KQL Search

Query Details

Anomalies Suspicious Volume Of AWS Cloud Trail Logs Events Of Group User Account By Event Type Name

Query

Anomalies
| where RuleName endswith "Suspicious volume of AWS cloud trail logs events of group user account by EventTypeName" and RuleStatus != "Flighting"
| extend
    Query = ExtendedLinks[0]["DetailBladeInputs"],
    EventType = tostring(AnomalyDetails["Observables"][1]["Value"]),
    EventCount = toint(AnomalyDetails["Observables"][0]["Value"]),
    ExpectedEventCount = toint(AnomalyDetails["Observables"][0]["TypicalObservations"]["Expected count"])
| project
    TimeGenerated,
    RuleName,
    Description,
    Query,
    UserName,
    EventType,
    EventCount,
    ExpectedEventCount,
    Score,
    AnomalyDetails,
    Entities,
    Tactics,
    Techniques,
    ExtendedLinks

Explanation

This query is looking for anomalies where the rule name ends with "Suspicious volume of AWS cloud trail logs events of group user account by EventTypeName" and the rule status is not "Flighting". It then extends the query by extracting specific details such as the query itself, event type, event count, and expected event count. Finally, it projects various fields including time generated, rule name, description, query, username, event type, event count, expected event count, score, anomaly details, entities, tactics, techniques, and extended links.

Details

Jose Sebastián Canós

Released: December 15, 2022

Tables

Anomalies

Keywords

AnomaliesRuleNameRuleStatusExtendedLinksQueryEventTypeEventCountExpectedEventCountTimeGeneratedDescriptionUserNameScoreAnomalyDetailsEntitiesTacticsTechniques

Operators

whereendswith!=extendtostringtointproject

Actions

GitHub