About mdicenzo

mdicenzo · ‎09-11-2023

Thanks for the feedback. This worked for me!

mdicenzo · ‎09-08-2023

Hello, Thanks for the feedback. I will be more specific next time. I wasn’t aware of the dc (distinct count) option in search. In the example you provided, how would I alert in which the dc has a count of over 5? Thank You

mdicenzo · ‎09-06-2023

I want to essentially trigger an alarm if a user changes the password of multiple distinct user accounts within a given period of time. I was able to start with the search below, which provides me a count of distinct user account change grouped by the source user. When I try to apply a threshold logic to it, it doesn't appear to work. source="WinEventLog:Security" (EventCode=628 OR EventCode=627 OR EventCode=4723 OR EventCode=4724) | stats count(Target_Account_Name) by Subject_Account_Name

mdicenzo · ‎08-17-2022

I am trying to do this same thing. Can you clarify what you did to get this to work? The field name is URL and the string already has https so I was trying to just put $!URL$ in the url link configuration.

mdicenzo · ‎08-04-2022

This is eventually how I did this. Thank you for the help!

mdicenzo · ‎08-04-2022

We have notable events for when a user is created on multiple devices. Most of them are expected for when devices are imaged. I want to use erex to create a suppression for like accounts. They typically have the same beginning and are followed by 2 numbers. Example would ituser23, ituser24, ituser25. I am using the search below for testing index=notable source="Endpoint - Anomalous User Account Creation - Rule" | erex user examples="ituser23, ituser24, ituser25" I am still getting user accounts that are unrelated such as phone or tablet. When I look at the recommended regex it seems like it is not being granular enough.

mdicenzo · ‎07-20-2022

So originally I tried to have this as the correlation search index=o365 sourcetype="mscs:azure:eventhub" "body.operationName"="Risky user" "body.properties.riskLevel"=high | rename body.properties.userDisplayName AS Display_Name | rename body.properties.userPrincipalName AS Email | stats values(body.operationName) AS Operation_Name, count AS result BY Display_Name | eval dd="index=o365 sourcetype=mscs:azure:eventhub body.operationName=\"User Risk Detection\" body.properties.riskLevel=high \"body.properties.userDisplayName\"=".Display_Name The drill down was then search $dd$. The problem is that the value in Display_Name needs quote for the search to work and I cannot seem to get that to work properly for .Display_Name. If I have a correlation search of index=o365 sourcetype="mscs:azure:eventhub" "body.operationName"="Risky user" "body.properties.riskLevel"=high | rename body.properties.userDisplayName AS Display_Name | rename body.properties.userPrincipalName AS Email | stats values(body.operationName) AS Operation_Name, count AS result BY Display_Name And a drill down of index=o365 sourcetype=mscs:azure:eventhub body.operationName="User Risk Detection" body.properties.riskLevel=high "body.properties.userDisplayName"=$Display_Name$ will that work?

mdicenzo · ‎07-20-2022

I am struggling with the same thing, have you resolved this issue?

mdicenzo · ‎07-11-2022

I am trying to include dynamic names for a notable event that I have triggering. When I try to use $variable$ it just shows that and does not pull the field value. My search: index = o365 sourcetype="mscs:azure:eventhub" body.operationName="User Risk Detection" "body.properties.riskLevel"=high | rename body.properties.userDisplayName AS "Display Name" My Name: Office 365 Risky User Detected - $Display Name$ Can anyone help?

Posts	9
Solutions	0
Karma Given	6
Karma Received	0
Member Since	‎07-11-2022

Online Status	Offline
Date Last Visited	‎09-12-2023 10:51 AM

How to Trigger Password Reset alarm by Admin by Di...

How to exclude notable events from triggering usin...

How to use variable names in notable events?

Re: Trigger Password Reset alarm by Admin by Disti...

Re: Trigger Password Reset alarm by Admin by Disti...

How to Trigger Password Reset alarm by Admin by Di...

Re: How do you set up a GET Workflow Action that l...

Re: How to exclude notable events from triggering ...

How to exclude notable events from triggering usin...

Re: Variable Substitution not working in drill dow...

Re: Variable Substitution not working in drill dow...

How to use variable names in notable events?