Microsoft Sentinel medium experimental kql

Jira - Workflow scheme copied

'Detects when workflow scheme was copied.'

View Source

Detection Logic

JiraAudit
| where EventMessage =~ 'Workflow scheme copied'
| extend workflow = todynamic(AssociatedItems)[0]['name']
| project EventCreationTime, ObjectItemName, UserName, SrcIpAddr, workflow
| extend AccountCustomEntity = UserName, IPCustomEntity = SrcIpAddr

Field Validations

Loading…

Comments (0)

Loading comments...