Copy and Paste into SIEM Search Bar
SELECT new_logs.uuid, new_logs.organization_id, new_logs.user_email AS user_email, new_logs.ecs_fields['itdr.Operation'] AS ecs_itdr_Operation, new_logs.ecs_fields['itdr.Parameters'] AS ecs_itdr_Parameters, new_logs.source_ip AS source_ip, new_logs.client_ip AS client_ip, new_logs.message FROM new_logs AS logs WHERE new_logs.organization_id = 322611 AND new_logs.account_id = 5931 AND new_logs.uuid >= '019f4c96-d060-7000-8000-000000000000' AND new_logs.uuid < '019f4d72-8a60-7000-8000-000000000000' AND new_logs.event_provider = 'ITDR' AND (mapContains(new_logs.ecs_fields, 'itdr.Operation') = 1 AND new_logs.ecs_fields['itdr.Operation'] = 'New-InboxRule' OR mapContains(new_logs.ecs_fields, 'itdr.Operation') = 1 AND new_logs.ecs_fields['itdr.Operation'] = 'Set-InboxRule' OR mapContains(new_logs.ecs_fields, 'itdr.Operation') = 1 AND new_logs.ecs_fields['itdr.Operation'] = 'UpdateInboxRules') ORDER BY new_logs.uuid DESC LIMIT 100