RecordedFuture Threat Hunting Url All Actors

Requête originale, sans modification.

let ioc_lookBack = 1d;
// The source table (_Im_WebSession) is a ASIM parser table, but can be replaced by any infrastructure table containing Url data.
// The following workbook: Recorded Future - Url Correlation will help researching available data and selecting tables and columns
_Im_WebSession
| where isnotempty(Url)
| extend lowerUrl=tolower(Url)
| join kind=inner (
ThreatIntelIndicators
// Only look for IOCs
| where ObservableKey == 'url:value'
| where isnotempty(ObservableValue)
// Only look at Recorded Future Threat Hunt Indicators.
| where Data.description startswith "Recorded Future - Threat Hunt"
// Only work with the latest indicators
| where TimeGenerated >= ago(ioc_lookBack)
| summarize LatestIndicatorTime = arg_max(TimeGenerated, *) by Id
| where IsActive == true and ValidUntil > now()
| extend lowerUrl=tolower(ObservableValue)
) on lowerUrl
// select column from the source table to match with Recorded Future ThreatIntelIndicators $left.Url
| mv-expand Label=Data.labels
| extend RecordedFuturePortalLink = parse_json(tostring(Label)).RecordedFuturePortalLink
 | where isnotempty(RecordedFuturePortalLink)
 | summarize arg_max(TimeGenerated, *) by ObservableValue
| project Url=ObservableValue, Description=Data.description, Type, TimeGenerated, RecordedFuturePortalLink