Microsoft Sentinel medium experimental kql

Zscaler - ZPA connections outside operational hours

'Detects ZAP connections outside operational hours.'

View Source

Detection Logic

ZPAEvent
| where DvcAction == 'open'
| where datetime_part("Hour", todatetime(LogTimestamp)) between (datetime_part("Hour", todatetime('19:01:00.7654321')) .. datetime_part("Hour", todatetime('08:01:00.7654321')))
| summarize count() by DstUserName
| project DstUserName
| extend AccountCustomEntity = DstUserName

Field Validations

Loading…

Comments (0)

Loading comments...