Microsoft Sentinel medium experimental kql

Flare leaked credentials results

'This query searches for leaked credential events.'

View Source

Detection Logic

FireworkV2_CL
| where notempty(uid) and RiskScore >= 3
| extend index_name = split(uid, "/")[0]
| where index_name == "leaked_credential"

Field Validations

Loading…

Comments (0)

Loading comments...