APTNotes table that can be used to join with other data connectors
Ransomware APT Notes Join Table
Query
let APTInfo = externaldata(Filename: string, Title: string, Source:
string, Link: string, SHA1: string, Date: datetime, Year: int)
[@"https://raw.githubusercontent.com/aptnotes/data/master/APTnotes.csv"]
with (format="csv", ignoreFirstRecord=True);
APTInfo
| where Year > 2015About this query
APTNotes table that can be used to join with other data connectors
Query Information
Description
APTNotes table that can be used to join with other data connectors
Defender XDR
Sentinel
let APTInfo = externaldata(Filename: string, Title: string, Source:
string, Link: string, SHA1: string, Date: datetime, Year: int)
[@"https://raw.githubusercontent.com/aptnotes/data/master/APTnotes.csv"]
with (format="csv", ignoreFirstRecord=True);
APTInfo
| where Year > 2015
Explanation
This query is designed to retrieve and filter data from an external CSV file containing information about Advanced Persistent Threat (APT) notes. Here's a simple breakdown of what the query does:
-
Data Source: It pulls data from a CSV file located at a specified URL on GitHub. This file contains information about APT activities.
-
Data Structure: The data includes several fields: Filename, Title, Source, Link, SHA1, Date, and Year.
-
Data Filtering: The query filters the data to include only records from the year 2016 onwards (i.e., where the Year is greater than 2015).
-
Purpose: The resulting filtered data can be used to join with other data connectors, which means it can be combined with other datasets for further analysis or reporting.
This query is written in KQL (Kusto Query Language) and is applicable for use in both Microsoft Defender XDR and Microsoft Sentinel environments.
Details
Bert-Jan Pals
Released: December 1, 2024
Tables
Keywords
Operators