Removed space from where clause

Author: akhil-sumologic

aws-observability/json/Alb-App.json

@@ -3048,7 +3048,7 @@
                     "queries": [
                         {
                             "transient": false,
-                            "queryString": "account={{account}} region={{region}} namespace={{namespace}}\n| parse \"* * * * * * * * * * * * \\\"*\\\" \\\"*\\\" * * * \\\"*\\\"\" as Type, DateTime, loadbalancer, Client, Target, RequestProcessingTime, TargetProcessingTime, ResponseProcessingTime, ElbStatusCode, TargetStatusCode, ReceivedBytes, SentBytes, Request, UserAgent, SslCipher, SslProtocol, TargetGroupArn, TraceId\n| where tolowercase(loadbalancer) matches tolowercase(\"{{loadbalancer}}\")\n| parse regex \"(?<ClientIp>\\b\\d{1,3}\\.\\d{1,3}\\.\\d{1,3}\\.\\d{1,3})\" multi\n| where ClientIp != \"0.0.0.0\" and ClientIp != \"127.0.0.1\"\n| count as ip_count by ClientIp\n| lookup type, actor, raw, threatlevel as MaliciousConfidence from sumo://threat/cs on threat=ClientIp\n| where  !isNull(MaliciousConfidence) \n| json field=raw \"labels[*].name\" as LabelName nodrop\n| replace(LabelName, \"\\\\/\",\"->\") as LabelName\n| replace(LabelName, \"\\\"\",\" \") as LabelName\n| if (isEmpty(actor), \"Unassigned\", actor) as Actor\n| sum (ip_count) as threat_count",
+                            "queryString": "account={{account}} region={{region}} namespace={{namespace}}\n| parse \"* * * * * * * * * * * * \\\"*\\\" \\\"*\\\" * * * \\\"*\\\"\" as Type, DateTime, loadbalancer, Client, Target, RequestProcessingTime, TargetProcessingTime, ResponseProcessingTime, ElbStatusCode, TargetStatusCode, ReceivedBytes, SentBytes, Request, UserAgent, SslCipher, SslProtocol, TargetGroupArn, TraceId\n| where tolowercase(loadbalancer) matches tolowercase(\"{{loadbalancer}}\")\n| parse regex \"(?<ClientIp>\\b\\d{1,3}\\.\\d{1,3}\\.\\d{1,3}\\.\\d{1,3})\" multi\n| where ClientIp != \"0.0.0.0\" and ClientIp != \"127.0.0.1\"\n| count as ip_count by ClientIp\n| lookup type, actor, raw, threatlevel as MaliciousConfidence from sumo://threat/cs on threat=ClientIp\n| where !isNull(MaliciousConfidence) \n| json field=raw \"labels[*].name\" as LabelName nodrop\n| replace(LabelName, \"\\\\/\",\"->\") as LabelName\n| replace(LabelName, \"\\\"\",\" \") as LabelName\n| if (isEmpty(actor), \"Unassigned\", actor) as Actor\n| sum (ip_count) as threat_count",
                             "queryType": "Logs",
                             "queryKey": "A",
                             "metricsQueryMode": null,
@@ -3156,7 +3156,7 @@
                     "queries": [
                         {
                             "transient": false,
-                            "queryString": "account={{account}} region={{region}} namespace={{namespace}}\n| parse \"* * * * * * * * * * * * \\\"*\\\" \\\"*\\\" * * * \\\"*\\\"\" as Type, DateTime, loadbalancer, Client, Target, RequestProcessingTime, TargetProcessingTime, ResponseProcessingTime, ElbStatusCode, TargetStatusCode, ReceivedBytes, SentBytes, Request, UserAgent, SslCipher, SslProtocol, TargetGroupArn, TraceId\n| where tolowercase(loadbalancer) matches tolowercase(\"{{loadbalancer}}\")\n| parse regex \"(?<ClientIp>\\b\\d{1,3}\\.\\d{1,3}\\.\\d{1,3}\\.\\d{1,3})\" multi\n| where ClientIp != \"0.0.0.0\" and ClientIp != \"127.0.0.1\"\n| count as Count by ClientIp\n| lookup type, actor, raw, threatlevel as MaliciousConfidence from sumo://threat/cs on threat=ClientIp\n| where  !isNull(MaliciousConfidence) \n| json field=raw \"labels[*].name\" as LabelName nodrop\n| replace(LabelName, \"\\\\/\",\"->\") as LabelName\n| replace(LabelName, \"\\\"\",\" \") as LabelName\n| if (isEmpty(actor), \"Unassigned\", actor) as Actor\n| count by ClientIp\n| lookup latitude, longitude from geo://location on ip = ClientIp\n| count by latitude, longitude\n| where !isnull(latitude)",
+                            "queryString": "account={{account}} region={{region}} namespace={{namespace}}\n| parse \"* * * * * * * * * * * * \\\"*\\\" \\\"*\\\" * * * \\\"*\\\"\" as Type, DateTime, loadbalancer, Client, Target, RequestProcessingTime, TargetProcessingTime, ResponseProcessingTime, ElbStatusCode, TargetStatusCode, ReceivedBytes, SentBytes, Request, UserAgent, SslCipher, SslProtocol, TargetGroupArn, TraceId\n| where tolowercase(loadbalancer) matches tolowercase(\"{{loadbalancer}}\")\n| parse regex \"(?<ClientIp>\\b\\d{1,3}\\.\\d{1,3}\\.\\d{1,3}\\.\\d{1,3})\" multi\n| where ClientIp != \"0.0.0.0\" and ClientIp != \"127.0.0.1\"\n| count as Count by ClientIp\n| lookup type, actor, raw, threatlevel as MaliciousConfidence from sumo://threat/cs on threat=ClientIp\n| where !isNull(MaliciousConfidence) \n| json field=raw \"labels[*].name\" as LabelName nodrop\n| replace(LabelName, \"\\\\/\",\"->\") as LabelName\n| replace(LabelName, \"\\\"\",\" \") as LabelName\n| if (isEmpty(actor), \"Unassigned\", actor) as Actor\n| count by ClientIp\n| lookup latitude, longitude from geo://location on ip = ClientIp\n| count by latitude, longitude\n| where !isnull(latitude)",
                             "queryType": "Logs",
                             "queryKey": "A",
                             "metricsQueryMode": null,

aws-observability/json/Api-Gateway-App.json

@@ -6379,7 +6379,7 @@
                     "queries": [
                         {
                             "transient": false,
-                            "queryString": "\"\\\"eventSource\\\":\\\"apigateway.amazonaws.com\\\"\" account={{account}} Namespace={{namespace}} region={{region}}\n| json \"eventName\", \"eventSource\", \"awsRegion\", \"userAgent\", \"recipientAccountId\", \"userIdentity\", \"requestParameters\", \"responseElements\", \"sourceIPAddress\", \"errorCode\", \"errorMessage\", \"requestID\" as event_name, event_source, Region, user_agent, accountId1, userIdentity, requestParameters, responseElements, src_ip, error_code, error_message, requestID nodrop\n| where event_source = \"apigateway.amazonaws.com\" and !(src_ip matches \"*.amazonaws.com\")\n| json field=userIdentity \"accountId\", \"arn\", \"userName\", \"type\" as accountId2, arn, username, type nodrop | parse field=arn \":assumed-role/*\" as user nodrop | parse field=arn \"arn:aws:iam::*:*\" as accountId, user nodrop\n| json field=requestParameters \"basePath\", \"domainName\" as basePath, domainName nodrop | json field=responseElements \"name\" as ApiName nodrop // CreateRestApi, CreateApiKey, CreateUsagePlan, CreateUsagePlanKey, CreateUsagePlanKey, ImportApi, ImportRestApi, UpdateRestApi, UpdateUsagePlan provides ApiName\n| where (tolowercase(ApiName) matches tolowercase(\"{{apiname}}\")) or isBlank(apiname)\n| if (!isEmpty(accountId1), accountId1, accountId2) as accountId\n| if (isEmpty(userName), user, userName) as user\n| count by src_ip, event_name // , user, user_agent, apiname\n| lookup type, actor, raw, threatlevel as malicious_confidence from sumo://threat/cs on threat=src_ip \n| where  malicious_confidence = \"high\"\n| json field=raw \"labels[*].name\" as label_name nodrop\n| replace(label_name, \"\\\\/\",\"->\") as label_name\n| replace(label_name, \"\\\"\",\" \") as label_name\n| if (isEmpty(actor), \"Unassigned\", actor) as Actor\n| sort by _count\n| fields src_ip, event_name, type, actor, malicious_confidence // , user, user_agent, apiname",
+                            "queryString": "\"\\\"eventSource\\\":\\\"apigateway.amazonaws.com\\\"\" account={{account}} Namespace={{namespace}} region={{region}}\n| json \"eventName\", \"eventSource\", \"awsRegion\", \"userAgent\", \"recipientAccountId\", \"userIdentity\", \"requestParameters\", \"responseElements\", \"sourceIPAddress\", \"errorCode\", \"errorMessage\", \"requestID\" as event_name, event_source, Region, user_agent, accountId1, userIdentity, requestParameters, responseElements, src_ip, error_code, error_message, requestID nodrop\n| where event_source = \"apigateway.amazonaws.com\" and !(src_ip matches \"*.amazonaws.com\")\n| json field=userIdentity \"accountId\", \"arn\", \"userName\", \"type\" as accountId2, arn, username, type nodrop | parse field=arn \":assumed-role/*\" as user nodrop | parse field=arn \"arn:aws:iam::*:*\" as accountId, user nodrop\n| json field=requestParameters \"basePath\", \"domainName\" as basePath, domainName nodrop | json field=responseElements \"name\" as ApiName nodrop // CreateRestApi, CreateApiKey, CreateUsagePlan, CreateUsagePlanKey, CreateUsagePlanKey, ImportApi, ImportRestApi, UpdateRestApi, UpdateUsagePlan provides ApiName\n| where (tolowercase(ApiName) matches tolowercase(\"{{apiname}}\")) or isBlank(apiname)\n| if (!isEmpty(accountId1), accountId1, accountId2) as accountId\n| if (isEmpty(userName), user, userName) as user\n| count by src_ip, event_name // , user, user_agent, apiname\n| lookup type, actor, raw, threatlevel as malicious_confidence from sumo://threat/cs on threat=src_ip \n| where malicious_confidence = \"high\"\n| json field=raw \"labels[*].name\" as label_name nodrop\n| replace(label_name, \"\\\\/\",\"->\") as label_name\n| replace(label_name, \"\\\"\",\" \") as label_name\n| if (isEmpty(actor), \"Unassigned\", actor) as Actor\n| sort by _count\n| fields src_ip, event_name, type, actor, malicious_confidence // , user, user_agent, apiname",
                             "queryType": "Logs",
                             "queryKey": "A",
                             "metricsQueryMode": null,

aws-observability/json/EC2-CW-Metrics-App.json

@@ -2628,7 +2628,7 @@
                     "queries": [
                         {
                             "transient": false,
-                            "queryString": "account={{account}} region={{region}} namespace={{namespace}} eventname eventsource \"ec2.amazonaws.com\" sourceIPAddress\n| json \"eventSource\", \"awsRegion\", \"requestParameters\", \"responseElements\", \"recipientAccountId\" as event_source, region, requestParameters, responseElements, accountid nodrop\n| json \"userIdentity\", \"eventName\", \"sourceIPAddress\", \"userAgent\", \"eventType\", \"requestID\", \"errorCode\", \"errorMessage\", \"eventCategory\", \"managementEvent\" as userIdentity, event_name, src_ip, user_agent, event_type, request_id, error_code, error_message, event_category, management_event nodrop\n| where event_source = \"ec2.amazonaws.com\" and !(src_ip matches \"*.amazonaws.com\")\n| \"aws/ec2\" as namespace\n| json field=userIdentity \"type\", \"principalId\", \"arn\", \"userName\", \"accountId\" nodrop\n| json field=userIdentity \"sessionContext.attributes.mfaAuthenticated\" as mfaAuthenticated nodrop\n| parse field=arn \":assumed-role/*\" as user nodrop  \n| parse field=arn \"arn:aws:iam::*:*\" as accountId, user nodrop\n| json field=requestParameters \"instanceType\", \"instancesSet\", \"instanceId\", \"DescribeInstanceCreditSpecificationsRequest.InstanceId.content\" as req_instancetype, req_instancesSet, req_instanceid_1, req_instanceid_2 nodrop\n| json field=req_instancesSet \"item\", \"items\" as req_instancesSet_item, req_instancesSet_items nodrop\n| parse regex field=req_instancesSet_item \"\\\"instanceId\\\":\\s*\\\"(?<req_instanceid_3>.*?)\\\"\" nodrop\n| parse regex field=req_instancesSet_items \"\\\"instanceId\\\":\\s*\\\"(?<req_instanceid_4>.*?)\\\"\" nodrop\n| json field=responseElements \"instancesSet.items\" as res_responseElements_items nodrop\n| parse regex field=res_responseElements_items \"\\\"instanceType\\\":\\s*\\\"(?<res_instanceType>.*?)\\\"\" nodrop\n| parse regex field=res_responseElements_items \"\\\"instanceId\\\":\\s*\\\"(?<res_instanceid>.*?)\\\"\" nodrop\n| if (!isBlank(req_instanceid_1), req_instanceid_1,  if (!isBlank(req_instanceid_2), req_instanceid_2, if (!isBlank(req_instanceid_3), req_instanceid_3, if (!isBlank(req_instanceid_4), req_instanceid_4, \"\")))) as req_instanceid\n| if (!isBlank(req_instanceid), req_instanceid, res_instanceid) as instanceid\n| if (!isBlank(req_instancetype), req_instancetype, res_instancetype) as instanceType \n| if (isEmpty(error_code), \"Success\", \"Failure\") as event_status\n| if (isEmpty(userName), user, userName) as user\n| tolowercase(instanceid) as instanceid\n| where instanceid matches \"{{instanceid}}\" OR isBlank(instanceid)\n| count by src_ip, event_name // , user, user_agent, instanceid\n| lookup type, actor, raw, threatlevel as malicious_confidence from sumo://threat/cs on threat=src_ip\n| where  malicious_confidence = \"high\"\n| json field=raw \"labels[*].name\" as label_name nodrop\n| replace(label_name, \"\\\\/\",\"->\") as label_name\n| replace(label_name, \"\\\"\",\" \") as label_name\n| if (isEmpty(actor), \"Unassigned\", actor) as Actor\n| sort by _count\n| fields src_ip, event_name, type, actor, malicious_confidence // , user, user_agent, instanceid",
+                            "queryString": "account={{account}} region={{region}} namespace={{namespace}} eventname eventsource \"ec2.amazonaws.com\" sourceIPAddress\n| json \"eventSource\", \"awsRegion\", \"requestParameters\", \"responseElements\", \"recipientAccountId\" as event_source, region, requestParameters, responseElements, accountid nodrop\n| json \"userIdentity\", \"eventName\", \"sourceIPAddress\", \"userAgent\", \"eventType\", \"requestID\", \"errorCode\", \"errorMessage\", \"eventCategory\", \"managementEvent\" as userIdentity, event_name, src_ip, user_agent, event_type, request_id, error_code, error_message, event_category, management_event nodrop\n| where event_source = \"ec2.amazonaws.com\" and !(src_ip matches \"*.amazonaws.com\")\n| \"aws/ec2\" as namespace\n| json field=userIdentity \"type\", \"principalId\", \"arn\", \"userName\", \"accountId\" nodrop\n| json field=userIdentity \"sessionContext.attributes.mfaAuthenticated\" as mfaAuthenticated nodrop\n| parse field=arn \":assumed-role/*\" as user nodrop  \n| parse field=arn \"arn:aws:iam::*:*\" as accountId, user nodrop\n| json field=requestParameters \"instanceType\", \"instancesSet\", \"instanceId\", \"DescribeInstanceCreditSpecificationsRequest.InstanceId.content\" as req_instancetype, req_instancesSet, req_instanceid_1, req_instanceid_2 nodrop\n| json field=req_instancesSet \"item\", \"items\" as req_instancesSet_item, req_instancesSet_items nodrop\n| parse regex field=req_instancesSet_item \"\\\"instanceId\\\":\\s*\\\"(?<req_instanceid_3>.*?)\\\"\" nodrop\n| parse regex field=req_instancesSet_items \"\\\"instanceId\\\":\\s*\\\"(?<req_instanceid_4>.*?)\\\"\" nodrop\n| json field=responseElements \"instancesSet.items\" as res_responseElements_items nodrop\n| parse regex field=res_responseElements_items \"\\\"instanceType\\\":\\s*\\\"(?<res_instanceType>.*?)\\\"\" nodrop\n| parse regex field=res_responseElements_items \"\\\"instanceId\\\":\\s*\\\"(?<res_instanceid>.*?)\\\"\" nodrop\n| if (!isBlank(req_instanceid_1), req_instanceid_1,  if (!isBlank(req_instanceid_2), req_instanceid_2, if (!isBlank(req_instanceid_3), req_instanceid_3, if (!isBlank(req_instanceid_4), req_instanceid_4, \"\")))) as req_instanceid\n| if (!isBlank(req_instanceid), req_instanceid, res_instanceid) as instanceid\n| if (!isBlank(req_instancetype), req_instancetype, res_instancetype) as instanceType \n| if (isEmpty(error_code), \"Success\", \"Failure\") as event_status\n| if (isEmpty(userName), user, userName) as user\n| tolowercase(instanceid) as instanceid\n| where instanceid matches \"{{instanceid}}\" OR isBlank(instanceid)\n| count by src_ip, event_name // , user, user_agent, instanceid\n| lookup type, actor, raw, threatlevel as malicious_confidence from sumo://threat/cs on threat=src_ip\n| where malicious_confidence = \"high\"\n| json field=raw \"labels[*].name\" as label_name nodrop\n| replace(label_name, \"\\\\/\",\"->\") as label_name\n| replace(label_name, \"\\\"\",\" \") as label_name\n| if (isEmpty(actor), \"Unassigned\", actor) as Actor\n| sort by _count\n| fields src_ip, event_name, type, actor, malicious_confidence // , user, user_agent, instanceid",
                             "queryType": "Logs",
                             "queryKey": "A",
                             "metricsQueryMode": null,