Skip to content

Commit 7630071

Browse files
damozes1damozes1
committed
Merge branch 'master' into impersonation-bec-hunting-queries
# Conflicts: # .script/tests/KqlvalidationsTests/SkipValidationsTemplates.json
2 parents 1184007 + bab50ac commit 7630071

295 files changed

Lines changed: 24373 additions & 7098 deletions

File tree

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎.script/tests/KqlvalidationsTests/CustomTables/CatoNetworksEvents_CL.json‎

Lines changed: 1601 additions & 0 deletions
Large diffs are not rendered by default.

‎.script/tests/KqlvalidationsTests/CustomTables/FileMaliciousContentInfo.json‎

Lines changed: 85 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,85 @@
1+
{
2+
"Name": "FileMaliciousContentInfo",
3+
"Properties": [
4+
{
5+
"name": "Timestamp",
6+
"type": "Datetime"
7+
},
8+
{
9+
"name": "Workload",
10+
"type": "String"
11+
},
12+
{
13+
"name": "FileName",
14+
"type": "String"
15+
},
16+
{
17+
"name": "FolderPath",
18+
"type": "String"
19+
},
20+
{
21+
"name": "FileSize",
22+
"type": "Long"
23+
},
24+
{
25+
"name": "SHA256",
26+
"type": "String"
27+
},
28+
{
29+
"name": "FileOwnerDisplayName",
30+
"type": "String"
31+
},
32+
{
33+
"name": "FileOwnerUpn",
34+
"type": "String"
35+
},
36+
{
37+
"name": "LastModifyingAccountUpn",
38+
"type": "String"
39+
},
40+
{
41+
"name": "DocumentID",
42+
"type": "String"
43+
},
44+
{
45+
"name": "ThreatTypes",
46+
"type": "String"
47+
},
48+
{
49+
"name": "ThreatNames",
50+
"type": "String"
51+
},
52+
{
53+
"name": "DetectionMethods",
54+
"type": "Dynamic"
55+
},
56+
{
57+
"name": "LastModifiedTime",
58+
"type": "Datetime"
59+
},
60+
{
61+
"name": "FileCreationTime",
62+
"type": "Datetime"
63+
},
64+
{
65+
"name": "ReportId",
66+
"type": "String"
67+
},
68+
{
69+
"name": "TenantId",
70+
"type": "String"
71+
},
72+
{
73+
"name": "Type",
74+
"type": "String"
75+
},
76+
{
77+
"name": "SourceSystem",
78+
"type": "String"
79+
},
80+
{
81+
"name": "TimeGenerated",
82+
"type": "Datetime"
83+
}
84+
]
85+
}

‎.script/tests/KqlvalidationsTests/CustomTables/HalcyonEventsV2_CL.json‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -5,6 +5,10 @@
55
"name": "TimeGenerated",
66
"type": "datetime"
77
},
8+
{
9+
"name": "Type",
10+
"type": "string"
11+
},
812
{
913
"name": "activity_id",
1014
"type": "int"

‎.script/tests/KqlvalidationsTests/CustomTables/ThinkstCanaryIncidents_CL.json‎

Lines changed: 121 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,121 @@
1+
{
2+
"Name": "ThinkstCanaryIncidents_CL",
3+
"Properties": [
4+
{
5+
"Name": "TimeGenerated",
6+
"Type": "datetime"
7+
},
8+
{
9+
"Name": "IncidentId",
10+
"Type": "string"
11+
},
12+
{
13+
"Name": "Description",
14+
"Type": "string"
15+
},
16+
{
17+
"Name": "Acknowledged",
18+
"Type": "string"
19+
},
20+
{
21+
"Name": "Created",
22+
"Type": "real"
23+
},
24+
{
25+
"Name": "CreatedPrintable",
26+
"Type": "string"
27+
},
28+
{
29+
"Name": "DestinationIP",
30+
"Type": "string"
31+
},
32+
{
33+
"Name": "DestinationPort",
34+
"Type": "string"
35+
},
36+
{
37+
"Name": "EventsCount",
38+
"Type": "string"
39+
},
40+
{
41+
"Name": "Events",
42+
"Type": "dynamic"
43+
},
44+
{
45+
"Name": "FlockId",
46+
"Type": "string"
47+
},
48+
{
49+
"Name": "FlockName",
50+
"Type": "string"
51+
},
52+
{
53+
"Name": "HashId",
54+
"Type": "string"
55+
},
56+
{
57+
"Name": "Host",
58+
"Type": "dynamic"
59+
},
60+
{
61+
"Name": "IpAddress",
62+
"Type": "string"
63+
},
64+
{
65+
"Name": "IncidentUpdated",
66+
"Type": "datetime"
67+
},
68+
{
69+
"Name": "LocalTime",
70+
"Type": "string"
71+
},
72+
{
73+
"Name": "Memo",
74+
"Type": "string"
75+
},
76+
{
77+
"Name": "RawEvent",
78+
"Type": "dynamic"
79+
},
80+
{
81+
"Name": "LogType",
82+
"Type": "string"
83+
},
84+
{
85+
"Name": "NodeId",
86+
"Type": "string"
87+
},
88+
{
89+
"Name": "Notified",
90+
"Type": "string"
91+
},
92+
{
93+
"Name": "PreviouslySeenCount",
94+
"Type": "real"
95+
},
96+
{
97+
"Name": "Sensor",
98+
"Type": "string"
99+
},
100+
{
101+
"Name": "SourceIP",
102+
"Type": "string"
103+
},
104+
{
105+
"Name": "SrcHostReverse",
106+
"Type": "string"
107+
},
108+
{
109+
"Name": "SourcePort",
110+
"Type": "string"
111+
},
112+
{
113+
"Name": "UpdatedId",
114+
"Type": "real"
115+
},
116+
{
117+
"Name": "UpdatedTimePrintable",
118+
"Type": "string"
119+
}
120+
]
121+
}

‎.script/tests/KqlvalidationsTests/CustomTables/dossier_atp_CL.json‎

Lines changed: 56 additions & 32 deletions
Original file line numberDiff line numberDiff line change
@@ -2,88 +2,112 @@
22
"Name": "dossier_atp_CL",
33
"Properties": [
44
{
5-
"Name": "TenantId",
5+
"Name": "task_id",
66
"Type": "string"
77
},
88
{
9-
"Name": "SourceSystem",
10-
"Type": "string"
9+
"Name": "params",
10+
"Type": "dynamic"
1111
},
1212
{
13-
"Name": "MG",
13+
"Name": "params_type",
1414
"Type": "string"
1515
},
1616
{
17-
"Name": "ManagementGroupName",
17+
"Name": "params_target",
1818
"Type": "string"
1919
},
2020
{
21-
"Name": "TimeGenerated",
22-
"Type": "datetime"
21+
"Name": "params_source",
22+
"Type": "string"
2323
},
2424
{
25-
"Name": "Computer",
25+
"Name": "status",
2626
"Type": "string"
2727
},
2828
{
29-
"Name": "RawData",
30-
"Type": "string"
29+
"Name": "time_value",
30+
"Type": "real"
3131
},
3232
{
33-
"Name": "status_message_for_dossier_s",
33+
"Name": "v_value",
3434
"Type": "string"
3535
},
3636
{
37-
"Name": "data_attack_chain_collection_s",
38-
"Type": "string"
37+
"Name": "data",
38+
"Type": "dynamic"
3939
},
4040
{
41-
"Name": "data_attack_chain_credential_access_s",
42-
"Type": "string"
41+
"Name": "data_record_count",
42+
"Type": "real"
4343
},
4444
{
45-
"Name": "data_attack_chain_defense_evasion_s",
46-
"Type": "string"
45+
"Name": "data_attack_chain",
46+
"Type": "dynamic"
4747
},
4848
{
49-
"Name": "data_attack_chain_execution_s",
50-
"Type": "string"
49+
"Name": "data_attack_chain_collection",
50+
"Type": "dynamic"
51+
},
52+
{
53+
"Name": "data_attack_chain_command_and_control",
54+
"Type": "dynamic"
55+
},
56+
{
57+
"Name": "data_attack_chain_credential_access",
58+
"Type": "dynamic"
5159
},
5260
{
53-
"Name": "data_attack_chain_initial_access_s",
61+
"Name": "data_attack_chain_defense_evasion",
62+
"Type": "dynamic"
63+
},
64+
{
65+
"Name": "data_attack_chain_discovery",
5466
"Type": "string"
5567
},
5668
{
57-
"Name": "task_id_g",
69+
"Name": "data_attack_chain_execution",
70+
"Type": "dynamic"
71+
},
72+
{
73+
"Name": "data_attack_chain_exfiltration",
74+
"Type": "dynamic"
75+
},
76+
{
77+
"Name": "data_attack_chain_impact",
5878
"Type": "string"
5979
},
6080
{
61-
"Name": "params_type_s",
81+
"Name": "data_attack_chain_initial_access",
82+
"Type": "dynamic"
83+
},
84+
{
85+
"Name": "data_attack_chain_lateral_movement",
6286
"Type": "string"
6387
},
6488
{
65-
"Name": "params_target_s",
89+
"Name": "data_attack_chain_persistence",
6690
"Type": "string"
6791
},
6892
{
69-
"Name": "params_source_s",
93+
"Name": "data_attack_chain_privilege_escalation",
7094
"Type": "string"
7195
},
7296
{
73-
"Name": "status_s",
97+
"Name": "status_message_for_dossier",
7498
"Type": "string"
7599
},
76100
{
77-
"Name": "time_d",
78-
"Type": "real"
101+
"Name": "TimeGenerated",
102+
"Type": "datetime"
79103
},
80104
{
81-
"Name": "v_s",
82-
"Type": "string"
105+
"Name": "RowData",
106+
"Type": "dynamic"
83107
},
84108
{
85-
"Name": "data_record_count_d",
86-
"Type": "real"
109+
"Name": "TenantId",
110+
"Type": "string"
87111
},
88112
{
89113
"Name": "Type",
@@ -94,4 +118,4 @@
94118
"Type": "string"
95119
}
96120
]
97-
}
121+
}

0 commit comments

Comments
 (0)