diff --git a/detections/endpoint/rare_parent_process_relationship_lolbas___ssa.yaml b/detections/endpoint/rare_parent_process_relationship_lolbas___ssa.yaml index 1a0f3c0bfb..a95eff594f 100644 --- a/detections/endpoint/rare_parent_process_relationship_lolbas___ssa.yaml +++ b/detections/endpoint/rare_parent_process_relationship_lolbas___ssa.yaml @@ -22,7 +22,7 @@ dest_device_id=ucast(map_get(input_event, "dest_device_id"), "string", null) | select parent_process, process_name, timestamp, dest_device_id, dest_user_id | conditional_anomaly conditional="parent_process" target="process_name" | rename output as input -| adaptive_threshold algorithm="quantile" entity="parent_process" value="input" window=604800000L +| adaptive_threshold algorithm="quantile" entity="parent_process" window=604800000L | where label AND quantile<0.1 AND (process_name="powershell.exe" OR process_name="regsvcs.exe" OR process_name="ftp.exe" OR diff --git a/notebooks/rare_parent_process_relationship_lolbas.ipynb b/notebooks/rare_parent_process_relationship_lolbas.ipynb new file mode 100644 index 0000000000..033f2f8f69 --- /dev/null +++ b/notebooks/rare_parent_process_relationship_lolbas.ipynb @@ -0,0 +1,664 @@ +{ + "cells": [ + { + "cell_type": "markdown", + "metadata": {}, + "source": [ + "# Rare Parent/Child Process Relationship\n", + "\n", + "An attacker may use LOLBAS tools spawned from vulnerable applications not typically used by system administrators. This search leverages the Splunk Streaming ML DSP plugin to find rare parent/child relationships. The list of application has been extracted from https://github.com/LOLBAS-Project/LOLBAS/tree/master/yml/OSBinaries\n", + "\n", + "https://github.com/splunk/security-content/blob/unit_test_prohibited_apps_spawning_cmdprompt/detections/endpoint/rare_parent_process_relationship_lolbas___ssa.yaml" + ] + }, + { + "cell_type": "code", + "execution_count": 21, + "metadata": { + "execution": { + "iopub.execute_input": "2020-10-15T20:08:27.093444Z", + "iopub.status.busy": "2020-10-15T20:08:27.093190Z", + "iopub.status.idle": "2020-10-15T20:08:36.211841Z", + "shell.execute_reply": "2020-10-15T20:08:36.211309Z", + "shell.execute_reply.started": "2020-10-15T20:08:27.093423Z" + } + }, + "outputs": [ + { + "data": { + "application/vnd.jupyter.widget-view+json": { + "model_id": "77a26780b74e4608b6aa7d13f168b61d", + "version_major": 2, + "version_minor": 0 + }, + "text/plain": [ + "HBox(children=(HTML(value=''), FloatProgress(value=0.0, max=5.0), HTML(value='')))" + ] + }, + "metadata": {}, + "output_type": "display_data" + }, + { + "name": "stdout", + "output_type": "stream", + "text": [ + " Finished. " + ] + }, + { + "data": { + "text/html": [ + "
\n", + "\n", + "\n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + "
inputdest_device_identitiesprocess_namequantilelabelparent_processbodydest_user_id
07.6666675gUXDbXvVfgC/FEpZOFUaA==[5gUXDbXvVfgC/FEpZOFUaA==]powershell.exe0.000000Truec:\\windows\\system32\\cmd.exeTBDNaN
11.1647255gUXDbXvVfgC/FEpZOFUaA==[5gUXDbXvVfgC/FEpZOFUaA==]cmd.exe0.082919Truec:\\program files\\splunkforwarderforsplunkinc\\b...TBDNaN
21.1642285gUXDbXvVfgC/FEpZOFUaA==[5gUXDbXvVfgC/FEpZOFUaA==]cmd.exe0.081037Truec:\\program files\\splunkforwarderforsplunkinc\\b...TBDNaN
31.161742IaNYgFTNQvyVmJNuPr58dQ==[IaNYgFTNQvyVmJNuPr58dQ==]cmd.exe0.083721Truec:\\program files\\splunkforwarderforsplunkinc\\b...TBDNaN
41.1582955gUXDbXvVfgC/FEpZOFUaA==[5gUXDbXvVfgC/FEpZOFUaA==]cmd.exe0.057663Truec:\\program files\\splunkforwarderforsplunkinc\\b...TBDNaN
..............................
17846.918486ZTQ/ltGlScpA4WGbfRJ0Xg==[ZTQ/ltGlScpA4WGbfRJ0Xg==]sc.exe0.000879Truec:\\windows\\system32\\svchost.exeTBDNaN
17858.567270lQ+9FBHxYQK/q8qXcrTE9A==[lQ+9FBHxYQK/q8qXcrTE9A==]sc.exe0.001315Truec:\\windows\\system32\\svchost.exeTBDNaN
17869.991479IaNYgFTNQvyVmJNuPr58dQ==[IaNYgFTNQvyVmJNuPr58dQ==]sc.exe0.001752Truec:\\windows\\system32\\svchost.exeTBDNaN
17875.403934OWUYaWKrJeuOY71+TXoqiw==[OWUYaWKrJeuOY71+TXoqiw==]cmd.exe0.000000Truec:\\program files\\splunkuniversalforwarder\\bin\\...TBDNaN
17880.035648OWUYaWKrJeuOY71+TXoqiw==[OWUYaWKrJeuOY71+TXoqiw==, rXYtTmzIXq56PqQ+iNO...cmd.exe0.000000Truec:\\windows\\system32\\cmd.exeTBDrXYtTmzIXq56PqQ+iNO/xw==
\n", + "

1789 rows × 9 columns

\n", + "
" + ], + "text/plain": [ + " input dest_device_id ... body dest_user_id\n", + "0 7.666667 5gUXDbXvVfgC/FEpZOFUaA== ... TBD NaN\n", + "1 1.164725 5gUXDbXvVfgC/FEpZOFUaA== ... TBD NaN\n", + "2 1.164228 5gUXDbXvVfgC/FEpZOFUaA== ... TBD NaN\n", + "3 1.161742 IaNYgFTNQvyVmJNuPr58dQ== ... TBD NaN\n", + "4 1.158295 5gUXDbXvVfgC/FEpZOFUaA== ... TBD NaN\n", + "... ... ... ... ... ...\n", + "1784 6.918486 ZTQ/ltGlScpA4WGbfRJ0Xg== ... TBD NaN\n", + "1785 8.567270 lQ+9FBHxYQK/q8qXcrTE9A== ... TBD NaN\n", + "1786 9.991479 IaNYgFTNQvyVmJNuPr58dQ== ... TBD NaN\n", + "1787 5.403934 OWUYaWKrJeuOY71+TXoqiw== ... TBD NaN\n", + "1788 0.035648 OWUYaWKrJeuOY71+TXoqiw== ... TBD rXYtTmzIXq56PqQ+iNO/xw==\n", + "\n", + "[1789 rows x 9 columns]" + ] + }, + "metadata": {}, + "output_type": "display_data" + }, + { + "name": "stdout", + "output_type": "stream", + "text": [ + "\n" + ] + }, + { + "data": { + "text/plain": [ + "" + ] + }, + "execution_count": 21, + "metadata": {}, + "output_type": "execute_result" + } + ], + "source": [ + "| from read_text(\"s3://smle-experiments/datasets/ssa/T1059.all.labeled.lolbas-test.json\")\n", + "| select from_json_object(value) as input_event\n", + "| eval timestamp=parse_long(ucast(map_get(input_event, \"_time\"), \"string\", null)) \n", + "| eval parent_process=lower(ucast(map_get(input_event, \"parent_process_name\"), \"string\", null)), \n", + "process_name=lower(ucast(map_get(input_event, \"process_name\"), \"string\", null)), \n", + "dest_user_id=ucast(map_get(input_event, \"dest_user_id\"), \"string\", null), \n", + "dest_device_id=ucast(map_get(input_event, \"dest_device_id\"), \"string\", null)\n", + "| where parent_process!=null \n", + "| select parent_process, process_name, timestamp, dest_device_id, dest_user_id \n", + "| conditional_anomaly conditional=\"parent_process\" target=\"process_name\" \n", + "| rename output as input \n", + "| adaptive_threshold algorithm=\"quantile\" entity=\"parent_process\" value=\"input\" window=604800000L \n", + "| where label AND quantile<0.1 AND (process_name=\"powershell.exe\" OR process_name=\"regsvcs.exe\" OR process_name=\"ftp.exe\" OR process_name=\"dfsvc.exe\" OR process_name=\"rasautou.exe\" OR process_name=\"schtasks.exe\" OR process_name=\"xwizard.exe\" OR process_name=\"findstr.exe\" OR process_name=\"esentutl.exe\" OR process_name=\"cscript.exe\" OR process_name=\"reg.exe\" OR process_name=\"csc.exe\" OR process_name=\"atbroker.exe\" OR process_name=\"print.exe\" OR process_name=\"pcwrun.exe\" OR process_name=\"vbc.exe\" OR process_name=\"rpcping.exe\" OR process_name=\"wsreset.exe\" OR process_name=\"ilasm.exe\" OR process_name=\"certutil.exe\" OR process_name=\"replace.exe\" OR process_name=\"mshta.exe\" OR process_name=\"bitsadmin.exe\" OR process_name=\"wscript.exe\" OR process_name=\"ieexec.exe\" OR process_name=\"cmd.exe\" OR process_name=\"microsoft.workflow.compiler.exe\" OR process_name=\"runscripthelper.exe\" OR process_name=\"makecab.exe\" OR process_name=\"forfiles.exe\" OR process_name=\"desktopimgdownldr.exe\" OR process_name=\"control.exe\" OR process_name=\"msbuild.exe\" OR process_name=\"register-cimprovider.exe\" OR process_name=\"tttracer.exe\" OR process_name=\"ie4uinit.exe\" OR process_name=\"sc.exe\" OR process_name=\"bash.exe\" OR process_name=\"hh.exe\" OR process_name=\"cmstp.exe\" OR process_name=\"mmc.exe\" OR process_name=\"jsc.exe\" OR process_name=\"scriptrunner.exe\" OR process_name=\"odbcconf.exe\" OR process_name=\"extexport.exe\" OR process_name=\"msdt.exe\" OR process_name=\"diskshadow.exe\" OR process_name=\"extrac32.exe\" OR process_name=\"eventvwr.exe\" OR process_name=\"mavinject.exe\" OR process_name=\"regasm.exe\" OR process_name=\"gpscript.exe\" OR process_name=\"rundll32.exe\" OR process_name=\"regsvr32.exe\" OR process_name=\"regedit.exe\" OR process_name=\"msiexec.exe\" OR process_name=\"gfxdownloadwrapper.exe\" OR process_name=\"presentationhost.exe\" OR process_name=\"regini.exe\" OR process_name=\"wmic.exe\" OR process_name=\"runonce.exe\" OR process_name=\"syncappvpublishingserver.exe\" OR process_name=\"verclsid.exe\" OR process_name=\"psr.exe\" OR process_name=\"infdefaultinstall.exe\" OR process_name=\"explorer.exe\" OR process_name=\"expand.exe\" OR process_name=\"installutil.exe\" OR process_name=\"netsh.exe\" OR process_name=\"wab.exe\" OR process_name=\"dnscmd.exe\" OR process_name=\"at.exe\" OR process_name=\"pcalua.exe\" OR process_name=\"cmdkey.exe\" OR process_name=\"msconfig.exe\")\n", + "| eval start_time = timestamp, end_time = timestamp, entities = mvappend(dest_device_id, dest_user_id), body = \"TBD\";" + ] + }, + { + "cell_type": "code", + "execution_count": null, + "metadata": {}, + "outputs": [], + "source": [] + }, + { + "cell_type": "code", + "execution_count": 17, + "metadata": { + "execution": { + "iopub.execute_input": "2020-10-15T20:02:37.170279Z", + "iopub.status.busy": "2020-10-15T20:02:37.170022Z", + "iopub.status.idle": "2020-10-15T20:02:43.678071Z", + "shell.execute_reply": "2020-10-15T20:02:43.677426Z", + "shell.execute_reply.started": "2020-10-15T20:02:37.170257Z" + } + }, + "outputs": [ + { + "data": { + "application/vnd.jupyter.widget-view+json": { + "model_id": "4e0d8eab254f4b029c177b1fe1e534e2", + "version_major": 2, + "version_minor": 0 + }, + "text/plain": [ + "HBox(children=(HTML(value=''), FloatProgress(value=0.0, max=4.0), HTML(value='')))" + ] + }, + "metadata": {}, + "output_type": "display_data" + }, + { + "name": "stdout", + "output_type": "stream", + "text": [ + " Finished. " + ] + }, + { + "data": { + "text/html": [ + "
\n", + "\n", + "\n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + "
\n", + "
" + ], + "text/plain": [ + "Empty DataFrame\n", + "Columns: []\n", + "Index: []" + ] + }, + "metadata": {}, + "output_type": "display_data" + }, + { + "name": "stdout", + "output_type": "stream", + "text": [ + "\n" + ] + }, + { + "data": { + "text/plain": [ + "" + ] + }, + "execution_count": 17, + "metadata": {}, + "output_type": "execute_result" + } + ], + "source": [ + "| from read_text(\"s3://smle-experiments/datasets/ssa/T1059.all.labeled.lolbas-test.json\")\n", + "| select from_json_object(value) as input_event\n", + "| eval timestamp=parse_long(ucast(map_get(input_event, \"_time\"), \"string\", null)) \n", + "| eval parent_process=lower(ucast(map_get(input_event, \"parent_process_name\"), \"string\", null)), process_name=lower(ucast(map_get(input_event, \"process_name\"), \"string\", null)), dest_user_id=ucast(map_get(input_event, \"dest_user_id\"), \"string\", null), dest_device_id=ucast(map_get(input_event, \"dest_device_id\"), \"string\", null)\n", + "| where parent_process!=null \n", + "| select parent_process, process_name, timestamp, dest_device_id, dest_user_id \n", + "| conditional_anomaly conditional=\"parent_process\" target=\"process_name\" \n", + "| rename output as input \n", + "| adaptive_threshold algorithm=\"quantile\" entity=\"parent_process\" window=604800000L \n", + "| where label AND quantile<0.1 \n", + "| eval start_time = timestamp, end_time = timestamp, entities = mvappend(dest_device_id, dest_user_id), body = \"TBD\";" + ] + }, + { + "cell_type": "code", + "execution_count": 20, + "metadata": { + "execution": { + "iopub.execute_input": "2020-10-15T20:08:09.210819Z", + "iopub.status.busy": "2020-10-15T20:08:09.210557Z", + "iopub.status.idle": "2020-10-15T20:08:14.938351Z", + "shell.execute_reply": "2020-10-15T20:08:14.937869Z", + "shell.execute_reply.started": "2020-10-15T20:08:09.210797Z" + } + }, + "outputs": [ + { + "data": { + "application/vnd.jupyter.widget-view+json": { + "model_id": "b65b4333a96b4def890df59aef61efd6", + "version_major": 2, + "version_minor": 0 + }, + "text/plain": [ + "HBox(children=(HTML(value=''), FloatProgress(value=0.0, max=5.0), HTML(value='')))" + ] + }, + "metadata": {}, + "output_type": "display_data" + }, + { + "name": "stdout", + "output_type": "stream", + "text": [ + " Finished. " + ] + }, + { + "data": { + "text/html": [ + "
\n", + "\n", + "\n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + "
dest_device_idparent_processprocess_nameinput_eventdest_user_id
0IaNYgFTNQvyVmJNuPr58dQ==c:\\program files\\splunkforwarderforsplunkinc\\b...splunk-monitornohandle.exe{'dest_device_id': 'IaNYgFTNQvyVmJNuPr58dQ==',...NaN
1IaNYgFTNQvyVmJNuPr58dQ==c:\\program files\\splunkforwarderforsplunkinc\\b...splunk-powershell.exe{'dest_device_id': 'IaNYgFTNQvyVmJNuPr58dQ==',...NaN
2IaNYgFTNQvyVmJNuPr58dQ==c:\\program files\\splunkforwarderforsplunkinc\\b...splunk-admon.exe{'dest_device_id': 'IaNYgFTNQvyVmJNuPr58dQ==',...NaN
3IaNYgFTNQvyVmJNuPr58dQ==c:\\program files\\splunkforwarderforsplunkinc\\b...splunk-winprintmon.exe{'dest_device_id': 'IaNYgFTNQvyVmJNuPr58dQ==',...NaN
4IaNYgFTNQvyVmJNuPr58dQ==c:\\program files\\splunkforwarderforsplunkinc\\b...splunk-regmon.exe{'dest_device_id': 'IaNYgFTNQvyVmJNuPr58dQ==',...NaN
..................
69294OWUYaWKrJeuOY71+TXoqiw==c:\\windows\\microsoft.net\\framework\\v4.0.30319\\...mscorsvw.exe{'dest_device_id': 'OWUYaWKrJeuOY71+TXoqiw==',...NaN
69295OWUYaWKrJeuOY71+TXoqiw==c:\\windows\\microsoft.net\\framework\\v4.0.30319\\...mscorsvw.exe{'dest_device_id': 'OWUYaWKrJeuOY71+TXoqiw==',...NaN
69296OWUYaWKrJeuOY71+TXoqiw==c:\\windows\\microsoft.net\\framework\\v4.0.30319\\...mscorsvw.exe{'dest_device_id': 'OWUYaWKrJeuOY71+TXoqiw==',...NaN
69297OWUYaWKrJeuOY71+TXoqiw==c:\\windows\\microsoft.net\\framework\\v4.0.30319\\...mscorsvw.exe{'dest_device_id': 'OWUYaWKrJeuOY71+TXoqiw==',...NaN
69298OWUYaWKrJeuOY71+TXoqiw==c:\\windows\\microsoft.net\\framework\\v4.0.30319\\...mscorsvw.exe{'dest_device_id': 'OWUYaWKrJeuOY71+TXoqiw==',...NaN
\n", + "

69299 rows × 5 columns

\n", + "
" + ], + "text/plain": [ + " dest_device_id ... dest_user_id\n", + "0 IaNYgFTNQvyVmJNuPr58dQ== ... NaN\n", + "1 IaNYgFTNQvyVmJNuPr58dQ== ... NaN\n", + "2 IaNYgFTNQvyVmJNuPr58dQ== ... NaN\n", + "3 IaNYgFTNQvyVmJNuPr58dQ== ... NaN\n", + "4 IaNYgFTNQvyVmJNuPr58dQ== ... NaN\n", + "... ... ... ...\n", + "69294 OWUYaWKrJeuOY71+TXoqiw== ... NaN\n", + "69295 OWUYaWKrJeuOY71+TXoqiw== ... NaN\n", + "69296 OWUYaWKrJeuOY71+TXoqiw== ... NaN\n", + "69297 OWUYaWKrJeuOY71+TXoqiw== ... NaN\n", + "69298 OWUYaWKrJeuOY71+TXoqiw== ... NaN\n", + "\n", + "[69299 rows x 5 columns]" + ] + }, + "metadata": {}, + "output_type": "display_data" + }, + { + "name": "stdout", + "output_type": "stream", + "text": [ + "\n" + ] + }, + { + "data": { + "text/plain": [ + "" + ] + }, + "execution_count": 20, + "metadata": {}, + "output_type": "execute_result" + } + ], + "source": [ + "| from read_text(\"s3://smle-experiments/datasets/ssa/T1059.all.labeled.lolbas-test.json\")\n", + "| select from_json_object(value) as input_event\n", + "| eval timestamp=parse_long(ucast(map_get(input_event, \"_time\"), \"string\", null)) \n", + "| eval parent_process=lower(ucast(map_get(input_event, \"parent_process_name\"), \"string\", null)), process_name=lower(ucast(map_get(input_event, \"process_name\"), \"string\", null)), dest_user_id=ucast(map_get(input_event, \"dest_user_id\"), \"string\", null), dest_device_id=ucast(map_get(input_event, \"dest_device_id\"), \"string\", null);" + ] + }, + { + "cell_type": "code", + "execution_count": 12, + "metadata": { + "execution": { + "iopub.execute_input": "2020-10-15T19:57:41.275353Z", + "iopub.status.busy": "2020-10-15T19:57:41.275091Z", + "iopub.status.idle": "2020-10-15T19:57:41.451939Z", + "shell.execute_reply": "2020-10-15T19:57:41.451420Z", + "shell.execute_reply.started": "2020-10-15T19:57:41.275329Z" + } + }, + "outputs": [ + { + "data": { + "application/vnd.jupyter.widget-view+json": { + "model_id": "a6d67552f5c94913ae1533cc38780ed3", + "version_major": 2, + "version_minor": 0 + }, + "text/plain": [ + "HBox(children=(HTML(value=''), FloatProgress(value=0.0, max=5.0), HTML(value='')))" + ] + }, + "metadata": {}, + "output_type": "display_data" + }, + { + "name": "stdout", + "output_type": "stream", + "text": [ + " Getting search results... \n" + ] + }, + { + "name": "stderr", + "output_type": "stream", + "text": [ + "SPL2RuntimeError: Search failed with exception: Error type checking arguments to function [eval] with ID: [9b2c2616-255f-4b80-976d-3ead4c842e4a]: Unable to find function [map_get] for arguments [input: get(fieldName: input_event), key: _time] with resolvedId [map_get:map:string] - candidate functions: \n", + "\t0: Argument [input: string] cannot be assigned to argument [input: map] for function [function(input: map, key: string): T]. resolvedId=map_get:map:string\n" + ] + }, + { + "data": { + "text/plain": [ + "" + ] + }, + "execution_count": 12, + "metadata": {}, + "output_type": "execute_result" + } + ], + "source": [ + "| from read_text(\"s3://smle-experiments/datasets/ssa/T1059.all.labeled.lolbas-test.json\")\n", + "| select ucast(value, \"string\", null) as input_event\n", + "| eval timestamp=parse_long(ucast(map_get(input_event, \"_time\"), \"string\", null));" + ] + }, + { + "cell_type": "code", + "execution_count": null, + "metadata": {}, + "outputs": [], + "source": [] + } + ], + "metadata": { + "kernelspec": { + "display_name": "SPL2", + "language": "SPL", + "name": "spl2" + }, + "language_info": { + "mimetype": "text/spl", + "name": "SPL" + } + }, + "nbformat": 4, + "nbformat_minor": 4 +}