Query Details

Anomalies UEBA Anomalous Data Destruction

Query

Anomalies
| where RuleName endswith "UEBA Anomalous Data Destruction" and RuleStatus != "Flighting"
| extend
    Query = ExtendedLinks[0]["DetailBladeInputs"]
| project
    TimeGenerated,
    RuleName,
    Description,
    Query,
    UserPrincipalName,
    ActivityInsights,
    DeviceInsights,
    UserInsights,
    Score,
    AnomalyDetails,
    Entities,
    Tactics,
    Techniques,
    ExtendedLinks

Explanation

This query retrieves anomalies where the rule name ends with "UEBA Anomalous Data Destruction" and the rule status is not "Flighting". It then extends the query by extracting the detail blade inputs from the extended links. Finally, it projects various fields including time generated, rule name, description, query, user principal name, activity insights, device insights, user insights, score, anomaly details, entities, tactics, techniques, and extended links.