Microsoft Sentinel medium experimental kql

Box - New external user

'Detects when new user created with SourceLogin containing non-corporate domain.'

View Source

Detection Logic

BoxEvents
| where EventType =~ 'NEW_USER'
| extend corp_domain = extract(@'@(.*)', 1, SourceLogin)
| extend new_domain = tolower(extract(@'@(.*)', 1, SourceLogin))
| where corp_domain != new_domain
| extend AccountCustomEntity = SourceLogin
| extend IPCustomEntity = SrcIpAddr

Field Validations

Loading…

Comments (0)

Loading comments...