Bert-Jan Pals unknown stable kql

SignIn From Suspicious IP

This query combines threat intelligence feeds with Entra ID sign-in information.

View Source

Detection Logic

let IPs = ThreatIntelligenceIndicator
| where isnotempty( NetworkSourceIP)
| where ConfidenceScore > 70
| distinct NetworkSourceIP;
AADSignInEventsBeta
| where IPAddress in (IPs)
| project TimeGenerated, AccountUpn, IPAddress, Country

Field Validations

Loading…

Comments (0)

Loading comments...