Update datamodel=MODEL fields to datamodel=Model.Submodel

detections/endpoint/investigate_failed_logins_for_multiple_destinations.yml

@@ -9,7 +9,7 @@ datamodel:
 description: This search returns failed logins to multiple destinations by user.
 search: '| tstats count `security_content_summariesonly` earliest(_time) as first_login
   latest(_time) as last_login dc(Authentication.dest) AS distinct_count_dest values(Authentication.dest)
-  AS Authentication.dest values(Authentication.app) AS Authentication.app  from datamodel=Authentication
+  AS Authentication.dest values(Authentication.app) AS Authentication.app  from datamodel=Authentication.Authentication
   where Authentication.action=failure by Authentication.user | where distinct_count_dest
   > 1 | `security_content_ctime(first_login)` | `security_content_ctime(last_login)`
   | `drop_dm_object_name("Authentication")` | search user=$user$'

detections/endpoint/investigate_previous_unseen_user.yml

@@ -11,7 +11,7 @@ description: This search returns previous unseen user, which didn't log in for 3
 search: '| tstats count `security_content_summariesonly` earliest(_time) as first_login
   latest(_time) as last_login values(Authentication.dest) AS Authentication.dest values(Authentication.app)
   AS Authentication.app values(Authentication.action) AS Authentication.action from
-  datamodel=Authentication where Authentication.action=success by _time, Authentication.user
+  datamodel=Authentication.Authentication where Authentication.action=success by _time, Authentication.user
   | bucket _time span=30d | stats count min(first_login) as first_login max(last_login)
   as last_login values(Authentication.dest) AS Authentication.dest by Authentication.user
   | where count=1 | where first_login >= relative_time(now(), "-30d") | `security_content_ctime(first_login)`

detections/endpoint/investigate_successful_remote_desktop_authentications.yml

@@ -10,7 +10,7 @@ description: 'This search returns the source, destination, and user for all succ
   remote-desktop authentications. A successful authentication after a brute-force
   attack on a destination machine is suspicious behavior. '
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
-  as lastTime from datamodel=Authentication where Authentication.signature_id=4624
+  as lastTime from datamodel=Authentication.Authentication where Authentication.signature_id=4624
   Authentication.app=win:remote by Authentication.src Authentication.dest Authentication.app
   Authentication.user Authentication.signature Authentication.src_nt_domain | `security_content_ctime(lastTime)`
   | `security_content_ctime(firstTime)` | `drop_dm_object_name("Authentication")`

detections/endpoint/java_class_file_download_by_java_user_agent.yml

@@ -10,7 +10,7 @@ description: The following analytic identifies a Java user agent performing a GE
   request for a .class file from the remote site. This is potentially indicative of
   exploitation of the Java application and may be related to current event CVE-2021-44228
   (Log4Shell).
-search: '| tstats count from datamodel=Web where Web.http_user_agent="*Java*" Web.http_method="GET"
+search: '| tstats count from datamodel=Web.Web where Web.http_user_agent="*Java*" Web.http_method="GET"
   Web.url="*.class*" by Web.http_user_agent Web.http_method, Web.url,Web.url_length
   Web.src, Web.dest | `drop_dm_object_name("Web")` | `security_content_ctime(firstTime)`
   | `security_content_ctime(lastTime)` | `java_class_file_download_by_java_user_agent_filter`'

detections/endpoint/short_lived_windows_accounts.yml

@@ -9,7 +9,7 @@ datamodel:
 description: This search detects accounts that were created and deleted in a short
   time period.
 search: '| tstats `security_content_summariesonly` values(All_Changes.result_id) as
-  result_id count min(_time) as firstTime max(_time) as lastTime from datamodel=Change
+  result_id count min(_time) as firstTime max(_time) as lastTime from datamodel=Change.All_Changes
   where All_Changes.result_id=4720 OR All_Changes.result_id=4726 by _time span=4h
   All_Changes.user All_Changes.dest | `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)`
   | `drop_dm_object_name("All_Changes")` | search result_id = 4720 result_id=4726

detections/endpoint/windows_updates_install_failures.yml

@@ -9,7 +9,7 @@ description: This search is intended to give you a feel for how often Windows up
   fail to install in your environment. Fluctuations in these numbers will allow you
   to determine when you should be concerned.
 search: '| tstats `security_content_summariesonly` dc(Updates.dest) as count FROM
-  datamodel=Updates where Updates.vendor_product="Microsoft Windows" AND Updates.status=failure
+  datamodel=Updates.Updates where Updates.vendor_product="Microsoft Windows" AND Updates.status=failure
   by _time span=1d'
 how_to_implement: You must be ingesting your Windows Update Logs
 known_false_positives: none

detections/endpoint/windows_updates_install_successes.yml

@@ -9,7 +9,7 @@ description: This search is intended to give you a feel for how often successful
   updates are applied in your environments. Fluctuations in these numbers will allow
   you to determine when you should be concerned.
 search: '| tstats `security_content_summariesonly` dc(Updates.dest) as count FROM
-  datamodel=Updates where Updates.vendor_product="Microsoft Windows" AND Updates.status=installed
+  datamodel=Updates.Updates where Updates.vendor_product="Microsoft Windows" AND Updates.status=installed
   by _time span=1d'
 how_to_implement: You must be ingesting your Windows Update Logs
 known_false_positives: none