Repository navigation

Use of watchlist to create an analytic rule in Sentinel #218

Open

opened

This rule triggers when there is a DNS query for non-local domain.

//This is my log query and watchlist

Not able to figure it out why i am not seeing the domain listed in the watchlist to my table

log_query

watchlist

to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Assignees

No one assigned

Labels

No labels

No labels

Type

No type

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests