Removed where clause with type=ip_address

Author: akhil-sumologic

aws-observability/json/Classic-lb-App.json

@@ -3188,7 +3188,7 @@
                     "queries": [
                         {
                             "transient": false,
-                            "queryString": "account={{account}} region={{region}} namespace={{namespace}}\n| parse \"* * * * * * * * * * * \\\"*\\\" \\\"*\\\" * *\" as datetime, loadbalancername, client, backend, request_processing_time, backend_processing_time, response_processing_time, elb_status_code, backend_status_code, received_bytes, sent_bytes, request, user_agent, ssl_cipher, ssl_protocol\n| where tolowercase(loadbalancername) matches tolowercase(\"{{loadbalancername}}\")\n| parse field=request \"* *://*:*/* HTTP\" as Method, Protocol, Domain, ServerPort, URI nodrop\n| parse regex \"(?<ClientIp>\\b\\d{1,3}\\.\\d{1,3}\\.\\d{1,3}\\.\\d{1,3})\" multi\n| where ClientIp != \"0.0.0.0\" and ClientIp != \"127.0.0.1\"\n| count as ip_count by ClientIp, URI\n| lookup type, actor, raw, threatlevel as MaliciousConfidence from sumo://threat/cs on threat=ClientIp \n| json field=raw \"labels[*].name\" as LabelName nodrop\n| replace(LabelName, \"\\\\/\",\"->\") as LabelName\n| replace(LabelName, \"\\\"\",\" \") as LabelName\n| where type=\"ip_address\" // and MaliciousConfidence=\"high\"\n| if (isEmpty(actor), \"Unassigned\", actor) as Actor\n| count(ip_count) as UniqueThreatIPs by URI\n| top 20 URI by UniqueThreatIPs, URI asc",
+                            "queryString": "account={{account}} region={{region}} namespace={{namespace}}\n| parse \"* * * * * * * * * * * \\\"*\\\" \\\"*\\\" * *\" as datetime, loadbalancername, client, backend, request_processing_time, backend_processing_time, response_processing_time, elb_status_code, backend_status_code, received_bytes, sent_bytes, request, user_agent, ssl_cipher, ssl_protocol\n| where tolowercase(loadbalancername) matches tolowercase(\"{{loadbalancername}}\")\n| parse field=request \"* *://*:*/* HTTP\" as Method, Protocol, Domain, ServerPort, URI nodrop\n| parse regex \"(?<ClientIp>\\b\\d{1,3}\\.\\d{1,3}\\.\\d{1,3}\\.\\d{1,3})\" multi\n| where ClientIp != \"0.0.0.0\" and ClientIp != \"127.0.0.1\"\n| count as ip_count by ClientIp, URI\n| lookup type, actor, raw, threatlevel as MaliciousConfidence from sumo://threat/cs on threat=ClientIp \n| json field=raw \"labels[*].name\" as LabelName nodrop\n| replace(LabelName, \"\\\\/\",\"->\") as LabelName\n| replace(LabelName, \"\\\"\",\" \") as LabelName\n| if (isEmpty(actor), \"Unassigned\", actor) as Actor\n| count(ip_count) as UniqueThreatIPs by URI\n| top 20 URI by UniqueThreatIPs, URI asc",
                             "queryType": "Logs",
                             "queryKey": "A",
                             "metricsQueryMode": null,

aws-observability/json/DynamoDb-App.json

@@ -1805,7 +1805,7 @@
                     "queries": [
                         {
                             "transient": false,
-                            "queryString": "region={{region}} account={{account}} namespace={{namespace}} \"\\\"eventSource\\\":\\\"dynamodb.amazonaws.com\\\"\"\n| json \"eventName\", \"awsRegion\", \"requestParameters.tableName\", \"sourceIPAddress\", \"userIdentity.userName\", \"userIdentity.sessionContext.sessionIssuer.userName\" as EventName, Region, tablename, SourceIp, UserName, ContextUserName nodrop\n| if (isEmpty(UserName), ContextUserName, UserName) as UserName\n| where (tolowercase(tablename) matches tolowercase(\"{{tablename}}\")) or isBlank(tablename)\n| where SourceIp != \"0.0.0.0\" and SourceIp != \"127.0.0.1\" and !(SourceIp matches \"*.amazonaws.com\")\n| count as ip_count by SourceIp\n| lookup type, actor, raw, threatlevel as malicious_confidence from sumo://threat/cs on threat=SourceIp\n| where type=\"ip_address\"\n| json field=raw \"labels[*].name\" as label_name nodrop\n| replace(label_name, \"\\\\/\",\"->\") as label_name\n| replace(label_name, \"\\\"\",\" \") as label_name\n| if (isEmpty(actor), \"Unassigned\", actor) as Actor\n| sum(ip_count) as ThreatCount by malicious_confidence\n| sort by ThreatCount, malicious_confidence asc",
+                            "queryString": "region={{region}} account={{account}} namespace={{namespace}} \"\\\"eventSource\\\":\\\"dynamodb.amazonaws.com\\\"\"\n| json \"eventName\", \"awsRegion\", \"requestParameters.tableName\", \"sourceIPAddress\", \"userIdentity.userName\", \"userIdentity.sessionContext.sessionIssuer.userName\" as EventName, Region, tablename, SourceIp, UserName, ContextUserName nodrop\n| if (isEmpty(UserName), ContextUserName, UserName) as UserName\n| where (tolowercase(tablename) matches tolowercase(\"{{tablename}}\")) or isBlank(tablename)\n| where SourceIp != \"0.0.0.0\" and SourceIp != \"127.0.0.1\" and !(SourceIp matches \"*.amazonaws.com\")\n| count as ip_count by SourceIp\n| lookup type, actor, raw, threatlevel as malicious_confidence from sumo://threat/cs on threat=SourceIp\n| json field=raw \"labels[*].name\" as label_name nodrop\n| replace(label_name, \"\\\\/\",\"->\") as label_name\n| replace(label_name, \"\\\"\",\" \") as label_name\n| if (isEmpty(actor), \"Unassigned\", actor) as Actor\n| sum(ip_count) as ThreatCount by malicious_confidence\n| sort by ThreatCount, malicious_confidence asc",
                             "queryType": "Logs",
                             "queryKey": "A",
                             "metricsQueryMode": null,

aws-observability/json/Rds-App.json

@@ -10653,7 +10653,7 @@
                     "queries": [
                         {
                             "transient": false,
-                            "queryString": "account={{account}} region={{region}} namespace=aws/rds _sourceHost=/aws/rds/*postgresql dbidentifier={{dbidentifier}} connection\n| json \"message\" nodrop | if (_raw matches \"{*\", message, _raw) as message\n| parse field=message \"* * *:*(*):*@*:[*]:*:*\" as date,time,time_zone,host,thread_id,user,database,processid,severity,msg\n| where user matches \"{{user}}\" and database matches \"{{database}}\" and host matches \"{{host}}\" \n| parse field=msg \"connection received: host=* port=*\" as ip,port \n| count by ip\n| lookup type, actor, raw, threatlevel as malicious_confidence from sumo://threat/cs on threat=ip\n| where type=\"ip_address\" \n| json field=raw \"labels[*].name\" as label_name nodrop\n| replace(label_name, \"\\\\/\",\"->\") as label_name\n| replace(label_name, \"\\\"\",\" \") as label_name\n| count by type, actor, ip, malicious_confidence, label_name",
+                            "queryString": "account={{account}} region={{region}} namespace=aws/rds _sourceHost=/aws/rds/*postgresql dbidentifier={{dbidentifier}} connection\n| json \"message\" nodrop | if (_raw matches \"{*\", message, _raw) as message\n| parse field=message \"* * *:*(*):*@*:[*]:*:*\" as date,time,time_zone,host,thread_id,user,database,processid,severity,msg\n| where user matches \"{{user}}\" and database matches \"{{database}}\" and host matches \"{{host}}\" \n| parse field=msg \"connection received: host=* port=*\" as ip,port \n| count by ip\n| lookup type, actor, raw, threatlevel as malicious_confidence from sumo://threat/cs on threat=ip\n| json field=raw \"labels[*].name\" as label_name nodrop\n| replace(label_name, \"\\\\/\",\"->\") as label_name\n| replace(label_name, \"\\\"\",\" \") as label_name\n| count by type, actor, ip, malicious_confidence, label_name",
                             "queryType": "Logs",
                             "queryKey": "A",
                             "metricsQueryMode": null,