diff --git a/msticpy/data/queries/m365d/kql_m365_hunting.yaml b/msticpy/data/queries/m365d/kql_m365_hunting.yaml index 69dfb3f36..54e27c7c3 100644 --- a/msticpy/data/queries/m365d/kql_m365_hunting.yaml +++ b/msticpy/data/queries/m365d/kql_m365_hunting.yaml @@ -8,12 +8,6 @@ defaults: metadata: data_source: 'hunting_queries' parameters: - start: - description: Query start time - type: datetime - end: - description: Query end time - type: datetime add_query_items: description: Additional query clauses type: str @@ -413,7 +407,7 @@ sources: makeset(Command), count(), min({time_column}) by AccountName, DeviceName, DeviceId | order by AccountName asc - | where min_Timestamp > ago(1d) + | where min_{time_column} > ago(1d) {add_query_items}' uri: "https://github.com/microsoft/WindowsDefenderATP-Hunting-Queries/blob/master/Lateral%20Movement/ServiceAccountsPerformingRemotePS.txt" accessibility_persistence: diff --git a/msticpy/data/queries/mde/kql_mdatp_hunting.yaml b/msticpy/data/queries/mde/kql_mdatp_hunting.yaml index 0e785ef8d..46f3fc04b 100644 --- a/msticpy/data/queries/mde/kql_mdatp_hunting.yaml +++ b/msticpy/data/queries/mde/kql_mdatp_hunting.yaml @@ -8,12 +8,6 @@ defaults: metadata: data_source: 'hunting_queries' parameters: - start: - description: Query start time - type: datetime - end: - description: Query end time - type: datetime add_query_items: description: Additional query clauses type: str