n3tsurge

from datetime import datetime
from requests import Session

def fetch_microsoft_ips(url: str) -> dict:
    '''
    Pulls down the Microsoft IP JSON list
    '''
    s = Session()
    result = s.get(url)
    if result.status_code == 200:

n3tsurge

def get_nested_field(message: dict, field: str):
    '''
    Iterates over nested fields to get the final desired value
    e.g signal.rule.name should return the value of name

    Paramters:
        message (dict): A dictionary of values you want to iterate over
        field (str): The field you want to extract from the message in dotted format

    Return:

n3tsurge

import requests
import json
import datetime
from requests.auth import HTTPBasicAuth

auth = HTTPBasicAuth('elastic', '')
index_pattern = "winlogbeat-*"
days = 90

response = requests.get(f'https://mtllppsecelk01:9200/{index_pattern}/_settings/index.creation_date_string?flat_settings=true&human&expand_wildcards=open', verify=False, auth=auth)

n3tsurge

// Add this above extractIP4
var splitIps = function(evt) {
    extractIP4(evt, "winlog.event_data.QueryResults")
}

// Add this above event22
var extractIP4 = function(evt, queryResultField) {
        
    var addresses = [];
    var ips = evt.Get(queryResultField)