Skip to content

Commit 553f033

Browse files
oshezafoshezaf
committed
Update filtering parameters to specify time generated
1 parent 19f9c7f commit 553f033

6 files changed

Lines changed: 12 additions & 12 deletions

‎articles/sentinel/normalization-schema-alert.md‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -46,8 +46,8 @@ The Alert parsers support various [filtering parameters](normalization-about-par
4646

4747
| Name | Type | Description |
4848
|------|------|-------------|
49-
| **starttime** | datetime | Filter only alerts that started at or after this time. |
50-
| **endtime** | datetime | Filter only alerts that started at or before this time. |
49+
| **starttime** | datetime | Filter only alerts that started at or after this time. This parameter filters on the `TimeGenerated` field, which is the standard designator for the time of the event, regardless of the parser-specific mapping of the EventStartTime and EventEndTime fields. |
50+
| **endtime** | datetime | Filter only alerts that started at or before this time. This parameter filters on the `TimeGenerated` field, which is the standard designator for the time of the event, regardless of the parser-specific mapping of the EventStartTime and EventEndTime fields. |
5151
| **ipaddr_has_any_prefix** | dynamic | Filter only alerts for which the **'DvcIpAddr'** field is in one of the listed values. |
5252
| **hostname_has_any** | dynamic | Filter only alerts for which the **'DvcHostname'** field is in one of the listed values. |
5353
| **username_has_any** | dynamic | Filter only alerts for which the **'Username'** field is in one of the listed values. |

‎articles/sentinel/normalization-schema-authentication.md‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -48,8 +48,8 @@ The following filtering parameters are available:
4848

4949
| Name | Type | Description |
5050
|----------|-----------|-------------|
51-
| **starttime** | datetime | Filter only authentication events that ran at or after this time. |
52-
| **endtime** | datetime | Filter only authentication events that finished running at or before this time. |
51+
| **starttime** | datetime | Filter only authentication events that ran at or after this time. This parameter filters on the `TimeGenerated` field, which is the standard designator for the time of the event, regardless of the parser-specific mapping of the EventStartTime and EventEndTime fields. |
52+
| **endtime** | datetime | Filter only authentication events that finished running at or before this time. This parameter filters on the `TimeGenerated` field, which is the standard designator for the time of the event, regardless of the parser-specific mapping of the EventStartTime and EventEndTime fields. |
5353
| **targetusername_has** | string | Filter only authentication events that have any of the listed user names. |
5454

5555

‎articles/sentinel/normalization-schema-dns.md‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -79,8 +79,8 @@ The following filtering parameters are available:
7979

8080
| Name | Type | Description |
8181
|----------|-----------|-------------|
82-
| **starttime** | datetime | Filter only DNS queries that ran at or after this time. |
83-
| **endtime** | datetime | Filter only DNS queries that finished running at or before this time. |
82+
| **starttime** | datetime | Filter only DNS queries that ran at or after this time. This parameter filters on the `TimeGenerated` field, which is the standard designator for the time of the event, regardless of the parser-specific mapping of the EventStartTime and EventEndTime fields. |
83+
| **endtime** | datetime | Filter only DNS queries that finished running at or before this time. This parameter filters on the `TimeGenerated` field, which is the standard designator for the time of the event, regardless of the parser-specific mapping of the EventStartTime and EventEndTime fields. |
8484
| **srcipaddr** | string | Filter only DNS queries from this source IP address. |
8585
| **domain_has_any**| dynamic/string | Filter only DNS queries where the `domain` (or `query`) has any of the listed domain names, including as part of the event domain. The length of the list is limited to 10,000 items.
8686
| **responsecodename** | string | Filter only DNS queries for which the response code name matches the provided value. <br>For example: `NXDOMAIN` |

‎articles/sentinel/normalization-schema-network.md‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -49,8 +49,8 @@ The following filtering parameters are available:
4949

5050
| Name | Type | Description |
5151
|----------|-----------|-------------|
52-
| **starttime** | datetime | Filter only network sessions that *started* at or after this time. |
53-
| **endtime** | datetime | Filter only network sessions that *started* running at or before this time. |
52+
| **starttime** | datetime | Filter only network sessions that *started* at or after this time. This parameter filters on the `TimeGenerated` field, which is the standard designator for the time of the event, regardless of the parser-specific mapping of the EventStartTime and EventEndTime fields. |
53+
| **endtime** | datetime | Filter only network sessions that *started* running at or before this time. This parameter filters on the `TimeGenerated` field, which is the standard designator for the time of the event, regardless of the parser-specific mapping of the EventStartTime and EventEndTime fields. |
5454
| **srcipaddr_has_any_prefix** | dynamic | Filter only network sessions for which the [source IP address field](#srcipaddr) prefix is in one of the listed values. Prefixes should end with a `.`, for example: `10.0.`. The length of the list is limited to 10,000 items.|
5555
| **dstipaddr_has_any_prefix** | dynamic | Filter only network sessions for which the [destination IP address field](#dstipaddr) prefix is in one of the listed values. Prefixes should end with a `.`, for example: `10.0.`. The length of the list is limited to 10,000 items.|
5656
| **ipaddr_has_any_prefix** | dynamic | Filter only network sessions for which the [destination IP address field](#dstipaddr) or [source IP address field](#srcipaddr) prefix is in one of the listed values. Prefixes should end with a `.`, for example: `10.0.`. The length of the list is limited to 10,000 items.<br><br>The field [ASimMatchingIpAddr](#asimmatchingipaddr) is set with the one of the values `SrcIpAddr`, `DstIpAddr`, or `Both` to reflect the matching fields or fields. |

‎articles/sentinel/normalization-schema-process-event.md‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -46,8 +46,8 @@ The following filtering parameters are available:
4646

4747
| Name | Type | Description |
4848
|----------|-----------|-------------|
49-
| **starttime** | datetime | Filter only process events occurred at or after this time. |
50-
| **endtime** | datetime | Filter only process events queries that occurred at or before this time. |
49+
| **starttime** | datetime | Filter only process events occurred at or after this time. This parameter filters on the `TimeGenerated` field, which is the standard designator for the time of the event, regardless of the parser-specific mapping of the EventStartTime and EventEndTime fields. |
50+
| **endtime** | datetime | Filter only process events queries that occurred at or before this time. This parameter filters on the `TimeGenerated` field, which is the standard designator for the time of the event, regardless of the parser-specific mapping of the EventStartTime and EventEndTime fields. |
5151
| **commandline_has_any** | dynamic | Filter only process events for which the command line executed has **any** of the listed values. The length of the list is limited to 10,000 items. |
5252
| **commandline_has_all**| dynamic | Filter only process events for which the command line executed has **all** of the listed values. The length of the list is limited to 10,000 items.
5353
| **commandline_has_any_ip_prefix** | dynamic | Filter only process events for which the command line executed has **all** of the listed IP addresses or IP address prefixes. Prefixes should end with a `.`, for example: `10.0.`. The length of the list is limited to 10,000 items. |

‎articles/sentinel/normalization-schema-web.md‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -69,8 +69,8 @@ The following filtering parameters are available:
6969

7070
| Name | Type | Description |
7171
|----------|-----------|-------------|
72-
| **starttime** | datetime | Filter only Web sessions that **started** at or after this time. |
73-
| **endtime** | datetime | Filter only Web sessions that **started** running at or before this time. |
72+
| **starttime** | datetime | Filter only Web sessions that **started** at or after this time. This parameter filters on the `TimeGenerated` field, which is the standard designator for the time of the event, regardless of the parser-specific mapping of the EventStartTime and EventEndTime fields. |
73+
| **endtime** | datetime | Filter only Web sessions that **started** running at or before this time. This parameter filters on the `TimeGenerated` field, which is the standard designator for the time of the event, regardless of the parser-specific mapping of the EventStartTime and EventEndTime fields. |
7474
| **srcipaddr_has_any_prefix** | dynamic | Filter only Web sessions for which the [source IP address field](normalization-schema-network.md#srcipaddr) prefix is in one of the listed values. The list of values can include IP addresses and IP address prefixes. Prefixes should end with a `.`, for example: `10.0.`. The length of the list is limited to 10,000 items.|
7575
| **ipaddr_has_any_prefix** | dynamic | Filter only network sessions for which the [destination IP address field](normalization-schema-network.md#dstipaddr) or [source IP address field](normalization-schema-network.md#srcipaddr) prefix is in one of the listed values. Prefixes should end with a `.`, for example: `10.0.`. The length of the list is limited to 10,000 items.<br><br>The field [ASimMatchingIpAddr](normalization-schema-network.md#asimmatchingipaddr) is set with the one of the values `SrcIpAddr`, `DstIpAddr`, or `Both` to reflect the matching fields or fields. |
7676
| **url_has_any** | dynamic | Filter only Web sessions for which the [URL field](#url) has any of the values listed. The parser may ignore the schema of the URL passed as a parameter, if the source does not report it. If specified, and the session is not a web session, no result will be returned. The length of the list is limited to 10,000 items.|

0 commit comments

Comments
 (0)