Compartir a través de

Consultas para la tabla AggregatedSecurityAlert

  • Artículo

Para obtener información sobre el uso de estas consultas en Azure Portal, consulte tutorial de Log Analytics. Para obtener la API REST, consulte Consulta.

Agrupar alertas de seguridad agregadas por sector

Alertas de seguridad agregadas agrupadas por sector originado.

source
| project
    TimeGenerated = todatetime(TimeGenerated),
    DisplayName = AlertDisplayName,
    AlertName = AlertDisplayName,
    AlertSeverity = Severity,
    Description,
    ProviderName,
    VendorName,
    VendorOriginalId = ProviderAlertId,
    SystemAlertId,
    AlertType,
    ConfidenceLevel,
    ConfidenceScore = tofloat(ConfidenceScore),
    StartTime = todatetime(StartTimeUtc),
    EndTime = todatetime(EndTimeUtc),
    ProcessingEndTime = todatetime(ProcessingEndTime),
    RemediationSteps = tostring(todynamic(RemediationSteps)),
    ExtendedProperties = tostring(todynamic(ExtendedProperties )),
    Entities = tostring(todynamic(Entities)),
    SourceSystem = "Detection",
    ExtendedLinks = tostring(todynamic(ExtendedLinks)),
    ProductName,
    ProductComponentName,
    Status,
    CompromisedEntity,
    Tactics = Intent,
    Techniques = tostring(todynamic(Techniques)),
    SubTechniques = tostring(todynamic(SubTechniques)),
    PartnerId,
    PartnerDisplayName,
    PartnerMetadata = tostring(todynamic(PartnerMetadata)),
    AggregatedSecurityAlertRuleIds,
    AggregatedSecurityAlertRuleNames