KQL Search

Query Details

Anomalies UEBA Anomalous Account Access Removal

Query

Anomalies
| where RuleName endswith "UEBA Anomalous Account Access Removal" and RuleStatus != "Flighting"
| extend
    Query = ExtendedLinks[0]["DetailBladeInputs"]
| project
    TimeGenerated,
    RuleName,
    Description,
    Query,
    UserPrincipalName,
    ActivityInsights,
    DeviceInsights,
    UserInsights,
    Score,
    AnomalyDetails,
    Entities,
    Tactics,
    Techniques,
    ExtendedLinks

Explanation

This query is looking for anomalies that have a specific rule name and are not in the "Flighting" status. It then extends the query to include a specific detail blade input. The results are then projected to include various fields such as time generated, rule name, description, query, user principal name, activity insights, device insights, user insights, score, anomaly details, entities, tactics, techniques, and extended links.

Details

Jose Sebastián Canós profile picture

Jose Sebastián Canós

Released: December 15, 2022

Tables

Anomalies

Keywords

AnomaliesRuleNameRuleStatusQueryTimeGeneratedDescriptionUserPrincipalNameActivityInsightsDeviceInsightsUserInsightsScoreAnomalyDetailsEntitiesTacticsTechniquesExtendedLinks

Operators

whereendswith!=extendproject

Actions

GitHub