update advanced hunting

This commit is contained in:
Joey Caparas 2018-03-19 13:27:49 -07:00
parent ad08827f04
commit 7b50b55aea
3 changed files with 7 additions and 2 deletions

View File

@ -44,7 +44,10 @@ In the following example, we start with the table name **ProcessCreationEvents**
![Image of Windows Defender ATP advanced hunting query](images/atp-advanced-hunting-query.png) ![Image of Windows Defender ATP advanced hunting query](images/atp-advanced-hunting-query.png)
First, we define a time filter to review only records from the previous 7 days. We then add a filter on the _FileName_ to contain only instances of powershell.exe First, we define a time filter to review only records from the previous seven days.
We then add a filter on the _FileName_ to contain only instances of _powershell.exe_.
Afterwards, we add a filter on the _ProcessCommandLine_ Afterwards, we add a filter on the _ProcessCommandLine_
Finally, we project only the columns we're interested in exploring and limit the results to 100 and click **Run query**. Finally, we project only the columns we're interested in exploring and limit the results to 100 and click **Run query**.
@ -141,4 +144,6 @@ You can refine your query based on the filter by clicking the "+" or "-" buttons
The filter selections will resolve as an additional query term and the results will be updated accordingly. The filter selections will resolve as an additional query term and the results will be updated accordingly.
## Public Advanced Hunting query GitHub repository ## Public Advanced Hunting query GitHub repository
Check out the [Advanced Hunting repository](https://github.com/Microsoft/Advanced-Hunting-Queries) - contribute and take examples of queries shared by our customers. Check out the [Advanced Hunting repository](https://github.com/Microsoft/Advanced-Hunting-Queries). Contribute and use example queries shared by our customers.

Binary file not shown.

Before

Width:  |  Height:  |  Size: 25 KiB

After

Width:  |  Height:  |  Size: 32 KiB

Binary file not shown.

Before

Width:  |  Height:  |  Size: 121 KiB

After

Width:  |  Height:  |  Size: 120 KiB