Plugins/Community Based Plugins/Microsoft Sentinel Custom Plugin Scenarios/ASIM Hunting queries/DNSEssentials_HuntingQueries.yaml [265:301]:
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
            let min_t = ago(14d);
            let max_t = now();
            let dt = 1d;
            // calculate avg. eps(events per second)
            let eps = materialize (_Im_Dns
              | project TimeGenerated
              | where TimeGenerated > ago(5m)
              | count
              | extend Count = Count / 300);
            let maxSummarizedTime = toscalar (
              union isfuzzy=true 
                  (
                  DNS_Summarized_Logs_ip_CL 
                  | where EventTime_t >= min_t
                  | summarize max_TimeGenerated=max(EventTime_t)
                  | extend max_TimeGenerated = datetime_add('hour', 1, max_TimeGenerated)
                  ),
                  (
                  print(min_t)
                  | project max_TimeGenerated = print_0
                  )
              | summarize maxTimeGenerated = max(max_TimeGenerated) 
              );
            let summarizationexist = materialize(
              union isfuzzy=true 
                  (
                  DNS_Summarized_Logs_ip_CL
                  | where EventTime_t > ago(1d) 
                  | project v = int(2)
                  ),
                  (
                  print int(1) 
                  | project v = print_0
                  )
              | summarize maxv = max(v)
              | extend sumexist = (maxv > 1)
              );
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -



Plugins/Community Based Plugins/Microsoft Sentinel Custom Plugin Scenarios/ASIM Hunting queries/DNSEssentials_HuntingQueries.yaml [382:418]:
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
            let min_t = ago(14d);
            let max_t = now();
            let dt = 1d;
            // calculate avg. eps(events per second)
            let eps = materialize (_Im_Dns
              | project TimeGenerated
              | where TimeGenerated > ago(5m)
              | count
              | extend Count = Count / 300);
            let maxSummarizedTime = toscalar (
              union isfuzzy=true 
                  (
                  DNS_Summarized_Logs_ip_CL 
                  | where EventTime_t >= min_t
                  | summarize max_TimeGenerated=max(EventTime_t)
                  | extend max_TimeGenerated = datetime_add('hour', 1, max_TimeGenerated)
                  ),
                  (
                  print(min_t)
                  | project max_TimeGenerated = print_0
                  )
              | summarize maxTimeGenerated = max(max_TimeGenerated) 
              );
            let summarizationexist = materialize(
              union isfuzzy=true 
                  (
                  DNS_Summarized_Logs_ip_CL
                  | where EventTime_t > ago(1d) 
                  | project v = int(2)
                  ),
                  (
                  print int(1) 
                  | project v = print_0
                  )
              | summarize maxv = max(v)
              | extend sumexist = (maxv > 1)
              );
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -



