Microsoft Sentinel medium experimental kql

XbowNewAssetDiscovered

Alerts when a new asset is registered in XBOW for the first time. This is detected by matching assets whose CreatedAt timestamp falls within the current query window, indicating the asset was newly added rather than updated. This helps track shadow IT, new deployments, and any unexpected expansion of the external attack surface.

View Source

Detection Logic

XbowAssets_CL
| where TimeGenerated > ago(1h)
// Only match assets created within the query window (new, not updated)
| where todatetime(CreatedAt) > ago(1h)
| summarize arg_max(TimeGenerated, *) by AssetId
| project
    TimeGenerated,
    AssetId,
    AssetName,
    StartUrl,
    Lifecycle,
    Sku,
    OrganizationId,
    CreatedAt,
    UpdatedAt,
    AssetReachableState,
    AssetReachableMessage

Field Validations

Loading…

Comments (0)

Loading comments...