Microsoft Sentinel low experimental kql

API - Anomaly Detection

'42Crunch API protection anomaly detection'

View Source

Detection Logic

let infoRec = FortyTwoCrunchAPIProtection
| where TimeGenerated >= ago(5m)
| project-away NonBlockingMode, SourcePort, DestinationPort, Query, ApiId, RequestHeader, ResponseHeader, Errors, EventType, Uuid
| where UriPath has "/api/users/info" and Status == 200;
let timestamp = toscalar(infoRec
| top 1 by Timestamp desc
| summarize by Timestamp);
let activityRec = FortyTwoCrunchAPIProtection
| where Timestamp < timestamp and TimeGenerated >= ago(5m)
| project-away NonBlockingMode, SourcePort, DestinationPort, Query, ApiId, RequestHeader, ResponseHeader, Errors, EventType, Uuid
| where UriPath has "/api/users/activity" and Status == 200;
activityRec

Field Validations

Loading…

Comments (0)

Loading comments...