Bert-Jan Pals unknown stable kql

Defense Evasion Alerts Generated by Defender For Endpoint

This query lists the Defense Evasion Alerts Generated by Defender For Endpoint.

View Source

Detection Logic

CloudAppEvents
| where ActionType == 'DefenseEvasion'
| extend
     AlertUri = parse_json(RawEventData).AlertUri,
     AlertDisplayName = parse_json(RawEventData).AlertDisplayName,
     AlertSeverity = parse_json(RawEventData).AlertSeverity
| project AlertUri, AlertDisplayName, AlertSeverity

Field Validations

Loading…

Comments (0)

Loading comments...