KQL Search

//Using externaldata to parse the MITRE ATLAS json located at: https://github.com/mitre/atlas-navigator/blob/01181c265655c4f01bda28a0b1e0a41ec7090f77/assets/atlas-2.0-stix.json

let ATLAS = externaldata(objects:string,name:string,description:string,external_references:string,url:string,external_id:string,x_mitre_shortname:string,created_by_ref:string,object_marking_refs:string,type:string,id:string,created:datetime,modified:datetime)
    [@"https://raw.githubusercontent.com/mitre/atlas-navigator/01181c265655c4f01bda28a0b1e0a41ec7090f77/assets/atlas-2.0-stix.json"]
    with (format="MultiJSON", ingestionMapping='[{"Column":"objects","Properties":{"Path":"$.objects"}},{"Column":"name","Properties":{"Path":"$.objects.name"}},{"Column":"description","Properties":{"Path":"$.objects.description"}},{"Column":"external_references","Properties":{"Path":"$.objects.external_references.source_name"}},{"Column":"url","Properties":{"Path":"$.objects.external_references.url"}},{"Column":"external_id","Properties":{"Path":"$.objects.external_references.external_id"}},{"Column":"x_mitre_shortname","Properties":{"Path":"$.objects.x_mitre_shortname"}},{"Column":"created_by_ref","Properties":{"Path":"$.objects.created_by_ref"}},{"Column":"object_marking_refs","Properties":{"Path":"$.objects.object_marking_refs"}},{"Column":"type","Properties":{"Path":"$.objects.type"}},{"Column":"id","Properties":{"Path":"$.objects.id"}},{"Column":"created","Properties":{"Path":"$.objects.created"}},{"Column":"modified","Properties":{"Path":"$.objects.modified"}},]');
ATLAS