-
Notifications
You must be signed in to change notification settings - Fork 3.6k
Open
Labels
Description
Is your feature request related to a problem? Please describe.
No problem, but a useful removed feature
Describe the solution you'd like
Enable again plugin rows_near for sentinel as useful to get some logs around a known interesting log.
What a did before:
let suspicous_keywords = dynamic(["a cmd", "a file name", "a domain", "an ip"]); // goal is to find it in any ActionType it could be
let alert_time = now();
let delta = 5m;
union Device*
| where around(TimeGenerated, alert_time, delta)
// return 20 rows before/ after a target element
| evaluate rows_near(pack_array(*) has_any(suspicous_keywords ), 20)
Describe alternatives you've considered
No alternatives to this function, at most next() or prev() can be used to get only on logs around a particularly interested one
Reactions are currently unavailable