Updates

Author: Albertyang0

articles/sentinel/migration-splunk-detection-rules.md

@@ -128,7 +128,7 @@ Use these samples to compare and map rules from Splunk to Microsoft Sentinel in
 |`eventstats`     |Generates summary statistics from fields in your events and saves those statistics in a new field.<br><br>[SPL example](#eventstats-command-spl-example)         |Examples:<br>• [join](/kusto/query/join-operator?view=microsoft-sentinel&preserve-view=true)<br>• [make_list](/kusto/query/make-list-aggregation-function?view=microsoft-sentinel&preserve-view=true)<br>• [mv-expand](/kusto/query/mv-expand-operator?view=microsoft-sentinel&preserve-view=true)         |[KQL example](#eventstats-command-kql-example) |
 |`streamstats`     |Find the cumulative sum of a field.<br><br>SPL example:<br>`... | streamstats sum(bytes) as bytes _ total \| timechart`	         |[row_cumsum](/kusto/query/row-cumsum-function?view=microsoft-sentinel&preserve-view=true)         |`...\| serialize cs=row_cumsum(bytes)` |
 |`anomalydetection`     |Find anomalies in the specified field.<br><br>[SPL example](#anomalydetection-command-spl-example)         |[series_decompose_anomalies()](/kusto/query/series-decompose-anomalies-function?view=microsoft-sentinel&preserve-view=true)         |[KQL example](#anomalydetection-command-kql-example) |
-|`where`     |Filters search results using `eval` expressions. Used to compare two diiferent fields.	|[where](/kusto/query/where-operator?view=microsoft-sentinel&preserve-view=true)         |`T | where fruit=="apple"`         |
+|`where`     |Filters search results using `eval` expressions. Used to compare two different fields.	|[where](/kusto/query/where-operator?view=microsoft-sentinel&preserve-view=true)         |`T | where fruit=="apple"`         |
 
 #### `lookup` command: KQL example
 
@@ -250,11 +250,11 @@ series_decompose_anomalies(Trend)
 |`cos(X)` |Calculates the cosine of X. |`n=cos(0)` |[cos()](/kusto/query/cos-function?view=microsoft-sentinel&preserve-view=true) |`cos(X)` |
 |`exact(X)`	     |Evaluates an expression X using double precision floating point arithmetic.         |`exact(3.14*num)`         |[`todecimal()`](/kusto/query/todecimal-function?view=microsoft-sentinel&preserve-view=true)         |`todecimal(3.14*2)` |
 |`exp(X)`    |Returns eX.         |`exp(3)`         |[exp()](/kusto/query/exp-function?view=microsoft-sentinel&preserve-view=true)         |`exp(3)` |
-|`if(X,Y,Z)`     |If `X` evaluates to `TRUE`, the result is the second argument `Y`. If `X` evaluates to `FALSE`, the result evaluates to the third argument `Z`.         |`if(error==200,`<br> `"OK", "Error")`         |[`iif()`](/kusto/query/iif-function?view=microsoft-sentinelc&preserve-view=true)         |[KQL example](#ifxyz-kql-example) |
-|`isbool(X)`	     |Returns `TRUE` if `X` is boolean.	         |`isbool(field)`         |• [`iif()`](/kusto/query/iif-function?view=microsoft-sentinelc&preserve-view=true)<br>• [`gettype`](/kusto/query/gettype-function?view=microsoft-sentinel&preserve-view=true)    |`iif(gettype(X) =="bool","TRUE","FALSE")` |
-|`isint(X)`     |Returns `TRUE` if `X` is an integer.	         |`isint(field)`         |• [`iif()`](/kusto/query/iif-function?view=microsoft-sentinelc&preserve-view=true)<br>• [`gettype`](/kusto/query/gettype-function?view=microsoft-sentinel&preserve-view=true)         |[KQL example](#isintx-kql-example) |
+|`if(X,Y,Z)`     |If `X` evaluates to `TRUE`, the result is the second argument `Y`. If `X` evaluates to `FALSE`, the result evaluates to the third argument `Z`.         |`if(error==200,`<br> `"OK", "Error")`         |[`iff()`](/kusto/query/iff-function?view=microsoft-sentinelc&preserve-view=true)         |[KQL example](#ifxyz-kql-example) |
+|`isbool(X)`	     |Returns `TRUE` if `X` is boolean.	         |`isbool(field)`         |• [`iff()`](/kusto/query/iff-function?view=microsoft-sentinelc&preserve-view=true)<br>• [`gettype`](/kusto/query/gettype-function?view=microsoft-sentinel&preserve-view=true)    |`iff(gettype(X) =="bool","TRUE","FALSE")` |
+|`isint(X)`     |Returns `TRUE` if `X` is an integer.	         |`isint(field)`         |• [`iff()`](/kusto/query/iff-function?view=microsoft-sentinelc&preserve-view=true)<br>• [`gettype`](/kusto/query/gettype-function?view=microsoft-sentinel&preserve-view=true)         |[KQL example](#isintx-kql-example) |
 |`isnull(X)`	     |Returns `TRUE` if `X` is null.	         |`isnull(field)`	 |[`isnull()`](/kusto/query/isnull-function?view=microsoft-sentinel&preserve-view=true)         |`isnull(field)` |
-|`isstr(X)`    |Returns `TRUE` if `X` is a string.	        |`isstr(field)`         |• [`iif()`](/kusto/query/iif-function?view=microsoft-sentinelc&preserve-view=true)<br>• [`gettype`](/kusto/query/gettype-function?view=microsoft-sentinel&preserve-view=true)    |[KQL example](#isstrx-kql-example) |
+|`isstr(X)`    |Returns `TRUE` if `X` is a string.	        |`isstr(field)`         |• [`iff()`](/kusto/query/iff-function?view=microsoft-sentinelc&preserve-view=true)<br>• [`gettype`](/kusto/query/gettype-function?view=microsoft-sentinel&preserve-view=true)    |[KQL example](#isstrx-kql-example) |
 |`len(X)`	     |This function returns the character length of a string `X`.	         |`len(field)`	         |[`strlen()`](/kusto/query/strlen-function?view=microsoft-sentinel&preserve-view=true)         |`strlen(field)` |
 |`like(X,"y")`     |Returns `TRUE` if and only if `X` is like the SQLite pattern in `Y`.       |`like(field, "addr%")`         |• [`has`](/kusto/query/has-any-operator?view=microsoft-sentinel&preserve-view=true)<br>• [`contains`](/kusto/query/datatypes-string-operators?view=microsoft-sentinel&preserve-view=true)<br>• [`startswith`](/kusto/query/datatypes-string-operators?view=microsoft-sentinel&preserve-view=true)<br>• [matches regex](/kusto/query/regex?view=microsoft-sentinel&preserve-view=true)	 |[KQL example](#likexy-example) |
 |`log(X,Y)`     |Returns the log of the first argument `X` using the second argument `Y` as the base. The default value of `Y` is `10`.       |`log(number,2)`         |• [`log`](/kusto/query/log-function?view=microsoft-sentinel&preserve-view=true)<br>• [`log2`](/kusto/query/log2-function?view=microsoft-sentinel&preserve-view=true)<br>• [`log10`](/kusto/query/log10-function?view=microsoft-sentinel&preserve-view=true)         |`log(X)`<br><br>`log2(X)`<br><br>`log10(X)` |
@@ -270,13 +270,13 @@ series_decompose_anomalies(Trend)
 |`mvjoin(X,Y)`     |Given a multi-valued field `X` and string delimiter `Y`, and joins the individual values of `X` using `Y`.		         |`mvjoin(address, ";")`         |[`strcat_array`](/kusto/query/strcat-array-function?view=microsoft-sentinel&preserve-view=true)         |[KQL example](#mvjoinxy-kql-example) |
 |`now()`     |Returns the current time, represented in Unix time.         |`now()`         |[`now()`](/kusto/query/now-function?view=microsoft-sentinel&preserve-view=true)         |`now()`<br><br>`now(-2d)` |
 |`null()`     |Doesn't accept arguments and returns `NULL`.	         |`null()`         |[null](/kusto/query/scalar-data-types/null-values)         |`null`
-|`nullif(X,Y)`	     |Includes two arguments, `X` and `Y`, and returns `X` if the arguments are diiferent. Otherwise, returns `NULL`. |`nullif(fieldA, fieldB)`         |[`iif`](/kusto/query/iif-function?view=microsoft-sentinelc&preserve-view=true)         |`iif(fieldA==fieldB, null, fieldA)` |
+|`nullif(X,Y)`	     |Includes two arguments, `X` and `Y`, and returns `X` if the arguments are different. Otherwise, returns `NULL`. |`nullif(fieldA, fieldB)`         |[`iff`](/kusto/query/iff-function?view=microsoft-sentinelc&preserve-view=true)         |`iff(fieldA==fieldB, null, fieldA)` |
 |`random()`     |Returns a pseudo-random number between `0` to `2147483647`.         |`random()`         |[`rand()`](/kusto/query/rand-function?view=microsoft-sentinel&preserve-view=true)         |`rand()` |
 |`relative_ time(X,Y)`    |Given an epoch time `X` and relative time specifier `Y`, returns the epoch time value of `Y` applied to `X`.	         |`relative_time(now(),"-1d@d")`	         |[unix time](/kusto/query/datetime-timespan-arithmetic?view=microsoft-sentinel&preserve-view=true#example-unix-time)         |[KQL example](#relative-timexy-kql-example) |
 |`replace(X,Y,Z)` |Returns a string formed by substituting string `Z` for every occurrence of regular expression string `Y` in string `X`. |Returns date with the month and day numbers switched.<br>For example, for the `4/30/2015` input, the output is `30/4/2009`:<br><br>`replace(date, "^(\d{1,2})/ (\d{1,2})/", "\2/\1/")`	|[`replace()`](/kusto/query/replace-string-function?view=microsoft-sentinelc&preserve-view=true)	|[KQL example](#replacexyz-kql-example) |
 |`round(X,Y)` |Returns `X` rounded to the number of decimal places specified by `Y`. The default is to round to an integer. |`round(3.5)` |[`round`](/kusto/query/round-function?view=microsoft-sentinel&preserve-view=true) |`round(3.5)` |
 |`rtrim(X,Y)` |Returns `X` with the characters of `Y` trimmed from the right side. If `Y` isn't specified, spaces and tabs are trimmed. |`rtrim(" ZZZZabcZZ ", " Z")` |[`trim_end()`](/kusto/query/trim-end-function?view=microsoft-sentinel&preserve-view=true) |`trim_end(@"[ Z]+",A)` |
-|`searchmatch(X)` |Returns `TRUE` if the event matches the search string `X`. |`searchmatch("foo AND bar")` |[iif()](/kusto/query/iif-function?view=microsoft-sentinelc&preserve-view=true) |`iif(field has "X","Yes","No")` |
+|`searchmatch(X)` |Returns `TRUE` if the event matches the search string `X`. |`searchmatch("foo AND bar")` |[iff()](/kusto/query/iff-function?view=microsoft-sentinelc&preserve-view=true) |`iff(field has "X","Yes","No")` |
 | `split(X,"Y")` |Returns `X` as a multi-valued field, split by delimiter `Y`. |`split(address, ";")` |[`split()`](/kusto/query/split-function?view=microsoft-sentinel&preserve-view=true) |`split(address, ";")` |
 |`sqrt(X)` |Returns the square root of `X`. |`sqrt(9)` |[`sqrt()`](/kusto/query/sqrt-function?view=microsoft-sentinel&preserve-view=true) |`sqrt(9)` |
 |`strftime(X,Y)` |Returns the epoch time value `X` rendered using the format specified by `Y`. |`strftime(_time, "%H:%M")` |[`format_datetime()`](/kusto/query/format-datetime-function?view=microsoft-sentinel&preserve-view=true) |`format_datetime(time,'HH:mm')` |
@@ -412,7 +412,7 @@ urldecode("http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fr%3Dheader")
 |`min(X)`     |Returns the minimum value of the field `X`. If the values of `X` are non-numeric, the minimum value is found via alphabetical ordering.	         |[min()](/kusto/query/min-aggregation-function?view=microsoft-sentinel&preserve-view=true)         |`…\| summarize min(X)`         |
 |`mode(X)`     |Returns the most frequent value of the field `X`.         |[top-hitters()](/kusto/query/top-hitters-operator?view=microsoft-sentinel&preserve-view=true)         |`…\| top-hitters 1 of Y by X`         |
 |`perc(Y)`     |Returns the percentile `X` value of the field `Y`. For example, `perc5(total)` returns the fifth percentile value of a field `total`.	         |[percentile()](/kusto/query/percentiles-aggregation-function?view=microsoft-sentinel&preserve-view=true)         |`…\| summarize percentile(Y, 5)`         |
-|`range(X)`     |Returns the diiference between the maximum and minimum values of the field `X`.	         |[range()](/kusto/query/range-function?view=microsoft-sentinel&preserve-view=true)         |`range(1, 3)`         |
+|`range(X)`     |Returns the difference between the maximum and minimum values of the field `X`.	         |[range()](/kusto/query/range-function?view=microsoft-sentinel&preserve-view=true)         |`range(1, 3)`         |
 |`stdev(X)`     |Returns the sample standard deviation of the field `X`.	         |[stdev](/kusto/query/stdev-aggregation-function?view=microsoft-sentinel&preserve-view=true)         |`stdev()`         |
 |`stdevp(X)`     |Returns the population standard deviation of the field `X`.	         |[stdevp()](/kusto/query/stdevp-aggregation-function?view=microsoft-sentinel&preserve-view=true)         |`stdevp()`         |
 |`sum(X)`     |Returns the sum of the values of the field `X`.	         |[sum()](/kusto/query/sum-aggregation-function?view=microsoft-sentinel&preserve-view=true)         |`sum(X)`         |