Microsoft Sentinel medium experimental kql

Flare lookalike domain results

'This query searches for lookalike domains and SSL certificate registrations.'

View Source

Detection Logic

FireworkV2_CL
| where notempty(uid) and RiskScore >= 3
| extend index_name = split(uid, "/")[0]
| where index_name == "domain"

Field Validations

Loading…

Comments (0)

Loading comments...