Skip to content

Replace TimeGenerated with EventEndTime in KQL queries for Box workbook #13037

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
v-dvedak merged 4 commits into from
Nov 3, 2025
Merged

Replace TimeGenerated with EventEndTime in KQL queries for Box workbook #13037

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
db7d41a
Replace TimeGenerated with EventEndTime in KQL queries
v-sabiraj Oct 29, 2025
e3bdf94
Fix boxEnterpriseId parameter reference in template
v-sabiraj Oct 29, 2025
28f4040
Replace TimeGenerated with EventEndTime in Box queries
v-sabiraj Oct 30, 2025
95ac1b9
Update Box analytics rule versions and queries
v-sabiraj Oct 30, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 3 additions & 3 deletions Solutions/Box/Analytic Rules/BoxAbnormalUserActivity.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -20,11 +20,11 @@ query: |
let lbperiod_start = 14d;
let lbperiod_end = 24h;
let user_actions_1 = BoxEvents
| where TimeGenerated between (ago(lbperiod_start) .. ago(lbperiod_end))
| where EventEndTime between (ago(lbperiod_start) .. ago(lbperiod_end))
| summarize TotalEvents = count() by SourceName
| project TotalEvents, User = SourceName;
let user_actions_2 = BoxEvents
| where TimeGenerated between (ago(lbperiod_start) .. ago(lbperiod_end))
| where EventEndTime between (ago(lbperiod_start) .. ago(lbperiod_end))
| summarize TotalEvents = count() by SrcUserName
| project TotalEvents, User = SrcUserName;
let TotalActions = (union user_actions_1, user_actions_2)
Expand All @@ -50,5 +50,5 @@ entityMappings:
fieldMappings:
- identifier: FullName
columnName: AccountCustomEntity
version: 1.0.0
version: 1.0.1
kind: Scheduled
6 changes: 3 additions & 3 deletions Solutions/Box/Analytic Rules/BoxInactiveUserLogin.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -21,11 +21,11 @@ query: |
let lbperiod_end = 7d;
let lbtime = 1h;
let active_users = BoxEvents
| where TimeGenerated between (ago(lbperiod_end) .. ago(lbtime))
| where EventEndTime between (ago(lbperiod_end) .. ago(lbtime))
| where EventType =~ 'LOGIN'
| summarize makeset(SourceName);
let inactive_users = BoxEvents
| where TimeGenerated between (ago(lbperiod_start) .. ago(lbperiod_end))
| where EventEndTime between (ago(lbperiod_start) .. ago(lbperiod_end))
| where EventType =~ 'LOGIN'
| where SourceName !in (active_users)
| summarize makeset(SourceName);
Expand All @@ -38,5 +38,5 @@ entityMappings:
fieldMappings:
- identifier: FullName
columnName: AccountCustomEntity
version: 1.0.0
version: 1.0.1
kind: Scheduled
4 changes: 2 additions & 2 deletions Solutions/Box/Analytic Rules/BoxMultipleItemsDeletedByUser.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -20,13 +20,13 @@ query: |
let threshold = 100;
BoxEvents
| where EventType =~ 'DELETE'
| summarize deleted_items = dcount(SourceItemName) by SrcUserName, bin(TimeGenerated, 5m)
| summarize deleted_items = dcount(SourceItemName) by SrcUserName, bin(EventEndTime, 5m)
| where deleted_items > threshold
| extend AccountCustomEntity = SrcUserName
entityMappings:
- entityType: Account
fieldMappings:
- identifier: FullName
columnName: AccountCustomEntity
version: 1.0.0
version: 1.0.1
kind: Scheduled
4 changes: 2 additions & 2 deletions Solutions/Box/Analytic Rules/BoxUserLoginAsAdmin.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -20,7 +20,7 @@ query: |
let lbperiod_start = 14d;
let lbperiod_end = 1d;
let admins = BoxEvents
| where TimeGenerated between (ago(lbperiod_start) .. ago(lbperiod_end))
| where EventEndTime between (ago(lbperiod_start) .. ago(lbperiod_end))
| where EventType =~ 'ADMIN_LOGIN'
| summarize makeset(SourceLogin);
BoxEvents
Expand All @@ -37,5 +37,5 @@ entityMappings:
fieldMappings:
- identifier: Address
columnName: IPCustomEntity
version: 1.0.0
version: 1.0.1
kind: Scheduled
8 changes: 4 additions & 4 deletions Solutions/Box/Analytic Rules/BoxUserRoleChangedToOwner.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -20,14 +20,14 @@ query: |
let lbperiod = 14d;
let lbtime = 1h;
BoxEvents
| where TimeGenerated between (ago(lbperiod) .. ago(lbtime))
| where EventEndTime between (ago(lbperiod) .. ago(lbtime))
| where EventType =~ 'COLLABORATION_INVITE'
| where AdditionalDetailsRole !~ 'Owner'
| summarize min(TimeGenerated) by AccessibleByName, FileDirectory, AdditionalDetailsRole
| summarize min(EventEndTime) by AccessibleByName, FileDirectory, AdditionalDetailsRole
| project AccessibleByName, FileDirectory, InitialRole = AdditionalDetailsRole
|join (BoxEvents
| where EventType =~ 'COLLABORATION_ROLE_CHANGE'
| summarize max(TimeGenerated) by AccessibleByName, FileDirectory, AdditionalDetailsRole
| summarize max(EventEndTime) by AccessibleByName, FileDirectory, AdditionalDetailsRole
| project AccessibleByName, FileDirectory, NewRole = AdditionalDetailsRole
) on FileDirectory, AccessibleByName
| where NewRole =~ 'Owner'
Expand All @@ -38,5 +38,5 @@ entityMappings:
fieldMappings:
- identifier: FullName
columnName: AccountCustomEntity
version: 1.0.0
version: 1.0.1
kind: Scheduled
2 changes: 1 addition & 1 deletion Solutions/Box/Data/Solution_Box.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -38,7 +38,7 @@
"Analytic Rules/BoxUserRoleChangedToOwner.yaml"
],
"BasePath": "C:\\GitHub\\Azure-Sentinel\\Solutions\\Box",
"Version": "3.1.0",
"Version": "3.1.2",
"Metadata": "SolutionMetadata.json",
"TemplateSpec": true,
"Is1PConnector": false
Expand Down
2 changes: 1 addition & 1 deletion Solutions/Box/Hunting Queries/BoxAdminIpAddress.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -14,7 +14,7 @@ relevantTechniques:
- T1078
query: |
BoxEvents
| where TimeGenerated > ago(30d)
| where EventEndTime > ago(30d)
| where EventType =~ 'ADMIN_LOGIN'
| summarize makeset(SrcIpAddr) by SourceLogin
| extend AccountCustomEntity = SourceLogin
Expand Down
4 changes: 2 additions & 2 deletions Solutions/Box/Hunting Queries/BoxDeletedUsers.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -13,9 +13,9 @@ relevantTechniques:
- T1531
query: |
BoxEvents
| where TimeGenerated > ago(24h)
| where EventEndTime > ago(24h)
| where EventType =~ 'DELETE_USER'
| project TimeGenerated, SourceName, SourceLogin
| project EventEndTime, SourceName, SourceLogin
| extend AccountCustomEntity = SourceLogin
entityMappings:
- entityType: Account
Expand Down
8 changes: 4 additions & 4 deletions Solutions/Box/Hunting Queries/BoxInactiveAdmins.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -13,20 +13,20 @@ relevantTechniques:
- T1078
query: |
let active_admins = BoxEvents
| where TimeGenerated between (ago(7d) .. ago(1d))
| where EventEndTime between (ago(7d) .. ago(1d))
| where EventType =~ 'ADMIN_LOGIN'
| summarize makeset(SourceLogin);
let inactive_admins = BoxEvents
| where TimeGenerated between (ago(30d) .. ago(7d))
| where EventEndTime between (ago(30d) .. ago(7d))
| where EventType =~ 'ADMIN_LOGIN'
| where SourceLogin !in (active_admins)
| summarize makeset(SourceLogin);
BoxEvents
| where TimeGenerated > ago(7d)
| where EventEndTime > ago(7d)
| where EventType =~ 'ADMIN_LOGIN'
| where SourceLogin !in (active_admins)
| where SourceLogin in (inactive_admins)
| summarize LastLoginTime = max(TimeGenerated) by SourceLogin
| summarize LastLoginTime = max(EventEndTime) by SourceLogin
| project LastLoginTime, SourceLogin
| extend AccountCustomEntity = SourceLogin
entityMappings:
Expand Down
8 changes: 4 additions & 4 deletions Solutions/Box/Hunting Queries/BoxInactiveUsers.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -13,20 +13,20 @@ relevantTechniques:
- T1078
query: |
let active_admins = BoxEvents
| where TimeGenerated between (ago(7d) .. ago(1d))
| where EventEndTime between (ago(7d) .. ago(1d))
| where EventType =~ 'LOGIN'
| summarize makeset(SourceLogin);
let inactive_admins = BoxEvents
| where TimeGenerated between (ago(30d) .. ago(7d))
| where EventEndTime between (ago(30d) .. ago(7d))
| where EventType =~ 'LOGIN'
| where SourceLogin !in (active_admins)
| summarize makeset(SourceLogin);
BoxEvents
| where TimeGenerated > ago(7d)
| where EventEndTime > ago(7d)
| where EventType =~ 'LOGIN'
| where SourceLogin !in (active_admins)
| where SourceLogin in (inactive_admins)
| summarize LastLoginTime = max(TimeGenerated) by SourceLogin
| summarize LastLoginTime = max(EventEndTime) by SourceLogin
| project LastLoginTime, SourceLogin
| extend AccountCustomEntity = SourceLogin
entityMappings:
Expand Down
4 changes: 2 additions & 2 deletions Solutions/Box/Hunting Queries/BoxNewUsers.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -14,9 +14,9 @@ relevantTechniques:
- T1078
query: |
BoxEvents
| where TimeGenerated > ago(24h)
| where EventEndTime > ago(24h)
| where EventType =~ 'NEW_USER'
| project TimeGenerated, SourceName, SourceLogin
| project EventEndTime, SourceName, SourceLogin
| extend AccountCustomEntity = SourceLogin
entityMappings:
- entityType: Account
Expand Down
4 changes: 2 additions & 2 deletions Solutions/Box/Hunting Queries/BoxSuspiciousFiles.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -13,9 +13,9 @@ relevantTechniques:
- T1048
query: |
BoxEvents
| where TimeGenerated > ago(24h)
| where EventEndTime > ago(24h)
| where SourceItemName =~ 'id_rsa' or SourceItemName contains 'password' or SourceItemName contains 'key' or SourceItemName contains '_key' or SourceItemName contains '.ssh' or SourceItemName endswith '.npmrc' or SourceItemName endswith '.muttrc' or SourceItemName contains 'config.json' or SourceItemName contains '.gitconfig' or SourceItemName endswith '.netrc' or SourceItemName endswith 'package.json' or SourceItemName endswith 'Gemfile' or SourceItemName endswith 'bower.json' or SourceItemName endswith 'config.gypi' or SourceItemName endswith 'travis.yml' or SourceItemName endswith '.ps1' or SourceItemName endswith '.bat' or SourceItemName endswith '.scr' or SourceItemName endswith '.sh' or SourceItemName endswith '.exe' or SourceFileName =~ 'id_rsa' or SourceFileName contains 'password' or SourceFileName contains 'key' or SourceFileName contains '_key' or SourceFileName contains '.ssh' or SourceFileName endswith '.npmrc' or SourceFileName endswith '.muttrc' or SourceFileName contains 'config.json' or SourceFileName contains '.gitconfig' or SourceFileName endswith '.netrc' or SourceFileName endswith 'package.json' or SourceFileName endswith 'Gemfile' or SourceFileName contains 'bower.json' or SourceFileName contains 'config.gypi' or SourceFileName contains 'travis.yml' or SourceFileName endswith '.ps1' or SourceFileName endswith '.bat' or SourceFileName endswith '.scr' or SourceFileName endswith '.sh' or SourceFileName endswith '.exe'
| project TimeGenerated, SourceName, SourceLogin
| project EventEndTime, SourceName, SourceLogin
| extend AccountCustomEntity = SourceLogin
entityMappings:
- entityType: Account
Expand Down
2 changes: 1 addition & 1 deletion Solutions/Box/Hunting Queries/BoxUserDownloadsByVolume.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -16,7 +16,7 @@ relevantTechniques:
- T1530
query: |
BoxEvents
| where TimeGenerated > ago(24h)
| where EventEndTime > ago(24h)
| where EventType =~ 'DOWNLOAD'
| summarize ['DataVolume(Bytes)'] = sum(FileSize) by SrcUserName
| project SrcUserName, ['DataVolume(Bytes)']
Expand Down
4 changes: 2 additions & 2 deletions Solutions/Box/Hunting Queries/BoxUserGroupChanges.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -13,9 +13,9 @@ relevantTechniques:
- T1078
query: |
BoxEvents
| where TimeGenerated > ago(24h)
| where EventEndTime > ago(24h)
| where EventType =~ 'GROUP_ADD_USER'
| project TimeGenerated, SourceName, SourceLogin, AdditionalDetailsGroupName
| project EventEndTime, SourceName, SourceLogin, AdditionalDetailsGroupName
| extend AccountCustomEntity = SourceLogin
entityMappings:
- entityType: Account
Expand Down
2 changes: 1 addition & 1 deletion Solutions/Box/Hunting Queries/BoxUserUploadsByVolume.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -15,7 +15,7 @@ relevantTechniques:
- T1537
query: |
BoxEvents
| where TimeGenerated > ago(24h)
| where EventEndTime > ago(24h)
| where EventType =~ 'UPLOAD'
| summarize ['DataVolume(Bytes)'] = sum(FileSize) by SrcUserName
| project SrcUserName, ['DataVolume(Bytes)']
Expand Down
4 changes: 2 additions & 2 deletions Solutions/Box/Hunting Queries/BoxUsersWithOwnerPermissions.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -13,10 +13,10 @@ relevantTechniques:
- T1078
query: |
BoxEvents
| where TimeGenerated > ago(24h)
| where EventEndTime > ago(24h)
| where EventType =~ 'COLLABORATION_ROLE_CHANGE'
| where AdditionalDetailsRole =~ 'Owner'
| project TimeGenerated, AccessibleByLogin, FileDirectory
| project EventEndTime, AccessibleByLogin, FileDirectory
| extend AccountCustomEntity = AccessibleByLogin
entityMappings:
- entityType: Account
Expand Down
Binary file added Solutions/Box/Package/3.1.2.zip
View file
Open in desktop
Binary file not shown.
2 changes: 1 addition & 1 deletion Solutions/Box/Package/createUiDefinition.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -67,7 +67,7 @@
"name": "dataconnectors2-text",
"type": "Microsoft.Common.TextBlock",
"options": {
"text": "This Solution installs the data connector for Box. You can get Box data in your Microsoft Sentinel workspace. After installing the solution, configure and enable this data connector by following guidance in Manage solution view."
"text": "This Solution installs the data connector for Box Events (CCP). You can get Box Events (CCP) data in your Microsoft Sentinel workspace. After installing the solution, configure and enable this data connector by following guidance in Manage solution view."
}
},
{
Expand Down
142 changes: 75 additions & 67 deletions Solutions/Box/Package/mainTemplate.json
View file
Open in desktop

Large diffs are not rendered by default.

1 change: 1 addition & 0 deletions Solutions/Box/ReleaseNotes.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,5 +1,6 @@
| **Version** | **Date Modified (DD-MM-YYYY)** | **Change History** |
|-------------|--------------------------------|--------------------------------------------------------------------|
| 3.1.2 | 29-10-2025 | Updated KQL queries in Workbook to use EventEndTime instead of TimeGenerated for time-based filtering |
| 3.1.1 | 10-02-2025 | Advancing CCP **Data Connector** from Public preview to Global Availability.|
| 3.1.0 | 06-12-2024 | Added new CCP **Data Connector** and modified **Parser**. |
| 3.0.1 | 18-08-2023 | Added text 'using Azure Functions' in **Data Connector** page. |
Expand Down
Loading