Microsoft Sentinel medium experimental kql

OCI - Discovery activity

'Detects possible discovery activity.'

View Source

Detection Logic

let threshold = 20;
OCILogs
| where data_eventName_s startswith 'List' or data_eventName_s startswith 'Get'
| summarize count() by data_definedTags_Oracle_Tags_CreatedBy_s, bin(TimeGenerated, 10m)
| where count_ > threshold
| extend AccountCustomEntity = data_definedTags_Oracle_Tags_CreatedBy_s

Field Validations

Loading…

Comments (0)

Loading comments...