KQL Search

Query Details

HomeAI ToolsDevice Query

Anomalies Attempted Computer Bruteforce

Query

Anomalies
| where RuleName endswith "Attempted computer bruteforce" and RuleStatus != "Flighting"
| extend
    Query = ExtendedLinks[0]["DetailBladeInputs"],
    Computer = Entities[0]["HostName"],
    AttemptCount = toint(AnomalyDetails["Observables"][0]["Value"]),
    ExpectedAttemptCount = toint(AnomalyDetails["Observables"][0]["TypicalObservations"]["Expected count"])
| project
    TimeGenerated,
    RuleName,
    Description,
    Query,
    Computer,
    AttemptCount,
    ExpectedAttemptCount,
    Score,
    AnomalyDetails,
    Entities,
    Tactics,
    Techniques,
    ExtendedLinks

Explanation

This query retrieves anomalies where the rule name ends with "Attempted computer bruteforce" and the rule status is not "Flighting". It then extends the query to include additional information such as the query details, computer hostname, attempt count, and expected attempt count. Finally, it projects various fields including the time generated, rule name, description, query, computer, attempt count, expected attempt count, score, anomaly details, entities, tactics, techniques, and extended links.

Details

Jose Sebastián Canós profile picture

Jose Sebastián Canós

Released: December 15, 2022

Tables

Anomalies

Keywords

Anomalies,RuleName,RuleStatus,Query,Computer,AttemptCount,ExpectedAttemptCount,TimeGenerated,Description,Score,AnomalyDetails,Entities,Tactics,Techniques,ExtendedLinks

Operators

whereendswith!=extendtointproject

Actions