Microsoft Sentinel medium experimental kql

Abnormal Security - Vendor compromise case detected

'Creates an incident when Abnormal Security opens a vendor case indicating a compromised or impersonated vendor domain (vendor email compromise). Surfaces the vendor domain and Abnormal insights so analysts can review related correspondence.'

View Source

Detection Logic

ABNORMAL_SECURITY_VENDOR_CASE_CL
| where isnotempty(abx_body_abx_body_vendorCaseId_g)
// Collapse to one row per vendor case (earliest event in the window) so repeated
// events for the same case do not raise duplicate alerts.
| summarize arg_min(TimeGenerated, *) by CaseId = abx_body_abx_body_vendorCaseId_g
| extend
    VendorDomain = abx_body_abx_body_vendorDomain_s,
    Insights = abx_body_abx_body_insights_s,
    FirstObserved = abx_body_abx_body_firstObservedTime_t
| project TimeGenerated, VendorDomain, CaseId, Insights, FirstObserved

Field Validations

Loading…

Comments (0)

Loading comments...