Microsoft Sentinel high experimental kql

Claroty - Asset Down

'Triggers asset is down.'

View Source

Detection Logic

ClarotyEvent
| where EventOriginalType has 'Asset Down' or EventType has 'Asset Down'
| project TimeGenerated, DstIpAddr
| extend IPCustomEntity = DstIpAddr

Field Validations

Loading…

Comments (0)

Loading comments...