Microsoft Sentinel medium experimental kql

OCI - Inbound SSH connection

'Detects inbound SSH connection.'

View Source

Detection Logic

OCILogs
| where EventType contains 'vcn.flowlogs'
| where data_action_s =~ 'ACCEPT'
| where ipv4_is_private(DstIpAddr)
| where ipv4_is_private(SrcIpAddr) == False
| where DstPortNumber == 22
| extend IPCustomEntity = DstIpAddr

Field Validations

Loading…

Comments (0)

Loading comments...