Bert-Jan Pals unknown stable kql

ATP Detection events triggered

Displays the AtpDetection events in CloudAppEvents.

View Source

Detection Logic

CloudAppEvents
| where ActionType == "AtpDetection"
| extend
     DetectionMethod = parse_json(RawEventData).DetectionMethod,
     EventDeepLink = parse_json(RawEventData).EventDeepLink,
     FileData = parse_json(RawEventData).FileData
| project-reorder
     TimeGenerated,
     ActionType,
     Application,
     AccountId,
     DetectionMethod,
     FileData,
     EventDeepLink

Field Validations

Loading…

Comments (0)

Loading comments...