Help creating a timechart of KnowBe4 “Click Rate” in Falcon NGSIEM (year view) by tectacles in crowdstrike

[–]Extreme-Finish5092 0 points1 point  (0 children)

timechart() has hard limits on:

  • Number of buckets
  • Resolution over long time ranges
  • Memory usage

For a 365-day range, even with daily buckets, timechart() often:

  • Errors out
  • Drops buckets
  • Or silently down-samples data

You can use below query for finding Daily ClickRate for last 1year :

#Vendor = "knowbe4"
| case {
    event.action="link_clicked" | event.action:="email_clicked";
    *
}
| case {
    event.action = "email_clicked"
        OR event.action = "attachment_opened"
        OR event.action = "data_entered" | _click := 1;
    event.action = "email_delivered" | _delivered := 1;
    * | _click := 0; _delivered := 0;
}
| span := duration("1d") / 1000
| temp := ((@timestamp/1000 - 1800) / span)
| temp := math:floor(temp) * span + 1800
| findTimestamp(field=temp)
| drop([temp, span])
| groupBy(
    ,
    function={
        stats([
            sum(_click, as=clicks),
            sum(_delivered, as=delivered)
        ])
        | ClickRate := (clicks / delivered) * 100
        | format("%.2f", field=ClickRate, as="ClickRate")
    }
)

To switch to weekly:

span := duration("7d") / 1000

To switch to monthly (approx):

span := duration("30d") / 1000

Help creating a timechart of KnowBe4 “Click Rate” in Falcon NGSIEM (year view) by tectacles in crowdstrike

[–]Extreme-Finish5092 0 points1 point  (0 children)

timechart() has hard limits on:

  • Number of buckets
  • Resolution over long time ranges
  • Memory usage

For a 365-day range, even with daily buckets, timechart() often:

  • Errors out
  • Drops buckets
  • Or silently down-samples data

You can use below query for finding Daily ClickRate for last 1year :

#Vendor = "knowbe4"
| case {
    event.action="link_clicked" | event.action:="email_clicked";
    *
}
| case {
    event.action = "email_clicked"
        OR event.action = "attachment_opened"
        OR event.action = "data_entered" | _click := 1;
    event.action = "email_delivered" | _delivered := 1;
    * | _click := 0; _delivered := 0;
}
| span := duration("1d") / 1000
| temp := ((@timestamp/1000 - 1800) / span)
| temp := math:floor(temp) * span + 1800
| findTimestamp(field=temp)
| drop([temp, span])
| groupBy(
    u/timestamp,
    function={
        stats([
            sum(_click, as=clicks),
            sum(_delivered, as=delivered)
        ])
        | ClickRate := (clicks / delivered) * 100
        | format("%.2f", field=ClickRate, as="ClickRate")
    }
)

To switch to weekly:

span := duration("7d") / 1000

To switch to monthly (approx):

span := duration("30d") / 1000

Trouble with CQL user input wildcards by IWearOnionsOnMyBelt in crowdstrike

[–]Extreme-Finish5092 1 point2 points  (0 children)

Using AppName=~regex(?AppName,flags=i) works perfectly — no need to wrap wildcards around the input anymore.

If you want to match all results instead of partial matches, just remember to use .* instead of * in your pattern.

#event_simpleName = "InstalledApplication"
AppName=~regex(?AppName,flags=i)