KQL Search

Query Details

Anomalies Attempted Computer Bruteforce

Query

Anomalies
| where RuleName endswith "Attempted computer bruteforce" and RuleStatus != "Flighting"
| extend
    Query = ExtendedLinks[0]["DetailBladeInputs"],
    Computer = Entities[0]["HostName"],
    AttemptCount = toint(AnomalyDetails["Observables"][0]["Value"]),
    ExpectedAttemptCount = toint(AnomalyDetails["Observables"][0]["TypicalObservations"]["Expected count"])
| project
    TimeGenerated,
    RuleName,
    Description,
    Query,
    Computer,
    AttemptCount,
    ExpectedAttemptCount,
    Score,
    AnomalyDetails,
    Entities,
    Tactics,
    Techniques,
    ExtendedLinks

Explanation

This query retrieves anomalies where the rule name ends with "Attempted computer bruteforce" and the rule status is not "Flighting". It then extends the query to include additional information such as the query details, computer hostname, attempt count, and expected attempt count. Finally, it projects various fields including the time generated, rule name, description, query, computer, attempt count, expected attempt count, score, anomaly details, entities, tactics, techniques, and extended links.