Microsoft Sentinel medium experimental kql

Bitglass - User Agent string has changed for user

'Detects when User Agent string has changed for user.'

View Source

Detection Logic

Bitglass
| where EventType =~ 'access'
| where EventMessage =~ 'Login'
| summarize ua = makeset(HttpUserAgent) by User
| join (Bitglass
| where EventType =~ 'access'
| where EventMessage =~ 'Login') on User
| where ua !contains HttpUserAgent
| extend AccountCustomEntity = User

Field Validations

Loading…

Comments (0)

Loading comments...