Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · Logic Apps · 📊
Surfaces hosts that contacted a HoneyLabs indicator backed by heavy evidence (Confidence 80 or above, meaning ten or more observed attacks) where that IP has not been seen in your logs in the preceding 14 days. First contact with a well-evidenced attacker is a stronger hunting lead than repeat background noise.
| Attribute | Value |
|---|---|
| Type | Hunting Query |
| Solution | HoneyLabs |
| ID | 9f1c2a44-7d18-4f5b-9c33-2a6e5b8d1c07 |
| Tactics | InitialAccess |
| Techniques | T1190 |
| Required Connectors | ThreatIntelligenceTaxii |
| Source | View on GitHub |
This content item queries data from the following tables:
| Table | Transformations | Ingestion API | Lake-Only |
|---|---|---|---|
CommonSecurityLog |
✓ | ✓ | ✓ |
ThreatIntelIndicators |
✓ | ✓ | ✗ |
Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · Logic Apps · 📊