KQL Search

Query Details

HomeAI ToolsDevice Query

Anomalies Potential Data Staging

Query

Anomalies
| where RuleName endswith "Potential data staging" and RuleStatus != "Flighting"
| extend
    Query = ExtendedLinks[0]["DetailBladeInputs"],
    DistinctFileCount = toint(AnomalyDetails["Observables"][0]["Value"]["Number of distinct file downloaded"]),
    FileDownloadCount = toint(AnomalyDetails["Observables"][1]["Value"]["Total events"]),
    DaysSeenPreviousWeek = toint(AnomalyDetails["Observables"][2]["Value"]["Number of days seen in previous week"])
| project
    TimeGenerated,
    RuleName,
    Description,
    Query,
    UserName,
    DistinctFileCount,
    FileDownloadCount,
    DaysSeenPreviousWeek,
    Score,
    AnomalyDetails,
    Entities,
    Tactics,
    Techniques,
    ExtendedLinks

Explanation

This query retrieves anomalies where the rule name ends with "Potential data staging" and the rule status is not "Flighting". It then extends the query to include additional information such as the query details, the number of distinct files downloaded, the total number of file download events, and the number of days seen in the previous week. Finally, it projects specific fields including the time generated, rule name, description, query, username, distinct file count, file download count, days seen in the previous week, score, anomaly details, entities, tactics, techniques, and extended links.

Details

Jose Sebastián Canós profile picture

Jose Sebastián Canós

Released: December 15, 2022

Tables

Anomalies

Keywords

Anomalies,RuleName,RuleStatus,ExtendedLinks,Query,DistinctFileCount,AnomalyDetails,Observables,Value,Numberofdistinctfiledownloaded,FileDownloadCount,Totalevents,DaysSeenPreviousWeek,TimeGenerated,Description,UserName,Score,Entities,Tactics,Techniques

Operators

whereendswith!=extendtointproject

Actions