Skip to content

Commit 8600645

Browse files
sean-mcclellandsean-mcclelland
authored
Merge pull request #2 from Samsung/fix-analytics-rules
Fix analytics rules
2 parents 8ab6c1a + e7e97f7 commit 8600645

File tree

9 files changed

+782
-0
lines changed

9 files changed

+782
-0
lines changed

‎.script/tests/KqlvalidationsTests/CustomTables/Samsung_Knox_Application_CL.json‎

Lines changed: 76 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,76 @@
1+
{
2+
"properties": {
3+
"schema": {
4+
"name": "Samsung_Knox_Application_CL",
5+
"columns": [
6+
{
7+
"name": "TimeGenerated",
8+
"type": "DateTime",
9+
"isDefaultDisplay": true,
10+
"description": "The timestamp (UTC) reflecting the time in which the event was generated."
11+
},
12+
{
13+
"name": "PrimaryImei",
14+
"type": "string"
15+
},
16+
{
17+
"name": "DeviceImei1",
18+
"type": "string"
19+
},
20+
{
21+
"name": "DeviceImei2",
22+
"type": "string"
23+
},
24+
{
25+
"name": "DeviceSerialNumber",
26+
"type": "string"
27+
},
28+
{
29+
"name": "DeviceWifimac",
30+
"type": "string"
31+
},
32+
{
33+
"name": "DeviceModel",
34+
"type": "string"
35+
},
36+
{
37+
"name": "EventGuid",
38+
"type": "long"
39+
},
40+
{
41+
"name": "Name",
42+
"type": "string"
43+
},
44+
{
45+
"name": "Version",
46+
"type": "string"
47+
},
48+
{
49+
"name": "Severity",
50+
"type": "string"
51+
},
52+
{
53+
"name": "MitreTtp",
54+
"type": "dynamic"
55+
},
56+
{
57+
"name": "Profile",
58+
"type": "string"
59+
},
60+
{
61+
"name": "PkgName",
62+
"type": "string"
63+
},
64+
{
65+
"name": "AccessibilityApi",
66+
"type": "string"
67+
},
68+
{
69+
"name": "RestrictedPerms",
70+
"type": "dynamic"
71+
}
72+
]
73+
},
74+
"plan": "Analytics"
75+
}
76+
}

‎.script/tests/KqlvalidationsTests/CustomTables/Samsung_Knox_Audit_CL.json‎

Lines changed: 92 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,92 @@
1+
{
2+
"properties": {
3+
"schema": {
4+
"name": "Samsung_Knox_Audit_CL",
5+
"columns": [
6+
{
7+
"name": "TimeGenerated",
8+
"type": "DateTime",
9+
"isDefaultDisplay": true,
10+
"description": "The timestamp (UTC) reflecting the time in which the event was generated."
11+
},
12+
{
13+
"name": "PrimaryImei",
14+
"type": "string"
15+
},
16+
{
17+
"name": "DeviceImei1",
18+
"type": "string"
19+
},
20+
{
21+
"name": "DeviceImei2",
22+
"type": "string"
23+
},
24+
{
25+
"name": "DeviceSerialNumber",
26+
"type": "string"
27+
},
28+
{
29+
"name": "DeviceWifimac",
30+
"type": "string"
31+
},
32+
{
33+
"name": "DeviceModel",
34+
"type": "string"
35+
},
36+
{
37+
"name": "EventGuid",
38+
"type": "long"
39+
},
40+
{
41+
"name": "Name",
42+
"type": "string"
43+
},
44+
{
45+
"name": "Version",
46+
"type": "string"
47+
},
48+
{
49+
"name": "Severity",
50+
"type": "string"
51+
},
52+
{
53+
"name": "MitreTtp",
54+
"type": "dynamic"
55+
},
56+
{
57+
"name": "Profile",
58+
"type": "string"
59+
},
60+
{
61+
"name": "UserId",
62+
"type": "int"
63+
},
64+
{
65+
"name": "AdmUserId",
66+
"type": "int"
67+
},
68+
{
69+
"name": "AdmPkgName",
70+
"type": "string"
71+
},
72+
{
73+
"name": "FailureReason",
74+
"type": "string"
75+
},
76+
{
77+
"name": "Action",
78+
"type": "string"
79+
},
80+
{
81+
"name": "KeyMask",
82+
"type": "int"
83+
},
84+
{
85+
"name": "PkgName",
86+
"type": "string"
87+
}
88+
]
89+
},
90+
"plan": "Analytics"
91+
}
92+
}

‎.script/tests/KqlvalidationsTests/CustomTables/Samsung_Knox_Network_CL.json‎

Lines changed: 140 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,140 @@
1+
{
2+
"properties": {
3+
"schema": {
4+
"name": "Samsung_Knox_Network_CL",
5+
"columns": [
6+
{
7+
"name": "TimeGenerated",
8+
"type": "DateTime",
9+
"isDefaultDisplay": true,
10+
"description": "The timestamp (UTC) reflecting the time in which the event was generated."
11+
},
12+
{
13+
"name": "PrimaryImei",
14+
"type": "string"
15+
},
16+
{
17+
"name": "DeviceImei1",
18+
"type": "string"
19+
},
20+
{
21+
"name": "DeviceImei2",
22+
"type": "string"
23+
},
24+
{
25+
"name": "DeviceSerialNumber",
26+
"type": "string"
27+
},
28+
{
29+
"name": "DeviceWifimac",
30+
"type": "string"
31+
},
32+
{
33+
"name": "DeviceModel",
34+
"type": "string"
35+
},
36+
{
37+
"name": "EventGuid",
38+
"type": "long"
39+
},
40+
{
41+
"name": "Name",
42+
"type": "string"
43+
},
44+
{
45+
"name": "Version",
46+
"type": "string"
47+
},
48+
{
49+
"name": "Severity",
50+
"type": "string"
51+
},
52+
{
53+
"name": "MitreTtp",
54+
"type": "dynamic"
55+
},
56+
{
57+
"name": "Profile",
58+
"type": "string"
59+
},
60+
{
61+
"name": "Protocol",
62+
"type": "int"
63+
},
64+
{
65+
"name": "SourcePort",
66+
"type": "int"
67+
},
68+
{
69+
"name": "RemotePort",
70+
"type": "int"
71+
},
72+
{
73+
"name": "SourceAddr",
74+
"type": "string"
75+
},
76+
{
77+
"name": "RemoteAddr",
78+
"type": "string"
79+
},
80+
{
81+
"name": "EventDetectedTime",
82+
"type": "DateTime"
83+
},
84+
{
85+
"name": "Family",
86+
"type": "int"
87+
},
88+
{
89+
"name": "PkgName",
90+
"type": "string"
91+
},
92+
{
93+
"name": "InterfaceName",
94+
"type": "string"
95+
},
96+
{
97+
"name": "Tid",
98+
"type": "int"
99+
},
100+
{
101+
"name": "Pid",
102+
"type": "int"
103+
},
104+
{
105+
"name": "Ppid",
106+
"type": "int"
107+
},
108+
{
109+
"name": "Uid",
110+
"type": "int"
111+
},
112+
{
113+
"name": "Gid",
114+
"type": "int"
115+
},
116+
{
117+
"name": "ExitCode",
118+
"type": "int"
119+
},
120+
{
121+
"name": "Syscall",
122+
"type": "int"
123+
},
124+
{
125+
"name": "Path",
126+
"type": "string"
127+
},
128+
{
129+
"name": "Ja3Fingerprint",
130+
"type": "string"
131+
},
132+
{
133+
"name": "SocketType",
134+
"type": "int"
135+
}
136+
]
137+
},
138+
"plan": "Analytics"
139+
}
140+
}

0 commit comments

Comments
 (0)