Additional ES|QL commands
in progress
J
Jerome Cousineau
PLEASE include support for CASE()🙏 my logs only contains Event.Code, I want to add human readability with a statement like, CASE(
event.code==1100, "Windows Event Log service shut down",
event.code==1101, "Audit events were dropped in transit",
event.code==1104, "Security log is full",
event.code==1108, "Event Log service could not process an event",
event.code==4612, "Audit queue exhausted; audit records may be lost",
event.code==4621, "System recovered after CrashOnAuditFail",
event.code==4906, "CrashOnAuditFail setting changed",
"Other audit-logging failure"
)
B
Brent Vidler
Would it be possible to include support for additional ES commands like JSON_EXTRACT? This would help extract some of the strings in things like itdr.ModifiedProperties in PIM elevation, where the elevated role is buried with several other fields.
Currently we'll get the raw JSON that can't be extracted in the Managed SIEM.
Nate O'Brien
updated the status to
in progress
We now support the stats COUNT and COUNT DISTINCT operators. SORT will becoming in the near future. Please see the documentation here: https://support.huntress.io/hc/en-us/articles/30113222043155-Huntress-Managed-SIEM-Log-Search-Guide
A
Anthony Kolka
Nate O'Brien Looking forward to SORT, please also implement AS to make it simpler to give a name to a column produced by an aggregation.
B
Bryce Skelton
Nate O'Brien not sure if it would be here or a different post, but are there plans to allow RENAME or similar functions to tune results from queries to be more readable if we need to?
Autopilot
Merged in a post:
ESQL Stats
K
Kurt Woods
We are building saved queries, but are seeing more data than we want to. ESQL has a Stats command that could allow us to set thresholds for queries. For example, it would allow us to build a saved search that only shows us hostnames that have 5 or more failed logins for the past 24 hours. I'd love to see the Stats be available for use