Recent RTR Sessions
List of the recent Real Time Response sessions that were started.
EDRmonitoring
FDR intermediatepor CrowdStrike (cql-hub.com) 1 min read
Query
// Get RTR Start events
#repo=detections #event_simpleName=Event_RemoteResponseSessionStartEvent
// Rename Agent ID value
| rename(field="AgentIdString", as="aid")
// Display results in table
| table([StartTimestamp, UserName, aid], limit=20000)
// Bring in data from AID Master lookup file
| aid=~match(file="aid_master_main.csv", column=[aid], strict=false)
// Convert timestamp to human-readable value
| formatTime(format="%F %T %Z", as=StartTimestamp, field=StartTimestamp)Explicación
Importado desde cql-hub.com. Agrega explicación de pipes aquí.
Variables a ajustar
Revisa y ajusta los valores según tu entorno.