Error when using Advanced Hunting

Question

Error when using Advanced Hunting

Anonymous

Hello,

I have a customer that is getting the error below when using advanced hunting and is unable to search 'EmailEvents' and would like some insight on it?

Issue:

When using the Advanced Hunting option, the object 'EmailEvents' returns:

"Syntax error Error message The incomplete fragment is unexpected"

1 answer

Your answer

Answer 1

James Hamil 27,211 Microsoft Employee Moderator

Hi @DG001 , this typically indicates that there is a syntax error in the query that is being used to search for EmailEvents in Advanced Hunting. Do you have the exact query used?

To resolve this issue, you can try the following steps:

Check the query syntax: Make sure that the query being used to search for EmailEvents is correct and follows the correct syntax. You can refer to the Microsoft documentation for Advanced Hunting query syntax to ensure that the query is correct.
Check the query for incomplete fragments: The error message indicates that there is an incomplete fragment in the query. Check the query to see if there are any incomplete fragments, such as missing parentheses or quotation marks. Make sure that all fragments in the query are complete and properly formatted.
Check the permissions: Ensure that the user has the necessary permissions to search for EmailEvents in Advanced Hunting. The user must have the necessary permissions to access the EmailEvents table in order to search for EmailEvents.

Please let me know if you have any questions and I can help you further.

If this answer helps you please mark "Accept Answer" so other users can reference it.

Thank you,

James

Anonymous

2024-04-26T00:07:51.04+00:00

Query:

// Author: (DISA HaC IRT)

// Description: Sourced from Syslog, this analytic is triggered when a restricted/banned UDP DestinationPort is allowed through the Palo Alto Firewalls.

// References: DOD INSTRUCTION 8551.01 - PORTS, PROTOCOLS, AND SERVICES MANAGEMENT

// False Positives: None known

//

HaC_IRT_Palo_Alto_TRAFFIC

| where tostring(SyslogMessage) has_any ("dpt=7", "dpt=9", "dpt=11", "dpt=13", "dpt=19", "dpt=23", "dpt=38", "dpt=49", "dpt=80", "dpt=115", "dpt=194", "dpt=258", "dpt=407", "dpt=530", "dpt=533", "dpt=1575", "dpt=1604", "dpt=3544", "dpt=4788", "dpt=6665", "dpt=6666", "dpt=6667", "dpt=6668", "dpt=6669", "dpt=10514")

// Match only Protocol=udp and action=allow and Bytes_out!=0

| where tostring(SyslogMessage) has "proto=udp"

    and tostring(SyslogMessage) has "act=allow"

    and tostring(SyslogMessage) has "reason="

    and tostring(SyslogMessage) has "out="

    and tostring(SyslogMessage) !has " out=0 "

// Exclude loopbacks and Private IP Address

| where tostring(SyslogMessage) !has "src=127.0.0.1"

    and tostring(SyslogMessage) !has "src=::1"

    and tostring(SyslogMessage) !has "src=10."

    and tostring(SyslogMessage) !has "src=fe80:"

| project

    EventTime,

    dvchost,

    SourceIP,

    sourceTranslatedAddress,

    destinationTranslatedAddress,

    DestinationIP,

    Source_Zone,

    Destination_Zone,

    protocol,

    DestinationPort,

    app,

    Rule,

    action,

    Bytes_in,

    Bytes_out,

    reason
Deleted

This comment has been deleted due to a violation of our Code of Conduct. The comment was manually reported or identified through automated detection before action was taken. Please refer to our Code of Conduct for more information.

Share via

Error when using Advanced Hunting

1 answer

Your answer