Bert-Jan Pals unknown stable kql

Hunt for anomalies in Sentinel

The anomalies table contains anomalies generated by the active Anomaly analytics rules in Azure Sentinel. Those anomalies do not trigger a incident by default (at the moment of writing). This query lists the anomalies and the reaons why they are anomalies.

View Source

Detection Logic

let TimeFrame = 7d;
Anomalies
| where TimeGenerated > ago(TimeFrame)
| extend DetailedResultsKQL = ExtendedLinks[0].DetailBladeInputs
| project-reorder TimeGenerated, Description, UserPrincipalName, RuleName, Tactics, DetailedResultsKQL, Entities

Field Validations

Loading…

Comments (0)

Loading comments...