u/dial647

I am trying to update a lookup file based on a query that will return some IP addresses. I am running this on a fusion workflow and able to get the new IP address based on the following query.

| #repo=abc123

| url.domain=/abc.com/i

| table([destination.ip])

| groupBy([destination.ip])

| join({readFile(["lookup.csv"]) | table([destination.ip]) | case {destination.ip=* | existing:=true}}, field=destination.ip, key=destinationIP, mode=left, include=[existing])

| existing != true

| table([destination.ip])

This query returns on new IP address.

How can I update the lookup file with the new IP?

I am calculating response times for EPP and ITP detection through different queries from different datasets.

Query 1 returns = eppcount

Query 2 returns = itpcount

I want to arithmetically add up both

Total = eppcount + itpcount

Please help with the query, functions.

We had a ClickFix incident this morning where the user pasted a command on powershell originated through a pop-up window of a compromised website. We were able to narrow it down to ClickFix but it took a while before we could identify the malicious website the led to this incident. We finally identified the website after searching through the logs.

Is there a faster way by which we can identify or stich the malicious website the led to an incident?

I am trying to add a filter to select only the events that matches the condition.

The field the filter is applied contains strings like the following.

tags = ["falcon_complete", "FC-Threat-Other Benign Activity", "false_positive", "FC-Action-No Action Taken", "FC-Type-NonMalicious"]

However the strings in this field is not fixed.

I was able to filter events where this field contained a specific string with the following query.

tags =/"FC-Action-No Action Taken"/i

How do I filter events that does not contain "FC-Action-No Action Taken"

tags !=/"FC-Action-No Action Taken"/i does not work.