Cheat Sheet

{
    "associatedToAll": true,
    "caseInsensitive": true,
    "cliName": "cheatsheet",
    "closeForm": false,
    "content": true,
    "editForm": true,
    "group": 0,
    "hidden": false,
    "id": "incident_cheatsheet",
    "isReadOnly": false,
    "locked": false,
    "name": "Cheat Sheet",
    "neverSetAsRequired": false,
    "openEnded": false,
    "ownerOnly": false,
    "required": false,
    "sla": 0,
    "system": false,
    "template":"# XQL Queries\n\n### Search for CMD.EXE executions\n_You can change the timeframe by replacing the **\"7d\"** value_\n```\nconfig case_sensitive = false timeframe = 7d \n| dataset = xdr_data \n| filter event_type = ENUM.PROCESS and event_sub_type = ENUM.PROCESS_START\n| filter action_process_image_name contains \"cmd.exe\" or action_file_name contains \"cmd.exe\"\n| fields action_process_image_name as procname, action_process_image_sha256 as procsha256, action_process_image_path as\nprocpath, action_file_name as filename, action_file_sha256 as filesha256, action_file_path as filepath, event_type as eventtype,\nevent_sub_type as event_sub_type, action_process_image_md5 as procmd5, action_file_md5 as filemd5, agent_id as EndpointID\n```\n\n### All files created by the user \"X\" in the downloads folder\n_Replace **\"X\"** with user name \nYou can change the timeframe by replacing the **\"7d\"** value_\n```\nconfig case_sensitive = false timeframe = 2d\n| dataset = xdr_data\n| filter event_type = ENUM.FILE and event_sub_type = ENUM.FILE_CREATE_NEW and action_file_path contains \"downloads\" and actor_effective_username contains \"X\"\n| dedup action_file_path , action_file_sha256\n| fields actor_effective_username , agent_hostname , action_file_path , action_file_sha256 , actor_process_command_line\n```\n\n### All hosts that the user \"X\" logged in to \n_Replace **\"X\"** with user name\nYou can change the timeframe by replacing the **\"7d\"** value_\n```\nconfig case_sensitive = false timeframe = 7d\n | dataset = xdr_data \n | filter event_type = ENUM.EVENT_LOG and action_evtlog_event_id = 4624 \n | alter Logon_Type = arrayindex(regextract(action_evtlog_message, \"Logon Type:.*?(\\d+)\\r\\n\"),0), User_Name = arrayindex(regextract(action_evtlog_message,\"New Logon:\\r\\n.*\\r\\n.*?Account Name:.*?(\\w.*?)\\r\\n\"),0), Domain = arrayindex(regextract(action_evtlog_message, \"New Logon:\\r\\n.*\\r\\n.*\\r\\n.Account Domain:.*?(\\w.*)\\r\\n\"),0), Source_IP = arrayindex(regextract(action_evtlog_message, \"Source Network Address:.*?(\\d+\\.\\d+\\.\\d+\\.\\d+)\\r\\n\"),0), Process_Name = arrayindex(regextract(action_evtlog_message, \"Process Name:.*?(\\w.*)\\r\\n\"),0), Host_Name = arrayindex(regextract(action_evtlog_message, \"Workstation Name:.*?(\\w.*)\\r\\n\"),0)\n| filter lowercase(User_Name) contains lowercase(\"X\") // change the username\n| fields User_Name, Host_Name, Domain, Logon_Type, Source_IP, Process_Name, action_evtlog_message as Raw_Message \n| comp count() as counter by Host_Name, Source_IP , Logon_Type \n```",
    "threshold": 72,
    "type": "markdown",
    "unmapped": false,
    "unsearchable": true,
    "useAsKpi": false,
    "version": -1,
    "fromVersion": "6.9.0"
}