDOCUMENTS|PAN_PANORAMA|PFSENSE|AZION|FIREEYE_PX|OPNSENSE|CISCO_FWSM|FORTINET_FORTIWEB|BARRACUDA_WAF|SYMANTEC_WSS|MENLO_SECURITY|DIGITALARTS_IFILTER|WEBMARSHAL|UMBRELLA_IP|AWS_SECURITY_HUB|EXTRAHOP|GUARDDUTY|MICROSOFT_ATA|ORCA|OSSEC|SURICATA_EVE|VMWARE_TANZU/ nocase
$event.principal.ip in cidr %PCI_Network_Ranges
or $event.principal.asset.ip in cidr %PCI_Network_Ranges
outcome:
$Count = count($event.network.direction)
Tráfego dos 10 principais destinos por local
$event.metadata.log_type = /ROUTER|SWITCH|DHCP|PROXY|NETWORK|VPN|FIREWALL|_FLOW|VPC|WIRELESS|IPS|IDS|ARUBA_EDGECONNECT_SDWAN|ARUBA_SWITCH|CISCO_APIC|CISCO_CALL_MANAGER|CISCO_DNAC|CISCO_ESTREAMER|CISCO_IOS|CISCO_PRIME|EFFICIENTIP_DDI|EXTREME_SWITCH|FORTINET_FORTIDDOS|FORTINET_FORTIMANAGER|ARUBA_CENTRAL|JUNIPER_JUNOS|JUNIPER_MIST|JUNIPER_SDWAN|NAGIOS|ARBOR_EDGE_DEFENSE|MICROSOFT_NPS|STEELHEAD|SHRUBBERY_TACACS|TRENDMICRO_DDI|VMWARE_NSX|WINDOWS_NET_POLICY_SERVER|ZYWALL|IMPERVA_FLEXPROTECT|PAN_IOT|NOZOMI_GUARDIAN|SURICATA_EVE|UMBRELLA_DNS|WINDOWS_SYSMON|COHESITY|RUBRIK|CISCO_MERAKI|CLAROTY_EMC|CLAROTY_CTD|HONEYD|AIRWATCH|IMPERVA_SECURESPHERE|SECURELINK|WALLIX_BASTION|CHECKPOINT_HARMONY|UNIFI_AP|DIGI_MODEMS|DESYNOVA_CONTIDO|CLOUDGENIX_SDWAN|JUNIPER_MX|SAP_WEBDISP|ADVA_FSP|HP_PROCURVE|VYOS|RSA_SECURID|HCNET_ACCOUNT_ADAPTER|INFOBLOX|VITALQIP|ASSET_STATIC_IP|BLUECAT_DDI|TWINGATE|SYMANTEC_VIP_AUTHHUB|ZSCALER_DECEPTION|BROCADE_SERVERIRON|KEMP_LOADBALANCER|A10_LOAD_BALANCER|AWS_ELB|F5_BIGIP_LTM|RADWARE_ALTEON|CITRIX_NETSCALER|AKAMAI_CLOUD_MONITOR|CISCO_ACE|GCP_LOADBALANCING|KERIOCONTROL|EXTRAHOP|NETFILTER_IPTABLES|CISCO_UMBRELLA_AUDIT|F5_AFM|NUTANIX_PRISM|SANGFOR_NGAF|VERCEL_WAF|PEPLINK_FW|NETDOCUMENTS|PAN_PANORAMA|PFSENSE|AZION|FIREEYE_PX|OPNSENSE|CISCO_FWSM|FORTINET_FORTIWEB|BARRACUDA_WAF|SYMANTEC_WSS|MENLO_SECURITY|DIGITALARTS_IFILTER|WEBMARSHAL|UMBRELLA_IP|AWS_SECURITY_HUB|EXTRAHOP|GUARDDUTY|MICROSOFT_ATA|ORCA|OSSEC|SURICATA_EVE|VMWARE_TANZU/ nocase
$event.principal.ip in cidr %PCI_Network_Ranges
or $event.principal.asset.ip in cidr %PCI_Network_Ranges
$event.target.ip != ""
$Countries = $event.target.location.country_or_region
$Latitude = $event.target.location.region_coordinates.latitude
$Longitude = $event.target.location.region_coordinates.longitude
$Countries != ""
match:
$Countries, $Latitude, $Longitude
outcome:
$Count = count($event.target.ip)
limit:
10
Tráfego pelos 10 principais destinos
$event.metadata.log_type = /ROUTER|SWITCH|DHCP|PROXY|NETWORK|VPN|FIREWALL|_FLOW|VPC|WIRELESS|IPS|IDS|ARUBA_EDGECONNECT_SDWAN|ARUBA_SWITCH|CISCO_APIC|CISCO_CALL_MANAGER|CISCO_DNAC|CISCO_ESTREAMER|CISCO_IOS|CISCO_PRIME|EFFICIENTIP_DDI|EXTREME_SWITCH|FORTINET_FORTIDDOS|FORTINET_FORTIMANAGER|ARUBA_CENTRAL|JUNIPER_JUNOS|JUNIPER_MIST|JUNIPER_SDWAN|NAGIOS|ARBOR_EDGE_DEFENSE|MICROSOFT_NPS|STEELHEAD|SHRUBBERY_TACACS|TRENDMICRO_DDI|VMWARE_NSX|WINDOWS_NET_POLICY_SERVER|ZYWALL|IMPERVA_FLEXPROTECT|PAN_IOT|NOZOMI_GUARDIAN|SURICATA_EVE|UMBRELLA_DNS|WINDOWS_SYSMON|COHESITY|RUBRIK|CISCO_MERAKI|CLAROTY_EMC|CLAROTY_CTD|HONEYD|AIRWATCH|IMPERVA_SECURESPHERE|SECURELINK|WALLIX_BASTION|CHECKPOINT_HARMONY|UNIFI_AP|DIGI_MODEMS|DESYNOVA_CONTIDO|CLOUDGENIX_SDWAN|JUNIPER_MX|SAP_WEBDISP|ADVA_FSP|HP_PROCURVE|VYOS|RSA_SECURID|HCNET_ACCOUNT_ADAPTER|INFOBLOX|VITALQIP|ASSET_STATIC_IP|BLUECAT_DDI|TWINGATE|SYMANTEC_VIP_AUTHHUB|ZSCALER_DECEPTION|BROCADE_SERVERIRON|KEMP_LOADBALANCER|A10_LOAD_BALANCER|AWS_ELB|F5_BIGIP_LTM|RADWARE_ALTEON|CITRIX_NETSCALER|AKAMAI_CLOUD_MONITOR|CISCO_ACE|GCP_LOADBALANCING|KERIOCONTROL|EXTRAHOP|NETFILTER_IPTABLES|CISCO_UMBRELLA_AUDIT|F5_AFM|NUTANIX_PRISM|SANGFOR_NGAF|VERCEL_WAF|PEPLINK_FW|NETDOCUMENTS|PAN_PANORAMA|PFSENSE|AZION|FIREEYE_PX|OPNSENSE|CISCO_FWSM|FORTINET_FORTIWEB|BARRACUDA_WAF|SYMANTEC_WSS|MENLO_SECURITY|DIGITALARTS_IFILTER|WEBMARSHAL|UMBRELLA_IP|AWS_SECURITY_HUB|EXTRAHOP|GUARDDUTY|MICROSOFT_ATA|ORCA|OSSEC|SURICATA_EVE|VMWARE_TANZU/ nocase
$event.principal.ip in cidr %PCI_Network_Ranges
or $event.principal.asset.ip in cidr %PCI_Network_Ranges
$IP_Address = $event.target.ip
match:
$IP_Address
outcome:
$Count = count($event.metadata.id)
order:
$Count desc
limit:
10
10 principais regras de rede acionadas
$event.metadata.log_type = /ROUTER|SWITCH|DHCP|PROXY|NETWORK|VPN|FIREWALL|_FLOW|VPC|WIRELESS|IPS|IDS|ARUBA_EDGECONNECT_SDWAN|ARUBA_SWITCH|CISCO_APIC|CISCO_CALL_MANAGER|CISCO_DNAC|CISCO_ESTREAMER|CISCO_IOS|CISCO_PRIME|EFFICIENTIP_DDI|EXTREME_SWITCH|FORTINET_FORTIDDOS|FORTINET_FORTIMANAGER|ARUBA_CENTRAL|JUNIPER_JUNOS|JUNIPER_MIST|JUNIPER_SDWAN|NAGIOS|ARBOR_EDGE_DEFENSE|MICROSOFT_NPS|STEELHEAD|SHRUBBERY_TACACS|TRENDMICRO_DDI|VMWARE_NSX|WINDOWS_NET_POLICY_SERVER|ZYWALL|IMPERVA_FLEXPROTECT|PAN_IOT|NOZOMI_GUARDIAN|SURICATA_EVE|UMBRELLA_DNS|WINDOWS_SYSMON|COHESITY|RUBRIK|CISCO_MERAKI|CLAROTY_EMC|CLAROTY_CTD|HONEYD|AIRWATCH|IMPERVA_SECURESPHERE|SECURELINK|WALLIX_BASTION|CHECKPOINT_HARMONY|UNIFI_AP|DIGI_MODEMS|DESYNOVA_CONTIDO|CLOUDGENIX_SDWAN|JUNIPER_MX|SAP_WEBDISP|ADVA_FSP|HP_PROCURVE|VYOS|RSA_SECURID|HCNET_ACCOUNT_ADAPTER|INFOBLOX|VITALQIP|ASSET_STATIC_IP|BLUECAT_DDI|TWINGATE|SYMANTEC_VIP_AUTHHUB|ZSCALER_DECEPTION|BROCADE_SERVERIRON|KEMP_LOADBALANCER|A10_LOAD_BALANCER|AWS_ELB|F5_BIGIP_LTM|RADWARE_ALTEON|CITRIX_NETSCALER|AKAMAI_CLOUD_MONITOR|CISCO_ACE|GCP_LOADBALANCING|KERIOCONTROL|EXTRAHOP|NETFILTER_IPTABLES|CISCO_UMBRELLA_AUDIT|F5_AFM|NUTANIX_PRISM|SANGFOR_NGAF|VERCEL_WAF|PEPLINK_FW|NETDOCUMENTS|PAN_PANORAMA|PFSENSE|AZION|FIREEYE_PX|OPNSENSE|CISCO_FWSM|FORTINET_FORTIWEB|BARRACUDA_WAF|SYMANTEC_WSS|MENLO_SECURITY|DIGITALARTS_IFILTER|WEBMARSHAL|UMBRELLA_IP|AWS_SECURITY_HUB|EXTRAHOP|GUARDDUTY|MICROSOFT_ATA|ORCA|OSSEC|SURICATA_EVE|VMWARE_TANZU/ nocase
$event.principal.ip in cidr %PCI_Network_Ranges
or $event.principal.asset.ip in cidr %PCI_Network_Ranges
$event.metadata.event_type = "NETWORK_UNCATEGORIZED"
or $event.metadata.event_type = "NETWORK_FLOW"
or $event.metadata.event_type = "NETWORK_CONNECTION"
or $event.metadata.event_type = "NETWORK_FTP"
or $event.metadata.event_type = "NETWORK_DHCP"
or $event.metadata.event_type = "NETWORK_DNS"
or $event.metadata.event_type = "NETWORK_HTTP"
or $event.metadata.event_type = "NETWORK_SMTP"
or $event.metadata.event_type = "SCAN_NETWORK"
$Log_Type = $event.metadata.log_type
$Event_Type = $event.metadata.event_type
$Product_Network_Event = $event.security_result.rule_name
$Direction = $event.network.direction
$Product_Network_Event != ""
match:
$Event_Type, $Log_Type, $Direction, $Product_Network_Event
outcome:
$Count = count_distinct($event.metadata.id)
order:
$Count desc
limit:
10
Tráfego pelas 10 principais portas de destino
$event.metadata.log_type = /ROUTER|SWITCH|DHCP|PROXY|NETWORK|VPN|FIREWALL|_FLOW|VPC|WIRELESS|IPS|IDS|ARUBA_EDGECONNECT_SDWAN|ARUBA_SWITCH|CISCO_APIC|CISCO_CALL_MANAGER|CISCO_DNAC|CISCO_ESTREAMER|CISCO_IOS|CISCO_PRIME|EFFICIENTIP_DDI|EXTREME_SWITCH|FORTINET_FORTIDDOS|FORTINET_FORTIMANAGER|ARUBA_CENTRAL|JUNIPER_JUNOS|JUNIPER_MIST|JUNIPER_SDWAN|NAGIOS|ARBOR_EDGE_DEFENSE|MICROSOFT_NPS|STEELHEAD|SHRUBBERY_TACACS|TRENDMICRO_DDI|VMWARE_NSX|WINDOWS_NET_POLICY_SERVER|ZYWALL|IMPERVA_FLEXPROTECT|PAN_IOT|NOZOMI_GUARDIAN|SURICATA_EVE|UMBRELLA_DNS|WINDOWS_SYSMON|COHESITY|RUBRIK|CISCO_MERAKI|CLAROTY_EMC|CLAROTY_CTD|HONEYD|AIRWATCH|IMPERVA_SECURESPHERE|SECURELINK|WALLIX_BASTION|CHECKPOINT_HARMONY|UNIFI_AP|DIGI_MODEMS|DESYNOVA_CONTIDO|CLOUDGENIX_SDWAN|JUNIPER_MX|SAP_WEBDISP|ADVA_FSP|HP_PROCURVE|VYOS|RSA_SECURID|HCNET_ACCOUNT_ADAPTER|INFOBLOX|VITALQIP|ASSET_STATIC_IP|BLUECAT_DDI|TWINGATE|SYMANTEC_VIP_AUTHHUB|ZSCALER_DECEPTION|BROCADE_SERVERIRON|KEMP_LOADBALANCER|A10_LOAD_BALANCER|AWS_ELB|F5_BIGIP_LTM|RADWARE_ALTEON|CITRIX_NETSCALER|AKAMAI_CLOUD_MONITOR|CISCO_ACE|GCP_LOADBALANCING|KERIOCONTROL|EXTRAHOP|NETFILTER_IPTABLES|CISCO_UMBRELLA_AUDIT|F5_AFM|NUTANIX_PRISM|SANGFOR_NGAF|VERCEL_WAF|PEPLINK_FW|NETDOCUMENTS|PAN_PANORAMA|PFSENSE|AZION|FIREEYE_PX|OPNSENSE|CISCO_FWSM|FORTINET_FORTIWEB|BARRACUDA_WAF|SYMANTEC_WSS|MENLO_SECURITY|DIGITALARTS_IFILTER|WEBMARSHAL|UMBRELLA_IP|AWS_SECURITY_HUB|EXTRAHOP|GUARDDUTY|MICROSOFT_ATA|ORCA|OSSEC|SURICATA_EVE|VMWARE_TANZU/ nocase
$event.principal.ip in cidr %PCI_Network_Ranges
or $event.principal.asset.ip in cidr %PCI_Network_Ranges
$Ports = strings.concat($event.target.port, " ")
match:
$Ports
outcome:
$Count = count($event.metadata.id)
order:
$Count desc
limit:
10
10 principais atividades de rede
$event.metadata.log_type = /ROUTER|SWITCH|DHCP|PROXY|NETWORK|VPN|FIREWALL|_FLOW|VPC|WIRELESS|IPS|IDS|ARUBA_EDGECONNECT_SDWAN|ARUBA_SWITCH|CISCO_APIC|CISCO_CALL_MANAGER|CISCO_DNAC|CISCO_ESTREAMER|CISCO_IOS|CISCO_PRIME|EFFICIENTIP_DDI|EXTREME_SWITCH|FORTINET_FORTIDDOS|FORTINET_FORTIMANAGER|ARUBA_CENTRAL|JUNIPER_JUNOS|JUNIPER_MIST|JUNIPER_SDWAN|NAGIOS|ARBOR_EDGE_DEFENSE|MICROSOFT_NPS|STEELHEAD|SHRUBBERY_TACACS|TRENDMICRO_DDI|VMWARE_NSX|WINDOWS_NET_POLICY_SERVER|ZYWALL|IMPERVA_FLEXPROTECT|PAN_IOT|NOZOMI_GUARDIAN|SURICATA_EVE|UMBRELLA_DNS|WINDOWS_SYSMON|COHESITY|RUBRIK|CISCO_MERAKI|CLAROTY_EMC|CLAROTY_CTD|HONEYD|AIRWATCH|IMPERVA_SECURESPHERE|SECURELINK|WALLIX_BASTION|CHECKPOINT_HARMONY|UNIFI_AP|DIGI_MODEMS|DESYNOVA_CONTIDO|CLOUDGENIX_SDWAN|JUNIPER_MX|SAP_WEBDISP|ADVA_FSP|HP_PROCURVE|VYOS|RSA_SECURID|HCNET_ACCOUNT_ADAPTER|INFOBLOX|VITALQIP|ASSET_STATIC_IP|BLUECAT_DDI|TWINGATE|SYMANTEC_VIP_AUTHHUB|ZSCALER_DECEPTION|BROCADE_SERVERIRON|KEMP_LOADBALANCER|A10_LOAD_BALANCER|AWS_ELB|F5_BIGIP_LTM|RADWARE_ALTEON|CITRIX_NETSCALER|AKAMAI_CLOUD_MONITOR|CISCO_ACE|GCP_LOADBALANCING|KERIOCONTROL|EXTRAHOP|NETFILTER_IPTABLES|CISCO_UMBRELLA_AUDIT|F5_AFM|NUTANIX_PRISM|SANGFOR_NGAF|VERCEL_WAF|PEPLINK_FW|NETDOCUMENTS|PAN_PANORAMA|PFSENSE|AZION|FIREEYE_PX|OPNSENSE|CISCO_FWSM|FORTINET_FORTIWEB|BARRACUDA_WAF|SYMANTEC_WSS|MENLO_SECURITY|DIGITALARTS_IFILTER|WEBMARSHAL|UMBRELLA_IP|AWS_SECURITY_HUB|EXTRAHOP|GUARDDUTY|MICROSOFT_ATA|ORCA|OSSEC|SURICATA_EVE|VMWARE_TANZU/ nocase
$event.principal.ip in cidr %PCI_Network_Ranges
or $event.principal.asset.ip in cidr %PCI_Network_Ranges
$Log_Type = $event.metadata.log_type
$Event_Type = $event.metadata.event_type
$Security_Action = $event.security_result.action
match:
$Event_Type, $Log_Type, $Security_Action
outcome:
$Count = count($event.metadata.event_type)
order:
$Count desc
limit:
10
Resumo da atividade da porta
$event.metadata.log_type = /ROUTER|SWITCH|DHCP|PROXY|NETWORK|VPN|FIREWALL|_FLOW|VPC|WIRELESS|IPS|IDS|ARUBA_EDGECONNECT_SDWAN|ARUBA_SWITCH|CISCO_APIC|CISCO_CALL_MANAGER|CISCO_DNAC|CISCO_ESTREAMER|CISCO_IOS|CISCO_PRIME|EFFICIENTIP_DDI|EXTREME_SWITCH|FORTINET_FORTIDDOS|FORTINET_FORTIMANAGER|ARUBA_CENTRAL|JUNIPER_JUNOS|JUNIPER_MIST|JUNIPER_SDWAN|NAGIOS|ARBOR_EDGE_DEFENSE|MICROSOFT_NPS|STEELHEAD|SHRUBBERY_TACACS|TRENDMICRO_DDI|VMWARE_NSX|WINDOWS_NET_POLICY_SERVER|ZYWALL|IMPERVA_FLEXPROTECT|PAN_IOT|NOZOMI_GUARDIAN|SURICATA_EVE|UMBRELLA_DNS|WINDOWS_SYSMON|COHESITY|RUBRIK|CISCO_MERAKI|CLAROTY_EMC|CLAROTY_CTD|HONEYD|AIRWATCH|IMPERVA_SECURESPHERE|SECURELINK|WALLIX_BASTION|CHECKPOINT_HARMONY|UNIFI_AP|DIGI_MODEMS|DESYNOVA_CONTIDO|CLOUDGENIX_SDWAN|JUNIPER_MX|SAP_WEBDISP|ADVA_FSP|HP_PROCURVE|VYOS|RSA_SECURID|HCNET_ACCOUNT_ADAPTER|INFOBLOX|VITALQIP|ASSET_STATIC_IP|BLUECAT_DDI|TWINGATE|SYMANTEC_VIP_AUTHHUB|ZSCALER_DECEPTION|BROCADE_SERVERIRON|KEMP_LOADBALANCER|A10_LOAD_BALANCER|AWS_ELB|F5_BIGIP_LTM|RADWARE_ALTEON|CITRIX_NETSCALER|AKAMAI_CLOUD_MONITOR|CISCO_ACE|GCP_LOADBALANCING|KERIOCONTROL|EXTRAHOP|NETFILTER_IPTABLES|CISCO_UMBRELLA_AUDIT|F5_AFM|NUTANIX_PRISM|SANGFOR_NGAF|VERCEL_WAF|PEPLINK_FW|NETDOCUMENTS|PAN_PANORAMA|PFSENSE|AZION|FIREEYE_PX|OPNSENSE|CISCO_FWSM|FORTINET_FORTIWEB|BARRACUDA_WAF|SYMANTEC_WSS|MENLO_SECURITY|DIGITALARTS_IFILTER|WEBMARSHAL|UMBRELLA_IP|AWS_SECURITY_HUB|EXTRAHOP|GUARDDUTY|MICROSOFT_ATA|ORCA|OSSEC|SURICATA_EVE|VMWARE_TANZU/ nocase
$event.principal.ip in cidr %PCI_Network_Ranges
or $event.principal.asset.ip in cidr %PCI_Network_Ranges
$Source_Port = $event.principal.port
$Target_Port = $event.target.port
$Direction = $event.network.direction
$Event_Type = $event.metadata.event_type
match:
$Source_Port, $Direction, $Target_Port, $Event_Type
outcome:
$Count = count($event.metadata.id)
order:
$Count desc
limit:
50
Tráfego pelos 10 principais protocolos
$event.metadata.log_type = /ROUTER|SWITCH|DHCP|PROXY|NETWORK|VPN|FIREWALL|_FLOW|VPC|WIRELESS|IPS|IDS|ARUBA_EDGECONNECT_SDWAN|ARUBA_SWITCH|CISCO_APIC|CISCO_CALL_MANAGER|CISCO_DNAC|CISCO_ESTREAMER|CISCO_IOS|CISCO_PRIME|EFFICIENTIP_DDI|EXTREME_SWITCH|FORTINET_FORTIDDOS|FORTINET_FORTIMANAGER|ARUBA_CENTRAL|JUNIPER_JUNOS|JUNIPER_MIST|JUNIPER_SDWAN|NAGIOS|ARBOR_EDGE_DEFENSE|MICROSOFT_NPS|STEELHEAD|SHRUBBERY_TACACS|TRENDMICRO_DDI|VMWARE_NSX|WINDOWS_NET_POLICY_SERVER|ZYWALL|IMPERVA_FLEXPROTECT|PAN_IOT|NOZOMI_GUARDIAN|SURICATA_EVE|UMBRELLA_DNS|WINDOWS_SYSMON|COHESITY|RUBRIK|CISCO_MERAKI|CLAROTY_EMC|CLAROTY_CTD|HONEYD|AIRWATCH|IMPERVA_SECURESPHERE|SECURELINK|WALLIX_BASTION|CHECKPOINT_HARMONY|UNIFI_AP|DIGI_MODEMS|DESYNOVA_CONTIDO|CLOUDGENIX_SDWAN|JUNIPER_MX|SAP_WEBDISP|ADVA_FSP|HP_PROCURVE|VYOS|RSA_SECURID|HCNET_ACCOUNT_ADAPTER|INFOBLOX|VITALQIP|ASSET_STATIC_IP|BLUECAT_DDI|TWINGATE|SYMANTEC_VIP_AUTHHUB|ZSCALER_DECEPTION|BROCADE_SERVERIRON|KEMP_LOADBALANCER|A10_LOAD_BALANCER|AWS_ELB|F5_BIGIP_LTM|RADWARE_ALTEON|CITRIX_NETSCALER|AKAMAI_CLOUD_MONITOR|CISCO_ACE|GCP_LOADBALANCING|KERIOCONTROL|EXTRAHOP|NETFILTER_IPTABLES|CISCO_UMBRELLA_AUDIT|F5_AFM|NUTANIX_PRISM|SANGFOR_NGAF|VERCEL_WAF|PEPLINK_FW|NETDOCUMENTS|PAN_PANORAMA|PFSENSE|AZION|FIREEYE_PX|OPNSENSE|CISCO_FWSM|FORTINET_FORTIWEB|BARRACUDA_WAF|SYMANTEC_WSS|MENLO_SECURITY|DIGITALARTS_IFILTER|WEBMARSHAL|UMBRELLA_IP|AWS_SECURITY_HUB|EXTRAHOP|GUARDDUTY|MICROSOFT_ATA|ORCA|OSSEC|SURICATA_EVE|VMWARE_TANZU/ nocase
$event.principal.ip in cidr %PCI_Network_Ranges
or $event.principal.asset.ip in cidr %PCI_Network_Ranges
$Log_Type = $event.metadata.log_type
$Protocol = $event.network.ip_protocol
$Direction = $event.network.direction
match:
$Protocol, $Direction
outcome:
$Count = count($event.metadata.id)
order:
$Count desc
limit:
10
Dados de rede processados ao longo do tempo (bytes enviados)
$event.metadata.log_type = /ROUTER|SWITCH|DHCP|PROXY|NETWORK|VPN|FIREWALL|_FLOW|VPC|WIRELESS|IPS|IDS|ARUBA_EDGECONNECT_SDWAN|ARUBA_SWITCH|CISCO_APIC|CISCO_CALL_MANAGER|CISCO_DNAC|CISCO_ESTREAMER|CISCO_IOS|CISCO_PRIME|EFFICIENTIP_DDI|EXTREME_SWITCH|FORTINET_FORTIDDOS|FORTINET_FORTIMANAGER|ARUBA_CENTRAL|JUNIPER_JUNOS|JUNIPER_MIST|JUNIPER_SDWAN|NAGIOS|ARBOR_EDGE_DEFENSE|MICROSOFT_NPS|STEELHEAD|SHRUBBERY_TACACS|TRENDMICRO_DDI|VMWARE_NSX|WINDOWS_NET_POLICY_SERVER|ZYWALL|IMPERVA_FLEXPROTECT|PAN_IOT|NOZOMI_GUARDIAN|SURICATA_EVE|UMBRELLA_DNS|WINDOWS_SYSMON|COHESITY|RUBRIK|CISCO_MERAKI|CLAROTY_EMC|CLAROTY_CTD|HONEYD|AIRWATCH|IMPERVA_SECURESPHERE|SECURELINK|WALLIX_BASTION|CHECKPOINT_HARMONY|UNIFI_AP|DIGI_MODEMS|DESYNOVA_CONTIDO|CLOUDGENIX_SDWAN|JUNIPER_MX|SAP_WEBDISP|ADVA_FSP|HP_PROCURVE|VYOS|RSA_SECURID|HCNET_ACCOUNT_ADAPTER|INFOBLOX|VITALQIP|ASSET_STATIC_IP|BLUECAT_DDI|TWINGATE|SYMANTEC_VIP_AUTHHUB|ZSCALER_DECEPTION|BROCADE_SERVERIRON|KEMP_LOADBALANCER|A10_LOAD_BALANCER|AWS_ELB|F5_BIGIP_LTM|RADWARE_ALTEON|CITRIX_NETSCALER|AKAMAI_CLOUD_MONITOR|CISCO_ACE|GCP_LOADBALANCING|KERIOCONTROL|EXTRAHOP|NETFILTER_IPTABLES|CISCO_UMBRELLA_AUDIT|F5_AFM|NUTANIX_PRISM|SANGFOR_NGAF|VERCEL_WAF|PEPLINK_FW|NETDOCUMENTS|PAN_PANORAMA|PFSENSE|AZION|FIREEYE_PX|OPNSENSE|CISCO_FWSM|FORTINET_FORTIWEB|BARRACUDA_WAF|SYMANTEC_WSS|MENLO_SECURITY|DIGITALARTS_IFILTER|WEBMARSHAL|UMBRELLA_IP|AWS_SECURITY_HUB|EXTRAHOP|GUARDDUTY|MICROSOFT_ATA|ORCA|OSSEC|SURICATA_EVE|VMWARE_TANZU/ nocase
$event.principal.ip in cidr %PCI_Network_Ranges
or $event.principal.asset.ip in cidr %PCI_Network_Ranges
$Log_Type = $event.metadata.log_type
$Date = timestamp.get_date($event.metadata.event_timestamp.seconds)
match:
$Date, $Log_Type
outcome:
$Total_Bytes = sum($event.network.sent_bytes)
$GB = math.ceil($Total_Bytes / 1073741824)
order:
$Date asc
limit:
50
Dados de rede processados ao longo do tempo (bytes recebidos)
$event.metadata.log_type = /ROUTER|SWITCH|DHCP|PROXY|NETWORK|VPN|FIREWALL|_FLOW|VPC|WIRELESS|IPS|IDS|ARUBA_EDGECONNECT_SDWAN|ARUBA_SWITCH|CISCO_APIC|CISCO_CALL_MANAGER|CISCO_DNAC|CISCO_ESTREAMER|CISCO_IOS|CISCO_PRIME|EFFICIENTIP_DDI|EXTREME_SWITCH|FORTINET_FORTIDDOS|FORTINET_FORTIMANAGER|ARUBA_CENTRAL|JUNIPER_JUNOS|JUNIPER_MIST|JUNIPER_SDWAN|NAGIOS|ARBOR_EDGE_DEFENSE|MICROSOFT_NPS|STEELHEAD|SHRUBBERY_TACACS|TRENDMICRO_DDI|VMWARE_NSX|WINDOWS_NET_POLICY_SERVER|ZYWALL|IMPERVA_FLEXPROTECT|PAN_IOT|NOZOMI_GUARDIAN|SURICATA_EVE|UMBRELLA_DNS|WINDOWS_SYSMON|COHESITY|RUBRIK|CISCO_MERAKI|CLAROTY_EMC|CLAROTY_CTD|HONEYD|AIRWATCH|IMPERVA_SECURESPHERE|SECURELINK|WALLIX_BASTION|CHECKPOINT_HARMONY|UNIFI_AP|DIGI_MODEMS|DESYNOVA_CONTIDO|CLOUDGENIX_SDWAN|JUNIPER_MX|SAP_WEBDISP|ADVA_FSP|HP_PROCURVE|VYOS|RSA_SECURID|HCNET_ACCOUNT_ADAPTER|INFOBLOX|VITALQIP|ASSET_STATIC_IP|BLUECAT_DDI|TWINGATE|SYMANTEC_VIP_AUTHHUB|ZSCALER_DECEPTION|BROCADE_SERVERIRON|KEMP_LOADBALANCER|A10_LOAD_BALANCER|AWS_ELB|F5_BIGIP_LTM|RADWARE_ALTEON|CITRIX_NETSCALER|AKAMAI_CLOUD_MONITOR|CISCO_ACE|GCP_LOADBALANCING|KERIOCONTROL|EXTRAHOP|NETFILTER_IPTABLES|CISCO_UMBRELLA_AUDIT|F5_AFM|NUTANIX_PRISM|SANGFOR_NGAF|VERCEL_WAF|PEPLINK_FW|NETDOCUMENTS|PAN_PANORAMA|PFSENSE|AZION|FIREEYE_PX|OPNSENSE|CISCO_FWSM|FORTINET_FORTIWEB|BARRACUDA_WAF|SYMANTEC_WSS|MENLO_SECURITY|DIGITALARTS_IFILTER|WEBMARSHAL|UMBRELLA_IP|AWS_SECURITY_HUB|EXTRAHOP|GUARDDUTY|MICROSOFT_ATA|ORCA|OSSEC|SURICATA_EVE|VMWARE_TANZU/ nocase
$event.principal.ip in cidr %PCI_Network_Ranges
or $event.principal.asset.ip in cidr %PCI_Network_Ranges
$Log_Type = $event.metadata.log_type
$Date = timestamp.get_date($event.metadata.event_timestamp.seconds)
match:
$Date, $Log_Type
outcome:
$Total_Bytes = sum($event.network.received_bytes)
$GB = math.ceil($Total_Bytes / 1073741824)
order:
$Date asc
limit:
50
Tráfego de rede ao longo do tempo
$event.metadata.log_type = /ROUTER|SWITCH|DHCP|PROXY|NETWORK|VPN|FIREWALL|_FLOW|VPC|WIRELESS|IPS|IDS|ARUBA_EDGECONNECT_SDWAN|ARUBA_SWITCH|CISCO_APIC|CISCO_CALL_MANAGER|CISCO_DNAC|CISCO_ESTREAMER|CISCO_IOS|CISCO_PRIME|EFFICIENTIP_DDI|EXTREME_SWITCH|FORTINET_FORTIDDOS|FORTINET_FORTIMANAGER|ARUBA_CENTRAL|JUNIPER_JUNOS|JUNIPER_MIST|JUNIPER_SDWAN|NAGIOS|ARBOR_EDGE_DEFENSE|MICROSOFT_NPS|STEELHEAD|SHRUBBERY_TACACS|TRENDMICRO_DDI|VMWARE_NSX|WINDOWS_NET_POLICY_SERVER|ZYWALL|IMPERVA_FLEXPROTECT|PAN_IOT|NOZOMI_GUARDIAN|SURICATA_EVE|UMBRELLA_DNS|WINDOWS_SYSMON|COHESITY|RUBRIK|CISCO_MERAKI|CLAROTY_EMC|CLAROTY_CTD|HONEYD|AIRWATCH|IMPERVA_SECURESPHERE|SECURELINK|WALLIX_BASTION|CHECKPOINT_HARMONY|UNIFI_AP|DIGI_MODEMS|DESYNOVA_CONTIDO|CLOUDGENIX_SDWAN|JUNIPER_MX|SAP_WEBDISP|ADVA_FSP|HP_PROCURVE|VYOS|RSA_SECURID|HCNET_ACCOUNT_ADAPTER|INFOBLOX|VITALQIP|ASSET_STATIC_IP|BLUECAT_DDI|TWINGATE|SYMANTEC_VIP_AUTHHUB|ZSCALER_DECEPTION|BROCADE_SERVERIRON|KEMP_LOADBALANCER|A10_LOAD_BALANCER|AWS_ELB|F5_BIGIP_LTM|RADWARE_ALTEON|CITRIX_NETSCALER|AKAMAI_CLOUD_MONITOR|CISCO_ACE|GCP_LOADBALANCING|KERIOCONTROL|EXTRAHOP|NETFILTER_IPTABLES|CISCO_UMBRELLA_AUDIT|F5_AFM|NUTANIX_PRISM|SANGFOR_NGAF|VERCEL_WAF|PEPLINK_FW|NETDOCUMENTS|PAN_PANORAMA|PFSENSE|AZION|FIREEYE_PX|OPNSENSE|CISCO_FWSM|FORTINET_FORTIWEB|BARRACUDA_WAF|SYMANTEC_WSS|MENLO_SECURITY|DIGITALARTS_IFILTER|WEBMARSHAL|UMBRELLA_IP|AWS_SECURITY_HUB|EXTRAHOP|GUARDDUTY|MICROSOFT_ATA|ORCA|OSSEC|SURICATA_EVE|VMWARE_TANZU/ nocase
$event.principal.ip in cidr %PCI_Network_Ranges
or $event.principal.asset.ip in cidr %PCI_Network_Ranges
$Direction = $event.network.direction
$Date = timestamp.get_date($event.metadata.event_timestamp.seconds)
match:
$Date, $Direction
outcome:
$Count = count($event.metadata.id)
order:
$Date asc
Tráfego pelas 10 principais portas de origem
$event.metadata.log_type = /ROUTER|SWITCH|DHCP|PROXY|NETWORK|VPN|FIREWALL|_FLOW|VPC|WIRELESS|IPS|IDS|ARUBA_EDGECONNECT_SDWAN|ARUBA_SWITCH|CISCO_APIC|CISCO_CALL_MANAGER|CISCO_DNAC|CISCO_ESTREAMER|CISCO_IOS|CISCO_PRIME|EFFICIENTIP_DDI|EXTREME_SWITCH|FORTINET_FORTIDDOS|FORTINET_FORTIMANAGER|ARUBA_CENTRAL|JUNIPER_JUNOS|JUNIPER_MIST|JUNIPER_SDWAN|NAGIOS|ARBOR_EDGE_DEFENSE|MICROSOFT_NPS|STEELHEAD|SHRUBBERY_TACACS|TRENDMICRO_DDI|VMWARE_NSX|WINDOWS_NET_POLICY_SERVER|ZYWALL|IMPERVA_FLEXPROTECT|PAN_IOT|NOZOMI_GUARDIAN|SURICATA_EVE|UMBRELLA_DNS|WINDOWS_SYSMON|COHESITY|RUBRIK|CISCO_MERAKI|CLAROTY_EMC|CLAROTY_CTD|HONEYD|AIRWATCH|IMPERVA_SECURESPHERE|SECURELINK|WALLIX_BASTION|CHECKPOINT_HARMONY|UNIFI_AP|DIGI_MODEMS|DESYNOVA_CONTIDO|CLOUDGENIX_SDWAN|JUNIPER_MX|SAP_WEBDISP|ADVA_FSP|HP_PROCURVE|VYOS|RSA_SECURID|HCNET_ACCOUNT_ADAPTER|INFOBLOX|VITALQIP|ASSET_STATIC_IP|BLUECAT_DDI|TWINGATE|SYMANTEC_VIP_AUTHHUB|ZSCALER_DECEPTION|BROCADE_SERVERIRON|KEMP_LOADBALANCER|A10_LOAD_BALANCER|AWS_ELB|F5_BIGIP_LTM|RADWARE_ALTEON|CITRIX_NETSCALER|AKAMAI_CLOUD_MONITOR|CISCO_ACE|GCP_LOADBALANCING|KERIOCONTROL|EXTRAHOP|NETFILTER_IPTABLES|CISCO_UMBRELLA_AUDIT|F5_AFM|NUTANIX_PRISM|SANGFOR_NGAF|VERCEL_WAF|PEPLINK_FW|NETDOCUMENTS|PAN_PANORAMA|PFSENSE|AZION|FIREEYE_PX|OPNSENSE|CISCO_FWSM|FORTINET_FORTIWEB|BARRACUDA_WAF|SYMANTEC_WSS|MENLO_SECURITY|DIGITALARTS_IFILTER|WEBMARSHAL|UMBRELLA_IP|AWS_SECURITY_HUB|EXTRAHOP|GUARDDUTY|MICROSOFT_ATA|ORCA|OSSEC|SURICATA_EVE|VMWARE_TANZU/ nocase
$event.principal.ip in cidr %PCI_Network_Ranges
or $event.principal.asset.ip in cidr %PCI_Network_Ranges
$Ports = strings.concat($event.principal.port, " ")
match:
$Ports
outcome:
$Count = count($event.metadata.id)
order:
$Count desc
limit:
10
Contagem de recursos de rede
$event.metadata.log_type = /ROUTER|SWITCH|DHCP|PROXY|NETWORK|VPN|FIREWALL|_FLOW|VPC|WIRELESS|IPS|IDS|ARUBA_EDGECONNECT_SDWAN|ARUBA_SWITCH|CISCO_APIC|CISCO_CALL_MANAGER|CISCO_DNAC|CISCO_ESTREAMER|CISCO_IOS|CISCO_PRIME|EFFICIENTIP_DDI|EXTREME_SWITCH|FORTINET_FORTIDDOS|FORTINET_FORTIMANAGER|ARUBA_CENTRAL|JUNIPER_JUNOS|JUNIPER_MIST|JUNIPER_SDWAN|NAGIOS|ARBOR_EDGE_DEFENSE|MICROSOFT_NPS|STEELHEAD|SHRUBBERY_TACACS|TRENDMICRO_DDI|VMWARE_NSX|WINDOWS_NET_POLICY_SERVER|ZYWALL|IMPERVA_FLEXPROTECT|PAN_IOT|NOZOMI_GUARDIAN|SURICATA_EVE|UMBRELLA_DNS|WINDOWS_SYSMON|COHESITY|RUBRIK|CISCO_MERAKI|CLAROTY_EMC|CLAROTY_CTD|HONEYD|AIRWATCH|IMPERVA_SECURESPHERE|SECURELINK|WALLIX_BASTION|CHECKPOINT_HARMONY|UNIFI_AP|DIGI_MODEMS|DESYNOVA_CONTIDO|CLOUDGENIX_SDWAN|JUNIPER_MX|SAP_WEBDISP|ADVA_FSP|HP_PROCURVE|VYOS|RSA_SECURID|HCNET_ACCOUNT_ADAPTER|INFOBLOX|VITALQIP|ASSET_STATIC_IP|BLUECAT_DDI|TWINGATE|SYMANTEC_VIP_AUTHHUB|ZSCALER_DECEPTION|BROCADE_SERVERIRON|KEMP_LOADBALANCER|A10_LOAD_BALANCER|AWS_ELB|F5_BIGIP_LTM|RADWARE_ALTEON|CITRIX_NETSCALER|AKAMAI_CLOUD_MONITOR|CISCO_ACE|GCP_LOADBALANCING|KERIOCONTROL|EXTRAHOP|NETFILTER_IPTABLES|CISCO_UMBRELLA_AUDIT|F5_AFM|NUTANIX_PRISM|SANGFOR_NGAF|VERCEL_WAF|PEPLINK_FW|NETDOCUMENTS|PAN_PANORAMA|PFSENSE|AZION|FIREEYE_PX|OPNSENSE|CISCO_FWSM|FORTINET_FORTIWEB|BARRACUDA_WAF|SYMANTEC_WSS|MENLO_SECURITY|DIGITALARTS_IFILTER|WEBMARSHAL|UMBRELLA_IP|AWS_SECURITY_HUB|EXTRAHOP|GUARDDUTY|MICROSOFT_ATA|ORCA|OSSEC|SURICATA_EVE|VMWARE_TANZU/ nocase
$event.principal.ip in cidr %PCI_Network_Ranges
or $event.principal.asset.ip in cidr %PCI_Network_Ranges
$Network_Asset = strings.coalesce($event.principal.ip, $event.principal.asset.ip)
outcome:
$Count = count_distinct(strings.coalesce($event.principal.ip, $event.principal.asset.ip))
Tráfego ao longo do tempo por protocolo
$event.metadata.log_type = /ROUTER|SWITCH|DHCP|PROXY|NETWORK|VPN|FIREWALL|_FLOW|VPC|WIRELESS|IPS|IDS|ARUBA_EDGECONNECT_SDWAN|ARUBA_SWITCH|CISCO_APIC|CISCO_CALL_MANAGER|CISCO_DNAC|CISCO_ESTREAMER|CISCO_IOS|CISCO_PRIME|EFFICIENTIP_DDI|EXTREME_SWITCH|FORTINET_FORTIDDOS|FORTINET_FORTIMANAGER|ARUBA_CENTRAL|JUNIPER_JUNOS|JUNIPER_MIST|JUNIPER_SDWAN|NAGIOS|ARBOR_EDGE_DEFENSE|MICROSOFT_NPS|STEELHEAD|SHRUBBERY_TACACS|TRENDMICRO_DDI|VMWARE_NSX|WINDOWS_NET_POLICY_SERVER|ZYWALL|IMPERVA_FLEXPROTECT|PAN_IOT|NOZOMI_GUARDIAN|SURICATA_EVE|UMBRELLA_DNS|WINDOWS_SYSMON|COHESITY|RUBRIK|CISCO_MERAKI|CLAROTY_EMC|CLAROTY_CTD|HONEYD|AIRWATCH|IMPERVA_SECURESPHERE|SECURELINK|WALLIX_BASTION|CHECKPOINT_HARMONY|UNIFI_AP|DIGI_MODEMS|DESYNOVA_CONTIDO|CLOUDGENIX_SDWAN|JUNIPER_MX|SAP_WEBDISP|ADVA_FSP|HP_PROCURVE|VYOS|RSA_SECURID|HCNET_ACCOUNT_ADAPTER|INFOBLOX|VITALQIP|ASSET_STATIC_IP|BLUECAT_DDI|TWINGATE|SYMANTEC_VIP_AUTHHUB|ZSCALER_DECEPTION|BROCADE_SERVERIRON|KEMP_LOADBALANCER|A10_LOAD_BALANCER|AWS_ELB|F5_BIGIP_LTM|RADWARE_ALTEON|CITRIX_NETSCALER|AKAMAI_CLOUD_MONITOR|CISCO_ACE|GCP_LOADBALANCING|KERIOCONTROL|EXTRAHOP|NETFILTER_IPTABLES|CISCO_UMBRELLA_AUDIT|F5_AFM|NUTANIX_PRISM|SANGFOR_NGAF|VERCEL_WAF|PEPLINK_FW|NETDOCUMENTS|PAN_PANORAMA|PFSENSE|AZION|FIREEYE_PX|OPNSENSE|CISCO_FWSM|FORTINET_FORTIWEB|BARRACUDA_WAF|SYMANTEC_WSS|MENLO_SECURITY|DIGITALARTS_IFILTER|WEBMARSHAL|UMBRELLA_IP|AWS_SECURITY_HUB|EXTRAHOP|GUARDDUTY|MICROSOFT_ATA|ORCA|OSSEC|SURICATA_EVE|VMWARE_TANZU/ nocase
$event.principal.ip in cidr %PCI_Network_Ranges
or $event.principal.asset.ip in cidr %PCI_Network_Ranges
$Protocol = $event.network.ip_protocol
$Date = timestamp.get_date($event.metadata.event_timestamp.seconds)
match:
$Date, $Protocol
outcome:
$Count = count_distinct($event.metadata.id)
order:
$Date asc
Tráfego ao longo do tempo por ação
$event.metadata.log_type = /ROUTER|SWITCH|DHCP|PROXY|NETWORK|VPN|FIREWALL|_FLOW|VPC|WIRELESS|IPS|IDS|ARUBA_EDGECONNECT_SDWAN|ARUBA_SWITCH|CISCO_APIC|CISCO_CALL_MANAGER|CISCO_DNAC|CISCO_ESTREAMER|CISCO_IOS|CISCO_PRIME|EFFICIENTIP_DDI|EXTREME_SWITCH|FORTINET_FORTIDDOS|FORTINET_FORTIMANAGER|ARUBA_CENTRAL|JUNIPER_JUNOS|JUNIPER_MIST|JUNIPER_SDWAN|NAGIOS|ARBOR_EDGE_DEFENSE|MICROSOFT_NPS|STEELHEAD|SHRUBBERY_TACACS|TRENDMICRO_DDI|VMWARE_NSX|WINDOWS_NET_POLICY_SERVER|ZYWALL|IMPERVA_FLEXPROTECT|PAN_IOT|NOZOMI_GUARDIAN|SURICATA_EVE|UMBRELLA_DNS|WINDOWS_SYSMON|COHESITY|RUBRIK|CISCO_MERAKI|CLAROTY_EMC|CLAROTY_CTD|HONEYD|AIRWATCH|IMPERVA_SECURESPHERE|SECURELINK|WALLIX_BASTION|CHECKPOINT_HARMONY|UNIFI_AP|DIGI_MODEMS|DESYNOVA_CONTIDO|CLOUDGENIX_SDWAN|JUNIPER_MX|SAP_WEBDISP|ADVA_FSP|HP_PROCURVE|VYOS|RSA_SECURID|HCNET_ACCOUNT_ADAPTER|INFOBLOX|VITALQIP|ASSET_STATIC_IP|BLUECAT_DDI|TWINGATE|SYMANTEC_VIP_AUTHHUB|ZSCALER_DECEPTION|BROCADE_SERVERIRON|KEMP_LOADBALANCER|A10_LOAD_BALANCER|AWS_ELB|F5_BIGIP_LTM|RADWARE_ALTEON|CITRIX_NETSCALER|AKAMAI_CLOUD_MONITOR|CISCO_ACE|GCP_LOADBALANCING|KERIOCONTROL|EXTRAHOP|NETFILTER_IPTABLES|CISCO_UMBRELLA_AUDIT|F5_AFM|NUTANIX_PRISM|SANGFOR_NGAF|VERCEL_WAF|PEPLINK_FW|NETDOCUMENTS|PAN_PANORAMA|PFSENSE|AZION|FIREEYE_PX|OPNSENSE|CISCO_FWSM|FORTINET_FORTIWEB|BARRACUDA_WAF|SYMANTEC_WSS|MENLO_SECURITY|DIGITALARTS_IFILTER|WEBMARSHAL|UMBRELLA_IP|AWS_SECURITY_HUB|EXTRAHOP|GUARDDUTY|MICROSOFT_ATA|ORCA|OSSEC|SURICATA_EVE|VMWARE_TANZU/ nocase
$event.principal.ip in cidr %PCI_Network_Ranges
or $event.principal.asset.ip in cidr %PCI_Network_Ranges
$Date = timestamp.get_date($event.metadata.event_timestamp.seconds)
$Security_Result = $event.security_result.action
match:
$Date, $Security_Result
outcome:
$Count = count($event.security_result.action)
order:
$Date asc
Tráfego das 10 principais origens
$event.metadata.log_type = /ROUTER|SWITCH|DHCP|PROXY|NETWORK|VPN|FIREWALL|_FLOW|VPC|WIRELESS|IPS|IDS|ARUBA_EDGECONNECT_SDWAN|ARUBA_SWITCH|CISCO_APIC|CISCO_CALL_MANAGER|CISCO_DNAC|CISCO_ESTREAMER|CISCO_IOS|CISCO_PRIME|EFFICIENTIP_DDI|EXTREME_SWITCH|FORTINET_FORTIDDOS|FORTINET_FORTIMANAGER|ARUBA_CENTRAL|JUNIPER_JUNOS|JUNIPER_MIST|JUNIPER_SDWAN|NAGIOS|ARBOR_EDGE_DEFENSE|MICROSOFT_NPS|STEELHEAD|SHRUBBERY_TACACS|TRENDMICRO_DDI|VMWARE_NSX|WINDOWS_NET_POLICY_SERVER|ZYWALL|IMPERVA_FLEXPROTECT|PAN_IOT|NOZOMI_GUARDIAN|SURICATA_EVE|UMBRELLA_DNS|WINDOWS_SYSMON|COHESITY|RUBRIK|CISCO_MERAKI|CLAROTY_EMC|CLAROTY_CTD|HONEYD|AIRWATCH|IMPERVA_SECURESPHERE|SECURELINK|WALLIX_BASTION|CHECKPOINT_HARMONY|UNIFI_AP|DIGI_MODEMS|DESYNOVA_CONTIDO|CLOUDGENIX_SDWAN|JUNIPER_MX|SAP_WEBDISP|ADVA_FSP|HP_PROCURVE|VYOS|RSA_SECURID|HCNET_ACCOUNT_ADAPTER|INFOBLOX|VITALQIP|ASSET_STATIC_IP|BLUECAT_DDI|TWINGATE|SYMANTEC_VIP_AUTHHUB|ZSCALER_DECEPTION|BROCADE_SERVERIRON|KEMP_LOADBALANCER|A10_LOAD_BALANCER|AWS_ELB|F5_BIGIP_LTM|RADWARE_ALTEON|CITRIX_NETSCALER|AKAMAI_CLOUD_MONITOR|CISCO_ACE|GCP_LOADBALANCING|KERIOCONTROL|EXTRAHOP|NETFILTER_IPTABLES|CISCO_UMBRELLA_AUDIT|F5_AFM|NUTANIX_PRISM|SANGFOR_NGAF|VERCEL_WAF|PEPLINK_FW|NETDOCUMENTS|PAN_PANORAMA|PFSENSE|AZION|FIREEYE_PX|OPNSENSE|CISCO_FWSM|FORTINET_FORTIWEB|BARRACUDA_WAF|SYMANTEC_WSS|MENLO_SECURITY|DIGITALARTS_IFILTER|WEBMARSHAL|UMBRELLA_IP|AWS_SECURITY_HUB|EXTRAHOP|GUARDDUTY|MICROSOFT_ATA|ORCA|OSSEC|SURICATA_EVE|VMWARE_TANZU/ nocase
$event.principal.ip in cidr %PCI_Network_Ranges
or $event.principal.asset.ip in cidr %PCI_Network_Ranges
$IP_Address = $event.principal.ip
match:
$IP_Address
outcome:
$Count = count_distinct($event.metadata.id)
order:
$Count desc
limit:
10
PCI: gerenciamento de patches
Esse painel oferece uma visão abrangente do ciclo de vida do gerenciamento de patches, permitindo que as organizações monitorem e gerenciem as atualizações do sistema de maneira eficaz. Ele usa as listas de referência patch_updates e pci_assets para restringir os dados ao ambiente de PCI.
Observação : os gráficos neste painel não são carregados até que as listas de referência necessárias sejam criadas.
10 principais instalações bem-sucedidas por hosts
Falhas de instalação ao longo do tempo
Sistemas com atualizações disponíveis
Instalações canceladas ao longo do tempo
Downloads com falha ao longo do tempo
Downloads concluídos ao longo do tempo
Downloads iniciados ao longo do tempo
Atualizações mais recentes instaladas
Instalações concluídas ao longo do tempo
As 10 principais instalações com falha por hosts
Nome do gráfico
Exemplo de consulta
10 principais instalações bem-sucedidas por hosts
strings.coalesce($event.principal.asset.hostname, $event.principal.hostname) in %PCI_Assets
$event.metadata.product_event_type = "19"
$Date = timestamp.get_date($event.metadata.event_timestamp.seconds)
$Hostname = strings.coalesce($event.principal.asset.hostname, $event.principal.hostname)
match:
$Date, $Hostname
outcome:
$Count = count($event.metadata.id)
order:
$Date desc
limit:
10
Falhas de instalação ao longo do tempo
strings.coalesce($event.principal.asset.hostname, $event.principal.hostname) in %PCI_Assets
$event.metadata.product_event_type = "20"
$Date = timestamp.get_date($event.metadata.event_timestamp.seconds)
$Event = $event.metadata.product_event_type
match:
$Event, $Date
outcome:
$Count = count($event.metadata.id)
order:
$Date asc
Sistemas com atualizações disponíveis
strings.coalesce($event.principal.asset.hostname, $event.principal.hostname) in %PCI_Assets
$event.metadata.product_event_type = "40"
$Date = timestamp.get_date($event.metadata.event_timestamp.seconds)
$Hostname = strings.coalesce($event.principal.asset.hostname, $event.principal.hostname)
match:
$Hostname, $Date
outcome:
$Count = count($event.metadata.id)
order:
$Date asc
limit:
10
Instalações canceladas ao longo do tempo
strings.coalesce($event.principal.asset.hostname, $event.principal.hostname) in %PCI_Assets
$event.metadata.product_event_type = "21"
$Date = timestamp.get_date($event.metadata.event_timestamp.seconds)
$Hostname = strings.coalesce($event.principal.asset.hostname, $event.principal.hostname)
match:
$Hostname, $Date
outcome:
$Count = count($event.metadata.id)
order:
$Date asc
Downloads com falha ao longo do tempo
strings.coalesce($event.principal.asset.hostname, $event.principal.hostname) in %PCI_Assets
$event.metadata.product_event_type = "31"
$Date = timestamp.get_date($event.metadata.event_timestamp.seconds)
$Hostname = strings.coalesce($event.principal.asset.hostname, $event.principal.hostname)
match:
$Hostname, $Date
outcome:
$Count = count($event.metadata.id)
order:
$Date asc
Downloads concluídos ao longo do tempo
strings.coalesce($event.principal.asset.hostname, $event.principal.hostname) in %PCI_Assets
$event.metadata.product_event_type = "16"
$Date = timestamp.get_date($event.metadata.event_timestamp.seconds)
$Hostname = strings.coalesce($event.principal.asset.hostname, $event.principal.hostname)
match:
$Hostname, $Date
outcome:
$Count = count($event.metadata.id)
order:
$Date asc
Downloads iniciados ao longo do tempo
strings.coalesce($event.principal.asset.hostname, $event.principal.hostname) in %PCI_Assets
$event.metadata.product_event_type = "41"
$Date = timestamp.get_date($event.metadata.event_timestamp.seconds)
$Hostname = strings.coalesce($event.principal.asset.hostname, $event.principal.hostname)
match:
$Hostname, $Date
outcome:
$Count = count($event.metadata.id)
order:
$Date asc
Atualizações mais recentes instaladas
strings.coalesce($event.principal.asset.hostname, $event.principal.hostname) in %PCI_Assets
$event.metadata.description in regex %Patch_Updates
$event.metadata.product_event_type = "19"
$Hostname = strings.coalesce($event.principal.asset.hostname, $event.principal.hostname)
$Hostname != ""
$Update = $event.metadata.description
match:
$Hostname, $Update
limit:
50
Instalações concluídas ao longo do tempo
strings.coalesce($event.principal.asset.hostname, $event.principal.hostname) in %PCI_Assets
$event.metadata.product_event_type = "19"
$Event = $event.metadata.product_event_type
$Date = timestamp.get_date($event.metadata.event_timestamp.seconds)
match:
$Event, $Date
outcome:
$Count = count($event.metadata.id)
order:
$Date asc
As 10 principais instalações com falha por hosts
strings.coalesce($event.principal.asset.hostname, $event.principal.hostname) in %PCI_Assets
$event.metadata.product_event_type = "20"
$Date = timestamp.get_date($event.metadata.event_timestamp.seconds)
$Hostname = strings.coalesce($event.principal.asset.hostname, $event.principal.hostname)
match:
$Date, $Hostname
outcome:
$Count = count($event.metadata.id)
order:
$Date desc
limit:
10
PCI: configurações seguras
Esse painel oferece monitoramento em tempo real das práticas de configuração segura. Ele rastreia métricas importantes, destaca riscos e ajuda a manter configurações críticas. Ele usa as listas de referência pci_assets e default_users para restringir os dados ao ambiente de PCI.
Observação : os gráficos neste painel não são carregados até que as listas de referência necessárias sejam criadas.
Tentativas de login com falha
Total de mudanças na política
Uso da conta padrão ao longo do tempo
10 principais nomes de usuário padrão
Falhas na tentativa de login ao longo do tempo
Mudanças na política por usuário
Falhas na tentativa de login pelos 10 principais hosts
Tentativas de login com falha por usuário
Uso da conta padrão por nome do host
Total de autenticações de nome de usuário padrão
Mudanças na política por fontes de registro
Mudanças na política ao longo do tempo
Resumo da autenticação de nomes de usuário padrão
Nome do gráfico
Exemplo de consulta
Tentativas de login com falha
$event_type = metadata.event_type
$event_type = "USER_LOGIN"
(principal.hostname in %PCI_Assets or principal.asset.hostname in %PCI_Assets or target.hostname in %PCI_Assets or target.asset.hostname in %PCI_Assets)
$action = security_result.action
$action = "BLOCK"
outcome:
$event_count = count(metadata.id)
order:
$event_count desc
Total de mudanças na política
$event_type = metadata.event_type
($event_type = "SYSTEM_AUDIT_LOG_UNCATEGORIZED" or $event_type = "STATUS_UPDATE")
(principal.hostname in %PCI_Assets or principal.asset.hostname in %PCI_Assets or target.hostname in %PCI_Assets or target.asset.hostname in %PCI_Assets)
$policy_change = strings.coalesce(security_result.description,metadata.product_event_type,security_result.about.registry.registry_key)
$policy_change = /policy change/ nocase
outcome:
$event_count = count(metadata.id)
Uso da conta padrão ao longo do tempo
$date = timestamp.get_date(metadata.event_timestamp.seconds)
(principal.hostname in %PCI_Assets or principal.asset.hostname in %PCI_Assets or target.hostname in %PCI_Assets or target.asset.hostname in %PCI_Assets)
$user = strings.coalesce(principal.user.userid,principal.user.user_display_name,principal.user.email_addresses)
$user in %Default_Users
match:
$date, $user
outcome:
$event_count = count(metadata.id)
order:
$date asc
10 principais nomes de usuário padrão
(principal.hostname in %PCI_Assets or principal.asset.hostname in %PCI_Assets or target.hostname in %PCI_Assets or target.asset.hostname in %PCI_Assets)
$user = strings.coalesce(principal.user.userid,principal.user.user_display_name,principal.user.email_addresses)
$user in %Default_Users
$event_type = metadata.event_type
match:
$user
outcome:
$event_types = array_distinct(metadata.event_type)
$event_count = count(metadata.id)
order:
$event_count desc
limit:
10
Falhas na tentativa de login ao longo do tempo
$date = timestamp.get_date(metadata.event_timestamp.seconds)
$event_type = metadata.event_type
$event_type = "USER_LOGIN"
(principal.hostname in %PCI_Assets or principal.asset.hostname in %PCI_Assets or target.hostname in %PCI_Assets or target.asset.hostname in %PCI_Assets)
$action = security_result.action
$action = "BLOCK"
match:
$date,$action
outcome:
$event_count = count(metadata.id)
order:
$date asc
Mudanças na política por usuário
$event_type = metadata.event_type
($event_type = "SYSTEM_AUDIT_LOG_UNCATEGORIZED" or $event_type = "STATUS_UPDATE")
(principal.hostname in %PCI_Assets or principal.asset.hostname in %PCI_Assets or target.hostname in %PCI_Assets or target.asset.hostname in %PCI_Assets)
$policy_change = strings.coalesce(security_result.description,metadata.product_event_type,security_result.about.registry.registry_key)
$policy_change = /policy change/ nocase
$user = strings.coalesce(principal.user.userid,principal.user.user_display_name,principal.user.email_addresses)
match:
$user
outcome:
$event_count = count(metadata.id)
order:
$event_count desc
Falhas na tentativa de login pelos 10 principais hosts
$event_type = metadata.event_type
$event_type = "USER_LOGIN"
(principal.hostname in %PCI_Assets or principal.asset.hostname in %PCI_Assets or target.hostname in %PCI_Assets or target.asset.hostname in %PCI_Assets)
$hostname = strings.coalesce(principal.hostname,principal.asset.hostname,target.hostname,target.asset.hostname)
$hostname != ""
$action = security_result.action
$action = "BLOCK"
match:
$hostname
outcome:
$event_count = count(metadata.id)
order:
$event_count desc
limit:
10
Tentativas de login com falha por usuário
$vendor = metadata.vendor_name
$event_type = metadata.event_type
$event_type = "USER_LOGIN"
(principal.hostname in %PCI_Assets or principal.asset.hostname in %PCI_Assets or target.hostname in %PCI_Assets or target.asset.hostname in %PCI_Assets)
$hostname = strings.coalesce(principal.hostname,principal.asset.hostname,target.hostname,target.asset.hostname)
$action = security_result.action
$action = "BLOCK"
$user = strings.coalesce(principal.user.userid,principal.user.user_display_name,principal.user.email_addresses)
$user != ""
match:
$user, $hostname, $vendor
outcome:
$event_count = count(metadata.id)
order:
$event_count desc
Uso da conta padrão por nome do host
(principal.hostname in %PCI_Assets or principal.asset.hostname in %PCI_Assets or target.hostname in %PCI_Assets or target.asset.hostname in %PCI_Assets)
$hostname = strings.coalesce(principal.hostname, principal.asset.hostname,target.hostname,target.asset.hostname)
$user = strings.coalesce(principal.user.userid,principal.user.user_display_name,principal.user.email_addresses)
$user in %Default_Users
match:
$hostname
outcome:
$event_count = count(metadata.id)
order:
$event_count desc
Total de autenticações de nome de usuário padrão
$event_type = metadata.event_type
$event_type = "USER_LOGIN"
(principal.hostname in %PCI_Assets or principal.asset.hostname in %PCI_Assets or target.hostname in %PCI_Assets or target.asset.hostname in %PCI_Assets)
$user = strings.coalesce(principal.user.userid,principal.user.user_display_name,principal.user.email_addresses)
$user in %Default_Users
outcome:
$event_count = count(metadata.id)
Mudanças na política por fontes de registro
$event_type = metadata.event_type
($event_type = "SYSTEM_AUDIT_LOG_UNCATEGORIZED" or $event_type = "STATUS_UPDATE")
(principal.hostname in %PCI_Assets or principal.asset.hostname in %PCI_Assets or target.hostname in %PCI_Assets or target.asset.hostname in %PCI_Assets)
$policy_change = strings.coalesce(security_result.description,metadata.product_event_type,security_result.about.registry.registry_key)
$policy_change = /policy change/ nocase
$log_source = metadata.log_type
match:
$log_source
outcome:
$event_count = count(metadata.id)
order:
$event_count desc
Mudanças na política ao longo do tempo
$event_type = metadata.event_type
($event_type = "SYSTEM_AUDIT_LOG_UNCATEGORIZED" or $event_type = "STATUS_UPDATE")
(principal.hostname in %PCI_Assets or principal.asset.hostname in %PCI_Assets or target.hostname in %PCI_Assets or target.asset.hostname in %PCI_Assets)
$policy_change = strings.coalesce(security_result.description,metadata.product_event_type,security_result.about.registry.registry_key)
$policy_change = /policy change/ nocase
$date = timestamp.get_date(metadata.event_timestamp.seconds)
match:
$date, $policy_change
outcome:
$event_count = count(metadata.id)
order:
$event_count desc
Resumo da autenticação de nomes de usuário padrão
$event_type = metadata.event_type
$event_type = "USER_LOGIN"
$log_type = metadata.log_type
(principal.hostname in %PCI_Assets or principal.asset.hostname in %PCI_Assets or target.hostname in %PCI_Assets or target.asset.hostname in %PCI_Assets)
$hostname = strings.coalesce(principal.hostname, principal.asset.hostname,target.hostname,target.asset.hostname)
$action = security_result.action
$user = strings.coalesce(principal.user.userid,principal.user.user_display_name,principal.user.email_addresses)
$user in %Default_Users
match:
$user, $hostname, $log_type, $action
outcome:
$event_count = count(metadata.id)
order:
$event_count desc
PCI: gerenciamento de vulnerabilidades
Esse painel oferece monitoramento e rastreamento de vulnerabilidades em tempo real. Ele apoia esforços de compliance mais amplos, ajudando a identificar, avaliar e gerenciar riscos para manter ambientes de pagamento seguros e simplificar a geração de relatórios. Ele usa as listas de referência pci_assets e pci_network_ranges para restringir os dados ao ambiente de PCI.
Observação : os gráficos neste painel não são carregados até que as listas de referência necessárias sejam criadas.
Vulnerabilidades por idade
10 principais hosts vulneráveis
As 10 principais vulnerabilidades
Novas vulnerabilidades
Total de vulnerabilidades
Sistemas vulneráveis
Vulnerabilidades por gravidade
Sistemas vulneráveis (porcentagem)
Vulnerabilidade por sistema
Nome do gráfico
Exemplo de consulta
Vulnerabilidades por idade
$event_type = metadata.event_type
($event_type = "SCAN_VULN_HOST" or $event_type = "SCAN_VULN_NETWORK")
(principal.hostname in %PCI_Assets) or (principal.asset.hostname in %PCI_Assets) or (principal.ip in cidr %PCI_Network_Ranges) or (principal.asset.ip in cidr %PCI_Network_Ranges)
$vulnerability = extensions.vulns.vulnerabilities.description
$First_Found = timestamp.get_date(extensions.vulns.vulnerabilities.first_found.seconds)
$date = timestamp.get_date(metadata.event_timestamp.seconds)
$Time_difference = timestamp.diff(metadata.event_timestamp.seconds, extensions.vulns.vulnerabilities.first_found.seconds, "DAY")
match:
$Time_difference,$vulnerability
outcome:
$Range = if(max($Time_difference) <= 30, "0-30Days", if(max($Time_difference) <= 60, "31-60Days", if(max($Time_difference) <= 90, "61-90Days", ">90Days")))
$event_count = count(metadata.id)
order:
$Time_difference desc
10 principais hosts vulneráveis
$event_type = metadata.event_type
($event_type = "SCAN_VULN_HOST" or $event_type = "SCAN_VULN_NETWORK")
$asset = strings.coalesce(principal.hostname,principal.asset.hostname,principal.ip,principal.asset.ip)
(principal.hostname in %PCI_Assets) or (principal.asset.hostname in %PCI_Assets) or (principal.ip in cidr %PCI_Network_Ranges) or (principal.asset.ip in cidr %PCI_Network_Ranges)
$platform = principal.platform
match:
$asset, $platform
outcome:
$event_count = count(metadata.id)
order:
$event_count desc
limit:
10
As 10 principais vulnerabilidades
$event_type = metadata.event_type
($event_type = "SCAN_VULN_HOST" or $event_type = "SCAN_VULN_NETWORK")
(principal.hostname in %PCI_Assets) or (principal.asset.hostname in %PCI_Assets) or (principal.ip in cidr %PCI_Network_Ranges) or (principal.asset.ip in cidr %PCI_Network_Ranges)
$vulnerability = extensions.vulns.vulnerabilities.description
$platform = principal.platform
match:
$vulnerability,$platform
outcome:
$event_count = count(metadata.id)
order:
$event_count desc
limit:
10
Novas vulnerabilidades
$event_type = metadata.event_type
($event_type = "SCAN_VULN_HOST" or $event_type = "SCAN_VULN_NETWORK")
(principal.hostname in %PCI_Assets) or (principal.asset.hostname in %PCI_Assets) or (principal.ip in cidr %PCI_Network_Ranges) or (principal.asset.ip in cidr %PCI_Network_Ranges)
$date = timestamp.get_date(metadata.event_timestamp.seconds)
$First_Found = timestamp.get_date(extensions.vulns.vulnerabilities.first_found.seconds)
$vulnerability = extensions.vulns.vulnerabilities.description
$severity = extensions.vulns.vulnerabilities.severity
$Time_difference = timestamp.diff(metadata.event_timestamp.seconds, extensions.vulns.vulnerabilities.first_found.seconds, "DAY")
$Time_difference < 30
match:
$vulnerability, $severity
outcome:
$event_count = count(metadata.id)
$age = max($Time_difference)
order:
$severity desc
Total de vulnerabilidades
$event_type = metadata.event_type
($event_type = "SCAN_VULN_HOST" or $event_type = "SCAN_VULN_NETWORK")
(principal.hostname in %PCI_Assets) or (principal.asset.hostname in %PCI_Assets) or (principal.ip in cidr %PCI_Network_Ranges) or (principal.asset.ip in cidr %PCI_Network_Ranges)
outcome:
$event_count = count(metadata.id)
Sistemas vulneráveis
$event_type = metadata.event_type
($event_type = "SCAN_VULN_HOST" or $event_type = "SCAN_VULN_NETWORK")
(principal.hostname in %PCI_Assets) or (principal.asset.hostname in %PCI_Assets) or (principal.ip in cidr %PCI_Network_Ranges) or (principal.asset.ip in cidr %PCI_Network_Ranges)
$asset = strings.coalesce(principal.hostname,principal.asset.hostname,principal.ip,principal.asset.ip)
outcome:
$event_count = count_distinct($asset)
Vulnerabilidades por gravidade
$event_type = metadata.event_type
($event_type = "SCAN_VULN_HOST" or $event_type = "SCAN_VULN_NETWORK")
(principal.hostname in %PCI_Assets) or (principal.asset.hostname in %PCI_Assets) or (principal.ip in cidr %PCI_Network_Ranges) or (principal.asset.ip in cidr %PCI_Network_Ranges)
$severity = extensions.vulns.vulnerabilities.severity
match:
$severity
outcome:
$event_count = count(metadata.id)
order:
$severity desc
Sistemas vulneráveis (porcentagem)
$event_type = metadata.event_type
($event_type = "SCAN_VULN_HOST" or $event_type = "SCAN_VULN_NETWORK")
(principal.hostname in %PCI_Assets) or (principal.asset.hostname in %PCI_Assets) or (principal.ip in cidr %PCI_Network_Ranges) or (principal.asset.ip in cidr %PCI_Network_Ranges)
$platform = principal.platform
match:
$platform
outcome:
$event_count = count($platform)
Vulnerabilidade por sistema
$event_type = metadata.event_type
($event_type = "SCAN_VULN_HOST" or $event_type = "SCAN_VULN_NETWORK")
$asset = strings.coalesce(principal.hostname,principal.asset.hostname,principal.ip,principal.asset.ip)
(principal.hostname in %PCI_Assets) or (principal.asset.hostname in %PCI_Assets) or (principal.ip in cidr %PCI_Network_Ranges) or (principal.asset.ip in cidr %PCI_Network_Ranges)
$platform = principal.platform
match:
$asset
outcome:
$operating_system = array_distinct($platform)
$event_count = count(metadata.id)
order:
$event_count desc
Painel de monitoramento de mudança de senha
Esse painel rastreia e registra as mudanças de senha e oferece uma visão abrangente dos eventos de mudança de senha, incluindo data e hora. Ele mostra tendências, identifica riscos, como endereços IP, usuários e locais suspeitos, e ajuda a detectar e responder a possíveis incidentes de segurança, como mudanças não autorizadas de senha.
Os 10 principais IPs de origem por usuário
As 10 principais redefinições de senha
Eventos ao longo do tempo por tipo de registro
Eventos por ação
Mapa de calor de geolocalização de origem
10 principais usuários por ação
Descrição dos 10 principais eventos
Alteração recente de senha do usuário (24 horas)
Eventos por gravidade
Nome do gráfico
Exemplo de consulta
Os 10 principais IPs de origem por usuário
metadata.event_type = "USER_CHANGE_PASSWORD"
$Source_IP = strings.coalesce(principal.ip, principal.asset.ip)
$Source_IP != ""
$User = strings.coalesce(principal.user.userid, principal.user.user_display_name, principal.user.email_addresses,target.user.userid,target.user.user_display_name,target.user.email_addresses )
match :
$Source_IP,$User
outcome :
$Count = count(metadata.id)
order :
$Count desc
limit:10
As 10 principais redefinições de senha
metadata.event_type = "USER_CHANGE_PASSWORD"
$Log_Type = metadata.log_type
$Password_Event_Type = metadata.product_event_type
$Description = metadata.description
($Password_Event_Type = /Reset/ nocase OR $Description = /Reset/ nocase)
$User = strings.coalesce(principal.user.userid, principal.user.user_display_name, principal.user.email_addresses,target.user.userid,target.user.user_display_name,target.user.email_addresses )
match :
$User
outcome :
$Count = count(metadata.id)
order :
$Count desc
limit: 10
Eventos ao longo do tempo por tipo de registro
metadata.event_type = "USER_CHANGE_PASSWORD"
$Log_Type = metadata.log_type
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
match :
$Date,$Log_Type
outcome :
$Count = count(metadata.id)
Eventos por ação
metadata.event_type = "USER_CHANGE_PASSWORD"
$Action = security_result.action
match :
$Action
outcome :
$Count = count(metadata.id)
Mapa de calor de geolocalização de origem
metadata.event_type = "USER_CHANGE_PASSWORD"
$Country = principal.ip_geo_artifact.location.country_or_region
match :
$Country
outcome :
$Count = count(metadata.id)
$Latitude = max(principal.ip_geo_artifact.location.region_coordinates.latitude)
$Longitude = max(principal.ip_geo_artifact.location.region_coordinates.longitude)
order :
$Count desc
10 principais usuários por ação
metadata.event_type = "USER_CHANGE_PASSWORD"
$User = strings.coalesce(principal.user.userid, principal.user.user_display_name, principal.user.email_addresses,target.user.userid,target.user.user_display_name,target.user.email_addresses )
$Action = security_result.action
match :
$User,$Action
outcome :
$Count = count(metadata.id)
order :
$Count desc
limit :
10
Descrição dos 10 principais eventos
metadata.event_type = "USER_CHANGE_PASSWORD"
$Description = strings.coalesce(metadata.description,security_result.description,metadata.product_event_type)
match :
$Description
outcome :
$Count = count(metadata.id)
order :
$Count desc
limit :
10
Alteração recente de senha do usuário (24 horas)
metadata.event_type = "USER_CHANGE_PASSWORD"
$Log_Type = metadata.log_type
$Password_Event_Type = metadata.product_event_type
$User = strings.coalesce(principal.user.userid, principal.user.user_display_name, principal.user.email_addresses,target.user.userid,target.user.user_display_name,target.user.email_addresses )
$Hostname = strings.coalesce(principal.hostname,principal.asset.hostname)
$Source_IP = strings.coalesce(principal.ip, principal.asset.ip)
match :
$User,$Hostname,$Source_IP,$Password_Event_Type,$Log_Type
outcome :
$Date = timestamp.get_timestamp(max(metadata.event_timestamp.seconds ), "%F %T")
$Count = count(metadata.id)
order :
$Count desc
Eventos por gravidade
metadata.event_type = "USER_CHANGE_PASSWORD"
$Severity = security_result.severity
match :
$Severity
outcome :
$Count = count(metadata.id)
Monitoramento de phishing
Esse painel oferece insights sobre ameaças de phishing, segurança de e-mail e tendências de ataques. Ela oferece visibilidade à equipe de segurança sobre tentativas de phishing, permitindo que as equipes monitorem atividades de e-mail maliciosas, identifiquem remetentes e usuários segmentados suspeitos e sinalizem indicadores potencialmente prejudiciais.
Observação : aplique filtros com base em tipos de registros específicos para mostrar resultados relevantes no painel.
10 principais usuários em alertas de fornecedores
Os 10 principais URLs de phishing acessados
10 principais assuntos de e-mails de phishing
Eventos por ação
Eventos ao longo do tempo por tipo de registro
Total de eventos de phishing detectados
10 principais domínios associados
Alertas de fornecedores ao longo do tempo por ação
Eventos de phishing recentes
10 principais alertas de fornecedores
10 principais nomes de ameaças
Eventos ao longo do tempo por ação
10 principais remetentes de e-mails de phishing
Detalhes do arquivo de phishing
Eventos por tipo de arquivo
Alertas do fornecedor ao longo do tempo por tipo de registro
10 principais URLs de phishing
10 principais destinatários de e-mails de phishing
Visão geral da geolocalização de origem
Eventos por gravidade
Nome do gráfico
Exemplo de consulta
10 principais usuários em alertas de fornecedores
(security_result.category = "MAIL_PHISHING" or re.regex(security_result.threat_name,`Phish`) nocase or re.regex(security_result.category_details,`Phish`)nocase)
security_result.threat_name != "NOT_PHISHING"
security_result.rule_name != ""
$User = strings.coalesce(network.email.from, principal.user.userid, principal.user.user_display_name, principal.user.email_addresses, target.user.userid, target.user.user_display_name, target.user.email_addresses)
match:
$User
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
Os 10 principais URLs de phishing acessados
(security_result.category = "MAIL_PHISHING" or re.regex(security_result.threat_name,`Phish`) nocase or re.regex(security_result.category_details,`Phish`) nocase)
security_result.threat_name!= "NOT_PHISHING"
metadata.product_event_type = /permit/ nocase
$URL = strings.coalesce (target.url, principal.process.file.embedded_urls, security_result.about.url, network.http.referral_url, principal.url)
$URL != ""
$User = strings.coalesce(network.email.from, principal.user.userid, principal.user.user_display_name, principal.user.email_addresses, target.user.userid, target.user.user_display_name, target.user.email_addresses)
$Action = security_result.action
match:
$URL, $Action
outcome:
$User_List = array_distinct($User)
$Count = count($URL)
order:
$URL desc
//limit:
//10
10 principais assuntos de e-mails de phishing
(security_result.category = "MAIL_PHISHING" or re.regex(security_result.threat_name,`Phish`) nocase or re.regex(security_result.category_details,`Phish`) nocase)
security_result.threat_name!= "NOT_PHISHING"
$Subject = network.email.subject
$Action = security_result.action
match:
$Subject, $Action
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
Eventos por ação
(security_result.category = "MAIL_PHISHING" or re.regex(security_result.threat_name,`Phish`) nocase or re.regex(security_result.category_details,`Phish`) nocase)
security_result.threat_name != "NOT_PHISHING"
$Action = security_result.action
match:
$Action
outcome:
$Count = count(metadata.id)
order:
$Action desc
Eventos ao longo do tempo por tipo de registro
(security_result.category = "MAIL_PHISHING" or re.regex(security_result.threat_name,`Phish`) nocase or re.regex(security_result.category_details,`Phish`)nocase)
security_result.threat_name!= "NOT_PHISHING"
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
$Log_Type = metadata.log_type
match:
$Date, $Log_Type
outcome:
$Count = count(metadata.id)
order:
$Date asc
Total de eventos de phishing detectados
(security_result.category = "MAIL_PHISHING" or re.regex(security_result.threat_name,`Phish`) nocase or re.regex(security_result.category_details,`Phish`) nocase)
security_result.threat_name != "NOT_PHISHING"
outcome:
$Count = count(metadata.id)
10 principais domínios associados
(security_result.category = "MAIL_PHISHING" or re.regex(security_result.threat_name,`Phish`) nocase or re.regex(security_result.category_details,`Phish`) nocase)
security_result.threat_name!= "NOT_PHISHING"
$Domain = strings.coalesce(principal.administrative_domain, target.administrative_domain, about.administrative_domain)
$Action = security_result.action
match:
$Domain, $Action
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
Alertas de fornecedores ao longo do tempo por ação
(security_result.category = "MAIL_PHISHING" or re.regex(security_result.threat_name,`Phish`) nocase or re.regex(security_result.category_details,`Phish`)nocase)
security_result.threat_name != "NOT_PHISHING"
security_result.rule_name != ""
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
$Action = security_result.action
match:
$Date, $Action
outcome:
$Count = count(metadata.id)
order:
$Date asc
Eventos de phishing recentes
(security_result.category = "MAIL_PHISHING" or re.regex(security_result.threat_name,`Phish`) nocase or re.regex(security_result.category_details,`Phish`)nocase)
security_result.threat_name!= "NOT_PHISHING"
$Security_Event_Type = metadata.product_event_type
$Summary = strings.coalesce(security_result.summary, metadata.description, security_result.description)
$Sender = strings.coalesce(network.email.from, principal.user.email_addresses)
$Subject = network.email.subject
match:
$Security_Event_Type, $Summary, $Subject, $Sender
outcome:
$Count = count(metadata.id)
$Receiver_Count = count_distinct(strings.coalesce(network.email.to, network.email.reply_to, target.user.email_addresses))
$Date = timestamp.get_timestamp(max(metadata.event_timestamp.seconds), "%F %T")
order:
$Count desc
10 principais alertas de fornecedores
(security_result.category = "MAIL_PHISHING" or re.regex(security_result.threat_name,`Phish`) nocase or re.regex(security_result.category_details,`Phish`)nocase)
security_result.threat_name != "NOT_PHISHING"
security_result.rule_name != ""
$Rule_Name = security_result.rule_name
match:
$Rule_Name
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
10 principais nomes de ameaças
(security_result.category = "MAIL_PHISHING" or re.regex(security_result.threat_name,`Phish`) nocase or re.regex(security_result.category_details,`Phish`) nocase)
security_result.threat_name!= "NOT_PHISHING"
$Threat_Name = strings.coalesce(security_result.threat_name,security_result.category_details)
$Log_Type = metadata.log_type
match:
$Threat_Name, $Log_Type
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
Eventos ao longo do tempo por ação
(security_result.category = "MAIL_PHISHING" or re.regex(security_result.threat_name,`Phish`) nocase or re.regex(security_result.category_details,`Phish`) nocase)
security_result.threat_name != "NOT_PHISHING"
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
$Action = security_result.action
match:
$Date, $Action
outcome:
$Count = count(metadata.id)
order:
$Action asc
10 principais remetentes de e-mails de phishing
(security_result.category = "MAIL_PHISHING" or re.regex(security_result.threat_name,`Phish`) nocase or re.regex(security_result.category_details,`Phish`) nocase)
security_result.threat_name != "NOT_PHISHING"
$Sender = strings.coalesce(network.email.from,principal.user.email_addresses)
$Action = security_result.action
match:
$Sender, $Action
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
Detalhes do arquivo de phishing
(security_result.category = "MAIL_PHISHING" or re.regex(security_result.threat_name,`Phish`) nocase or re.regex(security_result.category_details,`Phish`) nocase)
security_result.threat_name!= "NOT_PHISHING"
strings.coalesce(target.file.full_path, about.file.full_path, target.file.names) != ""
$File_Path = strings.coalesce(target.file.full_path, about.file.full_path, target.file.names)
$File_Type = strings.coalesce(about.file.mime_type, target.file.mime_type)
$Action = security_result.action
$Receiver = strings.coalesce(network.email.to, network.email.reply_to,target.user.email_addresses)
$Sender = strings.coalesce(network.email.from,principal.user.email_addresses)
$File_Hash = strings.coalesce(about.file.md5, about.file.sha256, security_result.about.file.sha256)
match:
$File_Path, $File_Type, $File_Hash, $Sender, $Receiver, $Action
outcome:
$Count = count(metadata.id)
$Date = timestamp.get_timestamp(max(metadata.event_timestamp.seconds), "%F %T")
order:
$Count desc
Eventos por tipo de arquivo
(security_result.category = "MAIL_PHISHING" or re.regex(security_result.threat_name,`Phish`) nocase or re.regex(security_result.category_details,`Phish`) nocase)
security_result.threat_name!= "NOT_PHISHING"
$File_Type = strings.coalesce(about.file.mime_type, target.file.mime_type)
match:
$File_Type
outcome:
$Count = count(metadata.id)
order:
$File_Type desc
Alertas do fornecedor ao longo do tempo por tipo de registro
(security_result.category = "MAIL_PHISHING" or re.regex(security_result.threat_name,`Phish`) nocase or re.regex(security_result.category_details,`Phish`)nocase)
security_result.threat_name != "NOT_PHISHING"
security_result.rule_name != ""
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
$Log_Type = metadata.log_type
match:
$Date, $Log_Type
outcome:
$Count = count(metadata.id)
order:
$Date asc
10 principais URLs de phishing
(security_result.category = "MAIL_PHISHING" or re.regex(security_result.threat_name,`Phish`) nocase or re.regex(security_result.category_details,`Phish`) nocase)
security_result.threat_name!= "NOT_PHISHING"
$URL = strings.coalesce(target.url, security_result.about.url, network.http.referral_url, principal.process.file.embedded_urls, principal.url)
$URL != ""
match:
$URL
outcome:
$Threat_Names = array_distinct(strings.coalesce(security_result.threat_name,security_result.category_details))
$Categories = array_distinct(security_result.category)
$Count = count($URL)
order:
$Count desc
limit:
10
10 principais destinatários de e-mails de phishing
(security_result.category = "MAIL_PHISHING" or re.regex(security_result.threat_name,`Phish`) nocase or re.regex(security_result.category_details,`Phish`) nocase)
security_result.threat_name!= "NOT_PHISHING"
$Receiver = strings.coalesce(network.email.to, network.email.reply_to, target.user.email_addresses)
$Action = security_result.action
match:
$Receiver, $Action
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
Visão geral da geolocalização de origem
(security_result.category = "MAIL_PHISHING" or re.regex(security_result.threat_name,`Phish`) nocase or re.regex(security_result.category_details,`Phish`) nocase)
security_result.threat_name != "NOT_PHISHING"
$Country = principal.ip_geo_artifact.location.country_or_region
$Country != ""
match:
$Country
outcome:
$Count = count(metadata.id)
$Latitude = max(principal.ip_geo_artifact.location.region_coordinates.latitude)
$Longitude = max(principal.ip_geo_artifact.location.region_coordinates.longitude)
order:
$Count desc
Eventos por gravidade
(security_result.category = "MAIL_PHISHING" or re.regex(security_result.threat_name,`Phish`) nocase or re.regex(security_result.category_details,`Phish`) nocase)
security_result.threat_name != "NOT_PHISHING"
$Severity = security_result.severity
match:
$Severity
outcome:
$Count = count(metadata.id)
order:
$Severity desc
Detecção de verificação de portas
Esse painel fornece insights sobre atividades de varredura de portas e outras técnicas relacionadas de reconhecimento de rede que podem indicar possíveis ameaças ou atividades maliciosas na infraestrutura de rede. Ao rastrear e visualizar esse tipo de comportamento, é possível detectar, investigar e mitigar tentativas de acesso não autorizado ou suspeito à rede.
Eventos ao longo do tempo por tipo de registro
Tentativas de conexão com portas padrão que falharam recentemente
Distribuição de gravidade
Eventos de verificação de porta ao longo do tempo por usuário
10 principais IPs de destino
Eventos recentes de verificação de porta
Os 10 principais países de origem
As 10 principais sub-redes internas segmentadas
Tentativas recentes de conexão com falha em portas não padrão
10 principais portas de destino
As 10 principais origens de verificação de porta
10 principais IPs de origem
Proporção porta/IP
Distribuição de protocolo
Eventos de verificação de porta ao longo do tempo por nome de host
Nome do gráfico
Exemplo de consulta
Eventos ao longo do tempo por tipo de registro
metadata.event_type = "SCAN_NETWORK"
or strings.coalesce(security_result.threat_name, security_result.rule_name, security_result.description, security_result.summary, metadata.product_event_type, metadata.description) = /port(?:\s|\_)?scan(?:ning|ner)?/ nocase
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
$Log_Type = metadata.log_type
match:
$Date, $Log_Type
outcome:
$Count = count(metadata.id)
order:
$Date desc
Tentativas de conexão com portas padrão que falharam recentemente
metadata.event_type = "NETWORK_UNCATEGORIZED"
or metadata.event_type = "NETWORK_FLOW"
or metadata.event_type = "NETWORK_CONNECTION"
or metadata.event_type = "NETWORK_FTP"
or metadata.event_type = "NETWORK_DHCP"
or metadata.event_type = "NETWORK_DNS"
or metadata.event_type = "NETWORK_HTTP"
or metadata.event_type = "NETWORK_SMTP"
security_result.action = "BLOCK"
target.port > 19
target.port < 1025
$Date = timestamp.get_timestamp(metadata.event_timestamp.seconds, "%F %T ")
$Principal_IP = principal.ip
$Target_IP = target.ip
$Protocol = network.ip_protocol
$Port = target.port
match:
$Date, $Principal_IP, $Protocol, $Port, $Target_IP
order:
$Date desc
Distribuição de gravidade
metadata.event_type = "SCAN_NETWORK"
or strings.coalesce(security_result.threat_name, security_result.rule_name, security_result.description, security_result.summary, metadata.product_event_type, metadata.description) = /port(?:\s|\_)?scan(?:ning|ner)?/ nocase
$Severity = security_result.severity
match:
$Severity
outcome:
$Count = count(metadata.id)
order:
$Count desc
Eventos de verificação de porta ao longo do tempo por usuário
metadata.event_type = "SCAN_NETWORK"
or strings.coalesce(security_result.threat_name, security_result.rule_name, security_result.description, security_result.summary, metadata.product_event_type, metadata.description) = /port(?:\s|\_)?scan(?:ning|ner)?/ nocase
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
$User = group(principal.user.userid, principal.user.email_addresses, target.user.userid, target.user.email_addresses)
match:
$Date, $User
outcome:
$Count = count(metadata.id)
order:
$Date desc
10 principais IPs de destino
metadata.event_type = "SCAN_NETWORK"
or strings.coalesce(security_result.threat_name, security_result.rule_name, security_result.description, security_result.summary, metadata.product_event_type, metadata.description) = /port(?:\s|\_)?scan(?:ning|ner)?/ nocase
$IP_Address = target.ip
$Log_Type = metadata.log_type
match:
$IP_Address, $Log_Type
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
Eventos recentes de verificação de porta
metadata.event_type = "SCAN_NETWORK"
or strings.coalesce(security_result.threat_name, security_result.rule_name, security_result.description, security_result.summary, metadata.product_event_type, metadata.description) = /port(?:\s|\_)?scan(?:ning|ner)?/ nocase
principal.ip != ""
target.ip != ""
$Date = timestamp.get_timestamp(metadata.event_timestamp.seconds, "%F %T ")
$Description = strings.coalesce(security_result.threat_name, security_result.rule_name, security_result.description, security_result.summary, metadata.product_event_type, metadata.description)
$Source_IP = principal.ip
$Target_IP = target.ip
match:
$Date, $Source_IP, $Description, $Target_IP
outcome:
$Port = array_distinct(target.port)
order:
$Date desc
Os 10 principais países de origem
metadata.event_type = "SCAN_NETWORK"
or strings.coalesce(security_result.threat_name, security_result.rule_name, security_result.description, security_result.summary, metadata.product_event_type, metadata.description) = /port(?:\s|\_)?scan(?:ning|ner)?/ nocase
$Country = principal.location.country_or_region
$Country != ""
match:
$Country
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
As 10 principais sub-redes internas segmentadas
metadata.event_type = "SCAN_NETWORK"
or strings.coalesce(security_result.threat_name, security_result.rule_name, security_result.description, security_result.summary, metadata.product_event_type, metadata.description) = /port(?:\s|\_)?scan(?:ning|ner)?/ nocase
net.ip_in_range_cidr(target.ip, "10.0.0.0/8")
or net.ip_in_range_cidr(target.ip, "172.16.0.0/12")
or net.ip_in_range_cidr(target.ip, "192.168.0.0/16")
or net.ip_in_range_cidr(target.ip, "fc00::/7")
$IP_Range = if(net.ip_in_range_cidr(target.ip, "192.168.0.0/16"), strings.concat(re.capture(target.ip, /^\d+\.\d+\.\d+\./), "0/16"),
if(net.ip_in_range_cidr(target.ip, "172.16.0.0/12"), strings.concat(re.capture(target.ip, /^\d+\.\d+\./), "0.0/12"),
if(net.ip_in_range_cidr(target.ip, "10.0.0.0/8"), strings.concat(re.capture(target.ip, /^\d+\./), "0.0.0/8"),
if(net.ip_in_range_cidr(target.ip, "fc00::/7"), strings.concat(re.capture(target.ip, /^(?:[0-9A-Fa-f]{1,4}:){3}[0-9A-Fa-f]{1,4}/), "/64"), "Unknown IP address range"))))
match:
$IP_Range
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
Tentativas recentes de conexão com falha em portas não padrão
metadata.event_type = "NETWORK_UNCATEGORIZED"
or metadata.event_type = "NETWORK_FLOW"
or metadata.event_type = "NETWORK_CONNECTION"
security_result.action = "BLOCK"
target.port < 19
or target.port > 1025
$Date = timestamp.get_timestamp(metadata.event_timestamp.seconds, "%F %T ")
$Principal_IP = principal.ip
$Target_IP = target.ip
$Protocol = network.ip_protocol
$Port = target.port
match:
$Date, $Principal_IP, $Protocol, $Port, $Target_IP
order:
$Date desc
10 principais portas de destino
metadata.event_type = "SCAN_NETWORK"
or strings.coalesce(security_result.threat_name, security_result.rule_name, security_result.description, security_result.summary, metadata.product_event_type, metadata.description) = /port(?:\s|\_)?scan(?:ning|ner)?/ nocase
$Port = strings.concat(target.port, " ")
$Log_Type = metadata.log_type
match:
$Port, $Log_Type
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
As 10 principais origens de verificação de porta
metadata.event_type = "SCAN_NETWORK"
or strings.coalesce(security_result.threat_name, security_result.rule_name, security_result.description, security_result.summary, metadata.product_event_type, metadata.description) = /port(?:\s|\_)?scan(?:ning|ner)?/ nocase
$Country = principal.location.country_or_region
$Latitude = principal.location.region_coordinates.latitude
$Latitude != 0
$Longitude = principal.location.region_coordinates.longitude
$Longitude != 0
match:
$Country, $Latitude, $Longitude
outcome:
$Count = count(metadata.id)
order:
$Count desc
10 principais IPs de origem
metadata.event_type = "SCAN_NETWORK"
or strings.coalesce(security_result.threat_name, security_result.rule_name, security_result.description, security_result.summary, metadata.product_event_type, metadata.description) = /port(?:\s|\_)?scan(?:ning|ner)?/ nocase
$IP_Address = principal.ip
$Log_Type = metadata.log_type
match:
$IP_Address, $Log_Type
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
Proporção porta/IP
metadata.event_type = "SCAN_NETWORK"
or strings.coalesce(security_result.threat_name, security_result.rule_name, security_result.description, security_result.summary, metadata.product_event_type, metadata.description) = /port(?:\s|\_)?scan(?:ning|ner)?/ nocase
$Port = target.port
$Source_IP = principal.ip
outcome:
$Ratio = math.round(count_distinct(target.port) / count_distinct(principal.ip), 2)
Distribuição de protocolo
metadata.event_type = "SCAN_NETWORK"
or strings.coalesce(security_result.threat_name, security_result.rule_name, security_result.description, security_result.summary, metadata.product_event_type, metadata.description) = /port(?:\s|\_)?scan(?:ning|ner)?/ nocase
$Protocol = network.ip_protocol
match:
$Protocol
outcome:
$Count = count(metadata.id)
order:
$Count desc
Eventos de verificação de porta ao longo do tempo por nome de host
metadata.event_type = "SCAN_NETWORK"
or strings.coalesce(security_result.threat_name, security_result.rule_name, security_result.description, security_result.summary, metadata.product_event_type, metadata.description) = /port(?:\s|\_)?scan(?:ning|ner)?/ nocase
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
$Hostname = group(principal.hostname, target.hostname)
match:
$Date, $Hostname
outcome:
$Count = count(metadata.id)
order:
$Date desc
Visão geral de porta e protocolo
Esse painel oferece insights em tempo real e históricos sobre a atividade da porta de rede e o uso do protocolo. Ele identifica portas ativas e inativas, possíveis vulnerabilidades e ajuda a otimizar a segurança e o desempenho da rede, garantindo a conformidade com as políticas.
Nova atividade de porta: entrada
Tráfego de portas permitidas x bloqueadas
10 principais portas por tráfego de saída
Distribuição de protocolo
Tráfego em portas comumente proibidas
10 principais portas por tráfego de entrada
Nome do gráfico
Exemplo de consulta
Nova atividade de porta: entrada
$event_type = metadata.event_type
$event_type >= 16000 and $event_type <= 16007
$Direction = network.direction
$Direction = "INBOUND"
$policy = security_result.rule_name
$port = strings.concat(target.port, "")
$port != /(40202|40203|40462|41611|41612|41620|41629|41674|41684|41685|41694|41703|41712|41721|41730|41747|43448|44924|44925|45071|52818|53025|54736|443|57903|58254|62977|80|88)/
$source_ip = principal.ip
$location = principal.ip_geo_artifact.location.country_or_region
$action = security_result.action
$action != "BLOCK"
match:
$port, $action
outcome:
$Source_IP = array_distinct($source_ip)
$event_count = count(metadata.id)
order:
$event_count desc
Tráfego de portas permitidas x bloqueadas
$event_type = metadata.event_type
$event_type >= 16000 and $event_type <= 16007
$action = security_result.action
$action != "UNKNOWN_ACTION"
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
match:
$action, $Date
outcome:
$Event_Count = count(metadata.id)
order:
$Date asc
10 principais portas por tráfego de saída
$event_type = metadata.event_type
$event_type >= 16000 and $event_type <= 16007
$Logtype = metadata.log_type
$Direction = network.direction
$Direction = "OUTBOUND"
$Port = target.port
match:
$Port
outcome:
$event_count = count(metadata.id)
$logtype = array_distinct($Logtype)
order:
$event_count desc
limit:
10
Distribuição de protocolo
$event_type = metadata.event_type
$event_type >= 16000 and $event_type <= 16007
$Protocol = network.ip_protocol
$Protocol != "UNKNOWN_IP_PROTOCOL"
match:
$Protocol
outcome:
$Event_Count = count(metadata.id)
Distribuição de protocolo
$event_type = metadata.event_type
$event_type >= 16000 and $event_type <= 16007
$Protocol = network.ip_protocol
$Protocol != "UNKNOWN_IP_PROTOCOL"
match:
$Protocol
outcome:
$Event_Count = count(metadata.id)
Tráfego em portas comumente proibidas
$event_type = metadata.event_type
$event_type >= 16000 and $event_type <= 16007
$policy = security_result.rule_name
$port = strings.concat(target.port, "")
$port != /(443|53|8080|8081|34622|34756|35406|35466|35546|36602|37276|38976|41394|41672|41926|45432|46354|47416|48678|51664|51824|52086|52818|54052|54958|55276|55890|57488|57666|58546|58914|59388|60388|61000|64450|64482|64498|64598|64674|64707|64735|64739|64740|64795|64828|64880|64905|64945|64962|65004|65019|65050|65094|65114|65169|65202|65223|65264|65287|65323|65346|65378|65392|65456|8728|3389|6379|5555|2222|5060|3128|8888|27017|8088|1080)/
match:
$port
outcome:
$event_count = count(metadata.id)
order:
$event_count desc
limit:
20
10 principais portas por tráfego de entrada
$event_type = metadata.event_type
$event_type >= 16000 and $event_type <= 16007
$Direction = network.direction
$Direction = "INBOUND"
$Port = target.port
$Logtype = metadata.log_type
match:
$Port
outcome:
$event_count = count(metadata.id)
$logtype = array_distinct($Logtype)
order:
$event_count desc
limit:
10
Tráfego em portas comumente proibidas
$event_type = metadata.event_type
$event_type >= 16000 and $event_type <= 16007
$policy = security_result.rule_name
$port = strings.concat(target.port, "")
$port != /(443|53|8080|8081|34622|34756|35406|35466|35546|36602|37276|38976|41394|41672|41926|45432|46354|47416|48678|51664|51824|52086|52818|54052|54958|55276|55890|57488|57666|58546|58914|59388|60388|61000|64450|64482|64498|64598|64674|64707|64735|64739|64740|64795|64828|64880|64905|64945|64962|65004|65019|65050|65094|65114|65169|65202|65223|65264|65287|65323|65346|65378|65392|65456|8728|3389|6379|5555|2222|5060|3128|8888|27017|8088|1080)/
match:
$port
outcome:
$event_count = count(metadata.id)
order:
$event_count desc
limit:
20
10 principais portas por tráfego de saída
$event_type = metadata.event_type
$event_type >= 16000 and $event_type <= 16007
$Logtype = metadata.log_type
$Direction = network.direction
$Direction = "OUTBOUND"
$Port = target.port
match:
$Port
outcome:
$event_count = count(metadata.id)
$logtype = array_distinct($Logtype)
order:
$event_count desc
limit:
10
Tráfego de portas permitidas x bloqueadas
$event_type = metadata.event_type
$event_type >= 16000 and $event_type <= 16007
$action = security_result.action
$action != "UNKNOWN_ACTION"
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
match:
$action, $Date
outcome:
$Event_Count = count(metadata.id)
order:
$Date asc
10 principais portas por tráfego de entrada
$event_type = metadata.event_type
$event_type >= 16000 and $event_type <= 16007
$Direction = network.direction
$Direction = "INBOUND"
$Port = target.port
$Logtype = metadata.log_type
match:
$Port
outcome:
$event_count = count(metadata.id)
$logtype = array_distinct($Logtype)
order:
$event_count desc
limit:
10
Nova atividade de porta: entrada
$event_type = metadata.event_type
$event_type >= 16000 and $event_type <= 16007
$Direction = network.direction
$Direction = "INBOUND"
$policy = security_result.rule_name
$port = strings.concat(target.port, "")
$port != /(40202|40203|40462|41611|41612|41620|41629|41674|41684|41685|41694|41703|41712|41721|41730|41747|43448|44924|44925|45071|52818|53025|54736|443|57903|58254|62977|80|88)/
$source_ip = principal.ip
$location = principal.ip_geo_artifact.location.country_or_region
$action = security_result.action
$action != "BLOCK"
match:
$port, $action
outcome:
$Source_IP = array_distinct($source_ip)
$event_count = count(metadata.id)
order:
$event_count desc
PowerShell
Ele foi projetado para analisar e monitorar a atividade do PowerShell na sua organização. Ele fornece insights sobre a execução de comandos, interações do usuário e possíveis riscos à segurança. Ao agregar e visualizar esses dados, o painel ajuda a identificar possíveis problemas, rastrear ameaças e melhorar a segurança geral.
Execução do PowerShell por tipo de evento de processo
Caminhos de arquivos menos comuns
Hosts menos comuns
Linhas de comando menos comuns
10 principais usuários
Eventos do PowerShell por ação de resultado de segurança
Usuários menos comuns
Conexões de rede de saída do PowerShell
Resumo da atividade do PowerShell
As 10 principais linhas de comando
Eventos do PowerShell por gravidade
Ofuscação de variáveis de caracteres
10 principais hosts
Downloads de arquivos via PowerShell
10 principais tipos de eventos que contêm PowerShell
Os 10 principais caminhos de arquivos
Nome do gráfico
Exemplo de consulta
Execução do PowerShell por tipo de evento de processo
$event.metadata.event_type = "PROCESS_UNCATEGORIZED"
or $event.metadata.event_type = "PROCESS_LAUNCH"
or $event.metadata.event_type = "PROCESS_INJECTION"
or $event.metadata.event_type = "PROCESS_PRIVILEGE_ESCALATION"
or $event.metadata.event_type = "PROCESS_TERMINATION"
or $event.metadata.event_type = "PROCESS_OPEN"
or $event.metadata.event_type = "PROCESS_MODULE_LOAD"
$Command_Line = group($event.principal.process.command_line, $event.target.process.command_line)
$Command_Line = /(?:pwsh|powershell(?:_ise)?)\.exe/ nocase
$Event_Type = $event.metadata.event_type
$Date = timestamp.get_date($event.metadata.event_timestamp.seconds)
match:
$Event_Type, $Date
outcome:
$Count = count($event.metadata.id)
order:
$Count desc
limit:
10
Caminhos de arquivos menos comuns
$event.principal.process.file.full_path = /(?:pwsh|powershell(?:_ise)?)\.exe/ nocase
$Full_Path = group($event.principal.process.file.full_path, $event.target.process.file.full_path)
$Full_Path != ""
match:
$Full_Path
outcome:
$Count = count($event.metadata.id)
order:
$Count asc
limit:
100
Hosts menos comuns
$Command_Line = group($event.principal.process.command_line, $event.target.process.command_line)
$Command_Line = /(?:pwsh|powershell(?:_ise)?)\.exe/ nocase
$Hostname = $event.principal.hostname
match:
$Hostname
outcome:
$Count = count($event.metadata.id)
order:
$Count asc
limit:
100
Linhas de comando menos comuns
$Command_Line = group($event.principal.process.command_line, $event.target.process.command_line)
$Command_Line = /(?:pwsh|powershell(?:_ise)?)\.exe/ nocase
match:
$Command_Line
outcome:
$Count = count($event.metadata.id)
order:
$Count asc
limit:
10
Linhas de comando menos comuns
$Command_Line = group($event.principal.process.command_line, $event.target.process.command_line)
$Command_Line = /(?:pwsh|powershell(?:_ise)?)\.exe/ nocase
match:
$Command_Line
outcome:
$Count = count($event.metadata.id)
order:
$Count asc
limit:
10
10 principais usuários
$event.principal.user.userid != /\$$/
$Command_Line = group($event.principal.process.command_line, $event.target.process.command_line)
$Command_Line = /(?:pwsh|powershell(?:_ise)?)\.exe/ nocase
$User = $event.principal.user.userid
$User != ""
match:
$User
outcome:
$Count = count($event.metadata.id)
order:
$Count desc
limit:
10
PowerShell Events by Security Result Action
$Powershell = group($event.principal.process.command_line, $event.target.process.command_line)
$Powershell = /(?:pwsh|powershell(?:_ise)?)\.exe/ nocase
$Action = $event.security_result.action
match:
$Action
outcome:
$Count = count($event.security_result.action)
order:
$Count desc
PowerShell Events by Security Result Action
$Powershell = group($event.principal.process.command_line, $event.target.process.command_line)
$Powershell = /(?:pwsh|powershell(?:_ise)?)\.exe/ nocase
$Action = $event.security_result.action
match:
$Action
outcome:
$Count = count($event.security_result.action)
order:
$Count desc
Least Common Users
$event.principal.user.userid != /\$$/
$Command_Line = group($event.principal.process.command_line, $event.target.process.command_line)
$Command_Line = /(?:pwsh|powershell(?:_ise)?)\.exe/ nocase
$User = $event.principal.user.userid
match:
$User
outcome:
$Count = count($event.metadata.id)
order:
$Count asc
limit:
100
Conexões de rede de saída do PowerShell
$event.metadata.event_type = "NETWORK_CONNECTION"
$event.network.direction = "OUTBOUND"
$Command_Line = group($event.principal.process.command_line, $event.target.process.command_line)
$Command_Line = /(?:pwsh|powershell(?:_ise)?)\.exe/ nocase
$Destination_IP = $event.target.ip
$Source_IP = $event.principal.ip
$Direction = $event.network.direction
match:
$Source_IP, $Direction, $Destination_IP, $Command_Line
outcome:
$Count = count($event.metadata.id)
order:
$Count desc
limit:
50
Conexões de rede de saída do PowerShell
$event.metadata.event_type = "NETWORK_CONNECTION"
$event.network.direction = "OUTBOUND"
$Command_Line = group($event.principal.process.command_line, $event.target.process.command_line)
$Command_Line = /(?:pwsh|powershell(?:_ise)?)\.exe/ nocase
$Destination_IP = $event.target.ip
$Source_IP = $event.principal.ip
$Direction = $event.network.direction
match:
$Source_IP, $Direction, $Destination_IP, $Command_Line
outcome:
$Count = count($event.metadata.id)
order:
$Count desc
limit:
50
Resumo da atividade do PowerShell
$Command_Line = group($event.principal.process.command_line, $event.target.process.command_line)
$Command_Line = /(?:pwsh|powershell(?:_ise)?)\.exe/ nocase
$Event_Type = $event.metadata.event_type
$Log_Type = $event.metadata.log_type
$Direction = $event.network.direction
match:
$Event_Type, $Log_Type, $Direction, $Command_Line
outcome:
$Count = count($event.metadata.id)
order:
$Count desc
limit:
50
As 10 principais linhas de comando
$Command_Line = group($event.principal.process.command_line, $event.target.process.command_line)
$Command_Line = /(?:pwsh|powershell(?:_ise)?)\.exe/ nocase
match:
$Command_Line
outcome:
$Count = count($event.metadata.id)
order:
$Count desc
limit:
10
Eventos do PowerShell por gravidade
$Powershell = group($event.principal.process.command_line, $event.target.process.command_line)
$Powershell = /(?:pwsh|powershell(?:_ise)?)\.exe/ nocase
$Severity = $event.security_result.severity
match:
$Severity
outcome:
$Count = count($event.security_result.severity)
order:
$Count desc
Execução do PowerShell por tipo de evento de processo
$event.metadata.event_type = "PROCESS_UNCATEGORIZED"
or $event.metadata.event_type = "PROCESS_LAUNCH"
or $event.metadata.event_type = "PROCESS_INJECTION"
or $event.metadata.event_type = "PROCESS_PRIVILEGE_ESCALATION"
or $event.metadata.event_type = "PROCESS_TERMINATION"
or $event.metadata.event_type = "PROCESS_OPEN"
or $event.metadata.event_type = "PROCESS_MODULE_LOAD"
$Command_Line = group($event.principal.process.command_line, $event.target.process.command_line)
$Command_Line = /(?:pwsh|powershell(?:_ise)?)\.exe/ nocase
$Event_Type = $event.metadata.event_type
match:
$Event_Type
outcome:
$Count = count($event.metadata.id)
order:
$Count desc
Ofuscação de variáveis de caracteres
$Command_Line = group($event.principal.process.command_line, $event.target.process.command_line)
$Command_Line = /(?:powershell(?:\.exe)?).*\[char(?:\]|\[)/ nocase
or $Command_Line = /(?:powershell(?:\.exe)?).*(?:iex|invoke-expression)/ nocase
or $Command_Line = /(?:powershell(?:\.exe)?).*(?:tochararray)/ nocase
$Registry_Value = $event.target.registry.registry_value_data
match:
$Command_Line, $Registry_Value
outcome:
$Count = count($event.metadata.id)
limit:
50
Top 10 Hosts
$Command_Line = group($event.principal.process.command_line, $event.target.process.command_line)
$Command_Line = /(?:pwsh|powershell(?:_ise)?)\.exe/ nocase
$Hostname = $event.principal.hostname
$Hostname != ""
match:
$Hostname
outcome:
$Count = count($event.metadata.id)
order:
$Count desc
limit:
10
Top 10 Users
$event.principal.user.userid != /\$$/
$Command_Line = group($event.principal.process.command_line, $event.target.process.command_line)
$Command_Line = /(?:pwsh|powershell(?:_ise)?)\.exe/ nocase
$User = $event.principal.user.userid
match:
$User
outcome:
$Count = count($event.metadata.id)
order:
$Count desc
limit:
10
File Downloads via PowerShell
$Command_Line = group($event.principal.process.command_line, $event.target.process.command_line)
$Command_Line = /(?:powershell(?:\.exe)?).*?(?:Invoke\-(?:WebRequest|RestMethod)|Start\-BitsTransfer)/ nocase
or $Command_Line = /(?:powershell(?:\.exe)?).*?(?:system\.net\.(?:http\.httpclient|webclient).*?(?:downloadfile|writeallbytes))/ nocase
match:
$Command_Line
outcome:
$Count = count($event.metadata.id)
limit:
50
Top 10 Event Types Containing PowerShell
$Command_Line = group($event.principal.process.command_line, $event.target.process.command_line)
$Command_Line = /(?:pwsh|powershell(?:_ise)?)\.exe/ nocase
$Event_Type = $event.metadata.event_type
match:
$Event_Type
outcome:
$Count = count($event.metadata.id)
order:
$Count desc
limit:
10
Powershell Activity Summary
$Command_Line = group($event.principal.process.command_line, $event.target.process.command_line)
$Command_Line = /(?:pwsh|powershell(?:_ise)?)\.exe/ nocase
$Event_Type = $event.metadata.event_type
$Log_Type = $event.metadata.log_type
$Direction = $event.network.direction
match:
$Event_Type, $Log_Type, $Direction, $Command_Line
outcome:
$Count = count($event.metadata.id)
order:
$Count desc
limit:
50
Top 10 Command Lines
$Command_Line = group($event.principal.process.command_line, $event.target.process.command_line)
$Command_Line = /(?:pwsh|powershell(?:_ise)?)\.exe/ nocase
match:
$Command_Line
outcome:
$Count = count($event.metadata.id)
order:
$Count desc
limit:
10
Least Common Users
$event.principal.user.userid != /\$$/
$Command_Line = group($event.principal.process.command_line, $event.target.process.command_line)
$Command_Line = /(?:pwsh|powershell(?:_ise)?)\.exe/ nocase
$User = $event.principal.user.userid
match:
$User
outcome:
$Count = count($event.metadata.id)
order:
$Count asc
limit:
100
Top 10 Hosts
$Command_Line = group($event.principal.process.command_line, $event.target.process.command_line)
$Command_Line = /(?:pwsh|powershell(?:_ise)?)\.exe/ nocase
$Hostname = $event.principal.hostname
match:
$Hostname
outcome:
$Count = count($event.metadata.id)
order:
$Count desc
limit:
10
Top 10 Event Types Containing PowerShell
$Command_Line = group($event.principal.process.command_line, $event.target.process.command_line)
$Command_Line = /(?:pwsh|powershell(?:_ise)?)\.exe/ nocase
$Event_Type = $event.metadata.event_type
match:
$Event_Type
outcome:
$Count = count($event.metadata.id)
order:
$Count desc
limit:
10
Least Common File Paths
$event.principal.process.file.full_path = /(?:pwsh|powershell(?:_ise)?)\.exe/ nocase
$Full_Path = group($event.principal.process.file.full_path, $event.target.process.file.full_path)
$Full_Path != ""
match:
$Full_Path
outcome:
$Count = count($event.metadata.id)
order:
$Count asc
limit:
100
Powershell Execution by Process Event Type
$event.metadata.event_type = "PROCESS_UNCATEGORIZED"
or $event.metadata.event_type = "PROCESS_LAUNCH"
or $event.metadata.event_type = "PROCESS_INJECTION"
or $event.metadata.event_type = "PROCESS_PRIVILEGE_ESCALATION"
or $event.metadata.event_type = "PROCESS_TERMINATION"
or $event.metadata.event_type = "PROCESS_OPEN"
or $event.metadata.event_type = "PROCESS_MODULE_LOAD"
$Command_Line = group($event.principal.process.command_line, $event.target.process.command_line)
$Command_Line = /(?:pwsh|powershell(?:_ise)?)\.exe/ nocase
$Event_Type = $event.metadata.event_type
$Date = timestamp.get_date($event.metadata.event_timestamp.seconds)
match:
$Event_Type, $Date
outcome:
$Count = count($event.metadata.id)
order:
$Count desc
limit:
10
Top 10 File Paths
$event.principal.process.file.full_path = /(?:pwsh|powershell(?:_ise)?)\.exe/ nocase
$Full_Path = group($event.principal.process.file.full_path, $event.target.process.file.full_path)
$Full_Path != ""
match:
$Full_Path
outcome:
$Count = count($event.metadata.id)
order:
$Count desc
limit:
10
Char Variable Obfuscation
$Command_Line = group($event.principal.process.command_line, $event.target.process.command_line)
$Command_Line = /(?:powershell(?:\.exe)?).*\[char(?:\]|\[)/ nocase
or $Command_Line = /(?:powershell(?:\.exe)?).*(?:iex|invoke-expression)/ nocase
or $Command_Line = /(?:powershell(?:\.exe)?).*(?:tochararray)/ nocase
$Registry_Value = $event.target.registry.registry_value_data
match:
$Command_Line, $Registry_Value
outcome:
$Count = count($event.metadata.id)
limit:
50
Downloads de arquivos via PowerShell
$Command_Line = group($event.principal.process.command_line, $event.target.process.command_line)
$Command_Line = /(?:powershell(?:\.exe)?).*?(?:Invoke\-(?:WebRequest|RestMethod)|Start\-BitsTransfer)/ nocase
or $Command_Line = /(?:powershell(?:\.exe)?).*?(?:system\.net\.(?:http\.httpclient|webclient).*?(?:downloadfile|writeallbytes))/ nocase
match:
$Command_Line
outcome:
$Count = count($event.metadata.id)
limit:
50
Execução do PowerShell por tipo de evento de processo
$event.metadata.event_type = "PROCESS_UNCATEGORIZED"
or $event.metadata.event_type = "PROCESS_LAUNCH"
or $event.metadata.event_type = "PROCESS_INJECTION"
or $event.metadata.event_type = "PROCESS_PRIVILEGE_ESCALATION"
or $event.metadata.event_type = "PROCESS_TERMINATION"
or $event.metadata.event_type = "PROCESS_OPEN"
or $event.metadata.event_type = "PROCESS_MODULE_LOAD"
$Command_Line = group($event.principal.process.command_line, $event.target.process.command_line)
$Command_Line = /(?:pwsh|powershell(?:_ise)?)\.exe/ nocase
$Event_Type = $event.metadata.event_type
match:
$Event_Type
outcome:
$Count = count($event.metadata.id)
order:
$Count desc
Eventos do PowerShell por gravidade
$Powershell = group($event.principal.process.command_line, $event.target.process.command_line)
$Powershell = /(?:pwsh|powershell(?:_ise)?)\.exe/ nocase
$Severity = $event.security_result.severity
match:
$Severity
outcome:
$Count = count($event.security_result.severity)
order:
$Count desc
Os 10 principais caminhos de arquivos
$event.principal.process.file.full_path = /(?:pwsh|powershell(?:_ise)?)\.exe/ nocase
$Full_Path = group($event.principal.process.file.full_path, $event.target.process.file.full_path)
$Full_Path != ""
match:
$Full_Path
outcome:
$Count = count($event.metadata.id)
order:
$Count desc
limit:
10
Hosts menos comuns
$Command_Line = group($event.principal.process.command_line, $event.target.process.command_line)
$Command_Line = /(?:pwsh|powershell(?:_ise)?)\.exe/ nocase
$Hostname = $event.principal.hostname
match:
$Hostname
outcome:
$Count = count($event.metadata.id)
order:
$Count asc
limit:
100
Privileged Access Management
Esse painel acompanha as atividades de acesso privilegiado, identificando fontes como usuários, nomes de hosts e endereços IP, além de destacar os principais recursos. Ele ajuda as equipes de segurança a monitorar tendências de acesso e gerenciar riscos, garantindo que apenas pessoas autorizadas acessem sistemas e dados sensíveis.
Observação : aplique filtros para mostrar resultados relevantes no painel.
Os 10 principais administradores
10 principais recursos
Eventos ao longo do tempo
As 10 principais contas de usuário
Distribuição de tipos de evento
10 principais nomes de host segmentados
10 principais IPs de origem
10 principais nomes de usuário de origem
Nome do gráfico
Exemplo de consulta
Os 10 principais administradores
principal.user.attribute.roles.type = "ADMINISTRATOR"
$Admin = principal.user.userid
match:
$Admin
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
10 principais recursos
$Asset = target.asset.hostname
$Asset != ""
match:
$Asset
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
Eventos ao longo do tempo
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
match:
$Date
outcome:
$Count = count(metadata.id)
order:
$Date desc
As 10 principais contas de usuário
$Account = target.user.userid
$Account != ""
match:
$Account
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
Distribuição de tipos de evento
$Event_Type = metadata.event_type
match:
$Event_Type
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
50
10 principais nomes de host segmentados
$Hostname = target.hostname
$Hostname != ""
match:
$Hostname
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
10 principais IPs de origem
$Source_IP = principal.ip
$Source_IP != ""
match:
$Source_IP
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
10 principais nomes de usuário de origem
$Username = principal.user.userid
$Username != ""
match:
$Username
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
Resumo do evento de processo
Esse painel oferece uma visão abrangente da atividade de rede coletando e visualizando dados sobre várias ocorrências de processos, hosts, usuários e eventos. Ele destaca métricas, gráficos e anomalias importantes para fornecer insights essenciais sobre a frequência de eventos e o desempenho do processo. É útil para monitorar proativamente a integridade do sistema, detectar possíveis ameaças à segurança por comportamento anômalo e identificar áreas que precisam de melhorias na eficiência.
Total de eventos do PowerShell
Os 10 principais processos pai
10 principais usuários
Total de eventos do shell de comandos
Total de usuários distintos
Total de eventos bloqueados
Os 10 principais eventos do PowerShell
10 principais hashes
Processar eventos
Os 10 principais comandos do shell por usuário
Processar eventos ao longo do tempo
10 principais nomes de host
Eventos de encerramento de processo ao longo do tempo
Total de eventos de processo
10 principais hosts
Total de hosts distintos
Total de nomes de host distintos
Distribuição do tipo de evento
Eventos de processo recentes
Os 10 principais eventos do shell de comando
Nome do gráfico
Exemplo de consulta
Total de eventos do PowerShell
$event.metadata.event_type = "PROCESS_UNCATEGORIZED"
or $event.metadata.event_type = "PROCESS_LAUNCH"
or $event.metadata.event_type = "PROCESS_INJECTION"
or $event.metadata.event_type = "PROCESS_PRIVILEGE_ESCALATION"
or $event.metadata.event_type = "PROCESS_TERMINATION"
or $event.metadata.event_type = "PROCESS_OPEN"
or $event.metadata.event_type = "PROCESS_MODULE_LOAD"
$Powershell = group($event.principal.process.command_line, $event.target.process.command_line)
$Powershell = /(?:pwsh|powershell(?:_ise)?)\.exe/ nocase
outcome:
$Count = count($Powershell)
Os 10 principais processos pai
metadata.event_type = "PROCESS_UNCATEGORIZED"
or metadata.event_type = "PROCESS_LAUNCH"
or metadata.event_type = "PROCESS_INJECTION"
or metadata.event_type = "PROCESS_PRIVILEGE_ESCALATION"
or metadata.event_type = "PROCESS_TERMINATION"
or metadata.event_type = "PROCESS_OPEN"
or metadata.event_type = "PROCESS_MODULE_LOAD"
$Event_Type = metadata.event_type
$Parent_Process = re.capture(principal.process.file.full_path, `\w+.exe$`)
$Parent_Process != ""
match:
$Parent_Process, $Event_Type
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
10 principais usuários
$event.metadata.event_type = "PROCESS_UNCATEGORIZED"
or $event.metadata.event_type = "PROCESS_LAUNCH"
or $event.metadata.event_type = "PROCESS_INJECTION"
or $event.metadata.event_type = "PROCESS_PRIVILEGE_ESCALATION"
or $event.metadata.event_type = "PROCESS_TERMINATION"
or $event.metadata.event_type = "PROCESS_OPEN"
or $event.metadata.event_type = "PROCESS_MODULE_LOAD"
$Event_Type = $event.metadata.event_type
$User = strings.concat($event.principal.user.userid, " ")
match:
$User, $Event_Type
outcome:
$Count = count($event.metadata.id)
order:
$Count desc
limit:
10
Total de eventos do shell de comandos
metadata.event_type = "PROCESS_UNCATEGORIZED"
or metadata.event_type = "PROCESS_LAUNCH"
or metadata.event_type = "PROCESS_INJECTION"
or metadata.event_type = "PROCESS_PRIVILEGE_ESCALATION"
or metadata.event_type = "PROCESS_TERMINATION"
or metadata.event_type = "PROCESS_OPEN"
or metadata.event_type = "PROCESS_MODULE_LOAD"
$Command_Shell = principal.process.command_line
$Command_Shell = /(?:cmd|shell)\.exe/ nocase or $Command_Shell = /\/(bash|sh|zsh)/ nocase
outcome:
$Count = count($Command_Shell)
Total de usuários distintos
$event.metadata.event_type = "PROCESS_UNCATEGORIZED"
or $event.metadata.event_type = "PROCESS_LAUNCH"
or $event.metadata.event_type = "PROCESS_INJECTION"
or $event.metadata.event_type = "PROCESS_PRIVILEGE_ESCALATION"
or $event.metadata.event_type = "PROCESS_TERMINATION"
or $event.metadata.event_type = "PROCESS_OPEN"
or $event.metadata.event_type = "PROCESS_MODULE_LOAD"
outcome:
$Count = count_distinct($event.principal.user.userid)
Total de eventos bloqueados
$event.metadata.event_type = "PROCESS_UNCATEGORIZED"
or $event.metadata.event_type = "PROCESS_LAUNCH"
or $event.metadata.event_type = "PROCESS_INJECTION"
or $event.metadata.event_type = "PROCESS_PRIVILEGE_ESCALATION"
or $event.metadata.event_type = "PROCESS_TERMINATION"
or $event.metadata.event_type = "PROCESS_OPEN"
or $event.metadata.event_type = "PROCESS_MODULE_LOAD"
$event.security_result.action = "BLOCK"
outcome:
$Count = count($event.metadata.id)
Total de eventos do PowerShell
metadata.event_type = "PROCESS_UNCATEGORIZED"
or metadata.event_type = "PROCESS_LAUNCH"
or metadata.event_type = "PROCESS_INJECTION"
or metadata.event_type = "PROCESS_PRIVILEGE_ESCALATION"
or metadata.event_type = "PROCESS_TERMINATION"
or metadata.event_type = "PROCESS_OPEN"
or metadata.event_type = "PROCESS_MODULE_LOAD"
$Powershell = group(principal.process.command_line, target.process.command_line)
$Powershell = /(?:pwsh|powershell(?:_ise)?)\.exe/ nocase
outcome:
$Count = count($Powershell)
Os 10 principais eventos do PowerShell
$event.metadata.event_type = "PROCESS_UNCATEGORIZED"
or $event.metadata.event_type = "PROCESS_LAUNCH"
or $event.metadata.event_type = "PROCESS_INJECTION"
or $event.metadata.event_type = "PROCESS_PRIVILEGE_ESCALATION"
or $event.metadata.event_type = "PROCESS_TERMINATION"
or $event.metadata.event_type = "PROCESS_OPEN"
or $event.metadata.event_type = "PROCESS_MODULE_LOAD"
$Powershell = group($event.principal.process.command_line, $event.target.process.command_line)
$Powershell = /(?:pwsh|powershell(?:_ise)?)\.exe/ nocase
match:
$Powershell
outcome:
$Count = count($event.metadata.id)
order:
$Count desc
limit:
10
10 principais hashes
metadata.event_type = "PROCESS_UNCATEGORIZED"
or metadata.event_type = "PROCESS_LAUNCH"
or metadata.event_type = "PROCESS_INJECTION"
or metadata.event_type = "PROCESS_PRIVILEGE_ESCALATION"
or metadata.event_type = "PROCESS_TERMINATION"
or metadata.event_type = "PROCESS_OPEN"
or metadata.event_type = "PROCESS_MODULE_LOAD"
$Event_Type = metadata.event_type
$Hash = group(principal.process.file.md5, principal.process.file.sha1, principal.process.file.sha256, target.process.file.md5, target.process.file.sha1, target.process.file.sha256)
$Hash != ""
match:
$Hash, $Event_Type
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
Processar eventos
$event.metadata.event_type = "PROCESS_UNCATEGORIZED"
or $event.metadata.event_type = "PROCESS_LAUNCH"
or $event.metadata.event_type = "PROCESS_INJECTION"
or $event.metadata.event_type = "PROCESS_PRIVILEGE_ESCALATION"
or $event.metadata.event_type = "PROCESS_TERMINATION"
or $event.metadata.event_type = "PROCESS_OPEN"
or $event.metadata.event_type = "PROCESS_MODULE_LOAD"
$Hostname = $event.principal.hostname
$User = $event.principal.user.userid
$Parent_Process = $event.principal.process.file.full_path
$Parent_Command_Line = $event.principal.process.command_line
$Target_Process = $event.target.process.file.full_path
$Target_Command_Line = $event.target.process.command_line
match:
$Hostname, $User, $Parent_Process, $Parent_Command_Line, $Target_Process, $Target_Command_Line
outcome:
$Time = timestamp.get_timestamp(max($event.metadata.event_timestamp.seconds))
order:
$Time desc
limit:
50
Os 10 principais comandos do shell por usuário
metadata.event_type = "PROCESS_UNCATEGORIZED"
or metadata.event_type = "PROCESS_LAUNCH"
or metadata.event_type = "PROCESS_INJECTION"
or metadata.event_type = "PROCESS_PRIVILEGE_ESCALATION"
or metadata.event_type = "PROCESS_TERMINATION"
or metadata.event_type = "PROCESS_OPEN"
or metadata.event_type = "PROCESS_MODULE_LOAD"
$Shell = principal.process.command_line
$Shell = /(?:pwsh|powershell(?:_ise)?)\.exe/ nocase
or $Shell = /(?:cmd|shell)\.exe/ nocase
or $Shell = /\/(bash|sh|zsh)/ nocase
$User = principal.user.userid
match:
$Shell, $User
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
Processar eventos ao longo do tempo
metadata.event_type = "PROCESS_UNCATEGORIZED"
or metadata.event_type = "PROCESS_LAUNCH"
or metadata.event_type = "PROCESS_INJECTION"
or metadata.event_type = "PROCESS_PRIVILEGE_ESCALATION"
or metadata.event_type = "PROCESS_TERMINATION"
or metadata.event_type = "PROCESS_OPEN"
or metadata.event_type = "PROCESS_MODULE_LOAD"
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
match:
$Date
outcome:
$Count = count(metadata.id)
order:
$Date desc
10 principais nomes de host
metadata.event_type = "PROCESS_UNCATEGORIZED"
or metadata.event_type = "PROCESS_LAUNCH"
or metadata.event_type = "PROCESS_INJECTION"
or metadata.event_type = "PROCESS_PRIVILEGE_ESCALATION"
or metadata.event_type = "PROCESS_TERMINATION"
or metadata.event_type = "PROCESS_OPEN"
or metadata.event_type = "PROCESS_MODULE_LOAD"
$Event_Type = metadata.event_type
$Hostname = principal.hostname
match:
$Hostname, $Event_Type
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
10 principais usuários
metadata.event_type = "PROCESS_UNCATEGORIZED"
or metadata.event_type = "PROCESS_LAUNCH"
or metadata.event_type = "PROCESS_INJECTION"
or metadata.event_type = "PROCESS_PRIVILEGE_ESCALATION"
or metadata.event_type = "PROCESS_TERMINATION"
or metadata.event_type = "PROCESS_OPEN"
or metadata.event_type = "PROCESS_MODULE_LOAD"
$Event_Type = metadata.event_type
$User = strings.concat(principal.user.userid, " ")
match:
$User, $Event_Type
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
Eventos de encerramento de processo ao longo do tempo
metadata.event_type = "PROCESS_TERMINATION"
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
match:
$Date
outcome:
$Count = count(metadata.id)
order:
$Date desc
Total de eventos bloqueados
metadata.event_type = "PROCESS_UNCATEGORIZED"
or metadata.event_type = "PROCESS_LAUNCH"
or metadata.event_type = "PROCESS_INJECTION"
or metadata.event_type = "PROCESS_PRIVILEGE_ESCALATION"
or metadata.event_type = "PROCESS_TERMINATION"
or metadata.event_type = "PROCESS_OPEN"
or metadata.event_type = "PROCESS_MODULE_LOAD"
security_result.action = "BLOCK"
outcome:
$Count = count(metadata.id)
Total de usuários distintos
metadata.event_type = "PROCESS_UNCATEGORIZED"
or metadata.event_type = "PROCESS_LAUNCH"
or metadata.event_type = "PROCESS_INJECTION"
or metadata.event_type = "PROCESS_PRIVILEGE_ESCALATION"
or metadata.event_type = "PROCESS_TERMINATION"
or metadata.event_type = "PROCESS_OPEN"
or metadata.event_type = "PROCESS_MODULE_LOAD"
outcome:
$Count = count_distinct(principal.user.userid)
Total de eventos de processo
metadata.event_type = "PROCESS_UNCATEGORIZED"
or metadata.event_type = "PROCESS_LAUNCH"
or metadata.event_type = "PROCESS_INJECTION"
or metadata.event_type = "PROCESS_PRIVILEGE_ESCALATION"
or metadata.event_type = "PROCESS_TERMINATION"
or metadata.event_type = "PROCESS_OPEN"
or metadata.event_type = "PROCESS_MODULE_LOAD"
outcome:
$Count = count(metadata.id)
10 principais hosts
$event.metadata.event_type = "PROCESS_UNCATEGORIZED"
or $event.metadata.event_type = "PROCESS_LAUNCH"
or $event.metadata.event_type = "PROCESS_INJECTION"
or $event.metadata.event_type = "PROCESS_PRIVILEGE_ESCALATION"
or $event.metadata.event_type = "PROCESS_TERMINATION"
or $event.metadata.event_type = "PROCESS_OPEN"
or $event.metadata.event_type = "PROCESS_MODULE_LOAD"
$Event_Type = $event.metadata.event_type
$Hostname = $event.principal.hostname
match:
$Hostname, $Event_Type
outcome:
$Count = count($event.metadata.id)
order:
$Count desc
limit:
10
Total de eventos de processo
$event.metadata.event_type = "PROCESS_UNCATEGORIZED"
or $event.metadata.event_type = "PROCESS_LAUNCH"
or $event.metadata.event_type = "PROCESS_INJECTION"
or $event.metadata.event_type = "PROCESS_PRIVILEGE_ESCALATION"
or $event.metadata.event_type = "PROCESS_TERMINATION"
or $event.metadata.event_type = "PROCESS_OPEN"
or $event.metadata.event_type = "PROCESS_MODULE_LOAD"
outcome:
$Count = count($event.metadata.id)
Total de hosts distintos
$event.metadata.event_type = "PROCESS_UNCATEGORIZED"
or $event.metadata.event_type = "PROCESS_LAUNCH"
or $event.metadata.event_type = "PROCESS_INJECTION"
or $event.metadata.event_type = "PROCESS_PRIVILEGE_ESCALATION"
or $event.metadata.event_type = "PROCESS_TERMINATION"
or $event.metadata.event_type = "PROCESS_OPEN"
or $event.metadata.event_type = "PROCESS_MODULE_LOAD"
outcome:
$Count = count_distinct($event.principal.hostname)
Total de nomes de host distintos
metadata.event_type = "PROCESS_UNCATEGORIZED"
or metadata.event_type = "PROCESS_LAUNCH"
or metadata.event_type = "PROCESS_INJECTION"
or metadata.event_type = "PROCESS_PRIVILEGE_ESCALATION"
or metadata.event_type = "PROCESS_TERMINATION"
or metadata.event_type = "PROCESS_OPEN"
or metadata.event_type = "PROCESS_MODULE_LOAD"
outcome:
$Count = count_distinct(principal.hostname)
Total de eventos do shell de comandos
$event.metadata.event_type = "PROCESS_UNCATEGORIZED"
or $event.metadata.event_type = "PROCESS_LAUNCH"
or $event.metadata.event_type = "PROCESS_INJECTION"
or $event.metadata.event_type = "PROCESS_PRIVILEGE_ESCALATION"
or $event.metadata.event_type = "PROCESS_TERMINATION"
or $event.metadata.event_type = "PROCESS_OPEN"
or $event.metadata.event_type = "PROCESS_MODULE_LOAD"
$Command_Shell = $event.principal.process.command_line
$Command_Shell = /(?:cmd|shell)\.exe/ nocase or $Command_Shell = /\/(bash|sh|zsh)/ nocase
outcome:
$Count = count($Command_Shell)
Distribuição do tipo de evento
metadata.event_type = "PROCESS_UNCATEGORIZED"
or metadata.event_type = "PROCESS_LAUNCH"
or metadata.event_type = "PROCESS_INJECTION"
or metadata.event_type = "PROCESS_PRIVILEGE_ESCALATION"
or metadata.event_type = "PROCESS_TERMINATION"
or metadata.event_type = "PROCESS_OPEN"
or metadata.event_type = "PROCESS_MODULE_LOAD"
$Event_Type = metadata.event_type
match:
$Event_Type
outcome:
$Count = count(metadata.id)
order:
$Count desc
Eventos de processo recentes
metadata.event_type = "PROCESS_UNCATEGORIZED"
or metadata.event_type = "PROCESS_LAUNCH"
or metadata.event_type = "PROCESS_INJECTION"
or metadata.event_type = "PROCESS_PRIVILEGE_ESCALATION"
or metadata.event_type = "PROCESS_TERMINATION"
or metadata.event_type = "PROCESS_OPEN"
or metadata.event_type = "PROCESS_MODULE_LOAD"
$Hostname = principal.hostname
$User = principal.user.userid
$Parent_Process = principal.process.file.full_path
$Parent_Command_Line = principal.process.command_line
$Target_Process = target.process.file.full_path
$Target_Command_Line = target.process.command_line
match:
$Hostname, $User, $Parent_Process, $Parent_Command_Line, $Target_Process, $Target_Command_Line
outcome:
$Time = timestamp.get_timestamp(max(metadata.event_timestamp.seconds), "%F %T")
order:
$Time desc
Os 10 principais eventos do shell de comando
$event.metadata.event_type = "PROCESS_UNCATEGORIZED"
or $event.metadata.event_type = "PROCESS_LAUNCH"
or $event.metadata.event_type = "PROCESS_INJECTION"
or $event.metadata.event_type = "PROCESS_PRIVILEGE_ESCALATION"
or $event.metadata.event_type = "PROCESS_TERMINATION"
or $event.metadata.event_type = "PROCESS_OPEN"
or $event.metadata.event_type = "PROCESS_MODULE_LOAD"
$Command_Shell = $event.principal.process.command_line
$Command_Shell = /(?:cmd|shell)\.exe/ nocase or $Command_Shell = /\/(bash|sh|zsh)/ nocase
match:
$Command_Shell
outcome:
$Count = count($event.metadata.id)
order:
$Count desc
limit:
10
Monitoramento de destaque de ransomware
Esse painel oferece uma visão abrangente da atividade relacionada a ransomware detectada por várias ferramentas de segurança e fontes de dados. Ele ajuda as equipes de segurança a identificar e responder rapidamente a ameaças de ransomware, destacando os eventos recentes, os dispositivos afetados e as fontes de detecção.
Eventos recentes de e-mail de ransomware por URLs/anexos
Eventos recentes de VM de ransomware
Eventos recentes de DLP de ransomware
Eventos recentes de ransomware em endpoints
10 principais origens de registros de ransomware
Eventos de ransomware ao longo do tempo por produto
Eventos recentes de NDR de ransomware
Eventos recentes de ransomware por nome de host
Nome do gráfico
Exemplo de consulta
Eventos recentes de e-mail de ransomware por URLs/anexos
security_result.summary = /ransom/ nocase
$Subject = network.email.subject
$Sender = network.email.from
$Receiver = network.email.to
$Log_Type = metadata.log_type
$Attachments = strings.coalesce(about.file.full_path, security_result.detection_fields["attachmentNames"])
$Summary = security_result.summary
$Url = target.url
$Action = security_result.action
$Severity = security_result.severity
match:
$Sender, $Receiver, $Subject, $Summary, $Url , $Attachments, $Action, $Severity, $Log_Type
outcome:
$Date = timestamp.get_timestamp(max(metadata.event_timestamp.seconds), "%F %T")
$Count = count(metadata.id)
order:
$Count desc
Eventos recentes de VM de ransomware
extensions.vulns.vulnerabilities.description = /ransom/ nocase
$Log_Type = metadata.log_type
$Summary = extensions.vulns.vulnerabilities.description
$Hostname = strings.coalesce(principal.hostname, principal.asset.hostname, target.hostname, target.asset.hostname)
match:
$Summary, $Hostname, $Log_Type
outcome:
$Date = timestamp.get_timestamp(max(metadata.event_timestamp.seconds), "%F %T")
$Count = count(metadata.id)
order:
$Count desc
Eventos recentes de DLP de ransomware
(security_result.rule_name = /ransom/ nocase or security_result.category_details = /ransom/ nocase or security_result.threat_name = /ransom/ nocase or security_result.summary = /ransom/ nocase
or security_result.description = /ransom/ nocase or metadata.description = /ransom/ nocase or metadata.product_event_type = /ransom/ nocase)
$Log_Type = metadata.log_type
$Summary = strings.coalesce(metadata.description, metadata.product_event_type, security_result.summary, security_result.rule_name, security_result.description, security_result.threat_name, security_result.category_details)
$Hostname = strings.coalesce(principal.hostname, principal.asset.hostname, target.hostname, target.asset.hostname)
$File = strings.coalesce(target.file.full_path, about.file.full_path, target.url)
$Action = security_result.action
$Severity = security_result.severity
match:
$Summary, $File, $Hostname, $Action, $Severity, $Log_Type
outcome:
$Date = timestamp.get_timestamp(max(metadata.event_timestamp.seconds), "%F %T")
$Count = count(metadata.id)
order:
$Count desc
Eventos recentes de ransomware em endpoints
(security_result.rule_name = /ransom/ nocase or security_result.category_details = /ransom/ nocase or security_result.threat_name = /ransom/ nocase or security_result.summary = /ransom/ nocase or security_result.description = /ransom/ nocase or metadata.description = /ransom/ nocase or metadata.product_event_type = /ransom/ nocase)
$Log_Type = metadata.log_type
$Summary = strings.coalesce(security_result.description, security_result.rule_name, security_result.threat_name, security_result.category_details, security_result.summary, metadata.description, metadata.product_event_type)
$Hostname = strings.coalesce(principal.hostname, principal.asset.hostname, target.hostname, target.asset.hostname)
$IP = strings.coalesce(principal.ip, principal.asset.ip, target.ip, target.asset.ip)
$File = strings.coalesce(target.file.full_path, about.file.full_path, target.url)
$Action = security_result.action
$Severity = security_result.severity
match:
$Summary, $File, $Hostname, $IP, $Action, $Severity, $Log_Type
outcome:
$Date = timestamp.get_timestamp(max(metadata.event_timestamp.seconds), "%F %T")
$Count = count(metadata.id)
order:
$Count desc
10 principais origens de registros de ransomware
(security_result.rule_name = /ransom/ nocase or security_result.category_details = /ransom/ nocase or security_result.threat_name = /ransom/ nocase or extensions.vulns.vulnerabilities.description = /ransom/ nocase or metadata.product_event_type = /ransom/ nocase or security_result.summary = /ransom/ nocase or metadata.description = /ransom/ nocase or security_result.description = /ransom/ nocase)
$Log_Type = metadata.log_type
match:
$Log_Type
outcome:
$Date = timestamp.get_timestamp(max(metadata.event_timestamp.seconds), "%F %T")
$Count = count(metadata.id)
order:
$Count desc
limit:
10
Eventos de ransomware ao longo do tempo por produto
(security_result.rule_name = /ransom/ nocase or security_result.category_details = /ransom/ nocase or security_result.threat_name = /ransom/ nocase or extensions.vulns.vulnerabilities.description = /ransom/ nocase or metadata.product_event_type = /ransom/ nocase or security_result.summary = /ransom/ nocase or metadata.description = /ransom/ nocase or security_result.description = /ransom/ nocase)
$Product = metadata.product_name
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
match:
$Product, $Date
outcome:
$Count = count(metadata.id)
order:
$Date asc
Eventos recentes de NDR de ransomware
(metadata.event_type = "NETWORK_CONNECTION"
or metadata.event_type = "NETWORK_DHCP"
or metadata.event_type = "NETWORK_DNS"
or metadata.event_type = "NETWORK_FLOW"
or metadata.event_type = "NETWORK_FTP"
or metadata.event_type = "NETWORK_HTTP"
or metadata.event_type = "NETWORK_SMTP"
or metadata.event_type = "NETWORK_UNCATEGORIZED")
(security_result.rule_name = /ransom/ nocase or security_result.category_details = /ransom/ nocase or security_result.threat_name = /ransom/ nocase or security_result.summary = /ransom/ nocase
or security_result.description = /ransom/ nocase or metadata.description = /ransom/ nocase or metadata.product_event_type = /ransom/ nocase)
$Log_Type = metadata.log_type
$Summary = strings.coalesce(metadata.product_event_type, metadata.description, security_result.summary, security_result.description, security_result.rule_name, security_result.category_details, security_result.threat_name)
$Threat_Name = security_result.threat_name
$Category = security_result.category_details
$Hostname = strings.coalesce(principal.hostname, principal.asset.hostname, target.hostname, target.asset.hostname)
$File = strings.coalesce(target.file.full_path, about.file.full_path, target.url)
$Action = security_result.action
$Severity = security_result.severity
match:
$Summary, $File, $Threat_Name, $Category, $Hostname, $Action, $Severity, $Log_Type
outcome:
$Date = timestamp.get_timestamp(max(metadata.event_timestamp.seconds), "%F %T")
$Count = count(metadata.id)
order:
$Count desc
Eventos recentes de ransomware por nome de host
(security_result.rule_name = /ransom/ nocase or security_result.category_details = /ransom/ nocase or security_result.threat_name = /ransom/ nocase or extensions.vulns.vulnerabilities.description = /ransom/ nocase or metadata.product_event_type = /ransom/ nocase or security_result.summary = /ransom/ nocase or metadata.description = /ransom/ nocase or security_result.description = /ransom/ nocase)
$Log_Type = metadata.log_type
$Summary = strings.coalesce(security_result.summary, security_result.description, metadata.description, metadata.product_event_type, security_result.rule_name , extensions.vulns.vulnerabilities.description, security_result.threat_name, security_result.category_details)
$Hostname = strings.coalesce(principal.hostname, principal.asset.hostname, target.hostname, target.asset.hostname)
$User = strings.coalesce(principal.user.userid, principal.user.email_addresses, principal.user.user_display_name, target.user.userid, target.user.email_addresses, target.user.user_display_name)
$File = strings.coalesce(target.file.full_path, about.file.full_path, target.url)
$Action = security_result.action
$Severity = security_result.severity
match:
$Summary, $File, $Hostname, $User, $Action, $Severity, $Log_Type
outcome:
$Date = timestamp.get_timestamp(max(metadata.event_timestamp.seconds), "%F %T")
$Count = count(metadata.id)
order:
$Count desc
Auditoria de funções e permissões
Este painel é uma análise detalhada para auditar o gerenciamento de papéis e permissões diretas de recursos.
Observação : aplique filtros para mostrar resultados relevantes no painel.
Os 10 principais usuários que criam funções
Os 10 principais usuários que mudaram as permissões de recursos
Os 10 principais usuários que modificam funções
Funções criadas recentemente
Os 10 principais recursos com permissões alteradas
Os 10 principais IPs de origem bloqueados em eventos de função
Permissões de recursos mudaram com o tempo
Ações do IAM ao longo do tempo
Total de papéis modificados
Os 10 principais IPs de origem que modificam papéis
Funções excluídas ao longo do tempo
Atividade em funções críticas
Total de funções criadas
Funções criadas ao longo do tempo
Papéis modificados recentemente
10 principais IPs de origem que criam papéis
KPI de ciclo de vida da função
Funções modificadas ao longo do tempo
Os 10 principais IPs de origem que mudaram as permissões de recursos
Total de papéis excluídos
Os 10 principais IPs de origem que excluem papéis
Os 10 principais usuários que excluíram funções
Nome do gráfico
Exemplo de consulta
Os 10 principais usuários que criam funções
metadata.product_event_type = /Create.?Role/ nocase
or
(security_result.category_details = /RoleManagement/ nocase
and metadata.product_event_type = /add role definition/ nocase)
security_result.action = "ALLOW"
$Log_Type = metadata.log_type
$Initiator = strings.coalesce(principal.user.windows_sid, principal.user.userid, principal.user.email_addresses)
match:
$Log_Type, $Initiator
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
Os 10 principais usuários que mudaram as permissões de recursos
metadata.event_type = "RESOURCE_PERMISSIONS_CHANGE"
security_result.action = "ALLOW"
$Initiator = strings.coalesce(principal.user.windows_sid, principal.user.userid, principal.user.email_addresses)
$Log_Type = metadata.log_type
match:
$Log_Type, $Initiator
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
Os 10 principais usuários que modificam funções
metadata.product_event_type = /Update.?Role/ nocase
or
(security_result.category_details = /RoleManagement/ nocase
and metadata.product_event_type = /update role definition/ nocase)
security_result.action = "ALLOW"
$Log_Type = metadata.log_type
$Initiator = strings.coalesce(principal.user.windows_sid, principal.user.userid, principal.user.email_addresses)
match:
$Log_Type, $Initiator
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
Funções criadas recentemente
metadata.product_event_type = /Create.?Role/ nocase
or
(security_result.category_details = /RoleManagement/ nocase
and metadata.product_event_type = /add role definition/ nocase)
security_result.action = "ALLOW"
$Log_Type = metadata.log_type
$Initiator = strings.coalesce(principal.user.windows_sid, principal.user.userid, principal.user.email_addresses)
$IP_Address = principal.ip
$Date = timestamp.get_timestamp(metadata.event_timestamp.seconds, "%F %T ")
$Role = strings.coalesce(target.user.attribute.roles.name, target.resource.name)
match:
$Date, $Log_Type, $Initiator, $IP_Address, $Role
order:
$Date desc
Os 10 principais recursos com permissões alteradas
metadata.event_type = "RESOURCE_PERMISSIONS_CHANGE"
security_result.action = "ALLOW"
$Log_Type = metadata.log_type
$Resource_Name = target.resource.name
match:
$Log_Type, $Resource_Name
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
Os 10 principais IPs de origem bloqueados em eventos de função
(metadata.product_event_type = /Create.?Role/ nocase
or
(security_result.category_details = /RoleManagement/ nocase
and metadata.product_event_type = /add role definition/ nocase))
or
(metadata.product_event_type = /Update.?Role/ nocase
or
(security_result.category_details = /RoleManagement/ nocase
and metadata.product_event_type = /update role definition/ nocase))
or
(metadata.product_event_type = /Delete.?Role/ nocase
or
(security_result.category_details = /RoleManagement/ nocase
and metadata.product_event_type = /delete role definition/ nocase))
security_result.action = "BLOCK"
$IP_Address = principal.ip
$Event = metadata.product_event_type
match:
$IP_Address, $Event
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
Permissões de recursos mudaram com o tempo
metadata.event_type = "RESOURCE_PERMISSIONS_CHANGE"
security_result.action = "ALLOW"
$Log_Type = metadata.log_type
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
match:
$Log_Type, $Date
outcome:
$Count = count(metadata.id)
order:
$Date desc
Ações do IAM ao longo do tempo
metadata.event_type = "RESOURCE_PERMISSIONS_CHANGE"
or metadata.event_type = "USER_UNCATEGORIZED"
or metadata.event_type = "USER_BADGE_IN"
or metadata.event_type = "USER_COMMUNICATION"
or metadata.event_type = "USER_CHANGE_PASSWORD"
or metadata.event_type = "USER_LOGIN"
or metadata.event_type = "USER_LOGOUT"
or metadata.event_type = "USER_CREATION"
or metadata.event_type = "USER_DELETION"
or metadata.event_type = "USER_CHANGE_PERMISSIONS"
or metadata.event_type = "USER_RESOURCE_UPDATE_PERMISSIONS"
or metadata.event_type = "USER_RESOURCE_ACCESS"
or metadata.event_type = "USER_RESOURCE_CREATION"
or metadata.event_type = "USER_RESOURCE_DELETION"
or metadata.event_type = "USER_RESOURCE_UPDATE_CONTENT"
or metadata.event_type = "GROUP_UNCATEGORIZED"
or metadata.event_type = "GROUP_CREATION"
or metadata.event_type = "GROUP_DELETION"
or metadata.product_event_type = /(add|delete) group/ nocase
or metadata.event_type = "GROUP_MODIFICATION"
or metadata.product_event_type = /(RemoveUserFrom|AddUserTo|Add member to |Remove member from )|(?:group)/ nocase
or metadata.product_event_type = /(Create|Update|\bDelete).?Role/ nocase
or (security_result.category_details = /RoleManagement/ nocase
and metadata.product_event_type = /(add|update|delete) role definition/ nocase)
security_result.action = "ALLOW"
$Event = metadata.event_type
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
match:
$Date, $Event
outcome:
$Count = count(metadata.id)
order:
$Date desc
Total de papéis modificados
metadata.product_event_type = /Update.?Role/ nocase
or
(security_result.category_details = /RoleManagement/ nocase
and metadata.product_event_type = /update role definition/ nocase)
security_result.action = "ALLOW"
outcome:
$Count = count_distinct(strings.coalesce(target.user.attribute.roles.name, target.resource.name))
Os 10 principais IPs de origem que modificam papéis
metadata.product_event_type = /Update.?Role/ nocase
or
(security_result.category_details = /RoleManagement/ nocase
and metadata.product_event_type = /update role definition/ nocase)
security_result.action = "ALLOW"
$Log_Type = metadata.log_type
$IP_Address = principal.ip
match:
$Log_Type, $IP_Address
outcome:
$Count = count(metadata.id)
order:
$Count
limit:
10
Funções excluídas ao longo do tempo
metadata.product_event_type = /Delete.?Role/ nocase
or
(security_result.category_details = /RoleManagement/ nocase
and metadata.product_event_type = /delete role definition/ nocase)
security_result.action = "ALLOW"
$Log_Type = metadata.log_type
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
match:
$Date, $Log_Type
outcome:
$Count = count(metadata.id)
order:
$Date desc
Atividade em funções críticas
metadata.product_event_type = /Create|Remove|Add|Update/ nocase
strings.coalesce(principal.user.attribute.roles.name, principal.resource.name, target.user.attribute.roles.name, target.resource.name) = /admin/ nocase
security_result.action = "ALLOW"
$Log_Type = metadata.log_type
$Role = strings.coalesce(principal.user.attribute.roles.name, principal.resource.name, target.user.attribute.roles.name, target.resource.name)
$Event = metadata.product_event_type
$User = if(strings.coalesce(principal.user.attribute.roles.name, principal.resource.name) = /admin/ nocase, strings.coalesce(principal.user.windows_sid, principal.user.userid, principal.user.email_addresses),
if(strings.coalesce(target.user.attribute.roles.name, target.resource.name) = /admin/ nocase, strings.coalesce(target.user.windows_sid, target.user.userid, target.user.email_addresses), ""))
$IP = principal.ip
match:
$Role, $Event, $Log_Type, $User, $IP
outcome:
$Date = latest(metadata.event_timestamp)
dedup:
$Role
order:
$Date desc
Total de funções criadas
metadata.product_event_type = /Create.?Role/ nocase
or
(security_result.category_details = /RoleManagement/ nocase
and metadata.product_event_type = /add role definition/ nocase)
security_result.action = "ALLOW"
outcome:
$Count = count_distinct(strings.coalesce(target.user.attribute.roles.name, target.resource.name))
Funções criadas ao longo do tempo
metadata.product_event_type = /Create.?Role/ nocase
or
(security_result.category_details = /RoleManagement/ nocase
and metadata.product_event_type = /add role definition/ nocase)
security_result.action = "ALLOW"
$Log_Type = metadata.log_type
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
match:
$Log_Type, $Date
outcome:
$Count = count(metadata.id)
order:
$Date desc
Papéis modificados recentemente
(metadata.event_type = "RESOURCE_WRITTEN"
and metadata.product_event_type = /UpdateRole/ nocase)
or
(security_result.category_details = /RoleManagement/ nocase
and metadata.product_event_type = /update role(?: definition)?/ nocase)
security_result.action = "ALLOW"
$Log_Type = metadata.log_type
$Initiator = strings.coalesce(principal.user.windows_sid, principal.user.userid, principal.user.email_addresses)
$Date = timestamp.get_timestamp(metadata.event_timestamp.seconds, "%F %T ")
$IP_Address = principal.ip
$Role = strings.coalesce(target.user.attribute.roles.name, target.resource.name)
match:
$Date, $Log_Type, $Initiator, $IP_Address, $Role
order:
$Date desc
10 principais IPs de origem que criam papéis
metadata.product_event_type = /Create.?Role/ nocase
or
(security_result.category_details = /RoleManagement/ nocase
and metadata.product_event_type = /add role definition/ nocase)
security_result.action = "ALLOW"
$Log_Type = metadata.log_type
$IP_Address = principal.ip
match:
$Log_Type, $IP_Address
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
KPI de ciclo de vida da função
(metadata.product_event_type = /Create.?Role/ nocase
or
(security_result.category_details = /RoleManagement/ nocase and metadata.product_event_type = /add role definition/ nocase)
and security_result.action = "ALLOW")
or
(metadata.product_event_type = /Update.?Role/ nocase
or
(security_result.category_details = /RoleManagement/ nocase and metadata.product_event_type = /update role definition/ nocase)
and security_result.action = "ALLOW")
or
(metadata.product_event_type = /Delete.?Role/ nocase
or (security_result.category_details = /RoleManagement/ nocase and metadata.product_event_type = /delete role definition/ nocase)
and security_result.action = "ALLOW")
$Event = if((metadata.product_event_type = /Create.?Role/ nocase or (security_result.category_details = /RoleManagement/ nocase and metadata.product_event_type = /add role definition/ nocase)), "Total Creation",
if (metadata.product_event_type = /Update.?Role/ nocase or (security_result.category_details = /RoleManagement/ nocase and metadata.product_event_type = /update role definition/ nocase), "Total Modification", "Total Deletion"))
match:
$Event
outcome:
$Count = count_distinct(strings.coalesce(target.user.attribute.roles.name, target.resource.name))
order:
$Count desc
Funções modificadas ao longo do tempo
metadata.product_event_type = /Update.?Role/ nocase
or
(security_result.category_details = /RoleManagement/ nocase
and metadata.product_event_type = /update role definition/ nocase)
security_result.action = "ALLOW"
$Log_Type = metadata.log_type
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
match:
$Log_Type, $Date
outcome:
$Count = count(metadata.id)
order:
$Date desc
Os 10 principais IPs de origem que mudaram as permissões de recursos
metadata.event_type = "RESOURCE_PERMISSIONS_CHANGE"
security_result.action = "ALLOW"
$Log_Type = metadata.log_type
$IP_Address = principal.ip
match:
$Log_Type, $IP_Address
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
Total de papéis excluídos
metadata.product_event_type = /Delete.?Role/ nocase
or
(security_result.category_details = /RoleManagement/ nocase
and metadata.product_event_type = /delete role definition/ nocase)
security_result.action = "ALLOW"
outcome:
$Count = count_distinct(strings.coalesce(target.user.attribute.roles.name, target.resource.name))
Os 10 principais IPs de origem que excluem papéis
metadata.product_event_type = /Delete.?Role/ nocase
or
(security_result.category_details = /RoleManagement/ nocase
and metadata.product_event_type = /delete role definition/ nocase)
security_result.action = "ALLOW"
$Log_Type = metadata.log_type
$IP_Address = principal.ip
match:
$Log_Type, $IP_Address
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
Os 10 principais usuários que excluíram funções
metadata.product_event_type = /Delete.?Role/ nocase
or
(security_result.category_details = /RoleManagement/ nocase
and metadata.product_event_type = /delete role definition/ nocase)
security_result.action = "ALLOW"
$Log_Type = metadata.log_type
$Initiator = strings.coalesce(principal.user.windows_sid, principal.user.userid, principal.user.email_addresses)
match:
$Log_Type, $Initiator
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
Enumeração de SMB
Esse painel oferece insights úteis sobre atividades relacionadas a SMBs, incluindo tendências de enumeração, tentativas de autenticação e padrões de acesso entre usuários e endereços IP. Ao identificar comportamentos suspeitos e possíveis ameaças, ele ajuda a mitigar os riscos de forma eficaz.
10 principais tentativas de enumeração de SMB por usuário
Tentativas recentes de autenticação SMB com falha
Distribuição de protocolo de tentativas de enumeração de SMB
Distribuição detectada de ferramentas de enumeração
Os 10 principais IPs segmentados na enumeração de PMEs
Distribuição do status de enumeração de PMEs
IPs de origem ao longo do tempo
Comandos de SMB ao longo do tempo
10 principais IPs de origem
Taxa média de enumeração
Os 10 principais comandos usados na enumeração de SMB
Detecções de enumeração de SMB ao longo do tempo
Distribuição do status de autenticação de SMB
Nome do gráfico
Exemplo de consulta
10 principais tentativas de enumeração de SMB por usuário
security_result.rule_name = /smb.*enumeration/ nocase
or (target.process.command_line = /(?:nmap.*(?:\-p(?:\s)?(?:137|138|139|445|139,445)?)(?:(?:\s)?--script smb)?|smbmap|smbclient --list|enum4linux)/ nocase
and (target.port = 137
or target.port = 138
or target.port = 139
or target.port = 445))
$Command_Line = target.process.command_line
$User = target.user.userid
match:
$User, $Command_Line
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
Tentativas recentes de autenticação SMB com falha
metadata.event_type = "NETWORK_CONNECTION"
or metadata.product_event_type = /5157/
target.port = 137
or target.port = 138
or target.port = 139
or target.port = 445
security_result.action = "BLOCK"
or security_result.summary = /failed/ nocase
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
$Hostname = principal.hostname
$Source_IP = principal.ip
$User = strings.coalesce(principal.user.userid, target.user.userid)
$Port = target.port
match:
$Date, $Hostname, $Source_IP, $Port, $User
order:
$Date desc
Distribuição de protocolo de tentativas de enumeração de SMB
security_result.rule_name = /smb.*enumeration/ nocase
or (target.process.command_line = /(?:nmap.*(?:\-p(?:\s)?(?:137|138|139|445|139,445)?)(?:(?:\s)?--script smb)?|smbmap|smbclient --list|enum4linux)/ nocase
and (target.port = 137
or target.port = 138
or target.port = 139
or target.port = 445))
$Protocol = network.ip_protocol
match:
$Protocol
outcome:
$Count = count(network.ip_protocol)
order:
$Count desc
Distribuição detectada de ferramentas de enumeração
security_result.rule_name = /smb.*enumeration/ nocase
or (target.process.command_line = /(?:\bnmap\b.*(?:\-p(?:\s)?(?:137|138|139|445|139,445)?)(?:(?:\s)?--script smb)?|smbmap|smbclient --list|enum4linux)/ nocase
and (target.port = 137
or target.port = 138
or target.port = 139
or target.port = 445))
$Tool = re.capture(target.process.command_line, `^\w+`)
match:
$Tool
outcome:
$Count = count(metadata.id)
order:
$Count desc
Os 10 principais IPs segmentados na enumeração de PMEs
security_result.rule_name = /smb.*enumeration/ nocase
or (target.process.command_line = /(?:nmap.*(?:\-p(?:\s)?(?:137|138|139|445|139,445)?)(?:(?:\s)?--script smb)?|smbmap|smbclient --list|enum4linux)/ nocase
and (target.port = 137
or target.port = 138
or target.port = 139
or target.port = 445))
$Hostname = principal.hostname
$Target_IP = target.ip
match:
$Target_IP, $Hostname
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
Distribuição do status de enumeração de PMEs
security_result.rule_name = /smb.*enumeration/ nocase
or (target.process.command_line = /(?:nmap.*(?:\-p(?:\s)?(?:137|138|139|445|139,445)?)(?:(?:\s)?--script smb)?|smbmap|smbclient --list|enum4linux)/ nocase
and (target.port = 137
or target.port = 138
or target.port = 139
or target.port = 445))
$Status = if(security_result.action = "ALLOW", security_result.action, "BLOCK")
match:
$Status
outcome:
$Count = count(metadata.id)
order:
$Count desc
IPs de origem ao longo do tempo
target.port = 137
or target.port = 138
or target.port = 139
or target.port = 445
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
match:
$Date
outcome:
$Count = count_distinct(principal.ip)
order:
$Date desc
Comandos de SMB ao longo do tempo
target.process.command_line = /(?:nmap.*(?:\-p(?:\s)?(?:137|138|139|445|139,445)?)(?:(?:\s)?--script smb)?|smb(?:client|map|status)|enum4linux|(?:get|new|remove|set|close)\-smb)|\bnet\s+(?:use|view|share|session|file|user|group|localgroup|accounts|config|start|stop)\b/ nocase
target.port = 137
or target.port = 138
or target.port = 139
or target.port = 445
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
match:
$Date
outcome:
$Count = count(metadata.id)
order:
$Date desc
10 principais IPs de origem
target.port = 137
or target.port = 138
or target.port = 139
or target.port = 445
$Hostname = principal.hostname
$Source_IP = principal.ip
$Source_IP != ""
match:
$Source_IP, $Hostname
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
Taxa média de enumeração
stage Enumeration{
security_result.rule_name = /smb.*enumeration/ nocase
or (target.process.command_line = /(?:nmap.*(?:\-p(?:\s)?(?:137|138|139|445|139,445)?)(?:(?:\s)?--script smb)?|smbmap|smbclient --list|enum4linux)/ nocase
and (target.port = 137
or target.port = 138
or target.port = 139
or target.port = 445))
$Target_IP = target.ip
$Hour_Bucket = timestamp.get_hour(metadata.event_timestamp.seconds)
match:
$Hour_Bucket
outcome:
$Ip_Count = count_distinct($Target_IP)
}
outcome:
$Avg_Enumeration_Rate = math.round(avg($Enumeration.Ip_Count), 2)
Os 10 principais comandos usados na enumeração de SMB
security_result.rule_name = /smb.*enumeration/ nocase
or (target.process.command_line = /(?:nmap.*(?:\-p(?:\s)?(?:137|138|139|445|139,445)?)(?:(?:\s)?--script smb)?|smbmap|smbclient --list|enum4linux)/ nocase
and (target.port = 137
or target.port = 138
or target.port = 139
or target.port = 445))
$Command_Line = target.process.command_line
match:
$Command_Line
outcome:
$Count = count(target.process.command_line)
order:
$Count desc
limit:
10
Detecções de enumeração de SMB ao longo do tempo
security_result.rule_name = /smb.*enumeration/ nocase
or (target.process.command_line = /(?:nmap.*(?:\-p(?:\s)?(?:137|138|139|445|139,445)?)(?:(?:\s)?--script smb)?|smbmap|smbclient --list|enum4linux)/ nocase
and (target.port = 137
or target.port = 138
or target.port = 139
or target.port = 445))
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
match:
$Date
outcome:
$Count = count(metadata.id)
order:
$Date desc
Distribuição do status de autenticação de SMB
metadata.event_type = "NETWORK_CONNECTION"
or metadata.product_event_type = /5156|5157/
target.port = 137
or target.port = 138
or target.port = 139
or target.port = 445
$Status = if(security_result.summary = /failed/, "BLOCK", security_result.action)
match:
$Status
outcome:
$Count = count(metadata.id)
order:
$Count desc
Auditoria de SecOps e monitoramento de atividades
Esse painel fornece insights essenciais sobre a postura de segurança, rastreia eventos, atividades do usuário e ações bloqueadas nas APIs do Google do Chronicle.
Eventos ao longo do tempo
10 principais tipos de evento
Ações bloqueadas recentemente
Os 10 principais IPs de origem por tipo de evento
Eventos bloqueados ao longo do tempo
Eventos incomuns fora do horário de expediente
Ações arriscadas recentes
Os 10 principais usuários por ação de risco
Os 10 principais usuários por tipo de evento
Eventos de SecOps bloqueados por local
Ação por tipos de evento: permitir x bloquear
Ações incomuns fora do horário de expediente por categoria
Nome do gráfico
Exemplo de consulta
Eventos ao longo do tempo
target.application = /(?:chronicle|backstory).googleapis\.com/ nocase
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
match:
$Date
outcome:
$Count = count(metadata.id)
order:
$Date desc
10 principais tipos de evento
target.application = /(?:chronicle|backstory).googleapis\.com/ nocase
$Event_Type = metadata.event_type
match:
$Event_Type
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
Ações bloqueadas recentemente
target.application = /(?:chronicle|backstory).googleapis.com/ nocase
security_result.action = "BLOCK"
$Date = timestamp.get_timestamp((metadata.event_timestamp.seconds), "%F %T ")
$Description = metadata.description
$Event_Type = metadata.event_type
$User = principal.user.userid
match:
$Date, $Event_Type, $Description, $User
order:
$Date desc
Os 10 principais IPs de origem por tipo de evento
target.application = /(?:chronicle|backstory).googleapis\.com/ nocase
$Event_Type = metadata.event_type
$Source_IP = principal.ip
match:
$Event_Type, $Source_IP
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
Eventos bloqueados ao longo do tempo
target.application = /(?:chronicle|backstory).googleapis.com/ nocase
security_result.action = "BLOCK"
$Date = timestamp.get_date((metadata.event_timestamp.seconds))
$Event_Type = re.capture(metadata.product_event_type, `\b[A-Za-z]+$`)
match:
$Date, $Event_Type
outcome:
$Count = count(metadata.id)
order:
$Date desc
Eventos incomuns fora do horário de expediente
target.application = /(?:chronicle|backstory).googleapis.com/ nocase
(
(timestamp.get_day_of_week(metadata.event_timestamp.seconds, "UTC") = 1 or timestamp.get_day_of_week(metadata.event_timestamp.seconds, "UTC") = 7)
or
((timestamp.get_day_of_week(metadata.event_timestamp.seconds, "UTC") >= 2 and timestamp.get_day_of_week(metadata.event_timestamp.seconds, "UTC") <= 6)
and
((timestamp.get_hour(metadata.event_timestamp.seconds, "UTC") >= 0 and timestamp.get_hour(metadata.event_timestamp.seconds, "UTC") <= 8) or timestamp.get_hour(metadata.event_timestamp.seconds, "UTC") > 19))
)
$Event_Type = metadata.event_type
$Product_Event = metadata.product_event_type
match:
$Event_Type, $Product_Event
outcome:
$Count = count(metadata.id)
$Date = timestamp.get_timestamp(max(metadata.event_timestamp.seconds), "%F %T ")
order:
$Date desc
Ações arriscadas recentes
target.application = /(?:chronicle|backstory).googleapis.com/ nocase
metadata.product_event_type = /\b(?:Delete|Remove|Disable|Update)/ nocase
$Date = timestamp.get_timestamp(metadata.event_timestamp.seconds)
$Event_Type = re.capture(metadata.product_event_type, `\b(?:Delete|Remove|Disable|Update)[A-Za-z]+`)
$Description = metadata.description
$User = re.capture(principal.user.userid, `subject\/([^\/]+)`)
match:
$Date, $Event_Type, $Description, $User
order:
$Date desc
Os 10 principais usuários por ação de risco
target.application = /(?:chronicle|backstory).googleapis.com/ nocase
metadata.product_event_type = /\b(?:Delete|Remove|Disable|Update)/ nocase
$Event_Type = re.capture(metadata.product_event_type, `\b(?:Delete|Remove|Disable|Update)[A-Za-z]+`)
$User = re.capture(principal.user.userid, `subject\/([^\/]+)`)
match:
$User, $Event_Type
outcome:
$Count = count(metadata.id)
order:
$Count desc
Os 10 principais usuários por tipo de evento
target.application = /(?:chronicle|backstory).googleapis\.com/ nocase
$Event_Type = metadata.event_type
$User = principal.user.userid
match:
$User, $Event_Type
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
Eventos de SecOps bloqueados por local
target.application = /(?:chronicle|backstory).googleapis.com/ nocase
security_result.action = "BLOCK"
$Countries = principal.location.country_or_region
$Latitude = principal.location.region_coordinates.latitude
$Longitude = principal.location.region_coordinates.longitude
match:
$Countries, $Latitude, $Longitude
outcome:
$Count = count(metadata.id)
order:
$Count desc
Ação por tipos de evento: permitir x bloquear
target.application = /(?:chronicle|backstory).googleapis\.com/ nocase
security_result.action = "ALLOW"
or security_result.action = "BLOCK"
$Event_Type = metadata.event_type
$Action = security_result.action
match:
$Event_Type, $Action
outcome:
$Count = count(metadata.id)
order:
$Count desc
Ações incomuns fora do horário de expediente por categoria
target.application = /(?:chronicle|backstory).googleapis.com/ nocase
(
(timestamp.get_day_of_week(metadata.event_timestamp.seconds, "UTC") = 1 or timestamp.get_day_of_week(metadata.event_timestamp.seconds, "UTC") = 7)
or
((timestamp.get_day_of_week(metadata.event_timestamp.seconds, "UTC") >= 2 and timestamp.get_day_of_week(metadata.event_timestamp.seconds, "UTC") <= 6)
and
((timestamp.get_hour(metadata.event_timestamp.seconds, "UTC") >= 0 and timestamp.get_hour(metadata.event_timestamp.seconds, "UTC") <= 8) or timestamp.get_hour(metadata.event_timestamp.seconds, "UTC") > 19))
)
$Event_Type = metadata.event_type
$Product_Event = metadata.product_event_type
$Service = re.capture(metadata.product_event_type, `([A-Za-z]+Service)`)
match:
$Product_Event, $Service
outcome:
$Date = timestamp.get_timestamp(max(metadata.event_timestamp.seconds), "%F %T ")
$Count = count(metadata.id)
order:
$Date desc
Monitoramento de registros de SecOps
Esse painel oferece insights sobre o gerenciamento de dados de registros, destacando a latência de ingestão e o status dos componentes. Ele ajuda a otimizar o desempenho, reduzir a perda de dados e melhorar o monitoramento de segurança.
Gerenciamento da postura de segurança
Esse painel oferece uma visão geral em tempo real do status de segurança da sua organização, destacando ameaças, incidentes e vulnerabilidades. Ele inclui detecções, segurança, resumo de atualizações do sistema e monitoramento de recursos, permitindo que as equipes de segurança avaliem os riscos e a postura de ameaça e implementem estratégias de correção de maneira eficaz. Essa visualização centralizada ajuda a melhorar a postura geral de segurança e simplificar a resposta a incidentes.
Visão geral da conta de serviço
Esse painel ajuda as equipes e administradores de segurança a monitorar a atividade da conta de serviço, fornecendo insights sobre padrões de uso, tentativas de login e modificações na conta. Ela permite tomar decisões informadas para identificar riscos de segurança, resolver vulnerabilidades e garantir a integridade do sistema. Observação: use os filtros disponíveis para restringir os resultados conforme necessário.
10 principais ações
Permissões modificadas recentemente
Logins bem-sucedidos ao longo do tempo
10 principais permissões de usuário modificadas
Mudanças recentes de senha
Contas de serviço excluídas ao longo do tempo
Falhas de login ao longo do tempo
Uso ao longo do tempo
Contas de serviço excluídas recentemente
As 10 principais contas de serviço por login
Contas de serviço criadas recentemente
As 10 principais contas de serviço
Contas de serviço criadas ao longo do tempo
Alto volume de solicitações de tíquetes de serviço do Kerberos
10 principais IPs de origem por falha no login
Os 10 principais IPs de origem por login interativo
Logins interativos ao longo do tempo
Mudanças de senha ao longo do tempo
Nome do gráfico
Exemplo de consulta
10 principais ações
principal.user.account_type = "SERVICE_ACCOUNT_TYPE"
or principal.resource.resource_type = "SERVICE_ACCOUNT"
or principal.user.attribute.roles.type = "SERVICE_ACCOUNT"
or target.user.account_type = "SERVICE_ACCOUNT_TYPE"
or target.resource.resource_type = "SERVICE_ACCOUNT"
or target.user.attribute.roles.type = "SERVICE_ACCOUNT"
or strings.coalesce(principal.resource.type, principal.user.attribute.roles.name, principal.resource.resource_subtype, principal.user.userid, target.resource.type, target.user.attribute.roles.name, target.resource.resource_subtype, target.user.userid) = /(?i)service.*(?:account|^principal$)/ nocase
$Product_Event = metadata.product_event_type
$Product_Event != ""
match:
$Product_Event
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
Permissões modificadas recentemente
metadata.event_type = "RESOURCE_PERMISSIONS_CHANGE"
or metadata.event_type = "USER_CHANGE_PERMISSIONS"
or metadata.event_type = "USER_RESOURCE_UPDATE_PERMISSIONS"
principal.user.account_type = "SERVICE_ACCOUNT_TYPE"
or principal.resource.resource_type = "SERVICE_ACCOUNT"
or principal.user.attribute.roles.type = "SERVICE_ACCOUNT"
or target.user.account_type = "SERVICE_ACCOUNT_TYPE"
or target.resource.resource_type = "SERVICE_ACCOUNT"
or target.user.attribute.roles.type = "SERVICE_ACCOUNT"
or strings.coalesce(principal.resource.type, principal.user.attribute.roles.name, principal.resource.resource_subtype, principal.user.userid, target.resource.type, target.user.attribute.roles.name, target.resource.resource_subtype, target.user.userid) = /(?i)service.*(?:account|^principal$)/ nocase
$Log_Type = metadata.log_type
$Initiator = strings.coalesce(principal.user.windows_sid, principal.user.userid, principal.user.email_addresses)
$User = strings.coalesce(target.user.userid, target.user.email_addresses)
$IP_Address = principal.ip
$Date = timestamp.get_timestamp(metadata.event_timestamp.seconds, "%F %T ")
match:
$Date, $Log_Type, $Initiator, $IP_Address, $User
order:
$Date desc
Logins bem-sucedidos ao longo do tempo
metadata.event_type = "USER_LOGIN"
security_result.action = "ALLOW"
principal.user.account_type = "SERVICE_ACCOUNT_TYPE"
or principal.resource.resource_type = "SERVICE_ACCOUNT"
or principal.user.attribute.roles.type = "SERVICE_ACCOUNT"
or target.user.account_type = "SERVICE_ACCOUNT_TYPE"
or target.resource.resource_type = "SERVICE_ACCOUNT"
or target.user.attribute.roles.type = "SERVICE_ACCOUNT"
or strings.coalesce(principal.resource.type, principal.user.attribute.roles.name, principal.resource.resource_subtype, principal.user.userid, target.resource.type, target.user.attribute.roles.name, target.resource.resource_subtype, target.user.userid) = /(?i)service.*(?:account|^principal$)/ nocase
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
match:
$Date
outcome:
$Count = count(metadata.id)
order:
$Date desc
10 principais permissões de usuário modificadas
metadata.event_type = "RESOURCE_PERMISSIONS_CHANGE"
or metadata.event_type = "USER_CHANGE_PERMISSIONS"
or metadata.event_type = "USER_RESOURCE_UPDATE_PERMISSIONS"
principal.user.account_type = "SERVICE_ACCOUNT_TYPE"
or principal.resource.resource_type = "SERVICE_ACCOUNT"
or principal.user.attribute.roles.type = "SERVICE_ACCOUNT"
or target.user.account_type = "SERVICE_ACCOUNT_TYPE"
or target.resource.resource_type = "SERVICE_ACCOUNT"
or target.user.attribute.roles.type = "SERVICE_ACCOUNT"
or strings.coalesce(principal.resource.type, principal.user.attribute.roles.name, principal.resource.resource_subtype, principal.user.userid, target.resource.type, target.user.attribute.roles.name, target.resource.resource_subtype, target.user.userid) = /(?i)service.*(?:account|^principal$)/ nocase
$User = strings.coalesce(target.user.userid, target.user.email_addresses)
match:
$User
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
Mudanças recentes de senha
metadata.event_type = "USER_CHANGE_PASSWORD"
principal.user.account_type = "SERVICE_ACCOUNT_TYPE"
or principal.resource.resource_type = "SERVICE_ACCOUNT"
or principal.user.attribute.roles.type = "SERVICE_ACCOUNT"
or target.user.account_type = "SERVICE_ACCOUNT_TYPE"
or target.resource.resource_type = "SERVICE_ACCOUNT"
or target.user.attribute.roles.type = "SERVICE_ACCOUNT"
or strings.coalesce(principal.resource.type, principal.user.attribute.roles.name, principal.resource.resource_subtype, principal.user.userid, target.resource.type, target.user.attribute.roles.name, target.resource.resource_subtype, target.user.userid) = /(?i)service.*(?:account|^principal$)/ nocase
$Log_Type = metadata.log_type
$Initiator = strings.coalesce(principal.user.windows_sid, principal.user.userid, principal.user.email_addresses)
$User = strings.coalesce(target.user.userid, target.user.email_addresses)
$IP_Address = principal.ip
$Date = timestamp.get_timestamp(metadata.event_timestamp.seconds, "%F %T ")
match:
$Date, $Log_Type, $Initiator, $IP_Address, $User
order:
$Date desc
Contas de serviço excluídas ao longo do tempo
metadata.event_type = "USER_DELETION"
or metadata.event_type = "USER_RESOURCE_DELETION"
principal.user.account_type = "SERVICE_ACCOUNT_TYPE"
or principal.resource.resource_type = "SERVICE_ACCOUNT"
or principal.user.attribute.roles.type = "SERVICE_ACCOUNT"
or target.user.account_type = "SERVICE_ACCOUNT_TYPE"
or target.resource.resource_type = "SERVICE_ACCOUNT"
or target.user.attribute.roles.type = "SERVICE_ACCOUNT"
or strings.coalesce(principal.resource.type, principal.user.attribute.roles.name, principal.resource.resource_subtype, principal.user.userid, target.resource.type, target.user.attribute.roles.name, target.resource.resource_subtype, target.user.userid) = /(?i)service.*(?:account|^principal$)/ nocase
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
match:
$Date
outcome:
$Count = count(metadata.id)
order:
$Date desc
Falhas de login ao longo do tempo
metadata.event_type = "USER_LOGIN"
security_result.action = "BLOCK"
principal.user.account_type = "SERVICE_ACCOUNT_TYPE"
or principal.resource.resource_type = "SERVICE_ACCOUNT"
or principal.user.attribute.roles.type = "SERVICE_ACCOUNT"
or target.user.account_type = "SERVICE_ACCOUNT_TYPE"
or target.resource.resource_type = "SERVICE_ACCOUNT"
or target.user.attribute.roles.type = "SERVICE_ACCOUNT"
or strings.coalesce(principal.resource.type, principal.user.attribute.roles.name, principal.resource.resource_subtype, principal.user.userid, target.resource.type, target.user.attribute.roles.name, target.resource.resource_subtype, target.user.userid) = /(?i)service.*(?:account|^principal$)/ nocase
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
match:
$Date
outcome:
$Count = count(metadata.id)
order:
$Date desc
Uso ao longo do tempo
principal.user.account_type = "SERVICE_ACCOUNT_TYPE"
or principal.resource.resource_type = "SERVICE_ACCOUNT"
or principal.user.attribute.roles.type = "SERVICE_ACCOUNT"
or target.user.account_type = "SERVICE_ACCOUNT_TYPE"
or target.resource.resource_type = "SERVICE_ACCOUNT"
or target.user.attribute.roles.type = "SERVICE_ACCOUNT"
or strings.coalesce(principal.resource.type, principal.user.attribute.roles.name, principal.resource.resource_subtype, principal.user.userid, target.resource.type, target.user.attribute.roles.name, target.resource.resource_subtype, target.user.userid) = /(?i)service.*(?:account|^principal$)/ nocase
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
match:
$Date
outcome:
$Count = count(metadata.id)
order:
$Date desc
Contas de serviço excluídas recentemente
metadata.event_type = "USER_DELETION"
or metadata.event_type = "USER_RESOURCE_DELETION"
principal.user.account_type = "SERVICE_ACCOUNT_TYPE"
or principal.resource.resource_type = "SERVICE_ACCOUNT"
or principal.user.attribute.roles.type = "SERVICE_ACCOUNT"
or target.user.account_type = "SERVICE_ACCOUNT_TYPE"
or target.resource.resource_type = "SERVICE_ACCOUNT"
or target.user.attribute.roles.type = "SERVICE_ACCOUNT"
or strings.coalesce(principal.resource.type, principal.user.attribute.roles.name, principal.resource.resource_subtype, principal.user.userid, target.resource.type, target.user.attribute.roles.name, target.resource.resource_subtype, target.user.userid) = /(?i)service.*(?:account|^principal$)/ nocase
$Log_Type = metadata.log_type
$Initiator = strings.coalesce(principal.user.windows_sid, principal.user.userid, principal.user.email_addresses)
$User = strings.coalesce(target.user.userid, target.user.email_addresses)
$IP_Address = principal.ip
$Date = timestamp.get_timestamp(metadata.event_timestamp.seconds, "%F %T ")
match:
$Date, $Log_Type, $Initiator, $IP_Address, $User
order:
$Date desc
As 10 principais contas de serviço por login
metadata.event_type = "USER_LOGIN"
principal.user.account_type = "SERVICE_ACCOUNT_TYPE"
or principal.resource.resource_type = "SERVICE_ACCOUNT"
or principal.user.attribute.roles.type = "SERVICE_ACCOUNT"
or target.user.account_type = "SERVICE_ACCOUNT_TYPE"
or target.resource.resource_type = "SERVICE_ACCOUNT"
or target.user.attribute.roles.type = "SERVICE_ACCOUNT"
or strings.coalesce(principal.resource.type, principal.user.attribute.roles.name, principal.resource.resource_subtype, principal.user.userid, target.resource.type, target.user.attribute.roles.name, target.resource.resource_subtype, target.user.userid) = /(?i)service.*(?:account|^principal$)/ nocase
$Service_Account = group(principal.user.userid, target.user.userid)
$Service_Account != ""
match:
$Service_Account
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
Contas de serviço criadas recentemente
metadata.event_type = "USER_CREATION"
principal.user.account_type = "SERVICE_ACCOUNT_TYPE"
or principal.resource.resource_type = "SERVICE_ACCOUNT"
or principal.user.attribute.roles.type = "SERVICE_ACCOUNT"
or target.user.account_type = "SERVICE_ACCOUNT_TYPE"
or target.resource.resource_type = "SERVICE_ACCOUNT"
or target.user.attribute.roles.type = "SERVICE_ACCOUNT"
or strings.coalesce(principal.resource.type, principal.user.attribute.roles.name, principal.resource.resource_subtype, principal.user.userid, target.resource.type, target.user.attribute.roles.name, target.resource.resource_subtype, target.user.userid) = /(?i)service.*(?:account|^principal$)/ nocase
$Log_Type = metadata.log_type
$Initiator = strings.coalesce(principal.user.windows_sid, principal.user.userid, principal.user.email_addresses)
$User = strings.coalesce(target.user.userid, target.user.email_addresses)
$IP_Address = principal.ip
$Date = timestamp.get_timestamp(metadata.event_timestamp.seconds, "%F %T ")
match:
$Date, $Log_Type, $Initiator, $IP_Address, $User
order:
$Date desc
As 10 principais contas de serviço
principal.user.account_type = "SERVICE_ACCOUNT_TYPE"
or principal.resource.resource_type = "SERVICE_ACCOUNT"
or principal.user.attribute.roles.type = "SERVICE_ACCOUNT"
or target.user.account_type = "SERVICE_ACCOUNT_TYPE"
or target.resource.resource_type = "SERVICE_ACCOUNT"
or target.user.attribute.roles.type = "SERVICE_ACCOUNT"
or strings.coalesce(principal.resource.type, principal.user.attribute.roles.name, principal.resource.resource_subtype, principal.user.userid, target.resource.type, target.user.attribute.roles.name, target.resource.resource_subtype, target.user.userid) = /(?i)service.*(?:account|^principal$)/ nocase
$Service_Account = group(principal.user.userid, target.user.userid)
$Service_Account != ""
match:
$Service_Account
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
Contas de serviço criadas ao longo do tempo
metadata.event_type = "USER_CREATION"
principal.user.account_type = "SERVICE_ACCOUNT_TYPE"
or principal.resource.resource_type = "SERVICE_ACCOUNT"
or principal.user.attribute.roles.type = "SERVICE_ACCOUNT"
or target.user.account_type = "SERVICE_ACCOUNT_TYPE"
or target.resource.resource_type = "SERVICE_ACCOUNT"
or target.user.attribute.roles.type = "SERVICE_ACCOUNT"
or strings.coalesce(principal.resource.type, principal.user.attribute.roles.name, principal.resource.resource_subtype, principal.user.userid, target.resource.type, target.user.attribute.roles.name, target.resource.resource_subtype, target.user.userid) = /(?i)service.*(?:account|^principal$)/ nocase
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
match:
$Date
outcome:
$Count = count(metadata.id)
order:
$Date desc
Alto volume de solicitações de tíquetes de serviço do Kerberos
metadata.product_event_type = /4769/ nocase
target.application != /\$$/ nocase
additional.fields["TicketEncryptionType"] = /0x(1|2|3|12|17)/ nocase
additional.fields["TicketOptions"] = /0x408(1000|0000|1001)0/ nocase
$Host = principal.hostname
match:
$Host over 1h
outcome:
$Count = count_distinct(target.application)
condition:
$Count >= 10
order:
$Count desc
limit:
10
10 principais IPs de origem por falha no login
metadata.event_type = "USER_LOGIN"
security_result.action = "BLOCK"
principal.user.account_type = "SERVICE_ACCOUNT_TYPE"
or principal.resource.resource_type = "SERVICE_ACCOUNT"
or principal.user.attribute.roles.type = "SERVICE_ACCOUNT"
or target.user.account_type = "SERVICE_ACCOUNT_TYPE"
or target.resource.resource_type = "SERVICE_ACCOUNT"
or target.user.attribute.roles.type = "SERVICE_ACCOUNT"
or strings.coalesce(principal.resource.type, principal.user.attribute.roles.name, principal.resource.resource_subtype, principal.user.userid, target.resource.type, target.user.attribute.roles.name, target.resource.resource_subtype, target.user.userid) = /(?i)service.*(?:account|^principal$)/ nocase
$Source_IP = principal.ip
$Source_IP != ""
match:
$Source_IP
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
Os 10 principais IPs de origem por login interativo
metadata.event_type = "USER_LOGIN"
extensions.auth.mechanism = "INTERACTIVE"
or extensions.auth.mechanism = "CACHED_INTERACTIVE"
or extensions.auth.mechanism = "CACHED_REMOTE_INTERACTIVE"
or extensions.auth.mechanism = "REMOTE_INTERACTIVE"
principal.user.account_type = "SERVICE_ACCOUNT_TYPE"
or principal.resource.resource_type = "SERVICE_ACCOUNT"
or principal.user.attribute.roles.type = "SERVICE_ACCOUNT"
or target.user.account_type = "SERVICE_ACCOUNT_TYPE"
or target.resource.resource_type = "SERVICE_ACCOUNT"
or target.user.attribute.roles.type = "SERVICE_ACCOUNT"
or strings.coalesce(principal.resource.type, principal.user.attribute.roles.name, principal.resource.resource_subtype, principal.user.userid, target.resource.type, target.user.attribute.roles.name, target.resource.resource_subtype, target.user.userid) = /(?i)service.*(?:account|^principal$)/ nocase
$Source_IP = principal.ip
match:
$Source_IP
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
Logins interativos ao longo do tempo
metadata.event_type = "USER_LOGIN"
extensions.auth.mechanism = "INTERACTIVE"
or extensions.auth.mechanism = "CACHED_INTERACTIVE"
or extensions.auth.mechanism = "CACHED_REMOTE_INTERACTIVE"
or extensions.auth.mechanism = "REMOTE_INTERACTIVE"
principal.user.account_type = "SERVICE_ACCOUNT_TYPE"
or principal.resource.resource_type = "SERVICE_ACCOUNT"
or principal.user.attribute.roles.type = "SERVICE_ACCOUNT"
or target.user.account_type = "SERVICE_ACCOUNT_TYPE"
or target.resource.resource_type = "SERVICE_ACCOUNT"
or target.user.attribute.roles.type = "SERVICE_ACCOUNT"
or strings.coalesce(principal.resource.type, principal.user.attribute.roles.name, principal.resource.resource_subtype, principal.user.userid, target.resource.type, target.user.attribute.roles.name, target.resource.resource_subtype, target.user.userid) = /(?i)service.*(?:account|^principal$)/ nocase
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
match:
$Date
outcome:
$Count = count(metadata.id)
order:
$Date desc
Mudanças de senha ao longo do tempo
metadata.event_type = "USER_CHANGE_PASSWORD"
principal.user.account_type = "SERVICE_ACCOUNT_TYPE"
or principal.resource.resource_type = "SERVICE_ACCOUNT"
or principal.user.attribute.roles.type = "SERVICE_ACCOUNT"
or target.user.account_type = "SERVICE_ACCOUNT_TYPE"
or target.resource.resource_type = "SERVICE_ACCOUNT"
or target.user.attribute.roles.type = "SERVICE_ACCOUNT"
or strings.coalesce(principal.resource.type, principal.user.attribute.roles.name, principal.resource.resource_subtype, principal.user.userid, target.resource.type, target.user.attribute.roles.name, target.resource.resource_subtype, target.user.userid) = /(?i)service.*(?:account|^principal$)/ nocase
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
match:
$Date
outcome:
$Count = count(metadata.id)
order:
$Date desc
Monitoramento de logon único (SSO)
Esse painel ajuda as equipes de segurança a rastrear a atividade de SSO, detectar acessos não autorizados e otimizar a autenticação para melhorar a segurança e garantir a conformidade.
Alertas de segurança do SSO
Logins de SSO ao longo do tempo por ação
Acesso não autorizado ao SSO
Taxa de sucesso x falha do SSO
Tentativas de login com falha por usuário
Eventos de SSO ao longo do tempo por gravidade
Total de logins com SSO
Registros de atividades do SSO
Logins de SSO pelos 10 principais aplicativos
Tendência de uso do SSO
Locais de login anômalo do SSO
Visão geral da geolocalização de origem
Os 10 principais usuários por logins
10 principais aplicativos por falha no login
10 principais alertas de fornecedores
Nome do gráfico
Exemplo de consulta
Alertas de segurança do SSO
$auth_type = extensions.auth.type
$auth_type = "SSO"
$alert_state = security_result.alert_state
$alert_state = "ALERTING"
$user = strings.coalesce(target.user.user_display_name, principal.user.user_display_name)
$user != ""
$action = security_result.action
$action != "UNKNOWN_ACTION"
$event_name = security_result.summary
$severity = security_result.severity
$category = security_result.category_details
match:
$event_name, $severity, $category
outcome :
$count = count($event_name)
Logins de SSO ao longo do tempo por ação
extensions.auth.type = "SSO"
$Action = security_result.action
$Event_Type = metadata.event_type
$Event_Type = "USER_LOGIN"
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
match:
$Date, $Action
outcome :
$Count = count(metadata.id)
Acesso não autorizado ao SSO
extensions.auth.type = "SSO"
$User = strings.coalesce(target.user.userid, target.user.user_display_name, target.user.email_addresses, principal.user.userid, principal.user.user_display_name, principal.user.email_addresses)
$Action = security_result.action
$Action != "ALLOW"
$Summary = strings.coalesce(security_result.summary, metadata.description, security_result.description)
$Severity = security_result.severity
$Category = security_result.category_details
match:
$Summary,$User, $Severity, $Action,$Category
outcome :
$Count = count(metadata.id)
Taxa de sucesso x falha do SSO
$auth_type = extensions.auth.type
$auth_type = "SSO"
$user = strings.coalesce(target.user.user_display_name, principal.user.user_display_name)
$user != ""
$action = security_result.action
$action != "UNKNOWN_ACTION"
match:
$action
outcome :
$count = count($action)
Tentativas de login com falha por usuário
metadata.event_type = "USER_LOGIN"
extensions.auth.type = "SSO"
security_result.action = "BLOCK"
$User = strings.coalesce(target.user.userid, target.user.user_display_name, target.user.email_addresses, principal.user.userid, principal.user.user_display_name, principal.user.email_addresses)
$User != ""
match:
$User
outcome :
$Count = count(metadata.id)
order:
$Count desc
Eventos de SSO ao longo do tempo por gravidade
extensions.auth.type = "SSO"
$Severity = security_result.severity
(security_result.severity = "CRITICAL" or security_result.severity = "HIGH")
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
match:
$Date, $Severity
outcome :
$Count = count(metadata.id)
order:
$Date asc
Total de logins com SSO
$event_type = metadata.event_type
$event_type = "USER_LOGIN"
$auth_type = extensions.auth.type
$auth_type = "SSO"
$user = strings.coalesce(target.user.user_display_name, principal.user.user_display_name)
$user != ""
outcome :
$count = count($user)
Registros de atividades do SSO
$auth_type = extensions.auth.type
$auth_type = "SSO"
$user = strings.coalesce(target.user.user_display_name, principal.user.user_display_name)
$user != ""
$location = principal.ip_geo_artifact.location.country_or_region
$summary = security_result.summary
$summary != ""
$action = security_result.action
match:
$summary, $location, $action
outcome :
$count = count($summary)
order:
$count desc
Logins de SSO pelos 10 principais aplicativos
$event_type = metadata.event_type
$event_type = "USER_LOGIN"
$auth_type = extensions.auth.type
$auth_type = "SSO"
$user = strings.coalesce(target.user.user_display_name, principal.user.user_display_name)
$user != ""
$application = target.application
$application != ""
match:
$application
outcome :
$count = count($application)
order:
$count desc
limit: 10
Tendência de uso do SSO
$auth_type = extensions.auth.type
$auth_type = "SSO"
$user = target.user.user_display_name
$user != ""
$location = principal.ip_geo_artifact.location.country_or_region
$date = timestamp.get_date(metadata.event_timestamp.seconds)
match:
$auth_type, $date
outcome :
$count = count($auth_type)
Acesso não autorizado ao SSO
$auth_type = extensions.auth.type
$auth_type = "SSO"
$alert_state = security_result.alert_state
$user = strings.coalesce(target.user.user_display_name, principal.user.user_display_name)
$user != ""
$action = security_result.action
$action != "UNKNOWN_ACTION"
$event_name = security_result.summary
$event_name != ""
$severity = security_result.severity
$category = security_result.category_details
$category != ""
match:
$event_name,$user, $severity, $action,$category
outcome :
$count = count($event_name)
Locais de login anômalo do SSO
$auth_type = extensions.auth.type
$auth_type = "SSO"
$user = strings.coalesce(target.user.user_display_name, principal.user.user_display_name)
$user != ""
$location = principal.ip_geo_artifact.location.country_or_region
$location != ""
$location != "United States"
match:
$location
outcome :
$count = count($location)
$latitude = max(principal.ip_geo_artifact.location.region_coordinates.latitude)
$longitude = max(principal.ip_geo_artifact.location.region_coordinates.longitude)
Visão geral da geolocalização de origem
metadata.event_type = "USER_LOGIN"
extensions.auth.type = "SSO"
$Location = principal.ip_geo_artifact.location.country_or_region
match:
$Location
outcome :
$Count = count(metadata.id)
$Latitude = max(principal.ip_geo_artifact.location.region_coordinates.latitude)
$Longitude = max(principal.ip_geo_artifact.location.region_coordinates.longitude)
Os 10 principais usuários por logins
$event_type = metadata.event_type
$event_type = "USER_LOGIN"
$auth_type = extensions.auth.type
$auth_type = "SSO"
$user = strings.coalesce(target.user.user_display_name, principal.user.user_display_name)
$user != ""
match:
$user
outcome :
$count = count($user)
order:
$count desc
limit:
10
10 principais aplicativos por falha no login
metadata.event_type = "USER_LOGIN"
extensions.auth.type = "SSO"
security_result.action = "BLOCK"
$Application = target.application
$Application != ""
match:
$Application
outcome :
$Count = count(metadata.id)
Order:
$Count desc
limit:
10
10 principais alertas de fornecedores
extensions.auth.type = "SSO"
$Rule_Name = security_result.rule_name
$Rule_Name != ""
match:
$Rule_Name
outcome :
$Count = count(metadata.id)
order:
$Count desc
limit:
10
Monitoramento do Sysmon
Esse painel é usado para analisar e monitorar registros gerados pelo sysmon. Ele fornece insights sobre a atividade do sistema, incluindo criações de processos, conexões de rede e alterações de arquivos. Ao agregar e visualizar esses dados, o painel ajuda os analistas de segurança a identificar comportamentos suspeitos, rastrear possíveis ameaças e responder de acordo.
Eventos recentes do serviço
10 principais hosts
Os 10 principais IDs de eventos do Sysmon
Mudanças no registro de execução automática ao longo do tempo
Eventos recentes do WMI
Eventos de carregamento de imagens ao longo do tempo por status de assinatura
Distribuição do tipo de evento
Hosts distintos
As 10 principais linhas de comando
Os 10 principais processos que iniciam a conexão de rede
Detalhamento dos tipos de evento
Os 10 principais arquivos criados
Os 10 principais domínios consultados pelo DNS por processo de origem
Usuários distintos
Os 10 principais processos pai
10 principais usuários
Processar eventos de acesso com direitos de injeção ao longo do tempo
Total de eventos do Sysmon
10 principais processos
Eventos de carga do driver ao longo do tempo por status da assinatura
Tendência de eventos do Sysmon
Total de hosts distintos
Eventos do Sysmon ao longo do tempo
As 10 principais chaves de registro modificadas
Total de usuários distintos
Nome do gráfico
Exemplo de consulta
Eventos recentes do serviço
metadata.log_type = "WINDOWS_SYSMON"
metadata.product_event_type = "4"
or metadata.product_event_type = "5"
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
match:
$Date
outcome:
$Count = count(metadata.id)
order:
$Date desc
10 principais hosts
$event.metadata.log_type = "WINDOWS_SYSMON"
$Hostname = $event.principal.hostname
$Hostname != ""
match:
$Hostname
outcome:
$Count = count($event.metadata.id)
order:
$Count desc
limit:
10
Os 10 principais IDs de eventos do Sysmon
metadata.log_type = "WINDOWS_SYSMON"
$Event_ID = metadata.product_event_type
match:
$Event_ID
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
Mudanças no registro de execução automática ao longo do tempo
metadata.log_type = "WINDOWS_SYSMON"
metadata.product_event_type = "12"
or metadata.product_event_type = "13"
or metadata.product_event_type = "14"
target.registry.registry_key = /(?:HKCU|HKLM)\\Software\\Microsoft\\Windows(?:\sNT)?\\CurrentVersion\\(?:Run(?:Once)?|Winlogon\\(?:Shell|Userinit))/ nocase
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
match:
$Date
outcome:
$Count = count(metadata.id)
order:
$Date desc
Eventos recentes do WMI
metadata.log_type = "WINDOWS_SYSMON"
metadata.product_event_type = "19"
or metadata.product_event_type = "20"
or metadata.product_event_type = "21"
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
match:
$Date
outcome:
$Count = count(metadata.id)
order:
$Date desc
Eventos de carregamento de imagens ao longo do tempo por status de assinatura
metadata.log_type = "WINDOWS_SYSMON"
metadata.product_event_type = "7"
$Signature_Status = target.resource.attribute.labels["SignatureStatus"]
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
match:
$Date, $Signature_Status
outcome:
$Count = count(metadata.id)
order:
$Date desc
Distribuição do tipo de evento
metadata.log_type = "WINDOWS_SYSMON"
$Event_Type = metadata.event_type
match:
$Event_Type
outcome:
$Count = count(metadata.id)
order:
$Count desc
Hosts distintos
$event.metadata.log_type = "WINDOWS_SYSMON"
outcome:
$Count = count_distinct($event.principal.hostname)
As 10 principais linhas de comando
metadata.log_type = "WINDOWS_SYSMON"
$Command = target.process.command_line
$Command != ""
match:
$Command
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
Os 10 principais processos que iniciam a conexão de rede
metadata.log_type = "WINDOWS_SYSMON"
metadata.event_type = "NETWORK_CONNECTION"
$Process = principal.process.file.full_path
match:
$Process
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
Detalhamento dos tipos de evento
$event.metadata.log_type = "WINDOWS_SYSMON"
$Event_Type = $event.metadata.event_type
match:
$Event_Type
outcome:
$Count = count($event.metadata.id)
order:
$Count desc
Os 10 principais arquivos criados
$event.metadata.log_type = "WINDOWS_SYSMON"
$event.metadata.event_type = "FILE_CREATION"
$File = $event.target.file.full_path
match:
$File
outcome:
$Count = count($event.metadata.id)
order:
$Count desc
limit:
10
Os 10 principais domínios consultados pelo DNS por processo de origem
metadata.log_type = "WINDOWS_SYSMON"
metadata.product_event_type = "22"
$Source_Process = strings.coalesce(principal.process.file.full_path, principal.hostname)
$Domain = network.dns.questions.name
match:
$Domain, $Source_Process
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
Usuários distintos
$event.metadata.log_type = "WINDOWS_SYSMON"
outcome:
$Count = count_distinct($event.principal.user.userid)
10 principais hosts
metadata.log_type = "WINDOWS_SYSMON"
$Hostname = principal.hostname
$Hostname != ""
match:
$Hostname
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
Os 10 principais processos pai
metadata.log_type = "WINDOWS_SYSMON"
$Process = principal.process.file.full_path
$Process != ""
match:
$Process
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
10 principais usuários
$event.metadata.log_type = "WINDOWS_SYSMON"
$User = $event.principal.user.userid
$User != ""
match:
$User
outcome:
$Count = count($event.metadata.id)
order:
$Count desc
limit:
10
Processar eventos de acesso com direitos de injeção ao longo do tempo
metadata.log_type = "WINDOWS_SYSMON"
metadata.product_event_type = "10"
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
$Target_Process = target.process.file.full_path
match:
$Date, $Target_Process
outcome:
$Count = count(metadata.id)
order:
$Date desc
Total de eventos do Sysmon
$event.metadata.log_type = "WINDOWS_SYSMON"
outcome:
$Count = count($event.metadata.id)
10 principais processos
metadata.log_type = "WINDOWS_SYSMON"
$Process = target.process.file.full_path
$Process != ""
match:
$Process
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
10 principais processos
$event.metadata.log_type = "WINDOWS_SYSMON"
$Process = $event.target.process.file.full_path
$Process != ""
match:
$Process
outcome:
$Count = count($event.metadata.id)
order:
$Count desc
limit:
10
As 10 principais linhas de comando
$event.metadata.log_type = "WINDOWS_SYSMON"
$Command = $event.target.process.command_line
$Command != ""
match:
$Command
outcome:
$Count = count($event.metadata.id)
order:
$Count desc
limit:
10
Os 10 principais IDs de eventos do Sysmon
$event.metadata.log_type = "WINDOWS_SYSMON"
$Event_ID = $event.metadata.product_event_type
match:
$Event_ID
outcome:
$Count = count($event.metadata.id)
order:
$Count desc
limit:
10
Eventos de carga do driver ao longo do tempo por status da assinatura
metadata.log_type = "WINDOWS_SYSMON"
metadata.product_event_type = "6"
$Signature_Status = target.resource.attribute.labels["SignatureStatus"]
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
match:
$Date, $Signature_Status
outcome:
$Count = count(metadata.id)
order:
$Date desc
Tendência de eventos do Sysmon
$event.metadata.log_type = "WINDOWS_SYSMON"
$Date = timestamp.get_date($event.metadata.event_timestamp.seconds)
match:
$Date
outcome:
$Count = count($event.metadata.id)
order:
$Date asc
Os 10 principais processos que iniciam a conexão de rede
$event.metadata.log_type = "WINDOWS_SYSMON"
$event.metadata.event_type = "NETWORK_CONNECTION"
$Process = $event.principal.process.file.full_path
match:
$Process
outcome:
$Count = count($event.metadata.id)
order:
$Count desc
limit:
10
Os 10 principais arquivos criados
metadata.log_type = "WINDOWS_SYSMON"
metadata.event_type = "FILE_CREATION"
$Source = principal.process.file.full_path
$File = target.file.full_path
match:
$File, $Source
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
10 principais usuários
metadata.log_type = "WINDOWS_SYSMON"
$User = principal.user.userid
$User != ""
match:
$User
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
Total de eventos do Sysmon
metadata.log_type = "WINDOWS_SYSMON"
outcome:
$Count = count(metadata.id)
Total de hosts distintos
metadata.log_type = "WINDOWS_SYSMON"
outcome:
$Count = count_distinct(principal.hostname)
Eventos do Sysmon ao longo do tempo
metadata.log_type = "WINDOWS_SYSMON"
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
match:
$Date
outcome:
$Count = count(metadata.id)
order:
$Date desc
As 10 principais chaves de registro modificadas
metadata.log_type = "WINDOWS_SYSMON"
metadata.product_event_type = "13"
$Registry = target.registry.registry_key
match:
$Registry
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
Total de usuários distintos
metadata.log_type = "WINDOWS_SYSMON"
outcome:
$Count = count_distinct(principal.user.userid)
Os 10 principais processos pai
$event.metadata.log_type = "WINDOWS_SYSMON"
$Process = $event.principal.process.file.full_path
$Process != ""
match:
$Process
outcome:
$Count = count($event.metadata.id)
order:
$Count desc
limit:
10
Auditoria do ciclo de vida do usuário
Este painel detalhado é para gerentes e auditores de segurança analisarem as atividades de gerenciamento de contas de usuário. Ele oferece uma visão abrangente do ciclo de vida do usuário, ajudando a garantir que as políticas de provisionamento e desprovisionamento sejam seguidas corretamente.
Observação : aplique filtros para mostrar resultados relevantes no painel.
Os 10 principais IPs de origem que criam usuários
Conta de usuários recentes criada
Usuários excluídos ao longo do tempo
Atividade de contas desativadas ou excluídas
Os 10 principais IPs de origem que excluem usuários
Os 10 principais usuários que modificam usuários
Eventos do usuário ao longo do tempo
Usuários criados ao longo do tempo
Conta de usuários recentes modificada
Usuários modificados ao longo do tempo
Os 10 principais usuários que excluem usuários
Os 10 principais IPs de origem que modificam usuários
Os 10 principais usuários que criam usuários
Nome do gráfico
Exemplo de consulta
Os 10 principais IPs de origem que criam usuários
metadata.event_type = "USER_CREATION"
security_result.action = "ALLOW"
$Log_Type = metadata.log_type
$IP_Address = principal.ip
match:
$Log_Type, $IP_Address
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
Conta de usuários recentes criada
metadata.event_type = "USER_CREATION"
security_result.action = "ALLOW"
$Log_Type = metadata.log_type
$Initiator = strings.coalesce(principal.user.windows_sid, principal.user.userid, principal.user.email_addresses)
$User = strings.coalesce(target.user.userid, target.user.email_addresses)
$IP_Address = principal.ip
$Date = timestamp.get_timestamp(metadata.event_timestamp.seconds, "%F %T ")
match:
$Date, $Log_Type, $Initiator, $IP_Address, $User
order:
$Date desc
Usuários excluídos ao longo do tempo
metadata.event_type = "USER_DELETION"
security_result.action = "ALLOW"
$Log_Type = metadata.log_type
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
match:
$Date, $Log_Type
outcome:
$Count = count(metadata.id)
order:
$Date desc
Atividade de contas desativadas ou excluídas
$User = strings.coalesce(target.user.userid, target.user.email_addresses, target.user.windows_sid)
$User != ""
match:
$User
outcome:
$Deletion_Time = max(if(metadata.event_type = "USER_DELETION", metadata.event_timestamp.seconds, 0))
$Deletion_Timestamp = timestamp.get_timestamp($Deletion_Time, "%F %T ")
$Recent_Activity = max(metadata.event_timestamp.seconds)
$Recent_Activity_Timestamp = timestamp.get_timestamp($Recent_Activity, "%F %T ")
$Status = if($Deletion_Time != 0 AND ($Recent_Activity > $Deletion_Time), "Active Deleted Account", "Inactive Deleted Account")
$Event_Activities = array_distinct(metadata.event_type)
condition:
arrays.contains($Event_Activities, "USER_DELETION") AND $Status != "Inactive Deleted Account"
order:
$User desc
unselect:
$Event_Activities, $Deletion_Time, $Recent_Activity
Os 10 principais IPs de origem que excluem usuários
metadata.event_type = "USER_DELETION"
security_result.action = "ALLOW"
$Log_Type = metadata.log_type
$IP_Address = principal.ip
match:
$Log_Type, $IP_Address
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
Os 10 principais usuários que modificam usuários
metadata.event_type = "USER_CHANGE_PERMISSIONS"
or metadata.event_type = "USER_CHANGE_PASSWORD"
or metadata.event_type = "USER_RESOURCE_UPDATE_PERMISSIONS"
security_result.action = "ALLOW"
$Log_Type = metadata.log_type
$User = strings.coalesce(principal.user.windows_sid, principal.user.userid, principal.user.email_addresses)
match:
$Log_Type, $User
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
Eventos do usuário ao longo do tempo
metadata.event_type = "USER_CREATION"
or metadata.event_type = "USER_DELETION"
or metadata.event_type = "USER_CHANGE_PERMISSIONS"
or metadata.event_type = "USER_CHANGE_PASSWORD"
or metadata.event_type = "USER_RESOURCE_UPDATE_PERMISSIONS"
security_result.action = "ALLOW"
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
$Event = metadata.event_type
match:
$Date, $Event
outcome:
$Count = count(metadata.id)
order:
$Date desc
Usuários criados ao longo do tempo
metadata.event_type = "USER_CREATION"
security_result.action = "ALLOW"
$Log_Type = metadata.log_type
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
match:
$Date, $Log_Type
outcome:
$Count = count(metadata.id)
order:
$Date desc
Conta de usuários recentes modificada
metadata.event_type = "USER_CHANGE_PERMISSIONS"
or metadata.event_type = "USER_CHANGE_PASSWORD"
or metadata.event_type = "USER_RESOURCE_UPDATE_PERMISSIONS"
security_result.action = "ALLOW"
$Event_Type = metadata.event_type
$Log_Type = metadata.log_type
$User = strings.coalesce(target.user.userid, target.user.email_addresses)
$Initiator = strings.coalesce(principal.user.windows_sid, principal.user.userid, principal.user.email_addresses)
$IP_Address = principal.ip
$Date = timestamp.get_timestamp(metadata.event_timestamp.seconds, "%F %T ")
match:
$Date, $Log_Type, $Initiator, $IP_Address, $User, $Event_Type
order:
$Date desc
Usuários modificados ao longo do tempo
metadata.event_type = "USER_CHANGE_PERMISSIONS"
or metadata.event_type = "USER_CHANGE_PASSWORD"
or metadata.event_type = "USER_RESOURCE_UPDATE_PERMISSIONS"
security_result.action = "ALLOW"
$Log_Type = metadata.log_type
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
match:
$Date, $Log_Type
outcome:
$Count = count(metadata.id)
order:
$Date desc
Os 10 principais usuários que excluem usuários
metadata.event_type = "USER_DELETION"
security_result.action = "ALLOW"
$Log_Type = metadata.log_type
$User = strings.coalesce(principal.user.windows_sid, principal.user.userid, principal.user.email_addresses)
match:
$Log_Type, $User
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
Os 10 principais IPs de origem que modificam usuários
metadata.event_type = "USER_CHANGE_PERMISSIONS"
or metadata.event_type = "USER_CHANGE_PASSWORD"
or metadata.event_type = "USER_RESOURCE_UPDATE_PERMISSIONS"
security_result.action = "ALLOW"
$Log_Type = metadata.log_type
$IP_Address = principal.ip
match:
$Log_Type, $IP_Address
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
Os 10 principais usuários que criam usuários
metadata.event_type = "USER_CREATION"
security_result.action = "ALLOW"
$Log_Type = metadata.log_type
$User = strings.coalesce(principal.user.windows_sid, principal.user.userid, principal.user.email_addresses)
match:
$Log_Type, $User
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
Visão geral do login do usuário
Esse painel oferece uma análise abrangente das atividades de autenticação, ajudando você a identificar e monitorar eventos de login. Isso ajuda a detectar usuários potencialmente arriscados, analisar status e tendências de login e entender a atividade geográfica e os hosts associados. Você também pode investigar comportamentos de login incomuns, responder a possíveis violações de segurança e manter uma segurança robusta com monitoramento contínuo e detecção proativa de ameaças.
Logins por país
Número de logins bem-sucedidos no último dia
Os 10 principais IPs por status de login
Os 10 principais talkers de origem/destino no último dia: bytes
Top 10 de aplicativos por logins
Logins por aplicativo
Os 10 principais pares de origem e destino por contagem de eventos
Número de logins bem-sucedidos
Logins por status
Os 10 principais usuários por falhas de login
Usuários por status de login
Mapa de locais de login
Logins por status ao longo do tempo
Nomes de host por status de login
Contagem de eventos de abuso por IP de destino
Logins por aplicativo
Os 10 principais IPs por falhas no login
Os cinco principais talkers de origem/destino no último dia
Os 10 principais nomes de host por logins concluídos
Eventos de login de acesso com credenciais
Número de tentativas de login com falha
IPs por status de login
Falhas de login por contagem (últimas 24 horas)
Os 10 principais IPs por logins concluídos
Os 10 principais países por logins
Contagem de eventos por tipo de registro e data
Logins por status
Os 10 principais nomes de host por falhas no login
Os 10 principais talkers de origem/destino no último dia
Eventos de login de acesso inicial
Os 10 principais usuários por status de login
Taxa de falha de login
Os 10 principais usuários por logins concluídos
Nome do gráfico
Exemplo de consulta
Logins por país
metadata.event_type = "USER_LOGIN"
$Country = principal.location.country_or_region
match:
$Country
outcome:
$Count = count(metadata.id)
order:
$Count desc
Número de logins bem-sucedidos no último dia
metadata.event_type = "USER_LOGIN"
security_result.action = $action
$action = "ALLOW"
match:
$action
outcome:
$event_count = count_distinct(metadata.id)
Os 10 principais IPs por status de login
metadata.event_type = "USER_LOGIN"
$IP_Address = principal.ip
match:
$IP_Address
outcome:
$Count = count(metadata.id)
$Failed_Login_Count = sum(if(security_result.action = "BLOCK", 1, 0))
$Successful_Login_Count = sum(if(security_result.action = "ALLOW", 1, 0))
order:
$Count desc
limit:
10
Os 10 principais talkers de origem/destino no último dia: bytes
metadata.event_type = "NETWORK_CONNECTION"
$pip = principal.ip
$tip = target.ip
match:
$pip, $tip
outcome:
$event_count = count_distinct(metadata.id)
$bytes_sent = sum(network.sent_bytes)
$bytes_received = sum(network.received_bytes)
order:
$bytes_sent desc
limit:
10
Top 10 de aplicativos por logins
metadata.event_type = "USER_LOGIN"
$Application = target.application
match:
$Application
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
Logins por aplicativo
target.application != ""
$application = target.application
$login_status = security_result.action
match:
$application, $login_status
outcome:
$event_count = count_distinct(metadata.id)
order:
$event_count desc
Os 10 principais pares de origem e destino por contagem de eventos
principal.hostname != ""
target.ip != ""
$source = principal.hostname
$target = target.ip
match:
$source, $target
outcome:
$event_count = count_distinct(metadata.id)
order:
$event_count desc
limit:
10
Número de logins bem-sucedidos
metadata.event_type = "USER_LOGIN"
security_result.action = "ALLOW"
outcome:
$Count = count(metadata.id)
Logins por status
metadata.event_type = "USER_LOGIN"
$security_result = security_result.action
match:
$security_result
outcome:
$event_count = count_distinct(metadata.id)
Os 10 principais usuários por falhas de login
metadata.event_type = "USER_LOGIN"
security_result.action = "BLOCK"
$User = target.user.userid
match:
$User
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
Usuários por status de login
metadata.event_type = "USER_LOGIN"
$User = target.user.userid
match:
$User
outcome:
$Count = count(metadata.id)
$Failed_Login_Count = sum(if(security_result.action = "BLOCK", 1, 0))
$Successful_Login_Count = sum(if(security_result.action = "ALLOW", 1, 0))
order:
$Count desc
Mapa de locais de login
metadata.event_type = "USER_LOGIN"
$IP_Address = principal.ip
$Latitude = principal.location.region_latitude
$Latitude != 0
$Longitude = principal.location.region_longitude
$Longitude != 0
match:
$IP_Address, $Latitude, $Longitude
outcome:
$Count = count(metadata.id)
order:
$Count desc
Logins por status ao longo do tempo
metadata.event_type = "USER_LOGIN"
$Action = security_result.action
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
match:
$Action, $Date
outcome:
$Count = count(metadata.id)
order:
$Count asc
Nomes de host por status de login
metadata.event_type = "USER_LOGIN"
$Hostname = principal.hostname
match:
$Hostname
outcome:
$Count = count(metadata.id)
$Failed_Login_Count = sum(if(security_result.action = "BLOCK", 1, 0))
$Successful_Login_Count = sum(if(security_result.action = "ALLOW", 1, 0))
order:
$Count desc
Contagem de eventos de abuso por IP de destino
principal.hostname = "abu"
$target = target.ip
match:
$target
outcome:
$event_count = count_distinct(metadata.id)
Logins por aplicativo
metadata.event_type = "USER_LOGIN"
$Application = target.application
match:
$Application
outcome:
$Count = count(metadata.id)
$Failed_Login_Count = sum(if(security_result.action = "BLOCK", 1, 0))
$Successful_Login_Count = sum(if(security_result.action = "ALLOW", 1, 0))
order:
$Count desc
limit:
10
Os 10 principais IPs por falhas no login
metadata.event_type = "USER_LOGIN"
security_result.action = "BLOCK"
$IP_Address = principal.ip
match:
$IP_Address
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
Os cinco principais talkers de origem/destino no último dia
metadata.event_type = "NETWORK_CONNECTION"
$ip_pair = strings.concat(principal.ip,"/",target.ip)
principal.ip != "10.9.8.7"
match:
$ip_pair
outcome:
$event_count = count_distinct(metadata.id)
order:
$event_count desc
limit:
5
Os 10 principais nomes de host por logins concluídos
metadata.event_type = "USER_LOGIN"
security_result.action = "ALLOW"
$Hostname = principal.hostname
match:
$Hostname
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
Eventos de login de acesso com credenciais
metadata.event_type = "USER_LOGIN"
strings.coalesce(security_result.attack_details.tactics.name, security_result.detection_fields["Tactic"]) = /Credential Access/ nocase
outcome:
$Count = count(metadata.id)
Número de tentativas de login com falha
metadata.event_type = "USER_LOGIN"
security_result.action = "BLOCK"
outcome:
$Count = count(metadata.id)
IPs por status de login
metadata.event_type = "USER_LOGIN"
$IP_Address = principal.ip
match:
$IP_Address
outcome:
$Count = count(metadata.id)
$Failed_Login_Count = sum(if(security_result.action = "BLOCK", 1, 0))
$Successful_Login_Count = sum(if(security_result.action = "ALLOW", 1, 0))
order:
$Count desc
Falhas de login por contagem (últimas 24 horas)
metadata.event_type = "USER_LOGIN"
security_result.action = "BLOCK"
$Date = timestamp.get_timestamp(metadata.event_timestamp.seconds)
$Hostname = principal.hostname
$IP_Address = principal.ip
$User = strings.coalesce(target.user.userid, target.user.user_display_name, principal.user.userid, principal.user.user_display_name)
match:
$Date, $User, $Hostname, $IP_Address
outcome:
$Failed_Logins = count(metadata.id)
order:
$Failed_Logins desc
Os 10 principais IPs por logins concluídos
metadata.event_type = "USER_LOGIN"
security_result.action = "ALLOW"
$IP_Address = principal.ip
match:
$IP_Address
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
Os 10 principais países por logins
metadata.event_type = "USER_LOGIN"
$Country = principal.location.country_or_region
match:
$Country
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
Contagem de eventos por tipo de registro e data
$log_type = metadata.log_type
$date = timestamp.get_date(metadata.event_timestamp.seconds, "America/Los_Angeles")
match:
$date, $log_type
outcome:
$event_count = count_distinct(metadata.id)
order:
$event_count desc
Logins por status
metadata.event_type = "USER_LOGIN"
$Action = security_result.action
match:
$Action
outcome:
$Count = count(metadata.id)
order:
$Count desc
Os 10 principais nomes de host por falhas no login
metadata.event_type = "USER_LOGIN"
security_result.action = "BLOCK"
$Hostname = principal.hostname
match:
$Hostname
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
Os 10 principais talkers de origem/destino no último dia
metadata.event_type = "NETWORK_CONNECTION"
$pip = principal.ip
$tip = target.ip
match:
$pip, $tip
outcome:
$event_count = count_distinct(metadata.id)
order:
$event_count desc
limit:
10
Eventos de login de acesso inicial
metadata.event_type = "USER_LOGIN"
strings.coalesce(security_result.attack_details.tactics.name, security_result.detection_fields["Tactic"]) = /Initial Access/ nocase
outcome:
$Count = count(metadata.id)
Os 10 principais usuários por status de login
metadata.event_type = "USER_LOGIN"
$User = target.user.userid
match:
$User
outcome:
$Count = count(metadata.id)
$Failed_Login_Count = sum(if(security_result.action = "BLOCK", 1, 0))
$Successful_Login_Count = sum(if(security_result.action = "ALLOW", 1, 0))
order:
$Count desc
limit:
10
Taxa de falha de login
metadata.event_type = "USER_LOGIN"
outcome:
$Total_Logins = count(metadata.id)
$Failed_Logins = sum(if(security_result.action = "BLOCK", 1, 0))
$Failure_Rate = math.round(($Failed_Logins / $Total_Logins), 2) * 100
Os 10 principais usuários por logins concluídos
metadata.event_type = "USER_LOGIN"
security_result.action = "ALLOW"
$User = target.user.userid
match:
$User
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
Monitoramento de atividade da VPN
Esse painel fornece insights sobre eventos de VPN relacionados à segurança.
Origens de conexão geográfica
As 10 principais tentativas de VPN com falha por usuário e IP
Tendências de uso de VPN
Uso da largura de banda da VPN ao longo do tempo
Distribuição da plataforma de origem
Os 10 principais usuários de VPN por contagem de eventos
10 principais IPs de destino
Conexões VPN ativas
Sucesso x falha na conexão VPN
Nome do gráfico
Exemplo de consulta
Origens de conexão geográfica
$log_type = metadata.log_type
$log_type = /VPN|Zscaler_ZPA|ZSCALER_DECEPTION|TWINGATE|SYMANTEC_VIP_AUTHHUB/nocase
$location = principal.location.country_or_region
$location != ""
match:
$location
outcome:
$event_count = count($location)
$latitude = max(principal.location.region_coordinates.latitude)
$longitude = max(principal.location.region_coordinates.longitude)
As 10 principais tentativas de VPN com falha por usuário e IP
$log_type = metadata.log_type
$log_type = /VPN|Zscaler_ZPA|ZSCALER_DECEPTION|TWINGATE|SYMANTEC_VIP_AUTHHUB/nocase
$summary = security_result.summary
($summary = /fail/ or additional.fields["connection-attempt-status"] = /fail/ or metadata.product_event_type = /fail/)
$user = principal.user.user_display_name
$src_ip = principal.ip
match:
$user,$src_ip
outcome:
$event_count = count(metadata.id)
order:
$event_count desc
limit :
10
Tendências de uso de VPN
$log_type = metadata.log_type
$log_type = /VPN|Zscaler_ZPA|ZSCALER_DECEPTION|TWINGATE|SYMANTEC_VIP_AUTHHUB/nocase
$date = timestamp.get_date(metadata.event_timestamp.seconds)
match:
$date
outcome:
$event_count = count(metadata.id)
order:
$date asc
Uso da largura de banda da VPN ao longo do tempo
$log_type = metadata.log_type
$log_type = /VPN|Zscaler_ZPA|ZSCALER_DECEPTION|TWINGATE|SYMANTEC_VIP_AUTHHUB/nocase
$date = timestamp.get_date(metadata.event_timestamp.seconds)
$sent_bytes = network.sent_bytes
$received_bytes = network.received_bytes
match:
$date
outcome:
$total_sent_bytes = sum($sent_bytes)
$total_received_bytes = sum($received_bytes)
$total_bandwidth = $total_sent_bytes + $total_received_bytes
$total_bandwidth_kb = $total_bandwidth/ 1024
order:
$date asc
Tendências de uso de VPN
$log_type = metadata.log_type
$log_type = /VPN|Zscaler_ZPA|ZSCALER_DECEPTION|TWINGATE|SYMANTEC_VIP_AUTHHUB/nocase
$date = timestamp.get_date(metadata.event_timestamp.seconds)
match:
$date
outcome:
$event_count = count(metadata.id)
order:
$date asc
Distribuição da plataforma de origem
$log_type = metadata.log_type
$log_type = /VPN|Zscaler_ZPA|ZSCALER_DECEPTION|TWINGATE|SYMANTEC_VIP_AUTHHUB/nocase
$platform = principal.platform
match:
$platform
outcome:
$event_count = count(metadata.id)
Os 10 principais usuários de VPN por contagem de eventos
$log_type = metadata.log_type
$log_type = /VPN|Zscaler_ZPA|ZSCALER_DECEPTION|TWINGATE|SYMANTEC_VIP_AUTHHUB/nocase
$user = strings.coalesce(principal.user.user_display_name,target.user.user_display_name)
$user != ""
match:
$user
outcome:
$event_count = count(metadata.id)
order:
$event_count desc
limit:
10
10 principais IPs de destino
$log_type = metadata.log_type
$log_type = /VPN|Zscaler_ZPA|ZSCALER_DECEPTION|TWINGATE|SYMANTEC_VIP_AUTHHUB/nocase
$dest_ip = target.ip
$dest_ip != ""
match:
$dest_ip
outcome:
$event_count = count(metadata.id)
order:
$event_count desc
limit:
10
Uso da largura de banda da VPN ao longo do tempo
$log_type = metadata.log_type
$log_type = /VPN|Zscaler_ZPA|ZSCALER_DECEPTION|TWINGATE|SYMANTEC_VIP_AUTHHUB/nocase
$date = timestamp.get_date(metadata.event_timestamp.seconds)
$sent_bytes = network.sent_bytes
$received_bytes = network.received_bytes
match:
$date
outcome:
$total_sent_bytes = sum($sent_bytes)
$total_received_bytes = sum($received_bytes)
$total_bandwidth = $total_sent_bytes + $total_received_bytes
$total_bandwidth_kb = $total_bandwidth/ 1024
order:
$date asc
Conexões VPN ativas
$log_type = metadata.log_type
$log_type = /VPN|Zscaler_ZPA|ZSCALER_DECEPTION|TWINGATE|SYMANTEC_VIP_AUTHHUB/nocase
$src_ip = principal.ip
$dest_ip = target.ip
$end_time = additional.fields["connection-end-time"]
$end_time = "NA"
$user = target.user.user_display_name
$session_duration = timestamp.diff(metadata.ingested_timestamp.seconds,timestamp.as_unix_seconds(additional.fields["connection-start-time"]))
$session_duration > 100
match:
$user,$src_ip,$dest_ip,$session_duration
outcome:
$event_count = count(metadata.id)
order:
$session_duration desc,$user asc
Origens de conexão geográfica
$log_type = metadata.log_type
$log_type = /VPN|Zscaler_ZPA|ZSCALER_DECEPTION|TWINGATE|SYMANTEC_VIP_AUTHHUB/nocase
$location = principal.location.country_or_region
$location != ""
match:
$location
outcome:
$event_count = count($location)
$latitude = max(principal.location.region_coordinates.latitude)
$longitude = max(principal.location.region_coordinates.longitude)
As 10 principais tentativas de VPN com falha por usuário e IP
$log_type = metadata.log_type
$log_type = /VPN|Zscaler_ZPA|ZSCALER_DECEPTION|TWINGATE|SYMANTEC_VIP_AUTHHUB/nocase
$summary = security_result.summary
($summary = /fail/ or additional.fields["connection-attempt-status"] = /fail/ or metadata.product_event_type = /fail/)
$user = principal.user.user_display_name
$src_ip = principal.ip
match:
$user,$src_ip
outcome:
$event_count = count(metadata.id)
order:
$event_count desc
limit :
10
Distribuição da plataforma de origem
$log_type = metadata.log_type
$log_type = /VPN|Zscaler_ZPA|ZSCALER_DECEPTION|TWINGATE|SYMANTEC_VIP_AUTHHUB/nocase
$platform = principal.platform
match:
$platform
outcome:
$event_count = count(metadata.id)
Conexões VPN ativas
$log_type = metadata.log_type
$log_type = /VPN|Zscaler_ZPA|ZSCALER_DECEPTION|TWINGATE|SYMANTEC_VIP_AUTHHUB/nocase
$src_ip = principal.ip
$dest_ip = target.ip
$end_time = additional.fields["connection-end-time"]
$end_time = "NA"
$user = target.user.user_display_name
$session_duration = timestamp.diff(metadata.ingested_timestamp.seconds,timestamp.as_unix_seconds(additional.fields["connection-start-time"]))
$session_duration > 100
match:
$user,$src_ip,$dest_ip,$session_duration
outcome:
$event_count = count(metadata.id)
order:
$session_duration desc,$user asc
Sucesso x falha na conexão VPN
$log_type = metadata.log_type
$log_type = /VPN|Zscaler_ZPA|ZSCALER_DECEPTION|TWINGATE|SYMANTEC_VIP_AUTHHUB/nocase
$summary = strings.coalesce(security_result.summary, metadata.product_event_type, additional.fields["connection-attempt-status"])
($summary = /fail/ or $summary = /success/)
match:
$summary
outcome:
$event_count = count(metadata.id)
Sucesso x falha na conexão VPN
$log_type = metadata.log_type
$log_type = /VPN|Zscaler_ZPA|ZSCALER_DECEPTION|TWINGATE|SYMANTEC_VIP_AUTHHUB/nocase
$summary = strings.coalesce(security_result.summary, metadata.product_event_type, additional.fields["connection-attempt-status"])
($summary = /fail/ or $summary = /success/)
match:
$summary
outcome:
$event_count = count(metadata.id)
Os 10 principais usuários de VPN por contagem de eventos
$log_type = metadata.log_type
$log_type = /VPN|Zscaler_ZPA|ZSCALER_DECEPTION|TWINGATE|SYMANTEC_VIP_AUTHHUB/nocase
$user = strings.coalesce(principal.user.user_display_name,target.user.user_display_name)
$user != ""
match:
$user
outcome:
$event_count = count(metadata.id)
order:
$event_count desc
limit:
10
10 principais IPs de destino
$log_type = metadata.log_type
$log_type = /VPN|Zscaler_ZPA|ZSCALER_DECEPTION|TWINGATE|SYMANTEC_VIP_AUTHHUB/nocase
$dest_ip = target.ip
$dest_ip != ""
match:
$dest_ip
outcome:
$event_count = count(metadata.id)
order:
$event_count desc
limit:
10
Monitoramento do firewall de aplicativos da Web (WAF)
Esse painel foi projetado para monitorar e analisar a atividade do firewall de aplicativos da Web e melhorar a segurança e o gerenciamento de ameaças. Ele fornece insights em tempo real sobre a segurança de aplicativos da Web ao rastrear várias métricas e eventos relacionados às operações do WAF, ajudando você a gerenciar e responder com eficácia a possíveis ameaças baseadas na Web.
Detecção de tráfego anômalo
10 principais ocorrências de regras do WAF
10 principais IPs de origem
Solicitações bloqueadas x permitidas
Geolocalização de ataques
Os 10 principais tipos de ataque
10 principais acessos de URL
Nome do gráfico
Exemplo de consulta
Detecção de tráfego anômalo
$Log_Type = metadata.log_type
$Log_Type = /WAF/ nocase
$Action = security_result.action
$date = timestamp.get_date(metadata.event_timestamp.seconds)
match:
$date
outcome:
$count = count(metadata.id)
10 principais ocorrências de regras do WAF
$Log_Type = metadata.log_type
$Log_Type = /WAF/ nocase
$Rule_Name = security_result.rule_name
match:
$Rule_Name, $Log_Type
outcome:
$count = count(metadata.id)
order:
$count desc
limit:
10
10 principais IPs de origem
$Log_Type = metadata.log_type
$Log_Type = /WAF/ nocase
$Source_IP = principal.ip
$Geolocation = principal.location.country_or_region
match:
$Source_IP, $Geolocation
outcome:
$Action = array_distinct(security_result.action)
$count = count(metadata.id)
Order:
$count desc
limit:
10
Solicitações bloqueadas x permitidas
$Log_Type = metadata.log_type
$Log_Type = /WAF/ nocase
$Action = security_result.action
match:
$Action
outcome:
$count = count(metadata.id)
Solicitações bloqueadas x permitidas
$Log_Type = metadata.log_type
$Log_Type = /WAF/
$Action = security_result.action
match:
$Action
outcome:
$count = count(metadata.id)
Geolocalização de ataques
$Log_Type = metadata.log_type
$Log_Type = /WAF/
$Geolocation = principal.location.country_or_region
match:
$Geolocation
outcome:
$Latitude = max(principal.location.region_latitude)
$Longitude = max(principal.location.region_longitude)
$count = count(metadata.id)
10 principais IPs de origem
$Log_Type = metadata.log_type
$Log_Type = /WAF/
$Source_IP = principal.ip
$Source_IP != ""
$Geolocation = principal.location.country_or_region
match:
$Source_IP, $Geolocation
outcome:
$Action = array_distinct(security_result.action)
$count = count(metadata.id)
Order:
$count desc
limit:
10
Os 10 principais tipos de ataque
$Log_Type = metadata.log_type
$Log_Type = /WAF/ nocase
$Description = security_result.description
match:
$Description, $Log_Type
outcome:
$Action = array_distinct(security_result.action)
$count = count(metadata.id)
order:
$count desc
limit:
10
Detecção de tráfego anômalo
$Log_Type = metadata.log_type
$Log_Type = /WAF/
$Action = security_result.action
$date = timestamp.get_date(metadata.event_timestamp.seconds)
match:
$date
outcome:
$count = count(metadata.id)
Os 10 principais tipos de ataque
$Log_Type = metadata.log_type
$Log_Type = /WAF/
$Description = security_result.description
$Description != ""
match:
$Description, $Log_Type
outcome:
$Action = array_distinct(security_result.action)
$count = count(metadata.id)
order:
$count desc
limit:
10
Geolocalização de ataques
$Log_Type = metadata.log_type
$Log_Type = /WAF/ nocase
$Geolocation = principal.location.country_or_region
match:
$Geolocation
outcome:
$Latitude = max(principal.location.region_latitude)
$Longitude = max(principal.location.region_longitude)
$count = count(metadata.id)
10 principais acessos de URL
$Log_Type = metadata.log_type
$Log_Type = /WAF/
$URL = target.url
$URL != ""
match:
$URL, $Log_Type
outcome:
$count = count(metadata.id)
order:
$count desc
limit:
10
10 principais ocorrências de regras do WAF
$Log_Type = metadata.log_type
$Log_Type = /WAF/
$Rule_Name = security_result.rule_name
$Rule_Name != ""
match:
$Rule_Name, $Log_Type
outcome:
$count = count(metadata.id)
order:
$count desc
limit:
10
10 principais acessos de URL
$Log_Type = metadata.log_type
$Log_Type = /WAF/ nocase
$URL = target.url
match:
$URL, $Log_Type
outcome:
$count = count(metadata.id)
order:
$count desc
limit:
10
Visão geral do Web Center
Esse painel monitora e analisa padrões de tráfego da Web e a atividade do usuário em toda a rede. Ele fornece insights sobre os principais user agents, fontes, destinos e URLs, ajudando você a acompanhar o uso e detectar possíveis riscos.
Uso de versões TLS fracas ao longo do tempo
Distribuição de criptografia TLS
10 principais URLs
URLs menos comuns
Distribuição de comunicação não criptografada
Eventos ao longo do tempo por método HTTP
10 principais IPs de destino
10 principais categorias da Web
Os 10 principais usuários por método HTTP
Os 10 principais user agents HTTP
10 principais IPs de origem
10 principais usuários por bytes baixados
10 principais usuários
Os 10 principais países por URL bloqueado
Eventos ao longo do tempo por código de resposta HTTP
URL bloqueado com base no local
10 principais URLs bloqueados
Taxa de falhas na Web
Eventos HTTP bloqueados por local
10 principais IPs principais
10 principais usuários por bytes enviados
Nome do gráfico
Exemplo de consulta
Uso de versões TLS fracas ao longo do tempo
metadata.event_type = "NETWORK_HTTP"
network.tls.version = /^tls/ nocase
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
$TLS_Version = network.tls.version
$TLS_Version != ""
match:
$Date, $TLS_Version
outcome:
$Count = count(metadata.id)
order:
$Date asc
Distribuição de criptografia TLS
network.tls.cipher = /^tls/ nocase
$TLS = network.tls.cipher
$TLS != ""
match:
$TLS
outcome:
$Count = count(metadata.id)
order:
$Count desc
10 principais URLs
$event.metadata.event_type = "NETWORK_HTTP"
$URL = $event.target.url
$URL != ""
match:
$URL
outcome:
$Count = count($event.metadata.id)
order:
$Count desc
limit:
10
URLs menos comuns
metadata.event_type = "NETWORK_HTTP"
$URL = target.url
$URL != ""
match:
$URL
outcome:
$Count = count(metadata.id)
order:
$Count asc
limit:
10
Distribuição de comunicação não criptografada
metadata.event_type = "NETWORK_UNCATEGORIZED"
or metadata.event_type = "NETWORK_FLOW"
or metadata.event_type = "NETWORK_CONNECTION"
or metadata.event_type = "NETWORK_FTP"
or metadata.event_type = "NETWORK_DHCP"
or metadata.event_type = "NETWORK_DNS"
or metadata.event_type = "NETWORK_HTTP"
or metadata.event_type = "NETWORK_SMTP"
network.application_protocol = "HTTP"
or network.application_protocol = "SMTP"
or network.application_protocol = "DNS"
$Protocol = network.application_protocol
match:
$Protocol
outcome:
$Count = count(metadata.id)
order:
$Count desc
Eventos ao longo do tempo por método HTTP
$event.metadata.event_type = "NETWORK_HTTP"
$Log_Type = $event.metadata.log_type
$Event_Type = $event.metadata.event_type
$HTTP_Method = $event.network.http.method
$HTTP_Method != ""
$Date = timestamp.get_date($event.metadata.event_timestamp.seconds)
match:
$Date, $Log_Type, $Event_Type, $HTTP_Method
outcome:
$Count = count($event.metadata.id)
order:
$Date asc
10 principais IPs de destino
$event.metadata.event_type = "NETWORK_HTTP"
$Destination_IP = $event.target.ip
match:
$Destination_IP
outcome:
$Count = count($event.metadata.id)
order:
$Count desc
limit:
10
10 principais categorias da Web
$event.metadata.event_type = "NETWORK_HTTP"
$Log_Type = $event.metadata.log_type
$Event_Type = $event.metadata.event_type
$Categories = $event.security_result.category_details
$Categories != ""
match:
$Event_Type, $Log_Type, $Categories
outcome:
$Count = count($event.metadata.id)
order:
$Count desc
limit:
10
Os 10 principais usuários por método HTTP
metadata.event_type = "NETWORK_HTTP"
$User = principal.user.userid
$User != ""
$HTTP_Method = network.http.method
$HTTP_Method = /PUT|POST|DELETE/ nocase
match:
$User, $HTTP_Method
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
Os 10 principais user agents HTTP
$event.metadata.event_type = "NETWORK_HTTP"
$User_Agent = $event.network.http.user_agent
$User_Agent != ""
match:
$User_Agent
outcome:
$Count = count($event.metadata.id)
order:
$Count desc
limit:
10
10 principais IPs de origem
metadata.event_type = "NETWORK_HTTP"
$Source_IP = principal.ip
match:
$Source_IP
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
Eventos ao longo do tempo por método HTTP
metadata.event_type = "NETWORK_HTTP"
$Log_Type = metadata.log_type
$Event_Type = metadata.event_type
$HTTP_Method = network.http.method
$HTTP_Method != ""
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
match:
$Date, $Log_Type, $Event_Type, $HTTP_Method
outcome:
$Count = count(metadata.id)
order:
$Date asc
10 principais usuários por bytes baixados
metadata.event_type = "NETWORK_HTTP"
network.http.method = "GET"
$User = principal.user.userid
$User != ""
match:
$User
outcome:
$Count = sum(network.received_bytes)
order:
$Count desc
limit:
10
10 principais usuários
$event.metadata.event_type = "NETWORK_HTTP"
$User = $event.principal.user.userid
$User != ""
match:
$User
outcome:
$Count = count($event.metadata.id)
order:
$Count desc
limit:
10
URLs menos comuns
$event.metadata.event_type = "NETWORK_HTTP"
$URL = $event.target.url
$URL != ""
match:
$URL
outcome:
$Count = count($event.metadata.id)
order:
$Count asc
limit:
10
10 principais URLs
metadata.event_type = "NETWORK_HTTP"
$URL = target.url
$URL != ""
match:
$URL
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
10 principais IPs de destino
metadata.event_type = "NETWORK_HTTP"
$Destination_IP = target.ip
match:
$Destination_IP
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
Os 10 principais user agents HTTP
metadata.event_type = "NETWORK_HTTP"
$User_Agent = network.http.user_agent
$User_Agent != ""
match:
$User_Agent
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
Os 10 principais países por URL bloqueado
metadata.event_type = "NETWORK_HTTP"
security_result.action = "BLOCK"
$URL = target.url
$URL != ""
$Country = target.location.country_or_region
match:
$Country
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
Eventos ao longo do tempo por código de resposta HTTP
$event.metadata.event_type = "NETWORK_HTTP"
$Response_Code = strings.concat($event.network.http.response_code, " ")
$Date = timestamp.get_date($event.metadata.event_timestamp.seconds)
match:
$Date, $Response_Code
outcome:
$Count = count($event.metadata.id)
order:
$Date asc
URL bloqueado com base no local
metadata.event_type = "NETWORK_HTTP"
security_result.action = "BLOCK"
$URL = target.url
$URL != ""
$Latitude = target.location.region_latitude
$Longitude = target.location.region_longitude
match:
$Latitude, $Longitude
outcome:
$Count = count(metadata.id)
order:
$Count desc
10 principais URLs bloqueados
$event.metadata.event_type = "NETWORK_HTTP"
$event.security_result.action = "BLOCK"
$Blocked_URL = $event.target.url
match:
$Blocked_URL
outcome:
$Event_Count = count($event.metadata.id)
order:
$Event_Count desc
limit:
10
Eventos ao longo do tempo por código de resposta HTTP
metadata.event_type = "NETWORK_HTTP"
$Response_Code = strings.concat(network.http.response_code, " ")
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
match:
$Date, $Response_Code
outcome:
$Count = count(metadata.id)
order:
$Date asc
10 principais URLs bloqueados
metadata.event_type = "NETWORK_HTTP"
security_result.action = "BLOCK"
$Blocked_URL = target.url
match:
$Blocked_URL
outcome:
$Event_Count = count(metadata.id)
order:
$Event_Count desc
limit:
10
Taxa de falhas na Web
metadata.event_type = "NETWORK_HTTP"
$Response_Code = strings.concat(network.http.response_code, " ")
outcome:
$Total_Count = count(metadata.id)
$Failure_Count = sum(if($Response_Code = /^(4|5)/, 1, 0))
$Failure_Rate = math.round($Failure_Count / $Total_Count, 2) * 100
10 principais categorias da Web
metadata.event_type = "NETWORK_HTTP"
$Log_Type = metadata.log_type
$Event_Type = metadata.event_type
$Categories = security_result.category_details
$Categories != ""
match:
$Event_Type, $Log_Type, $Categories
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
Eventos HTTP bloqueados por local
$event.metadata.event_type = "NETWORK_HTTP"
$event.security_result.action = "BLOCK"
$URL = $event.target.url
$URL != ""
$Latitude = $event.target.location.region_latitude
$Longitude = $event.target.location.region_longitude
match:
$Latitude, $Longitude
outcome:
$Count = count($event.metadata.id)
order:
$Count desc
10 principais IPs principais
$event.metadata.event_type = "NETWORK_HTTP"
$Source_IP = $event.principal.ip
match:
$Source_IP
outcome:
$Count = count($event.metadata.id)
order:
$Count desc
limit:
10
10 principais usuários
metadata.event_type = "NETWORK_HTTP"
$User = principal.user.userid
$User != ""
match:
$User
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
10 principais usuários por bytes enviados
metadata.event_type = "NETWORK_HTTP"
network.http.method = "POST"
$User = principal.user.userid
$User != ""
match:
$User
outcome:
$Count = sum(network.sent_bytes)
order:
$Count desc
limit:
10
Visão geral da Segurança do Windows
Esse painel analisa atividades de usuários e do sistema, como gerenciamento de contas, padrões de login, detalhes de ameaças e mudanças de configuração, para oferecer uma visão abrangente da postura de segurança do Windows e melhorar os recursos de detecção e resposta a ameaças.
Observação : aplique filtros para mostrar resultados relevantes no painel.
Tarefas programadas criadas recentemente
Logon bem-sucedido x com falha ao longo do tempo
Exclusão de conta de usuário
As 10 principais contas de usuário por falhas de logon
Distribuição de alertas por host (Defender ATP)
Ameaças do Windows Defender ATP
Distribuição de ações contra ameaças
Registro de eventos de segurança limpo
Status da proteção de endpoint ao longo do tempo (Antivírus do Defender)
Criações e exclusões de contas ao longo do tempo
Mudanças recentes na política de auditoria
Detecções de ameaças ao longo do tempo
Resumo do bloqueio da conta
Modificações em grupos privilegiados
Serviços instalados recentemente
Resumo da detecção de ameaças
Os 10 principais caminhos de arquivo de ameaças
Resumo da proteção de endpoint (Antivírus do Defender)
Distribuição do tipo de logon
Principais processos gerados em servidores (Windows Sysmon)
Países distintos de login remoto
Distribuição da versão do antivírus (Defender Antivirus)
Criação de contas de usuário
Nome do gráfico
Exemplo de consulta
Tarefas programadas criadas recentemente
metadata.product_event_type = "4698"
metadata.event_type = "SCHEDULED_TASK_CREATION"
$Description = strings.coalesce(metadata.description,security_result.description,security_result.summary)
$Event_Type = metadata.event_type
$Source_Hostname = strings.coalesce(principal.hostname, principal.asset.hostname)
$Source_IP = strings.coalesce(principal.ip, principal.asset.ip)
$Source_User = strings.coalesce(principal.user.userid, principal.user.user_display_name, principal.user.email_addresses )
$Severity = security_result.severity
match:
$Source_User, $Source_Hostname, $Description ,$Source_IP , $Event_Type, $Severity
outcome:
$Count = count(metadata.id)
$Date = timestamp.get_timestamp(max(metadata.event_timestamp.seconds), "%F %T")
order :
$Date desc, $Count desc
Logon bem-sucedido x com falha ao longo do tempo
(metadata.product_event_type = "4625" OR metadata.product_event_type = "4624")
$Action = security_result.action
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
match:
$Action, $Date
outcome:
$Count = count(metadata.id)
Order:
$Date asc
Exclusão de conta de usuário
(metadata.event_type = "USER_DELETION" OR metadata.product_event_type = "4726")
$Action = security_result.action
$Source_IP = strings.coalesce(principal.ip,principal.asset.ip)
$Hostname = strings.coalesce(principal.hostname,principal.asset.hostname, principal.asset.asset_id,intermediary.hostname)
$Source_User = strings.coalesce(principal.user.userid, principal.user.user_display_name, principal.user.email_addresses)
$Target_User = strings.coalesce(target.user.userid, target.user.user_display_name, target.user.email_addresses)
match:
$Source_IP, $Hostname, $Source_User, $Target_User,$Action
outcome :
$Count = count(metadata.id)
$Date = timestamp.get_timestamp(max(metadata.event_timestamp.seconds), "%F %T")
order:
$Date desc
As 10 principais contas de usuário por falhas de logon
metadata.product_event_type = "4625"
$User = strings.coalesce(principal.user.userid, principal.user.user_display_name, principal.user.email_addresses, target.user.userid, target.user.user_display_name, target.user.email_addresses)
$Hostname = strings.coalesce(principal.hostname, principal.asset.hostname, intermediary.hostname, target.hostname, target.asset.hostname)
match:
$User, $Hostname
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
Distribuição de alertas por host (Defender ATP)
metadata.product_event_type = "DeviceAlertEvents"
$Hostname = strings.coalesce(principal.hostname, principal.asset.hostname, target.hostname, target.asset.hostname)
match:
$Hostname
outcome:
$Critical = sum(if(security_result.severity = "CRITICAL", 1, 0))
$High = sum(if(security_result.severity = "HIGH", 1, 0))
$Medium = sum(if(security_result.severity = "MEDIUM", 1, 0))
$Low = sum(if(security_result.severity = "LOW", 1, 0))
$Information = sum(if(security_result.severity = "INFORMATIONAL", 1, 0))
$Error = sum(if(security_result.severity = "ERROR", 1, 0))
$Unknown_Severity = sum(if(security_result.severity = "UNKNOWN_SEVERITY", 1, 0))
$Count = count(security_result.severity)
order :
$Count desc
Ameaças do Windows Defender ATP
metadata.product_event_type = "DeviceAlertEvents"
$Threat_Name = security_result.threat_name
$Threat_Category = security_result.category_details
$Threat_Summary = security_result.summary
$Threat_Severity = security_result.severity
$Threat_Action = security_result.action
$Hostname = strings.coalesce(principal.hostname, principal.asset.hostname, target.hostname, target.asset.hostname)
$Threat_Name != ""
match:
$Threat_Name, $Threat_Category, $Threat_Severity, $Threat_Action, $Hostname, $Threat_Summary
outcome:
$Count = count(metadata.id)
order :
$Count desc
Distribuição de ações contra ameaças
security_result.threat_name != ""
$Action = security_result.action
match:
$Action
outcome:
$Count = count(metadata.id)
Registro de eventos de segurança limpo
(metadata.product_event_type = "104" OR metadata.product_event_type = "1102" )
$Description = strings.coalesce(metadata.description,security_result.description,security_result.summary)
$Source_Hostname = strings.coalesce(principal.hostname, principal.asset.hostname)
$Severity = security_result.severity
match:
$Source_Hostname, $Description, $Severity
outcome:
$Count = count(metadata.id)
$Date = timestamp.get_timestamp(max(metadata.event_timestamp.seconds), "%F %T")
order :
$Count desc
Status da proteção de endpoint ao longo do tempo (Antivírus do Defender)
(metadata.product_event_type = "MALWAREPROTECTION_RTP_DISABLED" OR metadata.product_event_type = "MALWAREPROTECTION_RTP_ENABLED")
$Event_Type = metadata.product_event_type
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
match:
$Date, $Event_Type
outcome:
$Count = count(metadata.id)
order :
$Date asc
Criações e exclusões de contas ao longo do tempo
(metadata.event_type = "USER_CREATION" OR metadata.event_type = "USER_DELETION" OR metadata.product_event_type = "4726" OR metadata.product_event_type = "4720")
$Event_Type = metadata.event_type
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
match:
$Event_Type, $Date
outcome:
$Count = count(metadata.id)
order:
$Date asc
Mudanças recentes na política de auditoria
metadata.product_event_type= "4719"
$Description = metadata.description
$Hostname = strings.coalesce(principal.hostname, principal.asset.hostname)
$User = strings.coalesce(principal.user.userid, principal.user.user_display_name, principal.user.email_addresses)
$Source_Domain = principal.administrative_domain
$Category = extracted.fields["AuditPolicyChanges"]
$Changes = extracted.fields["Changes"]
$Severity = security_result.severity
match:
$User, $Source_Domain, $Hostname, $Description,$Severity, $Category, $Changes
outcome:
$Count = count(metadata.id)
$Date = timestamp.get_timestamp(max(metadata.event_timestamp.seconds), "%F %T")
order:
$Severity desc, $Count desc
Detecções de ameaças ao longo do tempo
$Threat_Name = security_result.threat_name
$Threat_Name != ""
$Date = timestamp.get_date(metadata.event_timestamp.seconds)
match:
$Threat_Name, $Date
outcome:
$Count = count(metadata.id)
order:
$Date asc
Resumo do bloqueio da conta
metadata.product_event_type = "4740"
$User = strings.coalesce(principal.user.userid, principal.user.user_display_name, principal.user.email_addresses, target.user.userid, target.user.user_display_name, target.user.email_addresses)
$Hostname = strings.coalesce(principal.hostname, principal.asset.hostname)
match:
$User, $Hostname
outcome:
$Date = timestamp.get_timestamp(max(metadata.event_timestamp.seconds))
$Count = count(metadata.id)
order:
$Count desc
Modificações em grupos privilegiados
(metadata.product_event_type = "4728" OR metadata.product_event_type = "4729" OR metadata.product_event_type = "4730" OR metadata.product_event_type = "4731" OR metadata.product_event_type = "4732" OR metadata.product_event_type = "4733")
$Event_Type = metadata.event_type
$Description = metadata.description
$Source_User = strings.coalesce(principal.user.userid, principal.user.user_display_name, principal.user.email_addresses)
$Target_User = strings.coalesce(target.user.userid, target.user.user_display_name, target.user.email_addresses)
$Target_Domain_Group = target.group.group_display_name
$Severity = security_result.severity
$Summary = additional.fields["Message"]
match:
$Source_User, $Target_User, $Target_Domain_Group, $Event_Type, $Description, $Severity, $Summary
outcome:
$Count = count(metadata.id)
$Date = timestamp.get_timestamp(max(metadata.event_timestamp.seconds), "%F %T")
order:
$Severity desc, $Count desc
Serviços instalados recentemente
metadata.product_event_type = "7045"
$Description = metadata.description
$User = strings.coalesce(principal.user.userid, principal.user.user_display_name, principal.user.email_addresses)
$Hostname = strings.coalesce(principal.hostname, principal.asset.hostname)
$Service_Name = extracted.fields["ServiceName"]
$Service_Filepath = target.process.file.full_path
$Service_Account = extracted.fields["ServiceAccount"]
$Service_Type = additional.fields["ServiceType"]
$Service_StartType = extracted.fields["ServiceStartType"]
$Severity = security_result.severity
match:
$User, $Hostname, $Description, $Service_Name, $Service_Filepath, $Service_Account, $Service_Type, $Service_StartType, $Severity
outcome:
$Count = count(metadata.id)
$Date = timestamp.get_timestamp(max(metadata.event_timestamp.seconds), "%F %T")
order:
$Severity desc, $Count desc
Resumo da detecção de ameaças
$Threat_Name = security_result.threat_name
$Threat_Name != ""
$Log_Type = metadata.log_type
$Event_Type = metadata.product_event_type
$Action = security_result.action
$Severity = security_result.severity
$Description = strings.coalesce(metadata.description, security_result.description, security_result.summary)
$Source_Hostname = strings.coalesce(principal.hostname, principal.asset.hostname)
$File_Path = strings.coalesce(target.file.full_path, target.registry.registry_key, principal.process.file.full_path)
match:
$Log_Type, $Description, $Threat_Name, $Event_Type, $Source_Hostname, $File_Path, $Action, $Severity
outcome:
$Count = count(metadata.id)
$Date = timestamp.get_timestamp(max(metadata.event_timestamp.seconds), "%F %T")
order:
$Date desc,$Count desc
Os 10 principais caminhos de arquivo de ameaças
security_result.action = "ALLOW" OR security_result.action = "ALLOW_WITH_MODIFICATION" OR security_result.action = "UNKNOWN_ACTION"
security_result.threat_name != ""
$Severity = security_result.severity
$File_Path = strings.coalesce(target.file.full_path, target.registry.registry_key, principal.process.file.full_path)
match:
$File_Path, $Severity
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
Resumo da proteção de endpoint (Antivírus do Defender)
(metadata.product_event_type = "MALWAREPROTECTION_RTP_DISABLED" OR metadata.product_event_type = "MALWAREPROTECTION_RTP_ENABLED")
$Description = strings.coalesce(metadata.description, security_result.description, security_result.summary)
$Severity = security_result.severity
$Action = security_result.action
$Hostname = strings.coalesce(principal.hostname, principal.asset.hostname, target.hostname, target.asset.hostname)
$Source_User = strings.coalesce(principal.user.user_display_name, principal.user.userid, principal.user.email_addresses)
$Version = metadata.product_version
match:
$Description, $Hostname, $Source_User, $Severity, $Action, $Version
outcome:
$Count = count(metadata.id)
$Date = timestamp.get_timestamp(max(metadata.event_timestamp.seconds), "%F %T")
order :
$Count desc, $Date desc
Distribuição do tipo de logon
metadata.product_event_type = "4624"
$Logon_type = extensions.auth.mechanism
match:
$Logon_type
outcome:
$Count = count(metadata.id)
Principais processos gerados em servidores (Windows Sysmon)
metadata.product_event_type = "1"
$Hostname = strings.coalesce(principal.hostname, principal.asset.hostname)
$User = strings.coalesce(principal.user.userid, principal.user.user_display_name, principal.user.email_addresses)
$Severity = security_result.severity
$Description = security_result.summary
$Principal_Process_Path = principal.process.file.full_path
$Target_Process_Path = target.process.file.full_path
match :
$Hostname, $User, $Severity, $Principal_Process_Path, $Target_Process_Path
outcome:
$Count = count(metadata.id)
order:
$Count desc
Países distintos de login remoto
metadata.event_type = "USER_LOGIN"
metadata.product_event_type = "4624"
extensions.auth.mechanism = "REMOTE_INTERACTIVE"
$Logon = extensions.auth.mechanism
$Logon_type = extensions.auth.auth_details
$Source_IP = strings.coalesce(principal.ip, principal.asset.ip)
$Source_Hostname = strings.coalesce(principal.hostname, principal.asset.hostname)
$Source_User = strings.coalesce(principal.user.userid, principal.user.user_display_name, principal.user.email_addresses )
match:
$Source_User, $Source_IP, $Source_Hostname, $Logon, $Logon_type
outcome:
$Country = array_distinct(principal.ip_geo_artifact.location.country_or_region)
$Date = timestamp.get_timestamp(max(metadata.event_timestamp.seconds), "%F %T")
$Count = count(metadata.id)
order:
$Date desc
Distribuição da versão do antivírus (Defender Antivirus)
$Anti_Virus_Version = metadata.product_version
match:
$Anti_Virus_Version
outcome:
$Count = count_distinct(principal.hostname)
limit:
50
Criação de contas de usuário
(metadata.event_type = "USER_CREATION" OR metadata.product_event_type = "4720")
$Source_IP = strings.coalesce(principal.ip,principal.asset.ip)
$Hostname = strings.coalesce(principal.hostname,principal.asset.hostname, principal.asset.asset_id,intermediary.hostname)
$Source_User = strings.coalesce(principal.user.userid, principal.user.user_display_name, principal.user.email_addresses)
$Target_User = strings.coalesce(target.user.userid, target.user.user_display_name, target.user.email_addresses)
$Action = security_result.action
match:
$Source_IP, $Hostname, $Source_User, $Target_User,$Action
outcome :
$Count = count(metadata.id)
$Date = timestamp.get_timestamp(max(metadata.event_timestamp.seconds), "%F %T")
order:
$Date desc
Segurança de rede sem fio
Esse painel oferece insights sobre a atividade e a segurança da rede, incluindo distribuições de autenticação, falhas de login, detecções de APs não autorizados e comportamento de conexão do cliente. Ele ajuda a rastrear eventos de segurança por gravidade, identificar IDs suspeitos e otimizar o desempenho da rede para um gerenciamento de riscos proativo.
Observação : aplique filtros para mostrar resultados relevantes no painel.
Detecções de pontos de acesso não autorizados
Os 10 principais tipos de autenticação por ação
Os 10 principais SSIDs por MAC de origem(Cisco Meraki)
Os 10 principais pontos de acesso por MAC de origem
10 principais tipos de evento por ação
Os 10 principais endereços MAC por falha na autenticação
Falhas recentes de autenticação (últimas 24 horas)
Total de dispositivos de origem
10 principais descrições
Os 10 principais IPs de clientes detectados em pontos de acesso maliciosos
Distribuição de tipo de autenticação
Atividade de rede ad hoc detectada (CISCO MERAKI)
Atividades sem fio suspeitas
SSIDs por falhas de autenticação(Cisco Meraki)
Distribuição de gravidade
Contagem de detecções de pontos de acesso maliciosos
Visão geral da geolocalização de origem
Nome do gráfico
Exemplo de consulta
Detecções de pontos de acesso não autorizados
$Rogue = strings.coalesce(
if (extracted.fields["description"] = /Rogue|AP Detection|Spoof/ nocase, extracted.fields["description"], ""),
if (security_result.description = /Rogue|AP Detection|Spoof/ nocase, security_result.description, ""),
if (security_result.summary = /Rogue|AP Detection|Spoof/ nocase, security_result.summary, ""),
if (metadata.description = /Rogue|AP Detection|Spoof/ nocase, metadata.description,""))
$Rogue != ""
$Source_MAC = strings.coalesce(principal.mac, principal.asset.mac)
$ID = strings.coalesce(extracted.fields["ssid"], principal.resource.name)
$Description = strings.coalesce(metadata.description, security_result.summary)
$Source_IP= strings.coalesce(principal.ip, principal.asset.ip,extracted.fields["clientIp"])
$Log_Source = metadata.log_type
$Severity = security_result.severity
$Action = security_result.action
$Target_MAC = strings.coalesce(target.mac, target.asset.mac)
match:
$Log_Source, $Description,$Source_MAC, $Source_IP, $ID, $Target_MAC,$Severity,$Action
outcome:
$Count = count(metadata.id)
$Date = timestamp.get_timestamp(max(metadata.event_timestamp.seconds), "%F %T")
order :
$Severity desc,$Date desc
Os 10 principais tipos de autenticação por ação
metadata.event_type = "USER_LOGIN"
$Logon_type = extensions.auth.type
$Action = security_result.action
match:
$Action,$Logon_type
outcome:
$Count = count(metadata.id)
order :
$Count desc
limit:
10
Os 10 principais SSIDs por MAC de origem(Cisco Meraki)
$SSID = extracted.fields["ssid"]
$Log_Type = metadata.log_type
$SSID != ""
$Action = security_result.action
match:
$SSID, $Action
outcome:
$Count = count_distinct(strings.coalesce(principal.mac, principal.asset.mac))
order:
$Count desc
limit:
10
Os 10 principais pontos de acesso por MAC de origem
$Access_Point = strings.coalesce(target.hostname, target.asset.hostname, principal.user.company_name, observer.hostname,intermediary.hostname)
$Log_Type = metadata.log_type
match:
$Access_Point, $Log_Type
outcome:
$Count = count_distinct(strings.coalesce(principal.mac, principal.asset.mac))
order :
$Count desc
limit :
10
10 principais tipos de evento por ação
$Event_Type = metadata.event_type
$Action = security_result.action
match:
$Event_Type,$Action
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
Os 10 principais endereços MAC por falha na autenticação
$Authentication_Failed = strings.coalesce(
if (extracted.fields["description"] = /authentication failed/ nocase, extracted.fields["description"], ""),
if (security_result.description = /failed to connect/ nocase, security_result.description, ""),
if (security_result.summary = /Failed Authentication|authentication failed/ nocase, security_result.summary, ""),
if (metadata.description = /Authentication failed|verification failed/ nocase, metadata.description,""))
($Authentication_Failed != "" OR (metadata.event_type= "USER_LOGIN" AND security_result.action ="BLOCK"))
$MAC_Address = strings.coalesce(principal.mac, principal.asset.mac, target.mac, target.asset.mac)
$Severity = security_result.severity
match:
$MAC_Address, $Severity
outcome:
$Count = count(metadata.id)
order:
$Count desc
limit:
10
Falhas recentes de autenticação (últimas 24 horas)
$Authentication_Failed = strings.coalesce(
if (extracted.fields["description"] = /authentication failed/ nocase, extracted.fields["description"], ""),
if (security_result.description = /failed to connect/ nocase, security_result.description, ""),
if (security_result.summary = /Failed Authentication|authentication failed/ nocase, security_result.summary, ""),
if (metadata.description = /Authentication failed|verification failed/ nocase, metadata.description, ""))
($Authentication_Failed != "" OR (metadata.event_type= "USER_LOGIN" AND security_result.action ="BLOCK"))
$Log_Source = metadata.log_type
$Source_MAC = strings.coalesce(principal.mac, principal.asset.mac)
$Source_IP = strings.coalesce(principal.ip, principal.asset.ip,extracted.fields["clientIp"])
$Severity = security_result.severity
$Action = security_result.action
$Security_Event_Type = metadata.product_event_type
$Target_MAC = strings.coalesce(target.mac, target.asset.mac)
$Description = strings.coalesce(metadata.description,extracted.fields["description"], security_result.description,security_result.summary)
$Access_Point = strings.coalesce(target.hostname, target.asset.hostname, principal.user.company_name, observer.hostname,intermediary.hostname)
match:
$Log_Source,$Description, $Source_MAC, $Source_IP, $Access_Point, $Target_MAC, $Action, $Severity
outcome:
$Count = count(metadata.id)
$Date = timestamp.get_timestamp(max(metadata.event_timestamp.seconds), "%F %T")
order :
$Date desc, $Severity desc
Total de dispositivos de origem
outcome:
$Count = count_distinct(strings.coalesce(principal.mac, principal.asset.mac))
10 principais descrições
$Description = strings.coalesce(metadata.description,security_result.description,security_result.summary,extracted.fields["description"])
$Log_Type = metadata.log_type
$Description != ""
match:
$Log_Type, $Description
outcome :
$Count = count(metadata.id)
order :
$Count desc
limit:
10
Os 10 principais IPs de clientes detectados em pontos de acesso maliciosos
$Rogue = strings.coalesce(
if (extracted.fields["description"] = /Rogue|AP Detection|Spoof/ nocase, extracted.fields["description"], ""),
if (security_result.description = /Rogue|AP Detection|Spoof/ nocase, security_result.description, ""),
if (security_result.summary = /Rogue|AP Detection|Spoof/ nocase, security_result.summary, ""),
if (metadata.description = /Rogue|AP Detection|Spoof/ nocase, metadata.description,""))
$Rogue != ""
$Client_IP = strings.coalesce(principal.ip,principal.asset.ip,extracted.fields["clientIp"])
$Action = security_result.action
match:
$Client_IP, $Action
outcome:
$Count = count(metadata.id)
order :
$Count desc
limit :
10
Distribuição de tipo de autenticação
$Logon_type = extensions.auth.type
match:
$Logon_type
outcome:
$Count = count(metadata.id)
Atividade de rede ad hoc detectada (CISCO MERAKI)
extracted.fields["type"] = "adhoc_network_detected"
$Detection_Type = extracted.fields["type"]
$SSID = extracted.fields["ssid"]
$SSID != ""
$Source_IP = extracted.fields["clientIp"]
$Source_MAC = strings.coalesce(principal.mac, principal.asset.mac)
$Category = security_result.category
$Security_Description = security_result.description
match:
$Security_Description, $Detection_Type, $SSID, $Source_MAC, $Source_IP, $Category
outcome:
$Count = count(metadata.id)
$Date = timestamp.get_timestamp(max(metadata.event_timestamp.seconds), "%F %T")
order :
$Count desc
Atividades sem fio suspeitas
(security_result.category = "NETWORK_MALICIOUS" OR security_result.category = "NETWORK_SUSPICIOUS" OR security_result.category = "NETWORK_CATEGORIZED_CONTENT" OR security_result.category = "NETWORK_COMMAND_AND_CONTROL" OR security_result.category = "NETWORK_DENIAL_OF_SERVICE" OR security_result.category = "NETWORK_RECON" OR security_result.category = "AUTH_VIOLATION")
$Log_Source = metadata.log_type
$Source_MAC = strings.coalesce(principal.mac, principal.asset.mac)
$ID = strings.coalesce(extracted.fields["ssid"], principal.resource.name)
$Source_IP = strings.coalesce(principal.ip, principal.asset.ip,extracted.fields["clientIp"])
$Severity = security_result.severity
$Action = security_result.action
$Target_MAC = strings.coalesce(target.mac, target.asset.mac)
$Description = strings.coalesce(metadata.description,extracted.fields["description"], security_result.description,security_result.summary)
match:
$Log_Source, $Description, $Source_IP, $Source_MAC, $ID, $Target_MAC , $Severity, $Action
outcome:
$Count = count(metadata.id)
$Date = timestamp.get_timestamp(max(metadata.event_timestamp.seconds), "%F %T")
order :
$Severity desc,$Date desc
SSIDs por falhas de autenticação(Cisco Meraki)
$Authentication_Failed = strings.coalesce(
if (extracted.fields["description"] = /authentication failed/ nocase, extracted.fields["description"], ""),
if (security_result.description = /failed to connect/ nocase,security_result.description, ""),
if (security_result.summary = /Failed Authentication/ nocase, security_result.summary, ""),
if (metadata.description = /Authentication failed|verification failed/ nocase, metadata.description,""))
($Authentication_Failed != "" OR (metadata.event_type= "USER_LOGIN" AND security_result.action ="BLOCK"))
$SSID = extracted.fields["ssid"]
$Source_IP = extracted.fields["clientIp"]
$SSID != ""
$Source_MAC = strings.coalesce(principal.mac, principal.asset.mac)
$Access_Point = strings.coalesce(target.hostname, target.asset.hostname, principal.user.company_name, observer.hostname,intermediary.hostname)
$AP_Model = target.asset.hardware.model
$Target_Url = target.url
$Source_Hostname = principal.hostname
$Resource_Name = principal.resource.name
match:
$SSID, $Source_MAC, $Source_IP, $Access_Point, $AP_Model, $Target_Url, $Source_Hostname, $Resource_Name
outcome:
$Count = count(metadata.id)
$Date = timestamp.get_timestamp(max(metadata.event_timestamp.seconds), "%F %T")
order :
$Count desc
Distribuição de gravidade
$Severity = security_result.severity
match:
$Severity
outcome:
$Count = count(metadata.id)
Contagem de detecções de pontos de acesso maliciosos
$Rogue = strings.coalesce(
if (extracted.fields["description"] = /Rogue|AP Detection|Spoof/ nocase, extracted.fields["description"], ""),
if (security_result.description = /Rogue|AP Detection|Spoof/ nocase, security_result.description, ""),
if (security_result.summary = /Rogue|AP Detection|Spoof/ nocase, security_result.summary, ""),
if (metadata.description = /Rogue|AP Detection|Spoof/ nocase, metadata.description,""))
$Rogue != ""
outcome:
$Count = count_distinct(strings.coalesce(target.hostname, target.asset.hostname, principal.user.company_name, observer.hostname,intermediary.hostname))
Visão geral da geolocalização de origem
$Country = strings.coalesce(principal.location.country_or_region, principal.ip_geo_artifact.location.country_or_region)
$Country != ""
match:
$Country
outcome:
$Count = count(metadata.id)
$Latitude = max(principal.location.region_latitude)
$Longitude = max(principal.location.region_longitude)
order:
$Count desc
Precisa de mais ajuda? Receba respostas de membros da comunidade e profissionais do Google SecOps.
