About akselsoeb

akselsoeb · ‎04-09-2024

I have the same issue but these arguments are not set in the code? Same issue as OP is writing about. The table is shown if i select the classic dashboard, but not in studio..

akselsoeb · ‎12-28-2023

Thank you @dtburrows3 This was exactly what i was looking for.

akselsoeb · ‎12-27-2023

Hello guys I need some help with making a table/dashboard that shows me changes to incidents in our Defender platform. The underlying issue that we see is that Defender sometimes, when an incident is handled by automation, de-escalate the severity of a particular incident. So in my index of incidents i want to track for each specific incident that is handled by automation to show me when the severity field changes. The table should look something link this. IncidentId Description Status Old_Severity New_Severity I don't know whether to use the streamstats or the dedup command. I've been fiddling abit with both but can't seem to get the right output. Anyways, hope you can help me out here. If theres something unclear about my question, let me know so i can clarify.

akselsoeb · ‎11-22-2023

I got some help from a co-worker which looks to solve my issue, here is the query that he provided me with. All the credit goes to him btw! 😄 | tstats summariesonly=true count from datamodel="Authentication" WHERE Authentication.action="failure" AND Authentication.user="*" AND Authentication.src="*" AND Authentication.user!=*$ by _time span=1d,Authentication.user | `drop_dm_object_name("Authentication")` | sort 0 - _time | eval date=strftime(_time,"%Y-%m-%d %H:%M:%S") | transaction user maxpause=24h mvlist=true | stats max(eventcount) as maxeventcount by user | where maxeventcount>5 | rename maxeventcount as DaysInRow Using the transaction command instead (which i need to study abit to understand) and also works around the issue with the sort command limitation of 10000 events. I will let him know about the approach you're suggesting and see what he thinks about that one.

akselsoeb · ‎11-21-2023

Thanks for the reply @PickleRick It sounds rather complicated with my minimal knowledge, but i will give it a shot.

akselsoeb · ‎11-21-2023

Hello I am trying to add some logic/formatting to my list of failed authentications. Heres my search query. | tstats summariesonly=true count from datamodel="Authentication" WHERE Authentication.action="failure" AND Authentication.user="*" AND Authentication.src="*" AND Authentication.user!=*$ by Authentication.user | `drop_dm_object_name("Authentication")` | sort - count | head 10 I want to make it so that it counts how many consecutive days a user has been on this list, is that possible?

Posts	6
Solutions	0
Karma Given	0
Karma Received	0
Member Since	‎11-21-2023

Online Status	Offline
Date Last Visited	‎04-09-2024 09:38 AM

Track Changes to a field

Add a day counter to a list/table.

Re: "No Data" with Dashboard Studio

Re: Track Changes to a field

Track Changes to a field

Re: Add a day counter to a list/table.

Re: Add a day counter to a list/table.

Add a day counter to a list/table.

Join the Conversation