Statistics and aggregations in UDM search using YARA-L 2.0 | Google Security Operations | Google Cloud
This product or feature is subject to the "Pre-GA Offerings Terms" in the General Service Terms section of the Service Specific Terms. Pre-GA products and features are available "as is" and might have limited support. For more information, see the launch stage descriptions. This page describes how to run statistical queries on UDM events and group the results for analysis using YARA-L 2.0. When dealing with a large volume of UDM events generated within your environment, it's important to understand the trends in your UDM search data. You can use statistics and aggregate functions to gain actionable insights from your UDM logs. UDM search supports all the aggregate functions in YARA-L 2.0. You can use statistical queries for the following use cases: Track critical metrics: You can measure the distribution and frequency of UDM events and the assets involved, such as hosts communicating with known malicious IP addresses. Detect anomalous behaviour: You can detect unusual patterns or spike
Unterstützt in: Auf dieser Seite wird beschrieben, wie Sie statistische Abfragen für UDM-Ereignisse ausführen und die Ergebnisse mit YARA-L 2.0 für die Analyse gruppieren. Wenn Sie eine große Anzahl von UDM-Ereignissen verarbeiten, die in Ihrer Umgebung generiert werden, ist es wichtig, die Trends in Ihren UDM-Suchdaten zu verstehen. Mithilfe von Statistiken und Aggregatfunktionen können Sie aus Ihren UDM-Logs verwertbare Informationen gewinnen. Die UDM-Suche unterstützt alle Aggregatfunktionen in YARA-L 2.0. Anwendungsfälle für statistische Abfragen Sie können statistische Abfragen für…
related reading
- Tuning YARA-L Rules in Chronicle SIEM | by Chris Martin (@thatsiemguy) | Mediummedium.com
- SLUM: The Shadow Library Uptime Monitoropen-slum.org
- שיטות להטמעת נתונים וסוגי נתוניםcloud.google.com
- Chronicle White Papercdn2.hubspot.net
- Kontextsensitive Analysen erstellencloud.google.com
- Advanced threat detection with User and Entity Behavior Analytics (UEBA) in Microsoft Sentinel | Microsoft Learnlearn.microsoft.com
- Unsupervised Machine Learning with Splunk: the cluster command | by Alex Teixeira | Detect FYIdetect.fyi
- Anomalies detected by the Microsoft Sentinel machine learning engine | Microsoft Learnlearn.microsoft.com
- Use customizable anomalies to detect threats in Microsoft Sentinel | Microsoft Learnlearn.microsoft.com
- Create custom detection rules in Microsoft Defender XDR - Microsoft Defender XDR | Microsoft Learnlearn.microsoft.com
- 강화 구성cloud.google.com
- New IDR Log Search Enhancements | Rapid7 Blograpid7.com