SIEM Query Catalog

Copy and Paste into SIEM Search Bar - (Replace XXXX values) SELECT new_logs.uuid, new_logs.organization_id, new_logs.event_code_string AS ecs_event_code, new_logs.event_action AS event_action, new_logs.source_ip AS source_ip, new_logs.destination_ip AS destination_ip, new_ logs.host _hostname AS host_hostname, new_logs.message FROM new_logs AS logs WHERE new_logs.organization_id = XXXXX AND new_logs.account_id = XXXXXX AND new_logs.uuid >= 'XXXX-XXXX-XXXX' AND new_logs.uuid < 'XXXX-XXXX-XXXX' AND new_logs.event_provider = 'Fortigate' ORDER BY new_logs.uuid DESC LIMIT 100

Copy and Paste into SIEM Search Bar - (replace the XXXX values) SELECT new_logs.uuid, new_logs.organization_id, new_ logs.host _hostname AS host_hostname, new_logs.ecs_fields['winlog.event_data.SubjectUserName'] AS ecs_winlog_event_data_SubjectUserName, new_logs.ecs_fields['winlog.event_data.TaskName'] AS ecs_winlog_event_data_TaskName, new_logs.message FROM new_logs AS logs WHERE new_logs.organization_id = XXXXX AND new_logs.account_id = XXXX AND new_logs.uuid >= 'XXXXX-XXXXX-XXXXXX' AND new_logs.uuid < 'XXXXXXXX-XXXXXX-XXXXXXX' AND new_logs.event_provider = 'Microsoft-Windows-Security-Auditing' AND new_logs.event_code = 4698 AND lower(new_ logs.host _hostname) = 'XXX-XXXX ORDER BY new_logs.uuid DESC LIMIT 100

Copy and Paste into SIEM Seach Bar SELECT new_logs.uuid, new_logs.organization_id, new_logs.user_id AS user_id, new_logs.ecs_fields['itdr.ObjectId'] AS ecs_itdr_ObjectId, new_logs.ecs_fields['itdr.Operation'] AS ecs_itdr_Operation, new_logs.ecs_fields['itdr.TargetUserOrGroupName'] AS ecs_itdr_TargetUserOrGroupName, new_logs.ecs_fields['itdr.ModifiedProperties'] AS ecs_itdr_ModifiedProperties, new_logs.ecs_fields['itdr.ResultStatus'] AS ecs_itdr_ResultStatus, new_logs.message FROM new_logs AS logs WHERE new_logs.account_id = 7234 AND new_logs.uuid >= '019f1d98-c8e0-7000-8000-000000000000' AND new_logs.uuid < '019f1e74-82e0-7000-8000-000000000000' AND new_logs.event_provider = 'ITDR' AND (mapContains(new_logs.ecs_fields, 'itdr.Operation') = 1 AND new_logs.ecs_fields['itdr.Operation'] = 'Add member to role.' OR mapContains(new_logs.ecs_fields, 'itdr.Operation') = 1 AND new_logs.ecs_fields['itdr.Operation'] = 'Remove member from role.') AND (mapContains(new_logs.ecs_fields, 'itdr.TargetUserOrGroupName') = 1 AND lower(new_logs.ecs_fields['itdr.TargetUserOrGroupName']) ILIKE '%domain admins%' OR mapContains(new_logs.ecs_fields, 'itdr.ModifiedProperties') = 1 AND lower(new_logs.ecs_fields['itdr.ModifiedProperties']) ILIKE '%domain admins%') ORDER BY new_logs.uuid DESC LIMIT 100

SELECT new_logs.uuid, new_logs.organization_id, new_ logs.host _hostname AS host_hostname, new_logs.user_name AS user_name, new_logs.source_ip AS source_ip, new_logs.message FROM new_logs AS logs WHERE new_logs.account_id = 58711 AND new_logs.uuid >= '019f65b7-4f20-7000-8000-000000000000' AND new_logs.uuid < '019f6693-0920-7000-8000-000000000000' AND new_logs.event_provider = 'Microsoft-Windows-Security-Auditing' AND new_logs.event_code = 4625 ORDER BY new_logs.uuid DESC LIMIT 100

Copy and paste into SIEM Search Bar SELECT new_logs.uuid, new_logs.organization_id, new_logs.event_provider AS event_provider, new_logs.event_code_string AS ecs_event_code, new_ logs.host _hostname AS host_hostname, new_logs.user_name AS user_name, new_logs.source_ip AS source_ip, new_logs.message FROM new_logs AS logs WHERE new_logs.account_id = 2870 AND new_logs.log_source_id = 3685373 AND new_logs.uuid >= '019f83de-1ec0-7000-8000-000000000000' AND new_logs.uuid < '019f84b9-d8c0-7000-8000-000000000000' AND (new_logs.message ILIKE '%invalid%login%' OR new_logs.message ILIKE '%login%fail%' OR new_logs.message ILIKE '%authentication%fail%' OR new_logs.message ILIKE '%auth%fail%') ORDER BY new_logs.uuid DESC LIMIT 100

Copy and paste into SIEM Search Bar SELECT new_logs.uuid, new_logs.organization_id, new_logs.event_code_string AS ecs_event_code, new_logs.event_action AS event_action, new_logs.user_name AS user_name, new_logs.source_ip AS source_ip, new_logs.ecs_fields['sonicwall.msg'] AS ecs_sonicwall_msg, new_logs.message FROM new_logs AS logs WHERE new_logs.organization_id = 669808 AND new_logs.account_id = 60103 AND new_logs.uuid >= '019f89aa-30a0-7000-8000-000000000000' AND new_logs.uuid < '019f8a85-eaa0-7000-8000-000000000000' AND new_logs.event_provider = 'Syslog-SonicWall' AND new_logs.message ILIKE '%SSLVPN%' ORDER BY new_logs.uuid DESC LIMIT 100

Copy and paste into SIEM Search Bar (replace XXXX with specific values) SELECT all_logs.uuid, all_logs.organization_id, all_logs.event_provider AS event_provider, all_logs.event_code_string AS ecs_event_code, all_logs.ecs_fields['source.ip'] AS ecs_source_ip, all_logs.ecs_fields['client.ip'] AS ecs_client_ip, all_logs.ecs_fields['winlog.event_data.IpAddress'] AS ecs_winlog_event_data_IpAddress, all_logs.ecs_fields['itdr.ClientIP'] AS ecs_itdr_ClientIP, all_ logs.host _hostname AS host_hostname, all_logs.ecs_fields[' user.email '] AS ecs_user_email, all_logs.message FROM all_logs AS logs WHERE all_logs.account_id = XXXX AND all_logs.agent_id = XXXXX AND all_logs.uuid >= 'XXXXXXXXXXXXX' AND all_logs.uuid < 'XXXXXXXXXXXXXXXX' AND (mapContains(all_logs.ecs_fields, 'source.ip') = 1 AND all_logs.ecs_fields['source.ip'] = '10.1.13.50' OR mapContains(all_logs.ecs_fields, 'client.ip') = 1 AND all_logs.ecs_fields['client.ip'] = 'xx.x.xx.xx' OR mapContains(all_logs.ecs_fields, 'winlog.event_data.IpAddress') = 1 AND all_logs.ecs_fields['winlog.event_data.IpAddress'] = 'xx.x.xx.xx' OR mapContains(all_logs.ecs_fields, 'itdr.ClientIP') = 1 AND all_logs.ecs_fields['itdr.ClientIP'] = 'xx.x.xx.xx) ORDER BY all_logs.uuid DESC LIMIT 100

Copy and Paste into SIEM Search Bar SELECT new_logs.uuid, new_logs.organization_id, new_logs.event_provider AS event_provider, new_logs.event_code_string AS ecs_event_code, new_ logs.host _hostname AS host_hostname, new_logs.user_name AS user_name, new_logs.ecs_fields[' target.user.name '] AS ecs_target_user_name, new_logs.ecs_fields['winlog.event_data.ShutdownActionType'] AS ecs_winlog_event_data_ShutdownActionType, new_logs.ecs_fields['winlog.event_data.ShutdownReason'] AS ecs_winlog_event_data_ShutdownReason, new_logs.message FROM new_logs AS logs WHERE new_logs.account_id = 30971 AND new_logs.agent_id = 12637506 AND new_logs.uuid >= '019fc771-ecc0-7000-8000-000000000000' AND new_logs.uuid < '019fc84d-a6c0-7000-8000-000000000000' AND (new_logs.event_provider = 'Microsoft-Windows-Kernel-Power' OR new_logs.event_provider = 'Microsoft-Windows-Security-Auditing') AND (new_logs.event_code = 41 OR new_logs.event_code = 1074 OR new_logs.event_code = 6008 OR new_logs.event_code = 4720 OR new_logs.event_code = 4722 OR new_logs.event_code = 4725 OR new_logs.event_code = 4726 OR lower(new_logs.message) ILIKE '%install%') ORDER BY new_logs.uuid DESC LIMIT 100

Copy and Paste into SIEM Search Bar SELECT new_logs.uuid, new_logs.organization_id, new_logs.user_email AS user_email, new_logs.ecs_fields['itdr.Operation'] AS ecs_itdr_Operation, new_logs.ecs_fields['itdr.Parameters'] AS ecs_itdr_Parameters, new_logs.source_ip AS source_ip, new_logs.client_ip AS client_ip, new_logs.message FROM new_logs AS logs WHERE new_logs.organization_id = 322611 AND new_logs.account_id = 5931 AND new_logs.uuid >= '019f4c96-d060-7000-8000-000000000000' AND new_logs.uuid < '019f4d72-8a60-7000-8000-000000000000' AND new_logs.event_provider = 'ITDR' AND (mapContains(new_logs.ecs_fields, 'itdr.Operation') = 1 AND new_logs.ecs_fields['itdr.Operation'] = 'New-InboxRule' OR mapContains(new_logs.ecs_fields, 'itdr.Operation') = 1 AND new_logs.ecs_fields['itdr.Operation'] = 'Set-InboxRule' OR mapContains(new_logs.ecs_fields, 'itdr.Operation') = 1 AND new_logs.ecs_fields['itdr.Operation'] = 'UpdateInboxRules') ORDER BY new_logs.uuid DESC LIMIT 100

Copy and paste in SIEM search bar SELECT arrayDistinct(groupArrayIf(ecs_fields['itdr.TenantId'], mapContains(ecs_fields, 'itdr.TenantId'))) AS unique_tenants FROM new_logs AS logs WHERE new_logs.account_id = 26290 AND new_logs.uuid >= '019fd5b9-88b0-7000-8000-000000000000' AND new_logs.uuid < '019fd695-42b0-7000-8000-000000000000' LIMIT 50001