Microsoft Sentinel medium experimental kql

SlackAudit - User email linked to account changed.

'Detects when user email linked to account changes.'

View Source

Detection Logic

SlackAudit
| where TimeGenerated between (ago(14d) .. (1d))
| summarize max(TimeGenerated) by SrcUserName, SrcUserEmail
| join (SlackAudit
| where Action =~ 'user_login'
| project SrcIpAddr, SrcUserName, NewUserEmail = SrcUserEmail) on SrcUserName
| where NewUserEmail != SrcUserEmail
| extend AccountCustomEntity = SrcUserName
| extend IPCustomEntity = SrcIpAddr

Field Validations

Loading…

Comments (0)

Loading comments...