KQL Search

Query Details

HomeAI ToolsDevice Query

Anomalies UEBA Anomalous Defensive Mechanism Modification

Query

Anomalies
| where RuleName endswith "UEBA Anomalous Defensive Mechanism Modification" and RuleStatus != "Flighting"
| extend
    Query = ExtendedLinks[0]["DetailBladeInputs"]
| project
    TimeGenerated,
    RuleName,
    Description,
    Query,
    UserPrincipalName,
    ActivityInsights,
    DeviceInsights,
    UserInsights,
    Score,
    AnomalyDetails,
    Entities,
    Tactics,
    Techniques,
    ExtendedLinks

Explanation

This query retrieves anomalies that have a specific rule name and are not in the "Flighting" status. It extends the "Query" field from the first element of the "ExtendedLinks" array. The query then projects several fields including time generated, rule name, description, query, user principal name, activity insights, device insights, user insights, score, anomaly details, entities, tactics, techniques, and extended links.

Details

Jose Sebastián Canós profile picture

Jose Sebastián Canós

Released: December 15, 2022

Tables

Anomalies

Keywords

Anomalies,RuleName,RuleStatus,Query,TimeGenerated,Description,UserPrincipalName,ActivityInsights,DeviceInsights,UserInsights,Score,AnomalyDetails,Entities,Tactics,Techniques,ExtendedLinks

Operators

whereendswith!=extendproject

Actions