Microsoft Sentinel medium experimental kql

Snowflake - Unusual query

'Detects unusual query.'

View Source

Detection Logic

Snowflake
| where QueryType =~ '
SELECT'
| where QueryExecutionStatus =~ 'SUCCESS'
| where QueryText startswith @'
SELECT *'
| extend AccountCustomEntity = TargetUsername

Field Validations

Loading…

Comments (0)

Loading comments...