Microsoft Sentinel low experimental kql

SlackAudit - Unknown User Agent

'Detects Slack workspace activity from unknown user agents by comparing recent UserAgentOriginal values against a 14d baseline of known user agents.'

View Source

Detection Logic

let lbperiod = 14d;
let known_UAs = SlackAudit
| where TimeGenerated > ago(lbperiod)
| where isnotempty(UserAgentOriginal)
| summarize makeset(UserAgentOriginal);
SlackAudit
| where UserAgentOriginal !in (known_UAs)
| extend AccountCustomEntity = SrcUserName

Field Validations

Loading…

Comments (0)

Loading comments...