Microsoft Sentinel medium experimental kql

Snowflake - Possible data destraction

'Detects possible data destruction.'

View Source

Detection Logic

let threshold = 10;
Snowflake
| where QueryType =~ 'DROP'
| where QueryExecutionStatus =~ 'SUCCESS'
| summarize count() by TargetUsername, bin(TimeGenerated, 5m)
| where count_ > threshold
| extend AccountCustomEntity = TargetUsername

Field Validations

Loading…

Comments (0)

Loading comments...