Microsoft Sentinel high experimental kql

Unauthenticated API Endpoint with Sensitive Data

Detects internet-facing API endpoints with no authentication that handle sensitive data classifications (PII, Financial, PHI, Confidential). Uses StratoSecure_ApiInventory_CL from Phase 6 API inventory discovery.

View Source

Detection Logic

let sensitiveDataClasses = dynamic(["PII", "Financial", "PHI", "Confidential"]);
StratoSecure_ApiInventory_CL
| where TimeGenerated >= ago(6h)
| where InternetExposure == true
| where AuthType =~ "none" or isempty(AuthType)
| where DataClassification has_any (sensitiveDataClasses)
| summarize EndpointCount = count(), Endpoints = make_set(Path, 50),
        Methods = make_set(Method), DataClasses = make_set(DataClassification),
        EndTime = max(TimeGenerated)
        by ApplicationId = ServiceName, StraTenantId
| project TimeGenerated = EndTime, ApplicationId, StraTenantId,
        EndpointCount, Endpoints, Methods, DataClasses

Field Validations

Loading…

Comments (0)

Loading comments...