About fdevera

scelikok · ‎03-24-2021

Hi @fdevera, You can add it to where condition; please try below. index=security sourcetype=malware (connect OR disconnect OR recv) | lookup dnslookup clientip as src_ip OUTPUT clienthost as fqdn | rex field=fqdn "(?<hostname>[^.]+)\." | rex field=_raw recv\:\s+User-Agent\:\s+(?<user_agent>.*) | rex field=_raw recv\:\s+Host\:\s+(?<url>.*) | eval url=replace(url,"\.","[.]") | where isnotnull(url) | eventstats dc(url) as url_count by src_ip | where url_count>1 OR url="www.badurl.com" | transaction src_ip | table _time hostname url user_agent src_ip fqdn dest_port url_count

tscroggins · ‎02-20-2021

@fdevera A typical recurring lookup generator would append to the existing lookup: index=azuread | rex field=initiatedBy.user.userPrincipalName "ex(?<GUID>\d+)z\@" | search GUID=* | table initiatedBy.user.userPrincipalName, GUID | inputlookup append=t zguids.csv | dedup initiatedBy.user.userPrincipalName | outputlookup zguids.csv The initial lookup can be populated by executing the search manually over a sufficient range of time. Subsequent searches should be limited to the schedule window. I.e. For an hourly search, set earliest=-1h@h latest=@h. Be sure to account for input lag and adjust scheduling as needed.

fdevera · ‎02-03-2021

1st search works (I get all fields in my table including GUID): earliest=-1y index=azuread sourcetype="ms:aad:audit" category=DirectoryManagement (activityDisplayName="CreateTrustFrameworkPolicy" OR activityDisplayName="Add unverified domain" OR activityDisplayName="Add verified domain" OR activityDisplayName="Set federation settings on domain" OR activityDisplayName="Get tenant details" OR activityDisplayName="Initialize tenant" OR activityDisplayName="Create company" OR activityDisplayName="Create program") | fillnull value=”N/A” | rex field=initiatedBy.user.userPrincipalName "ex(?<GUID>\d+)z\@" | table activityDateTime, activityDisplayName, operationType, targetResources{}.displayName, targetResources{}.modifiedProperties{}.displayName, targetResources{}.modifiedProperties{}.oldValue, targetResources{}.modifiedProperties{}.newValue, initiatedBy.user.userPrincipalName, GUID 2nd search works (I get cn from map command by itself): earliest=-1y index=azuread sourcetype="ms:aad:audit" category=DirectoryManagement (activityDisplayName="CreateTrustFrameworkPolicy" OR activityDisplayName="Add unverified domain" OR activityDisplayName="Add verified domain" OR activityDisplayName="Set federation settings on domain" OR activityDisplayName="Get tenant details" OR activityDisplayName="Initialize tenant" OR activityDisplayName="Create company" OR activityDisplayName="Create program") | rex field=initiatedBy.user.userPrincipalName "ex(?<GUID>\d+)z\@" | fillnull value=”N/A” | map search="ldapsearch domain=DEFAULT search=\"(&(objectClass=user)(qcguid=$GUID$))\" attrs=cn" | table cn 3rd search combining the two searches blanks out my table but properly shows cn field obtained from map: earliest=-1y index=azuread sourcetype="ms:aad:audit" category=DirectoryManagement (activityDisplayName="CreateTrustFrameworkPolicy" OR activityDisplayName="Add unverified domain" OR activityDisplayName="Add verified domain" OR activityDisplayName="Set federation settings on domain" OR activityDisplayName="Get tenant details" OR activityDisplayName="Initialize tenant" OR activityDisplayName="Create company" OR activityDisplayName="Create program") | rex field=initiatedBy.user.userPrincipalName "ex(?<GUID>\d+)z\@" | fillnull value=”N/A” | map search="ldapsearch domain=DEFAULT search=\"(&(objectClass=user)(qcguid=$GUID$))\" attrs=cn" | table activityDateTime, activityDisplayName, operationType, targetResources{}.displayName, targetResources{}.modifiedProperties{}.displayName, targetResources{}.modifiedProperties{}.oldValue, targetResources{}.modifiedProperties{}.newValue, initiatedBy.user.userPrincipalName, GUID,cn How do fix this? Append, appendcols, join? Any idea? Thanks!

richgalloway · ‎01-28-2021

I have no suggestions about that.

fdevera · ‎01-26-2021

| rex field=initiatedBy.user.userPrincipalName "ex(?<GUID>\d+)d\@" That worked thank you! Now I have a GUID field with the values I need. One last thing, how would I use the following search to convert that GUID into a username? In the example below, "235999" would be where the GUID value is inserted. | ldapsearch domain=DEFAULT search="(&(objectClass=user)(exguid=235999))" | table name

fdevera · ‎01-26-2021

Bump please help

efavreau · ‎12-18-2020

@fdevera You could use a regular expression to create a new field for the subdomain, then call that new field in your table. | rex field=src "(?<justthesubdomain>.+?(?=\.))" | table justthesubdomain

fdevera · ‎11-05-2020

Bump

richgalloway · ‎10-08-2020

To check the randomization of the filename rather than the whole path, extract the name from the New_Process_Name field. eventtype=winevent EventCode=4688 (New_Process_Name="C:\\Windows\\TEMP\\*" OR New_Process_Name="C:\\users\\*\\appdata\\local\\temp\\*") NOT New_Process_Name="C:\\Users\\asiaynrf\\AppData\\Local\\Temp\\QIKCache\\*" | rex field=New_Process_Name "\\\(?<filename>[^\\\]+)$" | lookup ut_shannon_lookup word as filename | where ut_shannon > 4.5 | stats values(ut_shannon) as "Shannon Entropy Score" by New_Process_Name,host | rename New_Process_Name as Process,host as Endpoint | sort -"Shannon Entropy Score"

fdevera · ‎09-28-2020

Any ideas?

fdevera · ‎07-02-2020

Sorry I didn't explain clearly. dest field has fully qualified computernames and while many follow naming convention, the majority do not and we're talking about 30,000+ systems. dest_nt_domain field should only contain actual domains or bogus domains but in this case includes computernames which I suspect are local logins. e.g. COMPUTERNAME\username. I need something that notices the unqualified part of the fully qualified computername in the dest field, matches it up with the same computername showing up in the dest_nt_domain field and based on that match, excludes the result.

anilchaithu · ‎06-22-2020

if this helps an upvote would be appreciated

richgalloway · ‎06-22-2020

Thank you for clarifying the problem. This where clause should do the job. | where NOT like(TargetOutboundUserName, SubjectUserName."x")

to4kawa · ‎04-27-2020

index=azuread sourcetype=ms:aad:signin appDisplayName="Microsoft Teams" | table _time alternateSignInName appliedConditionalAccessPolicies{}.* | rename appliedConditionalAccessPolicies{}.* as *, *{} as * | eval _counter=mvrange(0,mvcount(result)) | stats values(alternateSignInName) as _alternateSignInName list(*) as * by _counter | foreach * [ eval <<FIELD>> = mvindex('<<FIELD>>', _counter)] | rename _* as * | fields - counter | table alternateSignInName * I'd like to look at the log once.

Sukisen1981 · ‎08-25-2019

glad to see you figured it out @fdevera . Sorry I am in IST times and it was too late in the night for me to see your comments,

Posts	36
Solutions	0
Karma Given	11
Karma Received	1
Member Since	‎08-21-2019

Online Status	Offline
Date Last Visited	‎03-26-2021 03:39 AM

Search for more than 1 url hit on a src_ip

Best way to dump Azure UPNs into scheduled lookup.

ldapsearch through map command is blanking out the...

How to populate results from regex into an ldap se...

Help with REGEX

Azure AD UPN results regex translation

How to drop domain from results

Webproxy search help

Looking for processes executions in temp directori...

Subsearch and Join(?) for VPN+Azure+O365 correlati...

Re: Search for more than 1 url hit on a src_ip

Re: Best way to dump Azure UPNs into scheduled loo...

ldapsearch through map command is blanking out the...

Re: How to populate results from regex into an lda...

Re: Help with REGEX

Re: Azure AD UPN results regex translation

Re: How to drop domain from results

Re: Webproxy search help

Re: Looking for processes executions in temp direc...

Re: Subsearch and Join(?) for VPN+Azure+O365 corre...

Re: Need help excluding results which have field v...

Re: Problem with a macro

Re: Help with excluding field combination

Re: Splitting MultiValue Fields: appliedConditiona...

Re: Need rex help with URL