Microsoft Sentinel low experimental kql

SlackAudit - Empty User Agent

'This query shows connections to the Slack Workspace with empty User Agent.'

View Source

Detection Logic

SlackAudit
| where isempty(UserAgentOriginal)
| extend AccountCustomEntity = SrcUserName
| project TimeGenerated, AccountCustomEntity, SrcUserName, UserAgentOriginal

Field Validations

Loading…

Comments (0)

Loading comments...