I have a situation where the date value is in the CEF payload and is
coming in like this:timestamp=2019-07-15T18:53:34.313ZIf I assign this
value to it
errors because of the Z on the end of the string. I can't seem to find a
way to strip off the Z o...
For setting up Microsoft Office 365 event sources: under the Advanced
section I see a field called Event Filter.It will not allow you to type
in it and has a drop down arrow but no data appears.We are looking to
filter Audit.SharePoint events to targ...
The API we are being asked to get data from is:GET
https://graph.microsoft.com/v1.0/security/alerts I see documented that
these are supported:Office365 Audit_AzureActiveDirectory Audit Exchange
Audit. SharePoint Audit_General (includes all other work...
Hello, I wanted to get clarification on what criteria analysis.service
gets populated with "http request path host header mismatch"Specifically
does is it: domain mismatch , tld mismatch or entirely different domains
altogether. I see this from Hunti...
I am being asked to parse out TTL from DNS response packets, but am
seeing difficulties with this. 1) DNS packets don't have any strings to
anchor a position off of and so would just be pulling straight
positional data which in essence would then act...
I believe those are what has inspired the request to parse the TTLS into
meta so that if those trigger then they can see what the value was and
if the packet had multiple responses, which one 'popped' the threshold.
