Anomalies UEBA Anomalous Defensive Mechanism Modification
Query
Anomalies
| where RuleName endswith "UEBA Anomalous Defensive Mechanism Modification" and RuleStatus != "Flighting"
| extend
Query = ExtendedLinks[0]["DetailBladeInputs"]
| project
TimeGenerated,
RuleName,
Description,
Query,
UserPrincipalName,
ActivityInsights,
DeviceInsights,
UserInsights,
Score,
AnomalyDetails,
Entities,
Tactics,
Techniques,
ExtendedLinksExplanation
This query retrieves anomalies that have a specific rule name and are not in the "Flighting" status. It extends the "Query" field from the first element of the "ExtendedLinks" array. The query then projects several fields including time generated, rule name, description, query, user principal name, activity insights, device insights, user insights, score, anomaly details, entities, tactics, techniques, and extended links.
Details
Jose Sebastián Canós
Released: December 15, 2022
Tables
Anomalies
Keywords
AnomaliesRuleNameRuleStatusQueryTimeGeneratedDescriptionUserPrincipalNameActivityInsightsDeviceInsightsUserInsightsScoreAnomalyDetailsEntitiesTacticsTechniquesExtendedLinks
Operators
whereendswith!=extendproject