Skip to content

Instantly share code, notes, and snippets.

Show Gist options
  • Star 0 You must be signed in to star a gist
  • Fork 0 You must be signed in to fork a gist
  • Save MagnusTiberius/3af0b6945ab3fc4bdf3c2fa520fbb427 to your computer and use it in GitHub Desktop.
Save MagnusTiberius/3af0b6945ab3fc4bdf3c2fa520fbb427 to your computer and use it in GitHub Desktop.
ALTER PROCEDURE [dbo].[EIP_EPOEvents_InsertEvent]
(
@ServerID nvarchar(16) = NULL,
@DetectedUTC datetime,
@AgentGUID nvarchar(64),
@Analyzer nvarchar(16),
@AnalyzerName nvarchar(64),
@AnalyzerVersion nvarchar(20),
@AnalyzerHostName nvarchar(128) = NULL,
@AnalyzerIPV4 int = NULL,
@AnalyzerIPV6 binary(16) = NULL,
@AnalyzerMAC nvarchar(16) = NULL,
@AnalyzerDATVersion nvarchar(20) = NULL,
@AnalyzerEngineVersion nvarchar(20) = NULL,
@SourceHostName nvarchar(128) = NULL,
@SourceIPV4 int = NULL,
@SourceIPV6 binary(16) = NULL,
@SourceMAC nvarchar(16) = NULL,
@SourceUserName nvarchar(128) = NULL,
@SourceProcessName nvarchar(128) = NULL,
@SourceURL nvarchar(256) = NULL,
@TargetHostName nvarchar(128) = NULL,
@TargetIPV4 int = NULL,
@TargetIPV6 binary(16) = NULL,
@TargetMAC nvarchar(16) = NULL,
@TargetUserName nvarchar(128) = NULL,
@TargetPort int = NULL,
@TargetProtocol nvarchar(16) = NULL,
@TargetProcessName nvarchar(128) = NULL,
@TargetFileName nvarchar(266) = NULL,
@ThreatCategory nvarchar(128),
@ThreatEventID int,
@ThreatName nvarchar(128),
@ThreatType nvarchar(32),
@ThreatSeverity tinyint = 1,
@ThreatActionTaken nvarchar(24) = 'none',
@ThreatHandled bit = NULL,
@AutoID int = NULL OUTPUT,
@AutoGUID nvarchar(64) = NULL OUTPUT
)
AS
BEGIN
-- used for guid insertion and returning
DECLARE @AutoGUID2 uniqueidentifier
DECLARE @AgentGUID2 uniqueidentifier
DECLARE @AnalyzerDetectionMethod nvarchar(128) = NULL
SET @AutoID = NULL;
SET @AutoGUID2 = NEWID();
SET @AgentGUID2 = dbo.NvarcharToUniqueidentifier(@AgentGUID);
INSERT INTO [dbo].[EPOEvents] (
AutoGUID,
ServerID,
DetectedUTC,
AgentGUID,
Analyzer,
AnalyzerName,
AnalyzerVersion,
AnalyzerHostName,
AnalyzerIPV4,
AnalyzerIPV6,
AnalyzerMAC,
AnalyzerDATVersion,
AnalyzerEngineVersion,
AnalyzerDetectionMethod,
SourceHostName,
SourceIPV4,
SourceIPV6,
SourceMAC,
SourceUserName,
SourceProcessName,
SourceURL,
TargetHostName,
TargetIPV4,
TargetIPV6,
TargetMAC,
TargetUserName,
TargetPort,
TargetProtocol,
TargetProcessName,
TargetFileName,
ThreatCategory,
ThreatEventID,
ThreatName,
ThreatType,
ThreatSeverity,
ThreatActionTaken,
ThreatHandled
)
VALUES
(
@AutoGUID2,
@ServerID,
@DetectedUTC,
@AgentGUID2,
@Analyzer,
@AnalyzerName,
@AnalyzerVersion,
@AnalyzerHostName,
@AnalyzerIPV4,
@AnalyzerIPV6,
@AnalyzerMAC,
@AnalyzerDATVersion,
@AnalyzerEngineVersion,
@AnalyzerDetectionMethod,
@SourceHostName,
@SourceIPV4,
@SourceIPV6,
@SourceMAC,
@SourceUserName,
@SourceProcessName,
@SourceURL,
@TargetHostName,
@TargetIPV4,
@TargetIPV6,
@TargetMAC,
@TargetUserName,
@TargetPort,
@TargetProtocol,
@TargetProcessName,
@TargetFileName,
@ThreatCategory,
@ThreatEventID,
@ThreatName,
@ThreatType,
@ThreatSeverity,
@ThreatActionTaken,
@ThreatHandled
);
SET @AutoID = CAST(SCOPE_IDENTITY() AS int);
RETURN @AutoID
END
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment