Microsoft Sentinel high experimental kql

Bitglass - Multiple failed logins

'Detects multiple failed logins.'

View Source

Detection Logic

let threshold = 10;
Bitglass
| where EventType =~ 'access'
| where EventResultDetails =~ 'Failed login attempt.'
| summarize count() by User, bin(TimeGenerated, 10m)
| where count_ >= threshold
| extend AccountCustomEntity = User

Field Validations

Loading…

Comments (0)

Loading comments...