I am crafting a query that will return active ddos attacks. The schema makes it seem like I should query GetdosdAttackAnalyticsGroups for items that do not have an endDatetime. I have been unable to find a way to do that in a filter.
I triggered an event and it looks like it has an endDatetime of “1970-01-01T00:00:00Z” like this:
{
“attackId”: “xxxxx-xxyyxxyyxyxyxyxyxyxy”,
“attackType”: “TCP SYN Flood”,
“bits”: 70944000,
“destinationIp”: “###.###.###.###”,
“endDatetime”: “1970-01-01T00:00:00Z”,
“mitigationReason”: “Block”,
“mitigationScope”: “Local”,
“mitigationType”: “Block”,
“packets”: 221700,
“startDatetime”: “2022-06-20T19:11:04Z”
}
Is filtering for endDatetme that is equal to “1970-01-01T00:00:00Z” the correct way to do this?