500 alerts are emitted per poll, oldest first. If more alerts are created between polls, the remaining alerts are emitted on the following polls.
Workflows with this trigger check for new events every 5 minutes by default. You can adjust this interval in the Trigger settings.
Parameters
| Parameter | Description |
|---|---|
| CQL Filter | Additional Taegis XDR Query Language (CQL) conditions to filter the alerts by. The conditions are appended to the trigger’s own time filter with AND.For Example: severity >= 0.6 AND status = 'OPEN'Notes: * DO NOT filter on created_at, or use EARLIEST or LATEST. The trigger manages the time range itself, and a conflicting time filter causes alerts to be missed or repeated.* DO NOT add pipe functions such as | sort, | head, | tail or | aggregate. The trigger relies on its own ascending sort and on the standard response structure.* DO NOT include the FROM alert or WHERE clauses, they are added by the trigger.* Use single quotes for string values, as in status = 'OPEN'. |
Sample Event
{
"id": "alert://priv:event-filter:11063:1630580463490:d30a7171-43a9-5d04-82bf-a25cc0948a8c",
"group_key": "",
"tenant_id": "11063",
"parent_tenant_id": "",
"status": "OPEN",
"resolution_reason": "",
"suppressed": false,
"suppression_rules": [
{
"id": "",
"version": ""
}
],
"alerting_rules": [
{
"id": "",
"version": ""
}
],
"tags": [
""
],
"sensor_types": [
"ENDPOINT_CARBON_BLACK"
],
"attack_technique_ids": [
"T1003"
],
"threat_score": 0,
"investigation_ids": [
{
"id": "",
"GenesisAlertsFlag": false
}
],
"entities": {
"entities": [
"computerName:OCTO-FILES"
],
"relationships": [
{
"from_entity": "fileName:rundll32.exe",
"relationship": "executedOn",
"to_entity": "sensorHostId:YLdYO3s3ziBynTlgxrBb"
}
]
},
"metadata": {
"title": "Memory Dump of the Local Security Authority Subsystem Service",
"full_title": "",
"description": "A process event associated with a dump file named after the Local Security Authority Subsystem Service (LSASS) process was identified. This activity may indicate that an adversary is attempting to obtain credentials stored within the memory of this process.\n\nExample:\n>COPY C:\\Users\\>username>\\Appdata\\Local\\Temp\\lsass.dmp C:\\Temp\\lsass.dmp\n\n\n",
"severity": 0.99,
"confidence": 1,
"origin": "",
"engine": {
"name": "app:event-filter",
"version": ""
},
"creator": {
"detector": {
"detector_id": "app:event-filter",
"detector_name": "",
"version": "v0.15.3"
},
"rule": {
"rule_id": "496ad330-7dc2-4009-b431-b792f7095ead",
"version": "sha1=18f594726b99b47b226a37a2e92ae1cff92d3166-1605731996"
}
},
"created_at": {
"seconds": 1630580464,
"nanos": 0
},
"updated_at": {
"seconds": 0,
"nanos": 0
},
"first_seen_at": {
"seconds": 0,
"nanos": 0
},
"began_at": {
"seconds": 0,
"nanos": 0
},
"ended_at": {
"seconds": 0,
"nanos": 0
}
}
}