forked from zakomlistov/kuma-queries
-
Notifications
You must be signed in to change notification settings - Fork 0
/
kuma_example_queries.json
30 lines (30 loc) · 54.7 KB
/
kuma_example_queries.json
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
{ "_id" : "6efaf0dd-1c7b-40ed-aa01-a9e44cb37036", "exportID" : "6efaf0dd-1c7b-40ed-aa01-a9e44cb37036", "tenantID" : "f02dbc6e-14cd-44f4-9c46-3fe9054bc210", "kind" : "search", "name" : "Audit", "description" : "", "createdAt" : 1705929900804, "updatedAt" : 1705929900804, "folderID" : "", "userID" : "309236e9-ff0e-4b17-a204-e7600320914b", "deps" : null, "internal" : false, "repositoryPackageID" : "", "packageIntegrationResource" : false, "payload" : { "id" : "6efaf0dd-1c7b-40ed-aa01-a9e44cb37036", "tenantIDs" : null, "name" : "Audit", "kind" : "event", "clusterID" : "8b61d2d2-c4ff-4534-8dc8-965b496b496c", "columns" : [ ], "where" : null, "period" : { "from" : 0, "to" : 0, "relative" : "now-1d", "column" : "" }, "sql" : "SELECT * FROM `events` WHERE Type=4 ORDER BY Timestamp DESC LIMIT 250", "displayColumns" : [ { "name" : "Timestamp", "alias" : "Time", "width" : 150 }, { "name" : "TenantID", "alias" : "", "width" : 150 }, { "name" : "DestinationHostName", "alias" : "", "width" : 50 }, { "name" : "DeviceProduct", "alias" : "", "width" : 150 }, { "name" : "DeviceVendor", "alias" : "", "width" : 150 }, { "name" : "DeviceProcessName", "alias" : "", "width" : 150 }, { "name" : "SourceUserName", "alias" : "", "width" : 150 }, { "name" : "DestinationUserName", "alias" : "", "width" : 150 }, { "name" : "DeviceAction", "alias" : "", "width" : 150 } ], "branchIDs" : [ ], "correlatorID" : "", "activeListID" : "", "contextTableID" : "", "limit" : 250, "orderBy" : [ { "column" : "Timestamp", "asc" : false, "shouldEscape" : false } ] } }
{ "_id" : "6313751b-dede-4708-9066-03bde97c5b41", "exportID" : "6313751b-dede-4708-9066-03bde97c5b41", "tenantID" : "a1fbde7a-76d3-4bbc-a769-82126b41b56f", "kind" : "search", "name" : "KATA; Все события за 24 часа", "description" : "", "createdAt" : NumberLong("1715941755386"), "updatedAt" : NumberLong("1715941755386"), "folderID" : "", "userID" : "309236e9-ff0e-4b17-a204-e7600320914b", "deps" : null, "internal" : false, "repositoryPackageID" : "", "packageIntegrationResource" : false, "payload" : { "id" : "6313751b-dede-4708-9066-03bde97c5b41", "tenantIDs" : [ ], "name" : "KATA; Все события за 24 часа", "kind" : "event", "clusterID" : "8b61d2d2-c4ff-4534-8dc8-965b496b496c", "columns" : [ ], "where" : null, "period" : { "from" : NumberLong(0), "to" : NumberLong(0), "relative" : "now-1h", "column" : "" }, "sql" : "SELECT * FROM `events` WHERE Name != 'Heartbeat message' AND DeviceProduct = 'KATA' ORDER BY Timestamp DESC LIMIT 250", "displayColumns" : [ { "name" : "TenantID", "alias" : "", "width" : NumberLong(107) }, { "name" : "Timestamp", "alias" : "", "width" : NumberLong(150) }, { "name" : "Name", "alias" : "", "width" : NumberLong(94) }, { "name" : "DeviceEventClassID", "alias" : "", "width" : NumberLong(164) }, { "name" : "DeviceHostName", "alias" : "", "width" : NumberLong(150) }, { "name" : "DeviceVersion", "alias" : "", "width" : NumberLong(150) }, { "name" : "Severity", "alias" : "", "width" : NumberLong(94) } ], "branchIDs" : [ ], "correlatorID" : "", "activeListID" : "", "contextTableID" : "", "limit" : NumberLong(250), "orderBy" : [ { "column" : "Timestamp", "asc" : false, "shouldEscape" : false } ] } }
{ "_id" : "356dba75-8687-44da-8bd4-1bee19ac845a", "exportID" : "356dba75-8687-44da-8bd4-1bee19ac845a", "tenantID" : "a1fbde7a-76d3-4bbc-a769-82126b41b56f", "kind" : "search", "name" : "KEDR; События в \"Нерабочее время\" (с 20 до 7)", "description" : "", "createdAt" : NumberLong("1713270874785"), "updatedAt" : NumberLong("1713270874785"), "folderID" : "", "userID" : "309236e9-ff0e-4b17-a204-e7600320914b", "deps" : null, "internal" : false, "repositoryPackageID" : "", "packageIntegrationResource" : false, "payload" : { "id" : "356dba75-8687-44da-8bd4-1bee19ac845a", "tenantIDs" : [ ], "name" : "KEDR; События в \"Нерабочее время\" (с 20 до 7)", "kind" : "event", "clusterID" : "8b61d2d2-c4ff-4534-8dc8-965b496b496c", "columns" : [ ], "where" : null, "period" : { "from" : NumberLong(0), "to" : NumberLong(0), "relative" : "now-1d", "column" : "" }, "sql" : "SELECT *\r\nFROM `events` \r\nWHERE DeviceVendor = 'Kaspersky' \r\nAND DeviceProduct = 'EDR'\r\nAND toHour(fromUnixTimestamp64Milli(Timestamp, 'Europe/Moscow'))\r\nIN (20, 21, 22, 23, 0, 1, 2, 3, 4, 5, 6, 7)\r\nORDER BY Timestamp ASC LIMIT 250", "displayColumns" : [ { "name" : "TenantID", "alias" : "", "width" : NumberLong(150) }, { "name" : "Timestamp", "alias" : "", "width" : NumberLong(150) }, { "name" : "DeviceProduct", "alias" : "", "width" : NumberLong(101) }, { "name" : "Name", "alias" : "", "width" : NumberLong(94) }, { "name" : "Message", "alias" : "", "width" : NumberLong(135) }, { "name" : "SourceUserName", "alias" : "", "width" : NumberLong(150) }, { "name" : "DeviceHostName", "alias" : "", "width" : NumberLong(150) }, { "name" : "DeviceAddress", "alias" : "", "width" : NumberLong(150) }, { "name" : "FileName", "alias" : "", "width" : NumberLong(150) }, { "name" : "Severity", "alias" : "", "width" : NumberLong(94) }, { "name" : "EventOutcome", "alias" : "", "width" : NumberLong(150) } ], "branchIDs" : [ ], "correlatorID" : "", "activeListID" : "", "contextTableID" : "", "limit" : NumberLong(250), "orderBy" : [ { "column" : "Timestamp", "asc" : true, "shouldEscape" : false } ] } }
{ "_id" : "c8f7b3c1-3359-4117-9d03-7d07733db813", "exportID" : "c8f7b3c1-3359-4117-9d03-7d07733db813", "tenantID" : "a1fbde7a-76d3-4bbc-a769-82126b41b56f", "kind" : "search", "name" : "KEDR; События за 1 час", "description" : "", "createdAt" : NumberLong("1713268820719"), "updatedAt" : NumberLong("1713268820719"), "folderID" : "", "userID" : "309236e9-ff0e-4b17-a204-e7600320914b", "deps" : null, "internal" : false, "repositoryPackageID" : "", "packageIntegrationResource" : false, "payload" : { "id" : "c8f7b3c1-3359-4117-9d03-7d07733db813", "tenantIDs" : [ ], "name" : "KEDR; События за 1 час", "kind" : "event", "clusterID" : "8b61d2d2-c4ff-4534-8dc8-965b496b496c", "columns" : [ ], "where" : null, "period" : { "from" : NumberLong(0), "to" : NumberLong(0), "relative" : "now-1h", "column" : "" }, "sql" : "SELECT * \nFROM `events` \nWHERE DeviceVendor = 'Kaspersky' \nAND DeviceProduct = 'EDR' \nORDER BY Timestamp DESC LIMIT 250", "displayColumns" : [ { "name" : "TenantID", "alias" : "", "width" : NumberLong(150) }, { "name" : "Timestamp", "alias" : "", "width" : NumberLong(150) }, { "name" : "DeviceVendor", "alias" : "", "width" : NumberLong(150) }, { "name" : "DeviceProduct", "alias" : "", "width" : NumberLong(150) }, { "name" : "Name", "alias" : "", "width" : NumberLong(150) }, { "name" : "Message", "alias" : "", "width" : NumberLong(150) }, { "name" : "SourceUserName", "alias" : "", "width" : NumberLong(150) }, { "name" : "DeviceHostName", "alias" : "", "width" : NumberLong(150) }, { "name" : "DeviceAddress", "alias" : "", "width" : NumberLong(150) }, { "name" : "FileName", "alias" : "", "width" : NumberLong(150) }, { "name" : "Severity", "alias" : "", "width" : NumberLong(150) } ], "branchIDs" : [ ], "correlatorID" : "", "activeListID" : "", "contextTableID" : "", "limit" : NumberLong(250), "orderBy" : [ { "column" : "Timestamp", "asc" : false, "shouldEscape" : false } ] } }
{ "_id" : "1912fd1c-7981-4282-a1ef-cc1159b95897", "exportID" : "1912fd1c-7981-4282-a1ef-cc1159b95897", "tenantID" : "a1fbde7a-76d3-4bbc-a769-82126b41b56f", "kind" : "search", "name" : "KEDR; События за 15 минут", "description" : "", "createdAt" : NumberLong("1713268723138"), "updatedAt" : NumberLong("1713268723138"), "folderID" : "", "userID" : "309236e9-ff0e-4b17-a204-e7600320914b", "deps" : null, "internal" : false, "repositoryPackageID" : "", "packageIntegrationResource" : false, "payload" : { "id" : "1912fd1c-7981-4282-a1ef-cc1159b95897", "tenantIDs" : [ ], "name" : "KEDR; События за 15 минут", "kind" : "event", "clusterID" : "8b61d2d2-c4ff-4534-8dc8-965b496b496c", "columns" : [ ], "where" : null, "period" : { "from" : NumberLong(0), "to" : NumberLong(0), "relative" : "now-15m", "column" : "" }, "sql" : "SELECT * \nFROM `events` \nWHERE DeviceVendor = 'Kaspersky' \nAND DeviceProduct = 'EDR' \nORDER BY Timestamp DESC LIMIT 250", "displayColumns" : [ { "name" : "TenantID", "alias" : "", "width" : NumberLong(150) }, { "name" : "Timestamp", "alias" : "", "width" : NumberLong(150) }, { "name" : "DeviceVendor", "alias" : "", "width" : NumberLong(150) }, { "name" : "DeviceProduct", "alias" : "", "width" : NumberLong(150) }, { "name" : "Name", "alias" : "", "width" : NumberLong(150) }, { "name" : "Message", "alias" : "", "width" : NumberLong(150) }, { "name" : "SourceUserName", "alias" : "", "width" : NumberLong(150) }, { "name" : "DeviceHostName", "alias" : "", "width" : NumberLong(150) }, { "name" : "DeviceAddress", "alias" : "", "width" : NumberLong(150) }, { "name" : "FileName", "alias" : "", "width" : NumberLong(150) }, { "name" : "Severity", "alias" : "", "width" : NumberLong(150) } ], "branchIDs" : [ ], "correlatorID" : "", "activeListID" : "", "contextTableID" : "", "limit" : NumberLong(250), "orderBy" : [ { "column" : "Timestamp", "asc" : false, "shouldEscape" : false } ] } }
{ "_id" : "9ac97ebf-c85b-4983-9877-210edffb16f3", "exportID" : "9ac97ebf-c85b-4983-9877-210edffb16f3", "tenantID" : "a1fbde7a-76d3-4bbc-a769-82126b41b56f", "kind" : "search", "name" : "KEDR; События изменения Регистра", "description" : "", "createdAt" : NumberLong("1713270685013"), "updatedAt" : NumberLong("1713270685013"), "folderID" : "", "userID" : "309236e9-ff0e-4b17-a204-e7600320914b", "deps" : null, "internal" : false, "repositoryPackageID" : "", "packageIntegrationResource" : false, "payload" : { "id" : "9ac97ebf-c85b-4983-9877-210edffb16f3", "tenantIDs" : [ ], "name" : "KEDR; События изменения Регистра", "kind" : "event", "clusterID" : "8b61d2d2-c4ff-4534-8dc8-965b496b496c", "columns" : [ ], "where" : null, "period" : { "from" : NumberLong(0), "to" : NumberLong(0), "relative" : "now-15m", "column" : "" }, "sql" : "SELECT *\r\nFROM `events` \r\nWHERE DeviceVendor = 'Kaspersky' \r\nAND DeviceProduct = 'EDR'\r\nAND Name = 'Registry change' \r\nORDER BY Timestamp ASC LIMIT 250", "displayColumns" : [ { "name" : "TenantID", "alias" : "", "width" : NumberLong(150) }, { "name" : "Timestamp", "alias" : "", "width" : NumberLong(150) }, { "name" : "DeviceVendor", "alias" : "", "width" : NumberLong(109) }, { "name" : "DeviceProduct", "alias" : "", "width" : NumberLong(101) }, { "name" : "Name", "alias" : "", "width" : NumberLong(94) }, { "name" : "Message", "alias" : "", "width" : NumberLong(135) }, { "name" : "SourceUserName", "alias" : "", "width" : NumberLong(150) }, { "name" : "DeviceHostName", "alias" : "", "width" : NumberLong(150) }, { "name" : "DeviceAddress", "alias" : "", "width" : NumberLong(150) }, { "name" : "FileName", "alias" : "", "width" : NumberLong(150) }, { "name" : "SourceUserPrivileges", "alias" : "", "width" : NumberLong(150) } ], "branchIDs" : [ ], "correlatorID" : "", "activeListID" : "", "contextTableID" : "", "limit" : NumberLong(250), "orderBy" : [ { "column" : "Timestamp", "asc" : true, "shouldEscape" : false } ] } }
{ "_id" : "52663c71-cb19-41fa-95bc-0094998c012e", "exportID" : "52663c71-cb19-41fa-95bc-0094998c012e", "tenantID" : "a1fbde7a-76d3-4bbc-a769-82126b41b56f", "kind" : "search", "name" : "KEDR; События изменения файлов", "description" : "", "createdAt" : NumberLong("1713270448631"), "updatedAt" : NumberLong("1713270448631"), "folderID" : "", "userID" : "309236e9-ff0e-4b17-a204-e7600320914b", "deps" : null, "internal" : false, "repositoryPackageID" : "", "packageIntegrationResource" : false, "payload" : { "id" : "52663c71-cb19-41fa-95bc-0094998c012e", "tenantIDs" : [ ], "name" : "KEDR; События изменения файлов", "kind" : "event", "clusterID" : "8b61d2d2-c4ff-4534-8dc8-965b496b496c", "columns" : [ ], "where" : null, "period" : { "from" : NumberLong(0), "to" : NumberLong(0), "relative" : "now-1h", "column" : "" }, "sql" : "SELECT * \nFROM `events` \nWHERE Name = 'File change'\nAND DeviceVendor = 'Kaspersky'\nAND DeviceProduct = 'EDR' \nORDER BY Timestamp DESC LIMIT 250", "displayColumns" : [ { "name" : "TenantID", "alias" : "", "width" : NumberLong(150) }, { "name" : "Timestamp", "alias" : "", "width" : NumberLong(150) }, { "name" : "DeviceVendor", "alias" : "", "width" : NumberLong(109) }, { "name" : "DeviceProduct", "alias" : "", "width" : NumberLong(101) }, { "name" : "Name", "alias" : "", "width" : NumberLong(94) }, { "name" : "Message", "alias" : "", "width" : NumberLong(150) }, { "name" : "SourceUserName", "alias" : "", "width" : NumberLong(150) }, { "name" : "DeviceHostName", "alias" : "", "width" : NumberLong(150) }, { "name" : "DeviceAddress", "alias" : "", "width" : NumberLong(150) }, { "name" : "FileName", "alias" : "", "width" : NumberLong(150) } ], "branchIDs" : [ ], "correlatorID" : "", "activeListID" : "", "contextTableID" : "", "limit" : NumberLong(250), "orderBy" : [ { "column" : "Timestamp", "asc" : false, "shouldEscape" : false } ] } }
{ "_id" : "cfbe8d5d-8752-4d30-9745-8fc4446bc93f", "exportID" : "cfbe8d5d-8752-4d30-9745-8fc4446bc93f", "tenantID" : "a1fbde7a-76d3-4bbc-a769-82126b41b56f", "kind" : "search", "name" : "KEDR; События подключения", "description" : "", "createdAt" : NumberLong("1713270337254"), "updatedAt" : NumberLong("1713270337254"), "folderID" : "", "userID" : "309236e9-ff0e-4b17-a204-e7600320914b", "deps" : null, "internal" : false, "repositoryPackageID" : "", "packageIntegrationResource" : false, "payload" : { "id" : "cfbe8d5d-8752-4d30-9745-8fc4446bc93f", "tenantIDs" : [ ], "name" : "KEDR; События подключения", "kind" : "event", "clusterID" : "8b61d2d2-c4ff-4534-8dc8-965b496b496c", "columns" : [ ], "where" : null, "period" : { "from" : NumberLong(0), "to" : NumberLong(0), "relative" : "now-1h", "column" : "" }, "sql" : "SELECT * \nFROM `events` \nWHERE Name = 'Connection' \nAND DeviceVendor = 'Kaspersky'\nAND DeviceProduct = 'EDR' \nORDER BY Timestamp DESC LIMIT 250", "displayColumns" : [ { "name" : "TenantID", "alias" : "", "width" : NumberLong(150) }, { "name" : "Timestamp", "alias" : "", "width" : NumberLong(150) }, { "name" : "DeviceVendor", "alias" : "", "width" : NumberLong(109) }, { "name" : "DeviceProduct", "alias" : "", "width" : NumberLong(101) }, { "name" : "Name", "alias" : "", "width" : NumberLong(94) }, { "name" : "Message", "alias" : "", "width" : NumberLong(150) }, { "name" : "SourceUserName", "alias" : "", "width" : NumberLong(150) }, { "name" : "DeviceHostName", "alias" : "", "width" : NumberLong(150) }, { "name" : "DeviceAddress", "alias" : "", "width" : NumberLong(150) }, { "name" : "DestinationAddress", "alias" : "", "width" : NumberLong(150) }, { "name" : "FileName", "alias" : "", "width" : NumberLong(150) }, { "name" : "Severity", "alias" : "", "width" : NumberLong(94) } ], "branchIDs" : [ ], "correlatorID" : "", "activeListID" : "", "contextTableID" : "", "limit" : NumberLong(250), "orderBy" : [ { "column" : "Timestamp", "asc" : false, "shouldEscape" : false } ] } }
{ "_id" : "154fd5ed-6a57-4e08-bc2a-ff9c19bdd819", "exportID" : "154fd5ed-6a57-4e08-bc2a-ff9c19bdd819", "tenantID" : "a1fbde7a-76d3-4bbc-a769-82126b41b56f", "kind" : "search", "name" : "KEDR; События с High Severity", "description" : "", "createdAt" : NumberLong("1713268959620"), "updatedAt" : NumberLong("1713268959620"), "folderID" : "", "userID" : "309236e9-ff0e-4b17-a204-e7600320914b", "deps" : null, "internal" : false, "repositoryPackageID" : "", "packageIntegrationResource" : false, "payload" : { "id" : "154fd5ed-6a57-4e08-bc2a-ff9c19bdd819", "tenantIDs" : [ ], "name" : "KEDR; События с High Severity", "kind" : "event", "clusterID" : "8b61d2d2-c4ff-4534-8dc8-965b496b496c", "columns" : [ ], "where" : null, "period" : { "from" : NumberLong(0), "to" : NumberLong(0), "relative" : "now-1h", "column" : "" }, "sql" : "SELECT * \nFROM `events` \nWHERE DeviceVendor = 'Kaspersky'\nAND Severity = 'High' \nAND DeviceProduct = 'EDR' \nORDER BY Timestamp DESC LIMIT 250", "displayColumns" : [ { "name" : "TenantID", "alias" : "", "width" : NumberLong(150) }, { "name" : "Timestamp", "alias" : "", "width" : NumberLong(150) }, { "name" : "DeviceVendor", "alias" : "", "width" : NumberLong(150) }, { "name" : "DeviceProduct", "alias" : "", "width" : NumberLong(150) }, { "name" : "Name", "alias" : "", "width" : NumberLong(150) }, { "name" : "Message", "alias" : "", "width" : NumberLong(150) }, { "name" : "SourceUserName", "alias" : "", "width" : NumberLong(150) }, { "name" : "DeviceHostName", "alias" : "", "width" : NumberLong(150) }, { "name" : "DeviceAddress", "alias" : "", "width" : NumberLong(150) }, { "name" : "FileName", "alias" : "", "width" : NumberLong(150) }, { "name" : "Severity", "alias" : "", "width" : NumberLong(150) } ], "branchIDs" : [ ], "correlatorID" : "", "activeListID" : "", "contextTableID" : "", "limit" : NumberLong(250), "orderBy" : [ { "column" : "Timestamp", "asc" : false, "shouldEscape" : false } ] } }
{ "_id" : "d40fd391-e800-4953-9c7d-3a195fc5711e", "exportID" : "d40fd391-e800-4953-9c7d-3a195fc5711e", "tenantID" : "a1fbde7a-76d3-4bbc-a769-82126b41b56f", "kind" : "search", "name" : "KEDR; События типа Connection", "description" : "", "createdAt" : NumberLong("1713280058307"), "updatedAt" : NumberLong("1713280058307"), "folderID" : "", "userID" : "309236e9-ff0e-4b17-a204-e7600320914b", "deps" : null, "internal" : false, "repositoryPackageID" : "", "packageIntegrationResource" : false, "payload" : { "id" : "d40fd391-e800-4953-9c7d-3a195fc5711e", "tenantIDs" : [ ], "name" : "KEDR; События типа Connection", "kind" : "event", "clusterID" : "8b61d2d2-c4ff-4534-8dc8-965b496b496c", "columns" : [ ], "where" : null, "period" : { "from" : NumberLong(0), "to" : NumberLong(0), "relative" : "now-1h", "column" : "" }, "sql" : "SELECT * \nFROM `events` \nWHERE DeviceEventCategory = 'connection'\nAND DeviceVendor = 'Kaspersky'\nAND DeviceProduct = 'EDR' \nORDER BY Timestamp DESC LIMIT 250", "displayColumns" : [ { "name" : "TenantID", "alias" : "", "width" : NumberLong(150) }, { "name" : "Timestamp", "alias" : "", "width" : NumberLong(150) }, { "name" : "SourceUserName", "alias" : "", "width" : NumberLong(150) }, { "name" : "SourceAddress", "alias" : "", "width" : NumberLong(150) }, { "name" : "SourcePort", "alias" : "", "width" : NumberLong(150) }, { "name" : "DestinationAddress", "alias" : "", "width" : NumberLong(150) }, { "name" : "DestinationPort", "alias" : "", "width" : NumberLong(150) }, { "name" : "RequestUrl", "alias" : "", "width" : NumberLong(150) } ], "branchIDs" : [ ], "correlatorID" : "", "activeListID" : "", "contextTableID" : "", "limit" : NumberLong(250), "orderBy" : [ { "column" : "Timestamp", "asc" : false, "shouldEscape" : false } ] } }
{ "_id" : "af265926-4d0b-47bb-9395-cf863da914d5", "exportID" : "af265926-4d0b-47bb-9395-cf863da914d5", "tenantID" : "a1fbde7a-76d3-4bbc-a769-82126b41b56f", "kind" : "search", "name" : "KEDR; События типа Filechange", "description" : "", "createdAt" : NumberLong("1713280150390"), "updatedAt" : NumberLong("1713280150390"), "folderID" : "", "userID" : "309236e9-ff0e-4b17-a204-e7600320914b", "deps" : null, "internal" : false, "repositoryPackageID" : "", "packageIntegrationResource" : false, "payload" : { "id" : "af265926-4d0b-47bb-9395-cf863da914d5", "tenantIDs" : [ ], "name" : "KEDR; События типа Filechange", "kind" : "event", "clusterID" : "8b61d2d2-c4ff-4534-8dc8-965b496b496c", "columns" : [ ], "where" : null, "period" : { "from" : NumberLong(0), "to" : NumberLong(0), "relative" : "now-1h", "column" : "" }, "sql" : "SELECT * \nFROM `events` \nWHERE DeviceEventCategory = 'filechange'\nAND DeviceVendor = 'Kaspersky'\nAND DeviceProduct = 'EDR' \nORDER BY Timestamp DESC LIMIT 250", "displayColumns" : [ { "name" : "TenantID", "alias" : "", "width" : NumberLong(150) }, { "name" : "Timestamp", "alias" : "", "width" : NumberLong(150) }, { "name" : "SourceUserName", "alias" : "", "width" : NumberLong(150) }, { "name" : "FileName", "alias" : "", "width" : NumberLong(150) }, { "name" : "OldFileName", "alias" : "", "width" : NumberLong(150) }, { "name" : "FilePath", "alias" : "", "width" : NumberLong(150) }, { "name" : "OldFilePath", "alias" : "", "width" : NumberLong(150) }, { "name" : "FileHash", "alias" : "", "width" : NumberLong(150) }, { "name" : "OldFileHash", "alias" : "", "width" : NumberLong(150) } ], "branchIDs" : [ ], "correlatorID" : "", "activeListID" : "", "contextTableID" : "", "limit" : NumberLong(250), "orderBy" : [ { "column" : "Timestamp", "asc" : false, "shouldEscape" : false } ] } }
{ "_id" : "6dd945eb-2708-477c-9d57-f6a1baa396e1", "exportID" : "6dd945eb-2708-477c-9d57-f6a1baa396e1", "tenantID" : "a1fbde7a-76d3-4bbc-a769-82126b41b56f", "kind" : "search", "name" : "KEDR; События типа Process", "description" : "", "createdAt" : NumberLong("1713280358749"), "updatedAt" : NumberLong("1713280358749"), "folderID" : "", "userID" : "309236e9-ff0e-4b17-a204-e7600320914b", "deps" : null, "internal" : false, "repositoryPackageID" : "", "packageIntegrationResource" : false, "payload" : { "id" : "6dd945eb-2708-477c-9d57-f6a1baa396e1", "tenantIDs" : [ ], "name" : "KEDR; События типа Process", "kind" : "event", "clusterID" : "8b61d2d2-c4ff-4534-8dc8-965b496b496c", "columns" : [ ], "where" : null, "period" : { "from" : NumberLong(0), "to" : NumberLong(0), "relative" : "now-1h", "column" : "" }, "sql" : "SELECT * \nFROM `events` \nWHERE DeviceEventCategory = 'process'\nAND DeviceVendor = 'Kaspersky'\nAND DeviceProduct = 'EDR' \nORDER BY Timestamp DESC LIMIT 250", "displayColumns" : [ { "name" : "TenantID", "alias" : "", "width" : NumberLong(150) }, { "name" : "Timestamp", "alias" : "", "width" : NumberLong(150) }, { "name" : "SourceUserName", "alias" : "", "width" : NumberLong(150) }, { "name" : "DeviceAddress", "alias" : "", "width" : NumberLong(150) }, { "name" : "SourceProcessName", "alias" : "", "width" : NumberLong(150) }, { "name" : "DeviceCustomString4", "alias" : "", "width" : NumberLong(150) }, { "name" : "FileHash", "alias" : "", "width" : NumberLong(150) } ], "branchIDs" : [ ], "correlatorID" : "", "activeListID" : "", "contextTableID" : "", "limit" : NumberLong(250), "orderBy" : [ { "column" : "Timestamp", "asc" : false, "shouldEscape" : false } ] } }
{ "_id" : "da013f1b-59ed-4c08-83d8-80c3430a5d6c", "exportID" : "da013f1b-59ed-4c08-83d8-80c3430a5d6c", "tenantID" : "a1fbde7a-76d3-4bbc-a769-82126b41b56f", "kind" : "search", "name" : "KEDR; События типа Registry", "description" : "", "createdAt" : NumberLong("1713280239236"), "updatedAt" : NumberLong("1713280239236"), "folderID" : "", "userID" : "309236e9-ff0e-4b17-a204-e7600320914b", "deps" : null, "internal" : false, "repositoryPackageID" : "", "packageIntegrationResource" : false, "payload" : { "id" : "da013f1b-59ed-4c08-83d8-80c3430a5d6c", "tenantIDs" : [ ], "name" : "KEDR; События типа Registry", "kind" : "event", "clusterID" : "8b61d2d2-c4ff-4534-8dc8-965b496b496c", "columns" : [ ], "where" : null, "period" : { "from" : NumberLong(0), "to" : NumberLong(0), "relative" : "now-1h", "column" : "" }, "sql" : "SELECT * \nFROM `events` \nWHERE DeviceEventCategory = 'registry'\nAND DeviceVendor = 'Kaspersky'\nAND DeviceProduct = 'EDR' \nORDER BY Timestamp DESC LIMIT 250", "displayColumns" : [ { "name" : "TenantID", "alias" : "", "width" : NumberLong(150) }, { "name" : "Timestamp", "alias" : "", "width" : NumberLong(150) }, { "name" : "SourceUserName", "alias" : "", "width" : NumberLong(150) }, { "name" : "DeviceAction", "alias" : "", "width" : NumberLong(150) }, { "name" : "DeviceCustomString4", "alias" : "", "width" : NumberLong(150) }, { "name" : "DeviceCustomString5", "alias" : "", "width" : NumberLong(150) }, { "name" : "DeviceCustomString6", "alias" : "", "width" : NumberLong(150) } ], "branchIDs" : [ ], "correlatorID" : "", "activeListID" : "", "contextTableID" : "", "limit" : NumberLong(250), "orderBy" : [ { "column" : "Timestamp", "asc" : false, "shouldEscape" : false } ] } }
{ "_id" : "366eca72-eb58-46ed-9191-12994a18e14a", "exportID" : "366eca72-eb58-46ed-9191-12994a18e14a", "tenantID" : "a1fbde7a-76d3-4bbc-a769-82126b41b56f", "kind" : "search", "name" : "KSC; Все события за 24 часа", "description" : "", "createdAt" : NumberLong("1715940594116"), "updatedAt" : NumberLong("1715940594116"), "folderID" : "", "userID" : "309236e9-ff0e-4b17-a204-e7600320914b", "deps" : null, "internal" : false, "repositoryPackageID" : "", "packageIntegrationResource" : false, "payload" : { "id" : "366eca72-eb58-46ed-9191-12994a18e14a", "tenantIDs" : [ ], "name" : "KSC; Все события за 24 часа", "kind" : "event", "clusterID" : "8b61d2d2-c4ff-4534-8dc8-965b496b496c", "columns" : [ ], "where" : null, "period" : { "from" : NumberLong(0), "to" : NumberLong(0), "relative" : "now-1d", "column" : "" }, "sql" : "SELECT * FROM `events` WHERE DeviceProduct = 'KSC' ORDER BY Timestamp DESC LIMIT 250", "displayColumns" : [ { "name" : "TenantID", "alias" : "", "width" : NumberLong(107) }, { "name" : "Timestamp", "alias" : "", "width" : NumberLong(150) }, { "name" : "Name", "alias" : "", "width" : NumberLong(94) }, { "name" : "DeviceEventClassID", "alias" : "", "width" : NumberLong(164) }, { "name" : "SourceAddress", "alias" : "", "width" : NumberLong(150) }, { "name" : "DestinationAddress", "alias" : "", "width" : NumberLong(150) }, { "name" : "DestinationHostName", "alias" : "", "width" : NumberLong(257) } ], "branchIDs" : [ ], "correlatorID" : "", "activeListID" : "", "contextTableID" : "", "limit" : NumberLong(250), "orderBy" : [ { "column" : "Timestamp", "asc" : false, "shouldEscape" : false } ] } }
{ "_id" : "8513289a-5e1f-49ed-87b4-8f5afa2e9991", "exportID" : "8513289a-5e1f-49ed-87b4-8f5afa2e9991", "tenantID" : "a1fbde7a-76d3-4bbc-a769-82126b41b56f", "kind" : "search", "name" : "KSMG; Все события за 24 часа", "description" : "", "createdAt" : NumberLong("1715940414316"), "updatedAt" : NumberLong("1715940414316"), "folderID" : "", "userID" : "309236e9-ff0e-4b17-a204-e7600320914b", "deps" : null, "internal" : false, "repositoryPackageID" : "", "packageIntegrationResource" : false, "payload" : { "id" : "8513289a-5e1f-49ed-87b4-8f5afa2e9991", "tenantIDs" : [ ], "name" : "KSMG; Все события за 24 часа", "kind" : "event", "clusterID" : "8b61d2d2-c4ff-4534-8dc8-965b496b496c", "columns" : [ ], "where" : null, "period" : { "from" : NumberLong(0), "to" : NumberLong(0), "relative" : "now-1d", "column" : "" }, "sql" : "SELECT * FROM `events` WHERE DeviceProduct = 'KSMG' AND DeviceEventClassID not like '%BASE%' ORDER BY Timestamp DESC LIMIT 250", "displayColumns" : [ { "name" : "TenantID", "alias" : "", "width" : NumberLong(107) }, { "name" : "Timestamp", "alias" : "", "width" : NumberLong(150) }, { "name" : "Name", "alias" : "", "width" : NumberLong(94) }, { "name" : "DeviceEventClassID", "alias" : "", "width" : NumberLong(164) }, { "name" : "SourceAddress", "alias" : "", "width" : NumberLong(150) }, { "name" : "DeviceAction", "alias" : "", "width" : NumberLong(150) }, { "name" : "DeviceCustomString4", "alias" : "", "width" : NumberLong(150) }, { "name" : "DestinationUserName", "alias" : "", "width" : NumberLong(150) }, { "name" : "EventOutcome", "alias" : "", "width" : NumberLong(150) } ], "branchIDs" : [ ], "correlatorID" : "", "activeListID" : "", "contextTableID" : "", "limit" : NumberLong(250), "orderBy" : [ { "column" : "Timestamp", "asc" : false, "shouldEscape" : false } ] } }
{ "_id" : "016c1ea5-bb23-416a-ba7e-4f9bd02d9fe3", "exportID" : "016c1ea5-bb23-416a-ba7e-4f9bd02d9fe3", "tenantID" : "a1fbde7a-76d3-4bbc-a769-82126b41b56f", "kind" : "search", "name" : "KWTS; Все события за 24 часа", "description" : "", "createdAt" : NumberLong("1715940326320"), "updatedAt" : NumberLong("1715940326320"), "folderID" : "", "userID" : "309236e9-ff0e-4b17-a204-e7600320914b", "deps" : null, "internal" : false, "repositoryPackageID" : "", "packageIntegrationResource" : false, "payload" : { "id" : "016c1ea5-bb23-416a-ba7e-4f9bd02d9fe3", "tenantIDs" : [ ], "name" : "KWTS; Все события за 24 часа", "kind" : "event", "clusterID" : "8b61d2d2-c4ff-4534-8dc8-965b496b496c", "columns" : [ ], "where" : null, "period" : { "from" : NumberLong(0), "to" : NumberLong(0), "relative" : "now-1d", "column" : "" }, "sql" : "SELECT * FROM `events` WHERE DeviceProduct = 'KWTS' ORDER BY Timestamp DESC LIMIT 250", "displayColumns" : [ { "name" : "TenantID", "alias" : "", "width" : NumberLong(107) }, { "name" : "Timestamp", "alias" : "", "width" : NumberLong(150) }, { "name" : "Name", "alias" : "", "width" : NumberLong(94) }, { "name" : "SourceAddress", "alias" : "", "width" : NumberLong(150) }, { "name" : "RequestUrl", "alias" : "", "width" : NumberLong(150) }, { "name" : "DeviceAction", "alias" : "", "width" : NumberLong(150) }, { "name" : "DeviceCustomString4", "alias" : "", "width" : NumberLong(150) } ], "branchIDs" : [ ], "correlatorID" : "", "activeListID" : "", "contextTableID" : "", "limit" : NumberLong(250), "orderBy" : [ { "column" : "Timestamp", "asc" : false, "shouldEscape" : false } ] } }
{ "_id" : "2cfe0c62-a82e-4b86-bb88-e6767a95c64e", "exportID" : "2cfe0c62-a82e-4b86-bb88-e6767a95c64e", "tenantID" : "a1fbde7a-76d3-4bbc-a769-82126b41b56f", "kind" : "search", "name" : "UNIX; EXECVE за 1 час", "description" : "", "createdAt" : NumberLong("1715935824955"), "updatedAt" : NumberLong("1715935824955"), "folderID" : "", "userID" : "309236e9-ff0e-4b17-a204-e7600320914b", "deps" : null, "internal" : false, "repositoryPackageID" : "", "packageIntegrationResource" : false, "payload" : { "id" : "2cfe0c62-a82e-4b86-bb88-e6767a95c64e", "tenantIDs" : [ ], "name" : "UNIX; EXECVE за 1 час", "kind" : "event", "clusterID" : "8b61d2d2-c4ff-4534-8dc8-965b496b496c", "columns" : [ ], "where" : null, "period" : { "from" : NumberLong(0), "to" : NumberLong(0), "relative" : "now-1h", "column" : "" }, "sql" : "SELECT * \nFROM `events` \nWHERE DeviceEventClassID = 'EXECVE'\nAND DeviceProduct = 'audit' \nAND DeviceVendor = 'Unix' \nORDER BY Timestamp DESC LIMIT 1000", "displayColumns" : [ { "name" : "TenantID", "alias" : "", "width" : NumberLong(107) }, { "name" : "Timestamp", "alias" : "", "width" : NumberLong(150) }, { "name" : "Message", "alias" : "", "width" : NumberLong(155) }, { "name" : "DeviceHostName", "alias" : "", "width" : NumberLong(150) }, { "name" : "DeviceAddress", "alias" : "", "width" : NumberLong(150) }, { "name" : "DeviceProcessName", "alias" : "", "width" : NumberLong(150) }, { "name" : "DestinationProcessName", "alias" : "", "width" : NumberLong(195) } ], "branchIDs" : [ ], "correlatorID" : "", "activeListID" : "", "contextTableID" : "", "limit" : NumberLong(1000), "orderBy" : [ { "column" : "Timestamp", "asc" : false, "shouldEscape" : false } ] } }
{ "_id" : "c63b5bd5-d1b0-41d7-8ca9-c0b116146b2f", "exportID" : "c63b5bd5-d1b0-41d7-8ca9-c0b116146b2f", "tenantID" : "a1fbde7a-76d3-4bbc-a769-82126b41b56f", "kind" : "search", "name" : "UNIX; SYSCALL за 15 минут", "description" : "", "createdAt" : NumberLong("1715935927703"), "updatedAt" : NumberLong("1715935927703"), "folderID" : "", "userID" : "309236e9-ff0e-4b17-a204-e7600320914b", "deps" : null, "internal" : false, "repositoryPackageID" : "", "packageIntegrationResource" : false, "payload" : { "id" : "c63b5bd5-d1b0-41d7-8ca9-c0b116146b2f", "tenantIDs" : [ ], "name" : "UNIX; SYSCALL за 15 минут", "kind" : "event", "clusterID" : "8b61d2d2-c4ff-4534-8dc8-965b496b496c", "columns" : [ ], "where" : null, "period" : { "from" : NumberLong(0), "to" : NumberLong(0), "relative" : "now-15m", "column" : "" }, "sql" : "SELECT * \nFROM `events` \nWHERE DeviceEventClassID = 'SYSCALL'\nAND DeviceProduct = 'audit' \nAND DeviceVendor = 'Unix' \nORDER BY Timestamp DESC LIMIT 250", "displayColumns" : [ { "name" : "TenantID", "alias" : "", "width" : NumberLong(107) }, { "name" : "Timestamp", "alias" : "", "width" : NumberLong(150) }, { "name" : "DeviceHostName", "alias" : "", "width" : NumberLong(150) }, { "name" : "DeviceAddress", "alias" : "", "width" : NumberLong(150) }, { "name" : "Message", "alias" : "", "width" : NumberLong(155) }, { "name" : "DestinationProcessName", "alias" : "", "width" : NumberLong(195) } ], "branchIDs" : [ ], "correlatorID" : "", "activeListID" : "", "contextTableID" : "", "limit" : NumberLong(250), "orderBy" : [ { "column" : "Timestamp", "asc" : false, "shouldEscape" : false } ] } }
{ "_id" : "4807548b-df58-45a8-b5c7-1b252442b92e", "exportID" : "4807548b-df58-45a8-b5c7-1b252442b92e", "tenantID" : "a1fbde7a-76d3-4bbc-a769-82126b41b56f", "kind" : "search", "name" : "Unix; Все события за 24 часа", "description" : "", "createdAt" : NumberLong("1713273343613"), "updatedAt" : NumberLong("1713273343613"), "folderID" : "", "userID" : "309236e9-ff0e-4b17-a204-e7600320914b", "deps" : null, "internal" : false, "repositoryPackageID" : "", "packageIntegrationResource" : false, "payload" : { "id" : "4807548b-df58-45a8-b5c7-1b252442b92e", "tenantIDs" : [ ], "name" : "Unix; Все события за 24 часа", "kind" : "event", "clusterID" : "8b61d2d2-c4ff-4534-8dc8-965b496b496c", "columns" : [ ], "where" : null, "period" : { "from" : NumberLong(0), "to" : NumberLong(0), "relative" : "now-1d", "column" : "" }, "sql" : "SELECT * \nFROM `events` \nWHERE DeviceProduct = 'audit' \nAND DeviceVendor = 'Unix' \nORDER BY Timestamp DESC LIMIT 250", "displayColumns" : [ { "name" : "TenantID", "alias" : "", "width" : NumberLong(150) }, { "name" : "Timestamp", "alias" : "", "width" : NumberLong(150) }, { "name" : "DeviceVendor", "alias" : "", "width" : NumberLong(109) }, { "name" : "DeviceProduct", "alias" : "", "width" : NumberLong(101) }, { "name" : "DeviceEventClassID", "alias" : "", "width" : NumberLong(164) }, { "name" : "Message", "alias" : "", "width" : NumberLong(203) }, { "name" : "SourceUserName", "alias" : "", "width" : NumberLong(150) }, { "name" : "DeviceHostName", "alias" : "", "width" : NumberLong(150) }, { "name" : "DeviceAddress", "alias" : "", "width" : NumberLong(150) }, { "name" : "DestinationProcessName", "alias" : "", "width" : NumberLong(195) } ], "branchIDs" : [ ], "correlatorID" : "", "activeListID" : "", "contextTableID" : "", "limit" : NumberLong(250), "orderBy" : [ { "column" : "Timestamp", "asc" : false, "shouldEscape" : false } ] } }
{ "_id" : "7bdc350f-6758-4522-8542-d3dbfcc7213f", "exportID" : "7bdc350f-6758-4522-8542-d3dbfcc7213f", "tenantID" : "a1fbde7a-76d3-4bbc-a769-82126b41b56f", "kind" : "search", "name" : "Unix; События входа за 24 часа", "description" : "", "createdAt" : NumberLong("1713273484274"), "updatedAt" : NumberLong("1713273484274"), "folderID" : "", "userID" : "309236e9-ff0e-4b17-a204-e7600320914b", "deps" : null, "internal" : false, "repositoryPackageID" : "", "packageIntegrationResource" : false, "payload" : { "id" : "7bdc350f-6758-4522-8542-d3dbfcc7213f", "tenantIDs" : [ ], "name" : "Unix; События входа за 24 часа", "kind" : "event", "clusterID" : "8b61d2d2-c4ff-4534-8dc8-965b496b496c", "columns" : [ ], "where" : null, "period" : { "from" : NumberLong(0), "to" : NumberLong(0), "relative" : "now-1d", "column" : "" }, "sql" : "SELECT * \nFROM `events` \nWHERE DeviceEventClassID = 'LOGIN'\nAND DeviceProduct = 'audit' \nAND DeviceVendor = 'Unix' \nORDER BY Timestamp DESC LIMIT 250", "displayColumns" : [ { "name" : "TenantID", "alias" : "", "width" : NumberLong(150) }, { "name" : "Timestamp", "alias" : "", "width" : NumberLong(150) }, { "name" : "DeviceVendor", "alias" : "", "width" : NumberLong(109) }, { "name" : "DeviceProduct", "alias" : "", "width" : NumberLong(101) }, { "name" : "DeviceEventClassID", "alias" : "", "width" : NumberLong(164) }, { "name" : "SourceUserName", "alias" : "", "width" : NumberLong(150) }, { "name" : "DeviceHostName", "alias" : "", "width" : NumberLong(150) }, { "name" : "DeviceAddress", "alias" : "", "width" : NumberLong(150) } ], "branchIDs" : [ ], "correlatorID" : "", "activeListID" : "", "contextTableID" : "", "limit" : NumberLong(250), "orderBy" : [ { "column" : "Timestamp", "asc" : false, "shouldEscape" : false } ] } }
{ "_id" : "1b45178a-94f0-439b-9d31-f0c1292a073a", "exportID" : "1b45178a-94f0-439b-9d31-f0c1292a073a", "tenantID" : "a1fbde7a-76d3-4bbc-a769-82126b41b56f", "kind" : "search", "name" : "Windows; Все события за 1 час", "description" : "", "createdAt" : NumberLong("1713253778111"), "updatedAt" : NumberLong("1713253778111"), "folderID" : "", "userID" : "309236e9-ff0e-4b17-a204-e7600320914b", "deps" : null, "internal" : false, "repositoryPackageID" : "", "packageIntegrationResource" : false, "payload" : { "id" : "1b45178a-94f0-439b-9d31-f0c1292a073a", "tenantIDs" : [ ], "name" : "Windows; Все события за 1 час", "kind" : "event", "clusterID" : "8b61d2d2-c4ff-4534-8dc8-965b496b496c", "columns" : [ ], "where" : null, "period" : { "from" : NumberLong(0), "to" : NumberLong(0), "relative" : "now-1h", "column" : "" }, "sql" : "SELECT * FROM `events` WHERE DeviceProduct = 'Windows' ORDER BY Timestamp DESC LIMIT 250", "displayColumns" : [ { "name" : "TenantID", "alias" : "", "width" : NumberLong(150) }, { "name" : "Timestamp", "alias" : "", "width" : NumberLong(150) }, { "name" : "DeviceEventClassID", "alias" : "", "width" : NumberLong(150) }, { "name" : "Name", "alias" : "", "width" : NumberLong(150) }, { "name" : "Message", "alias" : "", "width" : NumberLong(150) }, { "name" : "SourceUserName", "alias" : "", "width" : NumberLong(150) }, { "name" : "DestinationUserName", "alias" : "", "width" : NumberLong(150) }, { "name" : "DeviceHostName", "alias" : "", "width" : NumberLong(150) }, { "name" : "DestinationHostName", "alias" : "", "width" : NumberLong(150) } ], "branchIDs" : [ ], "correlatorID" : "", "activeListID" : "", "contextTableID" : "", "limit" : NumberLong(250), "orderBy" : [ { "column" : "Timestamp", "asc" : false, "shouldEscape" : false } ] } }
{ "_id" : "de79813c-670a-403d-8299-1e7f29d251ed", "exportID" : "de79813c-670a-403d-8299-1e7f29d251ed", "tenantID" : "a1fbde7a-76d3-4bbc-a769-82126b41b56f", "kind" : "search", "name" : "Windows; Все события за 24 часа", "description" : "", "createdAt" : NumberLong("1713253750546"), "updatedAt" : NumberLong("1713253750546"), "folderID" : "", "userID" : "309236e9-ff0e-4b17-a204-e7600320914b", "deps" : null, "internal" : false, "repositoryPackageID" : "", "packageIntegrationResource" : false, "payload" : { "id" : "de79813c-670a-403d-8299-1e7f29d251ed", "tenantIDs" : [ ], "name" : "Windows; Все события за 24 часа", "kind" : "event", "clusterID" : "8b61d2d2-c4ff-4534-8dc8-965b496b496c", "columns" : [ ], "where" : null, "period" : { "from" : NumberLong(0), "to" : NumberLong(0), "relative" : "now-1d", "column" : "" }, "sql" : "SELECT * FROM `events` WHERE DeviceProduct = 'Windows' ORDER BY Timestamp DESC LIMIT 250", "displayColumns" : [ { "name" : "TenantID", "alias" : "", "width" : NumberLong(150) }, { "name" : "Timestamp", "alias" : "", "width" : NumberLong(150) }, { "name" : "DeviceEventClassID", "alias" : "", "width" : NumberLong(150) }, { "name" : "Name", "alias" : "", "width" : NumberLong(150) }, { "name" : "Message", "alias" : "", "width" : NumberLong(150) }, { "name" : "SourceUserName", "alias" : "", "width" : NumberLong(150) }, { "name" : "DestinationUserName", "alias" : "", "width" : NumberLong(150) }, { "name" : "DeviceHostName", "alias" : "", "width" : NumberLong(150) }, { "name" : "DestinationHostName", "alias" : "", "width" : NumberLong(150) } ], "branchIDs" : [ ], "correlatorID" : "", "activeListID" : "", "contextTableID" : "", "limit" : NumberLong(250), "orderBy" : [ { "column" : "Timestamp", "asc" : false, "shouldEscape" : false } ] } }
{ "_id" : "c027d255-5a4d-4808-95fc-2461a999324d", "exportID" : "c027d255-5a4d-4808-95fc-2461a999324d", "tenantID" : "a1fbde7a-76d3-4bbc-a769-82126b41b56f", "kind" : "search", "name" : "Windows; События Kerberos (4768/4769/4771/4820)", "description" : "", "createdAt" : NumberLong("1713266542480"), "updatedAt" : NumberLong("1713266542480"), "folderID" : "", "userID" : "309236e9-ff0e-4b17-a204-e7600320914b", "deps" : null, "internal" : false, "repositoryPackageID" : "", "packageIntegrationResource" : false, "payload" : { "id" : "c027d255-5a4d-4808-95fc-2461a999324d", "tenantIDs" : [ ], "name" : "Windows; События Kerberos (4768/4769/4771/4820)", "kind" : "event", "clusterID" : "8b61d2d2-c4ff-4534-8dc8-965b496b496c", "columns" : [ ], "where" : null, "period" : { "from" : NumberLong(0), "to" : NumberLong(0), "relative" : "now-1d", "column" : "" }, "sql" : "SELECT *\r\nFROM `events` \r\nWHERE DeviceProduct = 'Windows'\r\nAND DeviceEventClassID IN ('4771','4768','4769', '4820')\r\nORDER BY Timestamp ASC LIMIT 250", "displayColumns" : [ { "name" : "TenantID", "alias" : "", "width" : NumberLong(150) }, { "name" : "Timestamp", "alias" : "", "width" : NumberLong(150) }, { "name" : "DeviceEventClassID", "alias" : "", "width" : NumberLong(150) }, { "name" : "Name", "alias" : "", "width" : NumberLong(150) }, { "name" : "Message", "alias" : "", "width" : NumberLong(150) }, { "name" : "SourceUserName", "alias" : "", "width" : NumberLong(150) }, { "name" : "DestinationUserName", "alias" : "", "width" : NumberLong(150) }, { "name" : "DeviceHostName", "alias" : "", "width" : NumberLong(150) }, { "name" : "DestinationHostName", "alias" : "", "width" : NumberLong(150) } ], "branchIDs" : [ ], "correlatorID" : "", "activeListID" : "", "contextTableID" : "", "limit" : NumberLong(250), "orderBy" : [ { "column" : "Timestamp", "asc" : true, "shouldEscape" : false } ] } }
{ "_id" : "b7dfdfa3-63b7-4eaa-9026-c650c022bd99", "exportID" : "b7dfdfa3-63b7-4eaa-9026-c650c022bd99", "tenantID" : "a1fbde7a-76d3-4bbc-a769-82126b41b56f", "kind" : "search", "name" : "Windows; События в \"Нерабочее время\"", "description" : "", "createdAt" : NumberLong("1713278652031"), "updatedAt" : NumberLong("1713278652031"), "folderID" : "", "userID" : "309236e9-ff0e-4b17-a204-e7600320914b", "deps" : null, "internal" : false, "repositoryPackageID" : "", "packageIntegrationResource" : false, "payload" : { "id" : "b7dfdfa3-63b7-4eaa-9026-c650c022bd99", "tenantIDs" : [ ], "name" : "Windows; События в \"Нерабочее время\"", "kind" : "event", "clusterID" : "8b61d2d2-c4ff-4534-8dc8-965b496b496c", "columns" : [ ], "where" : null, "period" : { "from" : NumberLong(0), "to" : NumberLong(0), "relative" : "now-1d", "column" : "" }, "sql" : "SELECT *\r\nFROM `events` \r\nWHERE DeviceProduct = 'Windows' \r\nAND toHour(fromUnixTimestamp64Milli(Timestamp, 'Europe/Moscow'))\r\nNOT BETWEEN 9 AND 18\r\nORDER BY Timestamp ASC LIMIT 250", "displayColumns" : [ { "name" : "TenantID", "alias" : "", "width" : NumberLong(150) }, { "name" : "Timestamp", "alias" : "", "width" : NumberLong(150) }, { "name" : "DeviceEventClassID", "alias" : "", "width" : NumberLong(164) }, { "name" : "Name", "alias" : "", "width" : NumberLong(94) }, { "name" : "Message", "alias" : "", "width" : NumberLong(203) }, { "name" : "SourceUserName", "alias" : "", "width" : NumberLong(150) }, { "name" : "DestinationUserName", "alias" : "", "width" : NumberLong(150) }, { "name" : "DeviceHostName", "alias" : "", "width" : NumberLong(150) }, { "name" : "DestinationHostName", "alias" : "", "width" : NumberLong(131) } ], "branchIDs" : [ ], "correlatorID" : "", "activeListID" : "", "contextTableID" : "", "limit" : NumberLong(250), "orderBy" : [ { "column" : "Timestamp", "asc" : true, "shouldEscape" : false } ] } }
{ "_id" : "75630ac2-919f-449b-bd45-dd7e2b0349f9", "exportID" : "75630ac2-919f-449b-bd45-dd7e2b0349f9", "tenantID" : "a1fbde7a-76d3-4bbc-a769-82126b41b56f", "kind" : "search", "name" : "Windows; События изменения в системных файлах или реестре", "description" : "", "createdAt" : NumberLong("1713256299135"), "updatedAt" : NumberLong("1713256299135"), "folderID" : "", "userID" : "309236e9-ff0e-4b17-a204-e7600320914b", "deps" : null, "internal" : false, "repositoryPackageID" : "", "packageIntegrationResource" : false, "payload" : { "id" : "75630ac2-919f-449b-bd45-dd7e2b0349f9", "tenantIDs" : [ ], "name" : "Windows; События изменения в системных файлах или реестре", "kind" : "event", "clusterID" : "8b61d2d2-c4ff-4534-8dc8-965b496b496c", "columns" : [ ], "where" : null, "period" : { "from" : NumberLong(0), "to" : NumberLong(0), "relative" : "now-1d", "column" : "" }, "sql" : "SELECT *\r\nFROM `events` \r\nWHERE DeviceProduct = 'Windows'\r\nAND DeviceEventClassID IN ('4657', '4663')\r\nORDER BY Timestamp ASC LIMIT 250", "displayColumns" : [ { "name" : "TenantID", "alias" : "", "width" : NumberLong(150) }, { "name" : "Timestamp", "alias" : "", "width" : NumberLong(150) }, { "name" : "DeviceEventClassID", "alias" : "", "width" : NumberLong(150) }, { "name" : "Name", "alias" : "", "width" : NumberLong(150) }, { "name" : "Message", "alias" : "", "width" : NumberLong(150) }, { "name" : "SourceUserName", "alias" : "", "width" : NumberLong(150) }, { "name" : "DestinationUserName", "alias" : "", "width" : NumberLong(150) }, { "name" : "DeviceHostName", "alias" : "", "width" : NumberLong(150) }, { "name" : "DestinationHostName", "alias" : "", "width" : NumberLong(150) }, { "name" : "FileName", "alias" : "", "width" : NumberLong(150) } ], "branchIDs" : [ ], "correlatorID" : "", "activeListID" : "", "contextTableID" : "", "limit" : NumberLong(250), "orderBy" : [ { "column" : "Timestamp", "asc" : true, "shouldEscape" : false } ] } }
{ "_id" : "adcb4407-dc6a-46b4-b6bf-9d602c0d3201", "exportID" : "adcb4407-dc6a-46b4-b6bf-9d602c0d3201", "tenantID" : "a1fbde7a-76d3-4bbc-a769-82126b41b56f", "kind" : "search", "name" : "Windows; События изменения учетных записей", "description" : "", "createdAt" : NumberLong("1713266922926"), "updatedAt" : NumberLong("1713266922926"), "folderID" : "", "userID" : "309236e9-ff0e-4b17-a204-e7600320914b", "deps" : null, "internal" : false, "repositoryPackageID" : "", "packageIntegrationResource" : false, "payload" : { "id" : "adcb4407-dc6a-46b4-b6bf-9d602c0d3201", "tenantIDs" : [ ], "name" : "Windows; События изменения учетных записей", "kind" : "event", "clusterID" : "8b61d2d2-c4ff-4534-8dc8-965b496b496c", "columns" : [ ], "where" : null, "period" : { "from" : NumberLong(0), "to" : NumberLong(0), "relative" : "now-1d", "column" : "" }, "sql" : "SELECT *\r\nFROM `events` \r\nWHERE DeviceProduct = 'Windows'\r\nAND DeviceEventClassID IN ('4720','4722','4723','4724','4725','4726','4738','4740','4767','4781')\r\nORDER BY Timestamp ASC LIMIT 250", "displayColumns" : [ { "name" : "TenantID", "alias" : "", "width" : NumberLong(150) }, { "name" : "Timestamp", "alias" : "", "width" : NumberLong(150) }, { "name" : "DeviceEventClassID", "alias" : "", "width" : NumberLong(150) }, { "name" : "Name", "alias" : "", "width" : NumberLong(150) }, { "name" : "Message", "alias" : "", "width" : NumberLong(150) }, { "name" : "SourceUserName", "alias" : "", "width" : NumberLong(150) }, { "name" : "DestinationUserName", "alias" : "", "width" : NumberLong(150) }, { "name" : "DeviceHostName", "alias" : "", "width" : NumberLong(150) }, { "name" : "DestinationHostName", "alias" : "", "width" : NumberLong(150) } ], "branchIDs" : [ ], "correlatorID" : "", "activeListID" : "", "contextTableID" : "", "limit" : NumberLong(250), "orderBy" : [ { "column" : "Timestamp", "asc" : true, "shouldEscape" : false } ] } }
{ "_id" : "84f927f2-2342-41c9-874a-abf208337b6f", "exportID" : "84f927f2-2342-41c9-874a-abf208337b6f", "tenantID" : "a1fbde7a-76d3-4bbc-a769-82126b41b56f", "kind" : "search", "name" : "Windows; События неуспешного входа в \"Нерабочее время\" (с 21 до 8)", "description" : "", "createdAt" : NumberLong("1713279686002"), "updatedAt" : NumberLong("1713279686002"), "folderID" : "", "userID" : "309236e9-ff0e-4b17-a204-e7600320914b", "deps" : null, "internal" : false, "repositoryPackageID" : "", "packageIntegrationResource" : false, "payload" : { "id" : "84f927f2-2342-41c9-874a-abf208337b6f", "tenantIDs" : [ ], "name" : "Windows; События неуспешного входа в \"Нерабочее время\" (с 21 до 8)", "kind" : "event", "clusterID" : "8b61d2d2-c4ff-4534-8dc8-965b496b496c", "columns" : [ ], "where" : null, "period" : { "from" : NumberLong(0), "to" : NumberLong(0), "relative" : "now-1d", "column" : "" }, "sql" : "SELECT *\r\nFROM `events` \r\nWHERE DeviceProduct = 'Windows' \r\nAND toHour(fromUnixTimestamp64Milli(Timestamp, 'Europe/Moscow'))\r\nNOT BETWEEN 8 AND 20\r\nAND DeviceEventClassID = '4625'\r\nAND NOT endsWith(DestinationUserName, '$')\r\nORDER BY Timestamp ASC LIMIT 250", "displayColumns" : [ { "name" : "TenantID", "alias" : "", "width" : NumberLong(150) }, { "name" : "Timestamp", "alias" : "", "width" : NumberLong(150) }, { "name" : "DeviceEventClassID", "alias" : "", "width" : NumberLong(164) }, { "name" : "Name", "alias" : "", "width" : NumberLong(94) }, { "name" : "Message", "alias" : "", "width" : NumberLong(203) }, { "name" : "SourceUserName", "alias" : "", "width" : NumberLong(150) }, { "name" : "DestinationUserName", "alias" : "", "width" : NumberLong(150) }, { "name" : "DeviceHostName", "alias" : "", "width" : NumberLong(150) }, { "name" : "DestinationHostName", "alias" : "", "width" : NumberLong(131) } ], "branchIDs" : [ ], "correlatorID" : "", "activeListID" : "", "contextTableID" : "", "limit" : NumberLong(250), "orderBy" : [ { "column" : "Timestamp", "asc" : true, "shouldEscape" : false } ] } }
{ "_id" : "b2c5f1a5-d2ad-4ea5-8abc-fa36edea1d7d", "exportID" : "b2c5f1a5-d2ad-4ea5-8abc-fa36edea1d7d", "tenantID" : "a1fbde7a-76d3-4bbc-a769-82126b41b56f", "kind" : "search", "name" : "Windows; События неуспешного входа за 1 час", "description" : "", "createdAt" : NumberLong("1713278784094"), "updatedAt" : NumberLong("1713278784094"), "folderID" : "", "userID" : "309236e9-ff0e-4b17-a204-e7600320914b", "deps" : null, "internal" : false, "repositoryPackageID" : "", "packageIntegrationResource" : false, "payload" : { "id" : "b2c5f1a5-d2ad-4ea5-8abc-fa36edea1d7d", "tenantIDs" : [ ], "name" : "Windows; События неуспешного входа за 1 час", "kind" : "event", "clusterID" : "8b61d2d2-c4ff-4534-8dc8-965b496b496c", "columns" : [ ], "where" : null, "period" : { "from" : NumberLong(0), "to" : NumberLong(0), "relative" : "now-1h", "column" : "" }, "sql" : "SELECT *\r\nFROM `events` \r\nWHERE DeviceProduct = 'Windows'\r\nAND DeviceEventClassID = '4625'\r\nAND NOT endsWith(DestinationUserName, '$')\r\nORDER BY Timestamp ASC LIMIT 250", "displayColumns" : [ { "name" : "TenantID", "alias" : "", "width" : NumberLong(150) }, { "name" : "Timestamp", "alias" : "", "width" : NumberLong(150) }, { "name" : "DeviceEventClassID", "alias" : "", "width" : NumberLong(164) }, { "name" : "Name", "alias" : "", "width" : NumberLong(94) }, { "name" : "Message", "alias" : "", "width" : NumberLong(203) }, { "name" : "SourceUserName", "alias" : "", "width" : NumberLong(150) }, { "name" : "DestinationUserName", "alias" : "", "width" : NumberLong(150) }, { "name" : "DeviceHostName", "alias" : "", "width" : NumberLong(150) }, { "name" : "DestinationHostName", "alias" : "", "width" : NumberLong(131) } ], "branchIDs" : [ ], "correlatorID" : "", "activeListID" : "", "contextTableID" : "", "limit" : NumberLong(250), "orderBy" : [ { "column" : "Timestamp", "asc" : true, "shouldEscape" : false } ] } }
{ "_id" : "460b0bed-6b36-4444-bd2c-2dac5825a152", "exportID" : "460b0bed-6b36-4444-bd2c-2dac5825a152", "tenantID" : "a1fbde7a-76d3-4bbc-a769-82126b41b56f", "kind" : "search", "name" : "Windows; События успешного входа в \"Нерабочее время\" (с 21 до 8)", "description" : "", "createdAt" : NumberLong("1713279668824"), "updatedAt" : NumberLong("1713279668824"), "folderID" : "", "userID" : "309236e9-ff0e-4b17-a204-e7600320914b", "deps" : null, "internal" : false, "repositoryPackageID" : "", "packageIntegrationResource" : false, "payload" : { "id" : "460b0bed-6b36-4444-bd2c-2dac5825a152", "tenantIDs" : [ ], "name" : "Windows; События успешного входа в \"Нерабочее время\" (с 21 до 8)", "kind" : "event", "clusterID" : "8b61d2d2-c4ff-4534-8dc8-965b496b496c", "columns" : [ ], "where" : null, "period" : { "from" : NumberLong(0), "to" : NumberLong(0), "relative" : "now-1d", "column" : "" }, "sql" : "SELECT *\r\nFROM `events` \r\nWHERE DeviceProduct = 'Windows' \r\nAND toHour(fromUnixTimestamp64Milli(Timestamp, 'Europe/Moscow'))\r\nNOT BETWEEN 8 AND 20\r\nAND DeviceEventClassID = '4624'\r\nAND NOT endsWith(DestinationUserName, '$')\r\nORDER BY Timestamp ASC LIMIT 250", "displayColumns" : [ { "name" : "TenantID", "alias" : "", "width" : NumberLong(150) }, { "name" : "Timestamp", "alias" : "", "width" : NumberLong(150) }, { "name" : "DeviceEventClassID", "alias" : "", "width" : NumberLong(164) }, { "name" : "Name", "alias" : "", "width" : NumberLong(94) }, { "name" : "Message", "alias" : "", "width" : NumberLong(203) }, { "name" : "SourceUserName", "alias" : "", "width" : NumberLong(150) }, { "name" : "DestinationUserName", "alias" : "", "width" : NumberLong(150) }, { "name" : "DeviceHostName", "alias" : "", "width" : NumberLong(150) }, { "name" : "DestinationHostName", "alias" : "", "width" : NumberLong(131) } ], "branchIDs" : [ ], "correlatorID" : "", "activeListID" : "", "contextTableID" : "", "limit" : NumberLong(250), "orderBy" : [ { "column" : "Timestamp", "asc" : true, "shouldEscape" : false } ] } }
{ "_id" : "937e66e6-81d9-48bd-9eaf-64bb546a6b04", "exportID" : "937e66e6-81d9-48bd-9eaf-64bb546a6b04", "tenantID" : "a1fbde7a-76d3-4bbc-a769-82126b41b56f", "kind" : "search", "name" : "Windows; События успешного входа за 1 час", "description" : "", "createdAt" : NumberLong("1713278764264"), "updatedAt" : NumberLong("1713278764264"), "folderID" : "", "userID" : "309236e9-ff0e-4b17-a204-e7600320914b", "deps" : null, "internal" : false, "repositoryPackageID" : "", "packageIntegrationResource" : false, "payload" : { "id" : "937e66e6-81d9-48bd-9eaf-64bb546a6b04", "tenantIDs" : [ ], "name" : "Windows; События успешного входа за 1 час", "kind" : "event", "clusterID" : "8b61d2d2-c4ff-4534-8dc8-965b496b496c", "columns" : [ ], "where" : null, "period" : { "from" : NumberLong(0), "to" : NumberLong(0), "relative" : "now-1h", "column" : "" }, "sql" : "SELECT *\r\nFROM `events` \r\nWHERE DeviceProduct = 'Windows'\r\nAND DeviceEventClassID = '4624'\r\nAND NOT endsWith(DestinationUserName, '$')\r\nORDER BY Timestamp ASC LIMIT 250", "displayColumns" : [ { "name" : "TenantID", "alias" : "", "width" : NumberLong(150) }, { "name" : "Timestamp", "alias" : "", "width" : NumberLong(150) }, { "name" : "DeviceEventClassID", "alias" : "", "width" : NumberLong(164) }, { "name" : "Name", "alias" : "", "width" : NumberLong(94) }, { "name" : "Message", "alias" : "", "width" : NumberLong(203) }, { "name" : "SourceUserName", "alias" : "", "width" : NumberLong(150) }, { "name" : "DestinationUserName", "alias" : "", "width" : NumberLong(150) }, { "name" : "DeviceHostName", "alias" : "", "width" : NumberLong(150) }, { "name" : "DestinationHostName", "alias" : "", "width" : NumberLong(131) } ], "branchIDs" : [ ], "correlatorID" : "", "activeListID" : "", "contextTableID" : "", "limit" : NumberLong(250), "orderBy" : [ { "column" : "Timestamp", "asc" : true, "shouldEscape" : false } ] } }