Hi,
Could anyone help me to fetch alert detections (custom as well as curated) of a specific entity from case using UDM Search Query and REST API?
So that I can display it on the case overview.
Solved
Fetch Alerts By Entity (via UDM and REST API)
+6- Bronze 2
Best answer by cmorris
The Search API now supports querying the Detection dataset, so I do not believe you need to build anything custom here, you can work with a query and the Execute UDM Query action. You’ll likely want to tweak the query (fields returned as well as placeholder for the host or some other entity), but as an example:
Results:
+14The Search API now supports querying the Detection dataset, so I do not believe you need to build anything custom here, you can work with a query and the Execute UDM Query action. You’ll likely want to tweak the query (fields returned as well as placeholder for the host or some other entity), but as an example:
Results:
+6- Bronze 2
This is really helpful. I am able to query the detections of an entity.
It was very difficult to understand which fields are supported in the query (for e.g. detection.collection_elements has 60014 objects and very difficult to scroll all of it.)
Is there any detailed documentation about what all fields are supported with respect to each data tables in SecOps lile Case, Alert, Detection
+14detection.collection_elements.event will contain all the event UDM field mappings for an event found in a detection, so detection.collection_elements.references.event.principal.hostname or detection.collection_elements.references.event.principal.ip for example. So many of the fields will be familiar, just with a prefix belonging to the detection dataset.
That said, this doc will cover the fields - https://docs.cloud.google.com/chronicle/docs/reference/rest/Shared.Types/Collection
And this will cover detections in search with some sample queries - https://docs.cloud.google.com/chronicle/docs/investigation/investigate-detections-in-search
Enter your E-mail address. We'll send you an e-mail with instructions to reset your password.