Red Canary Threat Detection

Requête originale, sans modification.

let detectionLookback = 1d;
let newDetectionWindow = 5m;
RedCanaryDetections_CL
| where TimeGenerated >= ago(detectionLookback)
| where isnotempty(detection_id_s)
| summarize FirstSeen = min(TimeGenerated), arg_max(TimeGenerated, *) by detection_id_s
| where FirstSeen >= ago(newDetectionWindow)
| extend    process_iocs_raw = column_ifexists('process_iocs_s', '[]'),
            child_process_iocs_raw = column_ifexists('child_process_iocs_s', '[]'),
            cross_process_iocs_raw = column_ifexists('cross_process_iocs_s', '[]'),
            file_modification_iocs_raw = column_ifexists('file_modification_iocs_s', '[]'),
            identities_raw = column_ifexists('identities_s', '[]')
| extend    process_ioc_array = todynamic(iff(isempty(process_iocs_raw), '[]', process_iocs_raw)),
            child_process_ioc_array = todynamic(iff(isempty(child_process_iocs_raw), '[]', child_process_iocs_raw)),
            cross_process_ioc_array = todynamic(iff(isempty(cross_process_iocs_raw), '[]', cross_process_iocs_raw)),
            file_mod_ioc_array = todynamic(iff(isempty(file_modification_iocs_raw), '[]', file_modification_iocs_raw)),
            identities_array = todynamic(iff(isempty(identities_raw), '[]', identities_raw))
| extend    evidence_array = array_concat(process_ioc_array, child_process_ioc_array, cross_process_ioc_array, file_mod_ioc_array)
| extend    evidence = todynamic(evidence_array[0]),
            identity = todynamic(identities_array[0])
| extend    file_hash_array = todynamic(evidence.file_hashes)
| extend    file_hash = todynamic(file_hash_array[0])
| project   detection_id_s,
            detection_url_s = column_ifexists('detection_url_s', ''),
            detection_headline_s = column_ifexists('detection_headline_s', ''),
            detection_details_s = column_ifexists('detection_details_s', ''),
            detection_severity_s = column_ifexists('detection_severity_s', ''),
            host_name_s = column_ifexists('host_name_s', ''),
            host_full_name_s = column_ifexists('host_full_name_s', ''),
            host_os_family_s = column_ifexists('host_os_family_s', ''),
            host_os_version_s = column_ifexists('host_os_version_s', ''),
            tactics_s = column_ifexists('tactics_s', ''),
            process_id = tostring(evidence.process_id),
            process_command_line = tostring(evidence.process_command_line),
            process_creation_time_utc = tostring(evidence.process_creation_time_utc),
            file_hash_algorithm = tostring(file_hash.algorithm),
            file_hash_value = tostring(file_hash.value),
            file_directory = tostring(evidence.file_directory),
            file_name = tostring(evidence.file_name),
            user_name = tostring(identity.user_name),
            user_uid = tostring(identity.user_uid)