Updating NetworkSession Rules for AnomalyFoundInNetworkSessionTraffic.yaml and DetectPortMisuseByAnomalyBasedDetection.yaml

Solutions/Network Session Essentials/Analytic Rules/AnomalyFoundInNetworkSessionTraffic.yaml

@@ -153,38 +153,7 @@ query: |
   )[
       1, false, false
   ]
-          | where toscalar(eps) > 1000
-          | join (NetworkSummary_Protocol) on NetworkSummary_Protocol_Exists
-          | join (NetworkCustomAnalytics) on NetworkCustomAnalyticsExists)
-          | join (
-              _Im_NetworkSession(starttime=todatetime(ago(2d)), endtime=now())
-              | where TimeGenerated > maxSummarizedTime
-              | summarize Count=count()
-                  by
-                  NetworkProtocol,
-                  DstPortNumber,
-                  DstAppName,
-                  NetworkDirection,
-                  DvcAction,
-                  bin(TimeGenerated, 10m)
-              | extend
-                  EventTime = TimeGenerated,
-                  Count = toint(Count),
-                  DstPortNumber = toint(DstPortNumber),
-                  exists=int(1)
-              )
-              on exists
-          | project-away exists*, maxv, NetworkSummary_Protocol_Exists*, NetworkCustomAnalyticsExists*
-          ),
-          (
-          (datatable(
-      exists: int,
-      NetworkSummary_Protocol_Exists: bool,
-      NetworkCustomAnalyticsExists: bool
-  )[
-      1, false, false
-  ]
-          | where toscalar(eps) between (501 .. 1000)
+          | where toscalar(eps) > 500
           | join (NetworkSummary_Protocol) on NetworkSummary_Protocol_Exists
           | join (NetworkCustomAnalytics) on NetworkCustomAnalyticsExists)
           | join (
@@ -339,5 +308,5 @@ customDetails:
 alertDetailsOverride:
   alertDisplayNameFormat: Anomaly was observed with {{anomalyFieldValue}} Traffic
   alertDescriptionFormat: 'Based on past data, anomaly was observed in {{anomalyFieldValue}} Traffic with a score of {{score}}.'
-version: 1.2.0
+version: 1.3.0
 kind: Scheduled

Solutions/Network Session Essentials/Analytic Rules/DetectPortMisuseByAnomalyBasedDetection.yaml

@@ -181,39 +181,7 @@ query: |
   )[
       1, false, false
   ]
-          | where toscalar(eps) > 1000
-          | join (NetworkSummary_Protocol) on NetworkSummary_Protocol_Exists
-          | join (NetworkCustomAnalytics) on NetworkCustomAnalyticsExists
-          )
-          | join (
-              _Im_NetworkSession(starttime=todatetime(ago(2d)), endtime=now())
-              | where TimeGenerated > maxSummarizedTime
-              | summarize Count=count()
-                  by
-                  NetworkProtocol,
-                  DstPortNumber,
-                  DstAppName,
-                  NetworkDirection,
-                  DvcAction,
-                  bin(TimeGenerated, 10m)
-              | extend
-                  EventTime = TimeGenerated,
-                  Count = toint(Count),
-                  DstPortNumber = toint(DstPortNumber),
-                  exists=int(1)
-              )
-              on exists
-          | project-away exists*, maxv, NetworkSummary_Protocol_Exists*, NetworkCustomAnalyticsExists*
-          ),
-          (
-          (datatable(
-      exists: int,
-      NetworkSummary_Protocol_Exists: bool,
-      NetworkCustomAnalyticsExists: bool
-  )[
-      1, false, false
-  ]
-          | where toscalar(eps) between (501 .. 1000)
+          | where toscalar(eps) > 500
           | join (NetworkSummary_Protocol) on NetworkSummary_Protocol_Exists
           | join (NetworkCustomAnalytics) on NetworkCustomAnalyticsExists
           )
@@ -352,5 +320,5 @@ alertDetailsOverride:
   alertDescriptionFormat: '{{Description}}'
   alertTacticsColumnName: Tactic
   alertSeverityColumnName: Severity
-version: 1.2.0
+version: 1.3.0
 kind: Scheduled