Skip to content
This repository was archived by the owner on Nov 16, 2023. It is now read-only.

Updated table names in Advanced Hunting section #334

Open
wants to merge 2 commits into
base: master
Choose a base branch
from
Open

Updated table names in Advanced Hunting section #334

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
7bf03ce
Updated table names in Advanced Hunting section
woodtechie1428 Apr 15, 2021
8053d8d
fixed missing ,
woodtechie1428 Apr 15, 2021
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
63 changes: 30 additions & 33 deletions Notebooks/WDATP APIs Demo Notebook.ipynb
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1611,16 +1611,16 @@
"One of the most powerful things you can do with API is run hunting queries. This allows you to access \n",
"the rich data that WDATP collects from endpoints. The following tables are exposed as part of Advanced hunting:\n",
"\n",
"- AlertEvents - Alerts on Windows Defender Security Center\n",
"- MachineInfo - Machine information, including OS information\n",
"- MachineNetworkInfo - Network properties of machines, including adapters, IP and MAC addresses, as well as connected networks and domains\n",
"- ProcessCreationEvents - Process creation and related events\n",
"- NetworkCommunicationEvents - Network connection and related events\n",
"- FileCreationEvents - File creation, modification, and other file system events\n",
"- RegistryEvents - Creation and modification of registry entries\n",
"- LogonEvents - Login and other authentication events\n",
"- ImageLoadEvents - DLL loading events\n",
"- MiscEvents - Multiple event types, such as process injection, creation of scheduled tasks, and LSASS access attempts"
"- DeviceAlertEvents - Alerts on Windows Defender Security Center\n",
"- DeviceInfo - Machine information, including OS information\n",
"- DeviceNetworkInfo - Network properties of machines, including adapters, IP and MAC addresses, as well as connected networks and domains\n",
"- DeviceProcessEvents - Process creation and related events\n",
"- DeviceNetworkEvents - Network connection and related events\n",
"- DeviceFileEvents - File creation, modification, and other file system events\n",
"- DeviceRegistryEvents - Creation and modification of registry entries\n",
"- DeviceLogonEvents - Login and other authentication events\n",
"- DeviceImageLoadEvents - DLL loading events\n",
"- DeviceEvents - Multiple event types, such as process injection, creation of scheduled tasks, and LSASS access attempts"
]
},
{
Expand Down Expand Up @@ -1722,11 +1722,11 @@
"## look for process creation events where someone ran: net.exe user foo /domain\n",
"\n",
"wdatp_api.query( query = '''\n",
"ProcessCreationEvents\n",
"| where EventTime > ago(3d)\n",
"DeviceProcessEvents\n",
"| where Timestamp > ago(3d)\n",
"| where FileName == 'net.exe'\n",
"| where ProcessCommandLine contains ' user ' and ProcessCommandLine contains ' /do' and ProcessCommandLine !contains ' /ad'\n",
"| project EventTime, ProcessCommandLine , InitiatingProcessCommandLine , InitiatingProcessParentFileName , AccountName \n",
"| project Timestamp, ProcessCommandLine , InitiatingProcessCommandLine , InitiatingProcessParentFileName , AccountName \n",
"| sort by InitiatingProcessParentFileName\n",
"''')"
]
Expand Down Expand Up @@ -3984,20 +3984,20 @@
"# build a hunting query that gets data around the time of the alert\n",
"get_records_qry = '''\n",
"let alertId = \"%s\";\n",
"let alert = AlertEvents | where AlertId == alertId | summarize AlertFirstEventTime=min(EventTime) by MachineId;\n",
"let machineId = toscalar(alert | project MachineId);\n",
"let alert = DeviceAlertEvents | where AlertId == alertId | summarize AlertFirstEventTime=min(Timestamp) by DeviceId;\n",
"let machineId = toscalar(alert | project DeviceId);\n",
"let timestamp = toscalar(alert | project AlertFirstEventTime);\n",
"let lookupPeriod = 10m;\n",
"find in (ProcessCreationEvents, NetworkCommunicationEvents, FileCreationEvents) \n",
"where EventTime between ((timestamp - lookupPeriod) .. lookupPeriod)\n",
" and MachineId == machineId\n",
"| project-away ComputerName, InitiatingProcessAccountDomain, InitiatingProcessAccountSid // demo env only\n",
"find in (DeviceProcessEvents, DeviceNetworkEvents, DeviceFileEvents) \n",
"where Timestamp between ((timestamp - lookupPeriod) .. lookupPeriod)\n",
" and DeviceId == machineId\n",
"| project-away DeviceName, InitiatingProcessAccountDomain, InitiatingProcessAccountSid // demo env only\n",
"| take 1000\n",
"''' % (alert_df.id.values[0])\n",
"\n",
"related_data_df = wdatp_api.query(query=get_records_qry)\n",
"print (\"Number of records found %d\" % len(related_data_df))\n",
"related_data_df "
"related_data_df"
]
},
{
Expand Down Expand Up @@ -7111,14 +7111,14 @@
"source": [
"# this query gets a handful of machines named desktop \n",
"query = '''\n",
"let machine_list = MachineInfo | where EventTime > ago(1d) | where ComputerName startswith 'desktop-' | summarize by ComputerName, MachineId | take 5;\n",
"NetworkCommunicationEvents\n",
"| where EventTime > ago(5d) | where isnotempty(MachineId)\n",
"let machine_list = DeviceInfo | where Timestamp > ago(1d) | where DeviceName startswith 'desktop-' | summarize by DeviceName, DeviceId | take 5;\n",
"DeviceNetworkEvents\n",
"| where Timestamp > ago(5d) | where isnotempty(DeviceId)\n",
"| where RemoteIPType == 'Public' and RemoteIP contains ('.') and RemotePort in ('80') \n",
"| extend MaskedIP = strcat(split(RemoteIP,'.')[0],'.', split(RemoteIP,'.')[1], '.*.*')\n",
"| summarize by MachineId, MaskedIP \n",
"| join kind=inner (machine_list) on MachineId \n",
"| summarize by ComputerName, MaskedIP\n",
"| summarize by DeviceId, MaskedIP \n",
"| join kind=inner (machine_list) on DeviceId \n",
"| summarize by DeviceName, MaskedIP \n",
"'''\n",
"df = wdatp_api.query(query)\n",
"print (\"rows returned = %d\" % len(df))\n",
Expand Down Expand Up @@ -8791,13 +8791,10 @@
"## query WDATP data for hashes of files recorded in alerts\n",
"\n",
"df_results = wdatp_api.query(query = '''\n",
"AlertEvents \n",
"| where EventTime > ago(7d) and SHA1 != ''\n",
"DeviceAlertEvents \n",
"| where Timestamp > ago(7d) and SHA1 != ''\n",
"| summarize by SHA1\n",
"| take 100\n",
"'''\n",
")\n",
"print(\"Number of hashes = %d\" % len(df_results))"
"| take 100"
]
},
{
Expand Down Expand Up @@ -10076,4 +10073,4 @@
},
"nbformat": 4,
"nbformat_minor": 2
}
}