Inspected LDAP / Kerberos / DCE/RCP Traffic

# --- Query Metadata ---
# Human-readable name for the query. Will be displayed as the title.
name: Inspected LDAP / Kerberos / DCE/RCP Traffic

# Description of what the query does and its purpose.
description: Shows inspected traffic requests over time on the selected domain controller

# The author or team that created the query.
author: CrowdStrike

# The required log sources to run this query successfully in Next-Gen SIEM.
# This will be displayed in the UI to inform the user.
log_sources:
  - Identity

# The CrowdStrike modules required to run this query.
cs_required_modules:
  - Identity

# Tags for filtering and categorization.
# Include relevant techniques, tactics, or platforms.
tags:
  - Monitoring

# --- Query Content ---
# The actual CrowdStrike Query Language (CQL) code.
# Using the YAML block scalar `|` allows for multi-line strings.
cql: |
  #repo=base_sensor #event_simpleName=/^ActiveDirectory(?:(?!Audit|Account).)*$/i
  | aid=?SelectedAid
  | case {
    ActiveDirectoryDataProtocol=0 | Protocol:="LDAP";
    ActiveDirectoryDataProtocol=1 | Protocol:="DCE/RPC";
    ActiveDirectoryDataProtocol=2 | Protocol:="SMB";
    ActiveDirectoryAuthenticationMethod=/[1,2,5]/F | Protocol:="NTLM";
    ActiveDirectoryAuthenticationMethod=0 | Protocol:="Kerberos";
  }
  | timeChart(span=15m, series=Protocol, function=sum("AggregationActivityCount"))