Microsoft Sentinel high experimental kql

OCI - SSH scanner

'Detects possible SSH scanning activity.'

View Source

Detection Logic

let threshold = 5;
OCILogs
| where EventType contains 'vcn.flowlogs'
| where data_action_s =~ 'REJECT'
| where ipv4_is_private(DstIpAddr)
| where ipv4_is_private(SrcIpAddr) == False
| where DstPortNumber == 22
| summarize p_count = dcount(DstIpAddr) by SrcIpAddr, bin(TimeGenerated, 5m)
| where p_count > threshold
| extend IPCustomEntity = SrcIpAddr

Field Validations

Loading…

Comments (0)

Loading comments...