surveilr_osquery_ms_create_behaviour()

Create a behaviour configuration using either a notebook name or a JSON or both for surveilr osquery-ms

Introduced in version 1.7.5.

Parameters

behavior_name

The name to give the behavior

notebook_name

The name of the notebook to use from the code_notebook_cell table

json

The JSON configuration to create.

surveilr_anonymize_date surveilr_anonymize_email surveilr_anonymize_name surveilr_assert_tabular_column surveilr_assert_tabular_object surveilr_device_id surveilr_ensure_extension surveilr_ensure_function surveilr_ensure_orchestration_nature surveilr_extension_docs surveilr_function_docs surveilr_generalize_age surveilr_get_orchestration_session_info surveilr_hash surveilr_ingest_session_id surveilr_mask surveilr_mask_address surveilr_mask_dob surveilr_mask_financial surveilr_mask_phone surveilr_notebook_cell_exec surveilr_orchestration_context_session_id surveilr_orchestration_nature_id surveilr_orchestration_session_append_exec surveilr_orchestration_session_append_log surveilr_osquery_ms_create_behaviour surveilr_osquery_ms_retrieve_behavior_id surveilr_osquery_ms_update_behavior surveilr_udi_dal_dropbox surveilr_udi_dal_fs surveilr_udi_dal_gdrive surveilr_udi_dal_postgresql surveilr_udi_dal_s3 surveilr_version