spicosolutions / thepeoplessiem

Patronus Support Portal
0 stars 0 forks source link

SSRG010 - High Or Critical Priority Host With Malware Detected #22

Closed jward51 closed 2 years ago

jward51 commented 2 years ago

ss_prep, ss_message_enrich, and ss_generate_score_system macros are missing

| from datamodel:"Malware"."Malware_Attacks" | where ('dest_priority'="high" OR 'dest_priority'="critical") | search category=av.detect | stats max(_time) as "lastTime",latest(_raw) as "orig_raw",values(dest_priority) as "dest_priority",count by "dest","signature","category" | ss_prep("SSRG010") |ss_message_enrich(1,dest) ss_generate_score_system(base_score,reliability,dest,dest_category,dest_priority)