secops native dashboard for silent host monitoring

Can you paste the code here please

 

sure 

$event.metadata.event_timestamp.seconds > timestamp.current_seconds() - 1200

$silent_hostname = $event.principal.hostname

$event.principal.hostname != ""

match:

$silent_hostname over 10m

outcome:

$log_type = array_distinct($event.metadata.log_type)

$max_event_time = max($event.metadata.event_timestamp.seconds)

$last_event = timestamp.get_timestamp($max_event_time, "%F %T","GMT")

$max_diff = timestamp.current_seconds() - $max_event_time

$src_ip = array_distinct($event.principal.ip)

condition:

$event and $max_diff > 600

$event.metadata.event_timestamp.seconds > timestamp.current_seconds() - 1200

$silent_hostname = $event.principal.hostname

$event.principal.hostname != ""

match:

$silent_hostname over 10m

outcome:

$log_type = array_distinct($event.metadata.log_type)

$max_event_time = max($event.metadata.event_timestamp.seconds)

$last_event = timestamp.get_timestamp($max_event_time, "%F %T","GMT")

$max_diff = timestamp.current_seconds() - $max_event_time

$src_ip = array_distinct($event.principal.ip)

condition:

$event and $max_diff > 600

Have you seen the OOTB dashboard “Silent Host Monitoring” ?  It has a few differences, most specifically looking at graph.domain rather than principal.host.  Would it be worth a try starting with that and adapting it to your layout requirement?

hi @SoarAndy

we couldn’t find the OOTB Dashboard for silent host monitoring could you please share the raw dashboard query so that we can replicate it in our infra

and we are looking for host machines that just stopped sending logs so isn’t it better to use principal.hostname rather than graph.domain as it contains other host machines as well

My apologies, some of the final content is still trickling through to full GA

I’ll paste two here:

$host = principal.hostname
$event_time = metadata.event_timestamp.seconds
match:
    $host
outcome:
    $last_seen_timestamp = timestamp.get_timestamp(max($event_time))
    $days_since_last_seen = math.round((timestamp.current_seconds() - max($event_time)) / 86400, 0)
order:
    $days_since_last_seen desc

$asset = graph.entity.hostname
$asset != ""

//time period declarations
$last_seen_seconds = graph.entity.domain.last_seen_time.seconds

// hosts seen in the last week, but not in the last two days
$last_seen_seconds <= timestamp.current_seconds() - 172800  AND $last_seen_seconds >= timestamp.current_seconds() - 604800

//show the user the last_seen timestamp in a human readable format 
$last_seen_timestamp = timestamp.get_timestamp(graph.entity.domain.last_seen_time.seconds)

match:
    $asset, $last_seen_timestamp

order:
     $last_seen_timestamp desc

Ignore, user error :)

 

$host = principal.hostname

$event_time = metadata.event_timestamp.seconds

match:

$host

outcome:

$last_seen_timestamp = timestamp.get_timestamp(max($event_time))

$days_since_last_seen = math.round((timestamp.current_seconds() - max($event_time)) / 86400, 0)

order:

$days_since_last_seen desc