KQL Search

Query Details

Heartbeat Stopped Event Reception Domain Controllers

Query

let query_frequency = 15m;
let query_wait = 1h;
let _DomainControllers = toscalar(
    _GetWatchlist("Service-PrivateCorporateServices")
    | where Service == "DomainController"
    | summarize make_list(HostName)
);
Heartbeat
| where TimeGenerated > ago(query_wait + query_frequency)
| extend TimeReceived = _TimeReceived
| summarize arg_max(TimeReceived, *) by Category, VMUUID, Computer, _ResourceId
| where Computer has_any (_DomainControllers)
| where TimeReceived between (ago(query_frequency + query_wait) .. ago(query_wait))
| project TimeReceived, Computer, OSType, Version, ComputerEnvironment, Type, Solutions

Explanation

This KQL (Kusto Query Language) query is designed to monitor the activity of domain controllers within a specific time frame. Here's a simplified explanation of what the query does:

  1. Define Time Intervals:

    • query_frequency is set to 15 minutes, and query_wait is set to 1 hour. These are used to define the time windows for the query.

  2. Retrieve Domain Controllers:

    • The query retrieves a list of hostnames for domain controllers from a watchlist named "Service-PrivateCorporateServices" where the service type is "DomainController".

  3. Filter Heartbeat Data:

    • It looks at the Heartbeat table for records generated more than 1 hour and 15 minutes ago.
    • It extends the data with a TimeReceived field.

  4. Summarize Latest Records:

    • It summarizes the data to get the most recent record (arg_max) for each combination of Category, VMUUID, Computer, and _ResourceId.

  5. Filter for Domain Controllers:

    • It filters the summarized data to include only those records where the Computer field matches any of the domain controllers retrieved earlier.

  6. Time Window Filtering:

    • It further filters these records to include only those received between 1 hour and 15 minutes ago and 1 hour ago.

  7. Select Specific Fields:

    • Finally, it projects (selects) specific fields to display: TimeReceived, Computer, OSType, Version, ComputerEnvironment, Type, and Solutions.

In essence, this query is checking for the most recent heartbeat data from domain controllers within a specific 15-minute window, occurring 1 hour ago, to monitor their status and activity.

Details

Jose Sebastián Canós profile picture

Jose Sebastián Canós

Released: November 21, 2024

Tables

_GetWatchlistHeartbeat

Keywords

HeartbeatDomainControllersComputerOSTypeVersionComputerEnvironmentTypeSolutions

Operators

lettoscalaragosummarizemake_listarg_maxextendprojectbetweenhas_anywhere

Actions

GitHub