[Feature] Add Lookback time to Modules

[NobleWolf]

Is your feature request related to a problem? Please describe.
The problem is that Analysts do not know the amount of time included in a data lookup. So, unless they check the STAT docs they do not know how much time (5 hours or 30 days) this enrichment includes data for. In our home-built integrations we include the lookback time at the bottom of every enrichment.

Describe the solution you'd like
It would be useful to have modules that do a data lookup to include a final line noting how far back the lookup went.

In this screenshot the last line should be something like "*Lookup includes most recent 5 days."

Describe alternatives you've considered
None.

Additional context
None

[briandelmsft]

@NobleWolf thanks for the feedback. I think this makes a lot of sense for the majority of modules.

I don't think I'd want to do it for the KQL module as you have an option already to include a custom query description, and since the LookbackInDays could be influenced by filters in the KQL query I wouldn't want to just take the lookback in days and put that in the enrichment. Do you agree?

I also don't think there's anything to add for Modules like Watchlist and TI where we are always checking all the relevant data so the lookback period isn't really relevant.

[NobleWolf]

Yes that makes perfect sense. I forgot about those custom modules.

…

On Fri, Jan 3, 2025, 3:39 PM Brian Delaney ***@***.***> wrote: @NobleWolf <https://github.com/NobleWolf> thanks for the feedback. I think this makes a lot of sense for the majority of modules. I don't think I'd want to do it for the KQL module as you have an option already to include a custom query description, and since the LookbackInDays could be influenced by filters in the KQL query I wouldn't want to just take the lookback in days and put that in the enrichment. Do you agree? I also don't think there's anything to add for Modules like Watchlist and TI where we are always checking all the relevant data so the lookback period isn't really relevant. — Reply to this email directly, view it on GitHub <#479 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/ABGNMGCPKZKI3DJFQ7OL3SD2I37RNAVCNFSM6AAAAABUSJQ53OVHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMZDKNRZHA2TCMBWGY> . You are receiving this because you were mentioned.Message ID: ***@***.***>

[briandelmsft]

@NobleWolf if you upgrade to v2.1 using https://github.com/briandelmsft/SentinelAutomationModules/wiki/Updating this is in it. Only the function app part is required to get this, but other parts of v2.1 need permissions and connector upgrade which is documented in the link above