Microsoft Sentinel medium experimental kql

Snowflake - Possible discovery activity

'Detects possible discovery activity.'

View Source

Detection Logic

let threshold = 20;
Snowflake
| where QueryType =~ 'SHOW'
| where QueryExecutionStatus =~ 'SUCCESS'
| summarize count() by TargetUsername, bin(TimeGenerated, 5m)
| where count_ > threshold
| extend AccountCustomEntity = TargetUsername

Field Validations

Loading…

Comments (0)

Loading comments...