Skip to content

Enable again rows_near plugin #13803

@JiTmun

Description

@JiTmun

Is your feature request related to a problem? Please describe.
No problem, but a useful removed feature

Describe the solution you'd like
Enable again plugin rows_near for sentinel as useful to get some logs around a known interesting log.
What a did before:

let suspicous_keywords = dynamic(["a cmd", "a file name", "a domain", "an ip"]); // goal is to find it in any ActionType it could be
let alert_time = now();
let delta = 5m;
union Device*
| where around(TimeGenerated, alert_time, delta)
// return 20 rows before/ after a target element
| evaluate rows_near(pack_array(*) has_any(suspicous_keywords ), 20)

Describe alternatives you've considered
No alternatives to this function, at most next() or prev() can be used to get only on logs around a particularly interested one

Metadata

Metadata

Type

No type

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions