Microsoft Sentinel low experimental kql

API - Invalid host access

'42Crunch API protection against invalid host access'

View Source

Detection Logic

FortyTwoCrunchAPIProtection
| where TimeGenerated >= ago(5m)
| where ErrorMessage has "hostpath_mapping"
| project-away NonBlockingMode, SourcePort, DestinationPort, Query, ApiId, ResponseHeader, RequestHeader, Errors, EventType, Uuid
| sort by TimeGenerated desc

Field Validations

Loading…

Comments (0)

Loading comments...