KQL Search

Query Details

Anomalies UEBA Anomalous Account Manipulation

Query

Anomalies
| where RuleName endswith "UEBA Anomalous Account Manipulation" and RuleStatus != "Flighting"
| extend
    Query = ExtendedLinks[0]["DetailBladeInputs"]
| project
    TimeGenerated,
    RuleName,
    Description,
    Query,
    UserPrincipalName,
    ActivityInsights,
    DeviceInsights,
    UserInsights,
    StartTime,
    EndTime,
    Score,
    AnomalyDetails,
    Entities,
    Tactics,
    Techniques,
    ExtendedLinks

Explanation

This query retrieves anomalies that are related to anomalous account manipulation. It filters out anomalies that are in the "Flighting" status. It extends the query with additional information from the "DetailBladeInputs" field. The final result includes various fields such as time generated, rule name, description, query, user principal name, activity insights, device insights, user insights, start time, end time, score, anomaly details, entities, tactics, techniques, and extended links.

Details

Jose Sebastián Canós profile picture

Jose Sebastián Canós

Released: March 27, 2023

Tables

Anomalies

Keywords

AnomaliesRuleNameRuleStatusQueryTimeGeneratedDescriptionUserPrincipalNameActivityInsightsDeviceInsightsUserInsightsStartTimeEndTimeScoreAnomalyDetailsEntitiesTacticsTechniquesExtendedLinks

Operators

whereendswith!=extendproject

Actions

GitHub