Skip to content

Commit

Permalink
Update Test_Solution.yaml
Browse files Browse the repository at this point in the history
  • Loading branch information
v-shukore committed Oct 16, 2024
1 parent d48e596 commit fc61584
Showing 1 changed file with 34 additions and 1 deletion.
35 changes: 34 additions & 1 deletion Solutions/TestSolution/Parsers/Test_Solution.yaml
Original file line number Diff line number Diff line change
Expand Up @@ -6,4 +6,37 @@ Function:
Category: Microsoft Sentinel Parser
FunctionName: Test_Solution
FunctionAlias: Test_Solution
FunctionQuery: null
FunctionQuery: |
union isfuzzy=true ProofpointTAPNativePoller_CL, ProofPointTAPMessagesDelivered_CL, ProofPointTAPMessagesBlocked_CL, ProofPointTAPClicksPermitted_CL, ProofPointTAPClicksBlocked_CL
| extend EventVendor = 'Proofpoint',
EventProduct = 'Targeted Attack Protection',
EventCount = '1'
| project-rename CcAddresses=ccAddresses_s,
Cluster=cluster_s,
CompletelyRewritten=completelyRewritten_b,
SrcUsername=fromAddress_s,
EventOriginalUid=GUID_s,
HeaderFrom=headerFrom_s,
HeaderReplyTo=headerReplyTo_s,
Id=id_g,
ImpostorScore=impostorScore_d,
MalwareScore=malwareScore_d,
MessageId=messageID_s,
MessageParts=messageParts_s,
NetworkBytes=messageSize_d,
EventEndTime=messageTime_t,
ModulesRun=modulesRun_s,
PhishScore=phishScore_d,
PolicyRoutes=policyRoutes_s,
Qid=QID_s,
QuarantineFolder=quarantineFolder_s,
QuarantineRule=quarantineRule_s,
Recipient=recipient_s,
ReplyToAddress=replyToAddress_s,
Sender=sender_s,
SrcIpAddr=senderIP_s,
SpamScore=spamScore_d,
Subject=subject_s,
ThreatsInfoMap=threatsInfoMap_s,
DstUsername=toAddresses_s,
Xmailer=xmailer_s

0 comments on commit fc61584

Please sign in to comment.