I am currently converting the following rule logic given below:
https://analyticsrules.exchange/analyticrules/237c3855-138c-4588-a68f-b870abd3bfc9/
I have already implemented most of the correlation and hotword-matching logic, but I am stuck on how to express several KQL constructs in Chronicle YARA-L, especially for the AzureDiagnostics table. can’t find appropriate Documentation for AzureDiagnostics.
The KQL portion I am struggling to translate is exactly this:
| extend hasHotword = iff(Statement has_any (hotwords), 1, 0) | summarize countEvents = count(), countStatements = dcount(Statement) , countStatementsWithHotwords = dcountif(Statement, hasHotword == 1) , countFailedStatementsWithHotwords = dcountif(Statement, (hasHotword == 1) and (Error > 0)) , countSuccessfulStatementsWithHotwords = dcountif(Statement, ((hasHotword == 1)) and (Error == 0)) , anyMonitoredStatement = anyif(Statement, (hasHotword == 1)) , anySuccessfulMonitoredStatement = anyif(Statement, (hasHotword == 1) and (Error == 0)) , anyInfo = anyif(AdditionalInfo, hasHotword == 1) , hotWord = anyif(extract(strcat_array(hotwords, '|'), 0, tolower(Statement)), hasHotword == 1) by Database, ClientIp, ApplicationName, PrincipalName, timeSlice,HostName,ResourceId | extend WindowType = case( timeSlice >= ago(detectionWindow), 'detection', (ago(trainingWindow) <= timeSlice and timeSlice < ago(detectionWindow)), 'training', 'other') | where WindowType in ('detection', 'training')); let trainingSet = processedData | where WindowType == 'training' | summarize countSlicesWithHotwords = dcountif(timeSlice, countStatementsWithHotwords >= monitoredStatementsThreshold) by Database; processedData | where WindowType == 'detection' | join kind = inner (trainingSet) on Database | extend IsHotwordAnomalyOnStatement = iff(((countStatementsWithHotwords >= monitoredStatementsThreshold) and (countSlicesWithHotwords <= trainingSlicesThreshold)), true, false) , anomalyScore = round(countStatementsWithHotwords/monitoredStatementsThreshold, 0) | where IsHotwordAnomalyOnStatement == 'true'
Kindly help this out @cmmartin_google @jstoner
