KQL Search

Query Details

Anomalies Anomalous Azure Operations

Query

Anomalies
| where RuleName endswith "Anomalous Azure operations" and RuleStatus != "Flighting"
| extend
    Query = ExtendedLinks[0]["DetailBladeInputs"],
    AnomalousOperations = AnomalyReasons[0]["Value"]
| project
    TimeGenerated,
    RuleName,
    Description,
    Query,
    UserName,
    AnomalousOperations,
    Score,
    AnomalyDetails,
    Entities,
    Tactics,
    Techniques,
    ExtendedLinks

Explanation

This query retrieves anomalies where the rule name ends with "Anomalous Azure operations" and the rule status is not "Flighting". It then extends the query with additional information such as the query details and the reason for the anomaly. Finally, it projects various fields including the time generated, rule name, description, query, username, anomalous operations, score, anomaly details, entities, tactics, techniques, and extended links.

Details

Jose Sebastián Canós profile picture

Jose Sebastián Canós

Released: December 15, 2022

Tables

Anomalies

Keywords

AnomaliesRuleNameRuleStatusQueryAnomalousOperationsTimeGeneratedDescriptionUserNameScoreAnomalyDetailsEntitiesTacticsTechniquesExtendedLinks

Operators

whereendswith!=extend[0]["DetailBladeInputs"]AnomalyReasons["Value"]project

Actions

GitHub