• NDR - Top 100 most trafficked hostnames (BARS)

    • Approved on
    • 0 Comments
    -- NAME: NDR - Top 100 most trafficked hostnames -- CATEGORY: NDR -- DESCRIPTION: Detection for identifying the top 100 most trafficked hostnames by traffic volume -- SOURCE: Data Lake -- VARIABLE $$Destination IP Address$$ IP ADDRESS -- VARIABLE $...
  • NDR Report with last execution time

    • Approved on
    • 0 Comments
    -- QUERY NAME: NDR Report with last execution time -- CATEGORY: All queries, NDR -- DESCRIPTION: List the available NDR reports and the most current report execution time -- SOURCE: Data Lake -- VARIABLE $$Report Name$$ STRING SELECT DISTINCT...
  • NDR - Protocol Report (BARS)

    • Approved on
    • 0 Comments
    -- NAME: NDR - Protocol Report (BARS) -- CATEGORY: NDR -- DESCRIPTION: Detection for identifying protocols used and how often -- NOTE: avg_pcr is the Producer Consumer Ratio (PCR) (-1 Pure Push to +1 Pure Pull) -- NOTE: mac_addresses is a list of...
  • NDR - Devices generating most network traffic (BARS)

    • Approved on
    • 0 Comments
    -- NAME: NDR - Devices generating most network traffic (BARS) -- CATEGORY: NDR -- DESCRIPTION: Detection for identifying the top 100 talkers on a network. -- Fields are ip: the private IP address of the machine, total_bytes: the total number of bytes...
  • NDR - Top Clusters (BARS)

    • Approved on
    • 0 Comments
    -- NAME: NDR - Top Clusters (BARS) -- CATEGORY: NDR -- DESCRIPTION: Detection for identifying the clusters with the most traffic in bytes. -- A cluster is a group of flows defined by their shared values for src_ip, dest_ip, dest_port, protocol, app_protocol...
  • NDR - Top 10 hosts for each protocol seen

    • Approved on
    • 0 Comments
    -- NAME: NDR - Top 10 hosts for each protocol seen -- CATEGORY: NDR -- DESCRIPTION: Detection for identifying all used application protocols on the network and the top five hosts using each -- SOURCE: Data Lake -- VARIABLE $$Application Protocol...
  • NDR - MAC IP correlation

    • Approved on
    • 0 Comments
    -- NAME: NDR - MAC IP correlation -- DESCRIPTION: Detection for identifying all the IP addresses associated with a given MAC address -- Excludes :: and 0.0.0.0 -- The query also checks for the MAC Address in the data lakes XDR Data to determine if...
  • NDR - Number of Monitored Hosts

    • Approved on
    • 0 Comments
    -- NAME: NDR - Number of Monitored Hosts -- CATEGORY: NDR -- DESCRIPTION: Detection for identifying the number of private, public, and unknown hosts being monitored by -- SOURCE: Data Lake -- VARIABLE $$Category$$ STRING WITH NDR_Data AS ( ...
  • NDR - Devices generating most network traffic

    • Approved on
    • 0 Comments
    -- NAME: NDR - Devices generating most network traffic -- CATEGORY: NDR -- DESCRIPTION: Detection for identifying the top 100 talkers on a network. -- Fields are ip: the private IP address of the machine, total_bytes: the total number of bytes sent...
  • NDR - Protocol Report

    • Approved on
    • 0 Comments
    -- NAME: NDR - Protocol Report -- CATEGORY: NDR -- DESCRIPTION: Detection for identifying protocols used and how often -- NOTE: avg_pcr is the Producer Consumer Ratio (PCR) (-1 Pure Push to +1 Pure Pull) -- NOTE: mac_addresses is a list of the top...