I’m currently leveraging curated Dashboard: Data Ingestion and Health to get insight on our daily volume ingestion. I modified a few queries there to make it suitable for our case.

It occurred to me to leverage some of these data and create a simple daily/ weekly alert check if we have exceeded our daily ingestion allowance.

example:

events:
 $event.ingestion.component = "Ingestion API"
 //$Log_Type = $event.ingestion.log_type
 //$Log_Type != ""
 $date = timestamp.get_date($event.ingestion.end_time)

match:
 $event,$date over 24h

outcome:
 $Total_Size_Bytes = sum(if($event.ingestion.component = "Ingestion API", $event.ingestion.log_volume, 0))
 $Total_Logs = sum(if($event.ingestion.component = "Ingestion API", $event.ingestion.log_count, 0))

condition:
 $Total_Size_Bytes >= [removed by moderator] 

It turns out that the Yara-L rule editor complains the field ingestion does not exits.

parsing: getting field descriptors: accessing field "udm.ingestion": field "ingestion" does not exist, valid fields are: "metadata", "additional", "principal", "src", "target", "intermediary", "observer", "about", "security_result", "network", "extensions", "extracted"
line: 12 
column: 4-29 

Are these tables and data not exposed to us to use beyond the Dashboards?

I’m aware there are other ways to do so, like using Cloud monitoring etc. I though this could be a simple way to avoid using a different platform + having to integrate outside of our SOAR and having to maintain another piece.

Any help or insight will be greatly appreciated.

Thanks!