Hi guys,
The team has created this search To Alerts when a host has an infection that has been re-infected remove multiple times over multiple days.
but we are not sure what we could do to get better results because alerts are coming a lot when we did this :
| tstats summariesonly=true allow_old_summaries=true dc(Malware_Attacks.date) as "day_count",count from datamodel="Malware"."Malware_Attacks" by "Malware_Attacks.dest","Malware_Attacks.signature","Malware_Attacks.action" | rename "Malware_Attacks.dest" as "dest","Malware_Attacks.signature" as "signature","Malware_Attacks.action" as action | where 'day_count'>5 | fields dest signature action day_count count | search signature!=unknown
Also do u guys know if the last pipe will break the search since it is a data model search
Yes, Do u know if the last pipe will break the search since it is a data model search ?
Are you looking for the value "unknown"? If so, put quotes around it.
Yes, do u know if the last pipe will break the search since it is a data model search