From dacd5b1d55d0906bfdaaede396b80b4b07e251bc Mon Sep 17 00:00:00 2001 From: Rico Valdez Date: Tue, 13 Aug 2019 15:46:49 -0600 Subject: [PATCH] removed src field from table, as it is not available and results in a blank column. Also incremented the version as a significant change was made to the search --- detections/dns_query_length_with_high_standard_deviation.json | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/detections/dns_query_length_with_high_standard_deviation.json b/detections/dns_query_length_with_high_standard_deviation.json index 5f73ce7d80..f4eb1b3e06 100644 --- a/detections/dns_query_length_with_high_standard_deviation.json +++ b/detections/dns_query_length_with_high_standard_deviation.json @@ -75,12 +75,12 @@ "earliest_time": "-70m@m", "latest_time": "-10m@m" }, - "search": "| tstats `summariesonly` count from datamodel=Network_Resolution by DNS.query DNS.record_type | `drop_dm_object_name(\"DNS\")` | eval query_length = len(query) | table src query query_length record_type count | eventstats stdev(query_length) AS stdev avg(query_length) AS avg p50(query_length) AS p50| where query_length>(avg+stdev*2) | eval z_score=(query_length-avg)/stdev", + "search": "| tstats `summariesonly` count from datamodel=Network_Resolution by DNS.query DNS.record_type | `drop_dm_object_name(\"DNS\")` | eval query_length = len(query) | table query query_length record_type count | eventstats stdev(query_length) AS stdev avg(query_length) AS avg p50(query_length) AS p50| where query_length>(avg+stdev*2) | eval z_score=(query_length-avg)/stdev", "search_description": "This search allows you to identify DNS requests and compute the standard deviation on the length of the names being resolved, then filter on two times the standard deviation to show you those queries that are unusually large for your environment.", "search_id": "1a67f15a-f4ff-4170-84e9-08cf6f75d6f5", "search_name": "DNS Query Length With High Standard Deviation", "search_type": "detection", "security_domain": "network", "spec_version": 1, - "version": "1.0" + "version": "2.0" }