Microsoft Sentinel high experimental kql

Radiflow - Network Scanning Detected

'Generates an incident when a network scan is detected either by Radiflow's iSID.'

View Source

Detection Logic

RadiflowEvent
| where DeviceProduct =~ 'iSID'
| where
    (
        EventClassID in (52, 105, 150, 151, 152, 153, 158, 166, 175)
        or EventMessage has 'Scan'
    )

Field Validations

Loading…

Comments (0)

Loading comments...