You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: articles/monitoring/monitoring-vminsights-log-search.md
+23-23Lines changed: 23 additions & 23 deletions
Original file line number
Diff line number
Diff line change
@@ -13,7 +13,7 @@ ms.devlang: na
13
13
ms.topic: article
14
14
ms.tgt_pltfrm: na
15
15
ms.workload: infrastructure-services
16
-
ms.date: 09/18/2018
16
+
ms.date: 09/20/2018
17
17
ms.author: magoedte
18
18
---
19
19
@@ -89,25 +89,25 @@ For convenience, the IP address of the remote end of a connection is included in
89
89
| Property | Description |
90
90
|:--|:--|
91
91
|RemoteCountry |The name of the country hosting RemoteIp. For example, *United States*|
92
-
|RemoteLatitude |The geolocation latitude. For example, *47.68*|
93
-
|RemoteLongitude |The geolocation longitude. For example, *-122.12*|
92
+
|RemoteLatitude |The geolocation latitude. For example, *47.68*|
93
+
|RemoteLongitude |The geolocation longitude. For example, *-122.12*|
94
94
95
95
#### Malicious IP
96
96
Every RemoteIp property in *VMConnection* table is checked against a set of IPs with known malicious activity. If the RemoteIp is identified as malicious the following properties will be populated (they are empty, when the IP is not considered malicious) in the following properties of the record:
97
97
98
98
| Property | Description |
99
99
|:--|:--|
100
100
|MaliciousIp |The RemoteIp address |
101
-
|IndicatorThreadType ||
102
-
|Description ||
103
-
|TLPLevel ||
104
-
|Confidence ||
105
-
|Severity ||
106
-
|FirstReportedDateTime ||
107
-
|LastReportedDateTime ||
108
-
|IsActive ||
109
-
|ReportReferenceLink ||
110
-
|AdditionalInformation ||
101
+
|IndicatorThreadType |Threat indicator detected is one of the following values, *Botnet*, *C2*, *CryptoMining*, *Darknet*, *DDos*, *MaliciousUrl*, *Malware*, *Phishing*, *Proxy*, *PUA*, *Watchlist*. |
102
+
|Description |Description of the observed threat.|
103
+
|TLPLevel |Traffic Light Protocol (TLP) Level is one of the defined values, *White*, *Green*, *Amber*, *Red*.|
104
+
|Confidence |Values are *0 – 100*.|
105
+
|Severity |Values are *0 – 5*, where *5* is the most severe and *0* is not severe at all. Default value is *3*. |
106
+
|FirstReportedDateTime |The first time the provider reported the indicator.|
107
+
|LastReportedDateTime |The last time the indicator was seen by Interflow.|
108
+
|IsActive |Indicates indicators are deactivated with *True* or *False* value.|
109
+
|ReportReferenceLink |Links to reports related to a given observable.|
110
+
|AdditionalInformation |Provides additional information, if applicable, about the observed threat.|
111
111
112
112
### ServiceMapComputer_CL records
113
113
Records with a type of *ServiceMapComputer_CL* have inventory data for servers with the Dependency agent. These records have the properties in the following table:
@@ -162,34 +162,34 @@ Records with a type of *ServiceMapProcess_CL* have inventory data for TCP-connec
162
162
## Sample log searches
163
163
164
164
### List all known machines
165
-
ServiceMapComputer_CL | summarize arg_max(TimeGenerated, *) by ResourceId
165
+
`ServiceMapComputer_CL | summarize arg_max(TimeGenerated, *) by ResourceId`
166
166
167
167
### List the physical memory capacity of all managed computers.
### Find all processes with "sql" in the command line
174
-
ServiceMapProcess_CL | where CommandLine_s contains_cs "sql" | summarize arg_max(TimeGenerated, *) by ResourceId
174
+
`ServiceMapProcess_CL | where CommandLine_s contains_cs "sql" | summarize arg_max(TimeGenerated, *) by ResourceId`
175
175
176
176
### Find a machine (most recent record) by resource name
177
-
search in (ServiceMapComputer_CL) "m-4b9c93f9-bc37-46df-b43c-899ba829e07b" | summarize arg_max(TimeGenerated, *) by ResourceId
177
+
`search in (ServiceMapComputer_CL) "m-4b9c93f9-bc37-46df-b43c-899ba829e07b" | summarize arg_max(TimeGenerated, *) by ResourceId`
178
178
179
179
### Find a machine (most recent record) by IP address
180
-
search in (ServiceMapComputer_CL) "10.229.243.232" | summarize arg_max(TimeGenerated, *) by ResourceId
180
+
`search in (ServiceMapComputer_CL) "10.229.243.232" | summarize arg_max(TimeGenerated, *) by ResourceId`
181
181
182
182
### List all known processes on a specified machine
183
-
ServiceMapProcess_CL | where MachineResourceName_s == "m-559dbcd8-3130-454d-8d1d-f624e57961bc" | summarize arg_max(TimeGenerated, *) by ResourceId
183
+
`ServiceMapProcess_CL | where MachineResourceName_s == "m-559dbcd8-3130-454d-8d1d-f624e57961bc" | summarize arg_max(TimeGenerated, *) by ResourceId`
184
184
185
185
### List all computers running SQL
186
-
ServiceMapComputer_CL | where ResourceName_s in ((search in (ServiceMapProcess_CL) "\*sql\*" | distinct MachineResourceName_s)) | distinct ComputerName_s
186
+
`ServiceMapComputer_CL | where ResourceName_s in ((search in (ServiceMapProcess_CL) "\*sql\*" | distinct MachineResourceName_s)) | distinct ComputerName_s`
187
187
188
188
### List all unique product versions of curl in my datacenter
189
-
ServiceMapProcess_CL | where ExecutableName_s == "curl" | distinct ProductVersion_s
189
+
`ServiceMapProcess_CL | where ExecutableName_s == "curl" | distinct ProductVersion_s`
190
190
191
191
### Create a computer group of all computers running CentOS
192
-
ServiceMapComputer_CL | where OperatingSystemFullName_s contains_cs "CentOS" | distinct ComputerName_s
192
+
`ServiceMapComputer_CL | where OperatingSystemFullName_s contains_cs "CentOS" | distinct ComputerName_s`
193
193
194
194
### Summarize the outbound connections from a group of machines
0 commit comments