KQL Search

Query Details

Anomalies UEBA Anomalous Password Reset

Query

Anomalies
| where RuleName endswith "UEBA Anomalous Password Reset" and RuleStatus != "Flighting"
| extend
    Query = ExtendedLinks[0]["DetailBladeInputs"]
| project
    TimeGenerated,
    RuleName,
    Description,
    Query,
    UserPrincipalName,
    ActivityInsights,
    DeviceInsights,
    UserInsights,
    Score,
    AnomalyDetails,
    Entities,
    Tactics,
    Techniques,
    ExtendedLinks

Explanation

This query retrieves anomalies that are related to anomalous password resets. It excludes anomalies that are in the "Flighting" status. The query then extends the "Query" field with the value from the "DetailBladeInputs" property of the first element in the "ExtendedLinks" array. Finally, it projects several fields including time generated, rule name, description, query, user principal name, activity insights, device insights, user insights, score, anomaly details, entities, tactics, techniques, and extended links.

Details

Jose Sebastián Canós profile picture

Jose Sebastián Canós

Released: December 15, 2022

Tables

Anomalies

Keywords

AnomaliesRuleNameRuleStatusQueryTimeGeneratedDescriptionUserPrincipalNameActivityInsightsDeviceInsightsUserInsightsScoreAnomalyDetailsEntitiesTacticsTechniquesExtendedLinks

Operators

whereendswith!=extendproject

Actions

GitHub