Microsoft Sentinel medium experimental kql

Ping Federate - OAuth old version

'Detects requests using not the latest version of OAuth protocol.'

View Source

Detection Logic

PingFederateEvent
| where isnotempty(DeviceCustomString3)
| extend proto = extract(@'(OAuth)', 1, DeviceCustomString3)
| extend ver = extract(@'(\d+)', 1, DeviceCustomString3)
| where proto =~ 'OAuth'
| where ver !~ '20'
| extend AccountCustomEntity = DstUserName
| extend IpCustomEntity = SrcIpAddr

Field Validations

Loading…

Comments (0)

Loading comments...