Skip to content

Use correct time columns to check Expiration and to summarize in TI Map Detections.#3549

Closed
ep3p wants to merge 5 commits into
Azure:masterfrom
ep3p:ep3p-TIMapUpdates
Closed

Use correct time columns to check Expiration and to summarize in TI Map Detections.#3549
ep3p wants to merge 5 commits into
Azure:masterfrom
ep3p:ep3p-TIMapUpdates

Conversation

@ep3p
Copy link
Copy Markdown
Contributor

@ep3p ep3p commented Nov 25, 2021

This Pull Request comes from a closed unmerged pull request that got messy (#3477)

Fixes #

Saving some unnecessary conditions.

Expiration Date is already getting compared at

ThreatIntelligenceIndicator
| where TimeGenerated >= ago(ioc_lookBack) and ExpirationDateTime > now()

2nd summarize was getting its TimeGenerated from the event table, not from the Indicator Table.

Proposed Changes

  • Remove conditions about the time of the indicator, as they are already fulfilled.
  • Use correct column in 2nd summarize.
  • Use project-rename for Event columns that conflict with Indicator columns.

Use project-rename instead of extend for columns that conflict with Indicator columns.
@shainw
Copy link
Copy Markdown
Contributor

shainw commented Nov 29, 2021

As I said in other comments, we are using this PR with multiple changes across all TI - #3571. Thanks much.

@shainw shainw closed this Nov 29, 2021
@shainw shainw self-assigned this Nov 29, 2021
@ep3p ep3p deleted the ep3p-TIMapUpdates branch November 30, 2021 07:05
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants