Microsoft Sentinel high experimental kql

API - Suspicious Login

'42Crunch API protection against suspicious login'

View Source

Detection Logic

let firstRec = FortyTwoCrunchAPIProtection
| where TimeGenerated >= ago(5m)
| project-away NonBlockingMode, SourcePort, DestinationPort, Query, ApiId, RequestHeader, ResponseHeader, Errors, EventType, Uuid
| where UriPath has "/api/login?user=" and Status in (200, 403);
let ipAddressCount = toscalar(firstRec
| summarize by SourceIp
| count);
let secondRec = firstRec
| summarize arg_max(TimeGenerated, *) by SourceIp;
let recCount = iff((toscalar(secondRec
| count) > 3), ipAddressCount, 0);
secondRec
| take recCount

Field Validations

Loading…

Comments (0)

Loading comments...