Microsoft Sentinel medium experimental kql

Radiflow - New Activity Detected

'Generates an incident when a new asset or MAC is detected either by Radiflow's iSID.'

View Source

Detection Logic

RadiflowEvent
| where DeviceProduct =~ 'iSID'
| where EventClassID in (1, 2, 3, 155)

Field Validations

Loading…

Comments (0)

Loading comments...