KQL Search

Query Details

HomeAI ToolsDevice Query

Anomalies Suspicious Volume Of Logins To Computer

Query

Anomalies
| where RuleName endswith "Suspicious volume of logins to computer" and RuleStatus != "Flighting"
| extend
    Query = ExtendedLinks[0]["DetailBladeInputs"],
    Computer = Entities[0]["HostName"],
    LoginCount = toint(AnomalyDetails["Observables"][0]["Value"]),
    ExpectedLoginCount = toint(AnomalyDetails["Observables"][0]["TypicalObservations"]["Expected count"])
| project
    TimeGenerated,
    RuleName,
    Description,
    Query,
    Computer,
    LoginCount,
    ExpectedLoginCount,
    Score,
    AnomalyDetails,
    Entities,
    Tactics,
    Techniques,
    ExtendedLinks

Explanation

This query is looking for anomalies where the rule name ends with "Suspicious volume of logins to computer" and the rule status is not "Flighting". It then extends the query to include additional information such as the query details, computer hostname, login count, and expected login count. Finally, it projects various fields including time generated, rule name, description, query, computer, login count, expected login count, score, anomaly details, entities, tactics, techniques, and extended links.

Details

Jose Sebastián Canós profile picture

Jose Sebastián Canós

Released: December 15, 2022

Tables

Anomalies

Keywords

Anomalies,RuleName,RuleStatus,Flighting,Query,ExtendedLinks,Computer,Entities,HostName,LoginCount,AnomalyDetails,Observables,Value,TypicalObservations,Expectedcount,TimeGenerated,Description,Score,Tactics,Techniques

Operators

whereendswith!=extendtointproject

Actions