Microsoft Sentinel high experimental kql

OCI - Insecure metadata endpoint

'Detects insecure metadata endpoint.'

View Source

Detection Logic

OCILogs
| where data_request_headers_oci_original_url_s contains '/opc/v1' or data_request_headers_oci_original_url_s contains '/openstack'
| where HttpStatusCode == 200
| extend IPCustomEntity = DstIpAddr

Field Validations

Loading…

Comments (0)

Loading comments...