ASIM snippets

ASIM_snippets.md

KQL Snippets

This file contains useful snippets that can be used for the development of ASIM Parsers for Microsoft Sentinel

DstHostname

| extend DstHostname = case(DstHostname != "", DstHostname, DestinationIP)

let src_or_any = set_union(srcipaddr_has_any_prefix, ipaddr_has_any_prefix);
let dst_or_any = set_union(dstipaddr_has_any_prefix, ipaddr_has_any_prefix);
| extend
    temp_SrcMatch = has_any_ipv4_prefix(SrcIpAddr, src_or_any)
  , temp_DstMatch = has_any_ipv4_prefix(DstIpAddr, dst_or_any)
| extend
  ASimMatchingIpAddr = case(
    array_length(src_or_any) == 0 and array_length(dst_or_any) == 0 ,"-"
    , temp_SrcMatch and temp_DstMatch, "Both"
    , temp_SrcMatch, "SrcIpAddr"
    , temp_DstMatch, "DstIpAddr"
    , "No match"
  )
| extend 
  ASimMatchingHostname = case(
    array_length(hostname_has_any) == 0, "-"
    , temp_SrcMatch and temp_DstMatch, "Both"
    , temp_SrcMatch, "SrcDomain"
    , temp_DstMatch, "DstDomain"
    , "No match"
  )
| where ASimMatchingHostname != "No match"