mirror of
https://github.com/marcredhat/kql
synced 2026-06-08 13:23:58 +00:00
marc
43 lines
2.3 KiB
Plaintext
43 lines
2.3 KiB
Plaintext
/Users/marc.chisinevski/.venvs/azcli/lib/python3.9/site-packages/urllib3/__init__.py:35: NotOpenSSLWarning: urllib3 v2 only supports OpenSSL 1.1.1+, currently the 'ssl' module is compiled with 'LibreSSL 2.8.3'. See: https://github.com/urllib3/urllib3/issues/3020
|
|
warnings.warn(
|
|
[sdl_client] session = kql-proof-64b584b2-b3db-4478-be7c-995df8785351
|
|
Latest proof_run_id from log: run-5abed53e35
|
|
|
|
================================================================================
|
|
# any event for this run
|
|
q: proof_run_id='run-5abed53e35' | group n=count()
|
|
status=success matching=445.0 took=3.6s
|
|
{'n': 445}
|
|
|
|
================================================================================
|
|
# by event_type for this run
|
|
q: proof_run_id='run-5abed53e35' | group n=count() by event_type
|
|
status=success matching=445.0 took=2.5s
|
|
{'event_type': 'AuditLogs', 'n': 12}
|
|
{'event_type': 'AzureActivity', 'n': 6}
|
|
{'event_type': 'CommonSecurityLog', 'n': 84}
|
|
{'event_type': 'DeviceFileEvents', 'n': 9}
|
|
{'event_type': 'OfficeActivity', 'n': 203}
|
|
{'event_type': 'SecurityEvent', 'n': 61}
|
|
{'event_type': 'SigninLogs', 'n': 69}
|
|
{'event_type': 'ThreatIntelIndicators', 'n': 1}
|
|
|
|
================================================================================
|
|
# all kql-proof logfile (any run)
|
|
q: logfile contains 'kql-proof' | group n=count() by event_type
|
|
status=success matching=1351.0 took=2.1s
|
|
{'event_type': 'AuditLogs', 'n': 36}
|
|
{'event_type': 'AzureActivity', 'n': 19}
|
|
{'event_type': 'CommonSecurityLog', 'n': 265}
|
|
{'event_type': 'DeviceFileEvents', 'n': 27}
|
|
{'event_type': 'OfficeActivity', 'n': 610}
|
|
{'event_type': 'SecurityEvent', 'n': 184}
|
|
{'event_type': 'SigninLogs', 'n': 207}
|
|
{'event_type': 'ThreatIntelIndicators', 'n': 3}
|
|
|
|
================================================================================
|
|
# rule 1 raw query that errors
|
|
q: proof_run_id='run-5abed53e35' event_type='SigninLogs' | filter ts_epoch_ms >= 0 | group LocationCount = estimate_distinct(Location), LocationList = group_unique_values(Location), LogonCount = count() by UserPrincipalName, AppDisplayName | filter LocationCount >= 3
|
|
status=error/client/badParam matching=None took=0.7s
|
|
ERROR: {"message": "invalid query: Unknown function 'group_unique_values'", "status": "error/client/badParam"}
|