Query Details

Anomalies UEBA Anomalous Process Creation

Query

Anomalies
| where RuleName endswith "UEBA Anomalous Process Creation" and RuleStatus != "Flighting"
| extend
    Query = ExtendedLinks[0]["DetailBladeInputs"]
| project
    TimeGenerated,
    RuleName,
    Description,
    Query,
    UserPrincipalName,
    ActivityInsights,
    DeviceInsights,
    UserInsights,
    StartTime,
    EndTime,
    Score,
    AnomalyDetails,
    Entities,
    Tactics,
    Techniques,
    ExtendedLinks

Explanation

This query retrieves anomalies that are related to anomalous process creation. It filters out anomalies that are in the "Flighting" status. It extends the query to include the detail blade inputs. The final result includes various fields such as time generated, rule name, description, query, user principal name, activity insights, device insights, user insights, start time, end time, score, anomaly details, entities, tactics, techniques, and extended links.