Baseline Comparison

Baseline Comparison. Author: miflower. The purpose of this query is to perform a comparison between "known good" machines and suspected bad machines. The original concept for this query was born due to reapplying the same 'whitelist' filters over and over. It brings deltas between a baseline and another machine quickly to the analyst's view. This query supports multiple suspected bad machines and multiple "known good" machines. It also supports providing a timeframe for how far back in time to build a baseline as well as how far back in time to evaluate the suspected bad machines. Each of the links provided by DeviceId/DeviceName will go to the most recent entry for whatever entity is listed. Average results for the pre-defined settings below with a single good host and a single bad host on a 'huge' tenant (300k+ machines):. Compute Time: ~10-20 seconds. Result Set Size: ~500 rows. The workflow is as follows:. 1. Establish Variables that are editable on a per-query basis. 2. Define functions for reuse. 3. Calculate DeviceIds for all machines in scope. 4. Derive deltas using the aforementioned functions. 5. Union together all results into a single view. The following datasets are returned:. 1. Alerts on the suspected bad machines (ignores known good machines, because...they're alerts, additional data has the triggered file). 2. Connected Networks (from DeviceNetworkInfo table, additional data has full Connected Network details). 3. File Creations (disabled by default due to volume, enable at your own risk, additional data has initiating processes). 4. Image Loads (disabled by default due to volume, enable at your own risk, additional data has initiating processes). 5. Logon (derived from DeviceLogonEvents for the unique users logged on, additional data has logon types). 6. Network communication (grouped by 2nd level-domain, ie 'microsoft.com' in 'www.microsoft.com' and 'web.microsoft.com', additional data has the full list of URLs). 7. Process creation (additional da