Identity Protection - Average Cloud Response Time

Average time (in seconds) the cloud service takes to resolve entity information (e.g., from SID/GUID). Latency above 3 seconds may cause intermittent issues; above 4 seconds can lead to recurring timeouts.

Identitymonitoring

FDR intermediatepor CrowdStrike (cql-hub.com) 1 min read

Query

#repo=base_sensor #event_simpleName=IdpTelemetryData
| in(field=cid, values=[?SelectedCid])
| match(file="aid_master_main.csv", field=[cid, aid])
| in(field=MachineDomain, values=[?SelectedDomain])
| IdpTelemetryObjectArrayV2=/{"_name":"IdpTelemetryObject","identifier":\["CloudFetcher\/CloudResponseTime"\],"statistics_features":\[{"_name":"IdpTelemetryObjectStatisticsFeatures","average":\["(?<CloudResponseTimeAverage>\d+)"\],"median":\["(?<CloudResponseTimeMedian>\d+)"\],"p95_value":\["(?<CloudResponseTimeP95_value>\d+)"\],"p99_value":\["(?<CloudResponseTimeP99_value>\d+)"\]}]}/
| CloudResponseTimeAverage:=CloudResponseTimeAverage/10000000
| timeChart(function=avg("CloudResponseTimeAverage"))

Explicación

Importado desde cql-hub.com. Agrega explicación de pipes aquí.

Variables a ajustar

Revisa y ajusta los valores según tu entorno.