Azure query

havatz — Wed, 14 Oct 2020 06:16:19 GMT

Hello

I have this query:

"| tstats `summariesonly` values(Authentication.app) as app,count from datamodel=Authentication.Authentication where earliest=-1d by Authentication.action,Authentication.src,index | `drop_dm_object_name(\"Authentication\")` | eval success=if(action=\"success\",count,0),failure=if(action=\"failure\",count,0) | stats values(app) as app,sum(failure) as failure,sum(success) as success by src,index | where success > 0 | `mltk_apply_upper(\"app:failures_by_src_count_1d\", \"medium\", \"failure\")` | table userPrincipalName, state"

1. I need to add user to the query but I didnt find user field on this datamodel (used this stats dc() as * | transpose)

How can I find all the fields there ?

2. Also, shows app list + number of failures + number of successes, but but no correlation of failures/successes to apps, how can I add this?

3. How can I add failure reason ?

thanks!

topic Azure query in Splunk Enterprise Security

Azure query