MITRE ATLAS Parser
Query
No standalone KQL detected in this source
View source on GitHubAbout this query
Explanation
This query is using external data to parse a JSON file from the MITRE ATLAS repository. It extracts specific fields like name, description, URL, and created date from the JSON file and stores them in a variable called ATLAS.
Details
Rod Trent
Released: April 30, 2024
Tables
ATLAS
Keywords
ExternaldataMITREATLASJSONObjectsNameDescriptionExternal_ReferencesURLExternal_IDx_mitre_shortnameCreated_By_RefObject_Marking_RefsTypeIDCreatedModified
Operators
projectextendmv-expandsummarizewhereorder bylimitdistinctcountcountifisemptyisnotemptyisemptyornullisnotemptyornullhashasprefixhassubstringhassuffixcontainscontainscscontainsignoringcasestartswithendswithmatches regexparse_jsonserializestrcatstrcat_arraystrcat_separatorstrcat_separator_arraystrcatifstrcatif_arraystrcatif_separatorstrcatif_separator_arraystrcatifcsstrcatifcs_arraystrcatifcs_separatorstrcatifcs_separator_arraystrcatifignoringcasestrcatifignoringcase_arraystrcatifignoringcase_separatorstrcatifignoringcase_separator_arraystrcat_array_separatorstrcat_separator_array_separatorstrcat_array_separator_arraystrcat_separator_array_separator_arraystrcat_array_separator_array_separatorstrcat_array_separator_array_separator_arraystrcat_separator_array_separator_array_separatorstrcat_array_separator_array_separator_array_separatorstrcat_separator_array_separator_array_separator_arraystrcat_array_separator_array_separator_array_separator_arraystrcat_separator_array_separator_array_separator_array_separator_arraystrcat_array_separator_array_separator_array_separator_array_separatorstrcat_array_separator_array_separator_array_separator_array_separator_arraystrcat_separator_array_separator_array_separator_array_separator_array_separatorstrcat_array_separator_array_separator_array_separator_array_separator_array_separatorstrcat_separator_array_separator_array_separator_array_separator_array_separator_arraystrcat_array_separator_array_separator_array_separator_array_separator_array_separator_arraystrcat_separator_array_separator_array_separator_array_separator_array_separator_array_separatorstrcat_array_separator_array_separator_array_separator_array_separator_array_separator_array_separatorstrcat_separator_array_separator_array_separator_array_separator_array_separator_array_separator_arraystrcat_array_separator_array_separator_array_separator_array_separator_array_separator_array_separator_arraystrcat_separator_array_separator_array_separator_array_separator_array_separator_array_separator_array_separatorstrcat_array_separator_array_separator_array_separator_array_separator_array_separator_array_separator_array_separatorstrcat_separator_array_separator_array_separator_array_separator_array_separator_array_separator_array_separator_arraystrcat_array_separator_array_separator_array_separator_array_separator_array_separator_array_separator_array_separator_arraystrcat_separator_array_separator_array_separator_array_separator_array_separator_array_separator_array_separator_array_separatorstrcat_array_separator_array_separator_array_separator_array_separator_array_separator_array_separator_array_separator_array_separatorstrcat_separator_array_separator_array_separator_array_separator_array_separator_array_separator_array_separator_array_separator_array