Query Details

Anomalies UEBA Anomalous Sign In

Query

Anomalies
| where RuleName endswith "UEBA Anomalous Sign In" and RuleStatus != "Flighting"
| extend
    Query = ExtendedLinks[0]["DetailBladeInputs"]
| project
    TimeGenerated,
    RuleName,
    Description,
    Query,
    UserPrincipalName,
    ActivityInsights,
    DeviceInsights,
    UserInsights,
    Score,
    AnomalyDetails,
    Entities,
    Tactics,
    Techniques,
    ExtendedLinks

Explanation

This query retrieves anomalies that are related to anomalous sign-ins. It filters out anomalies that are in the "Flighting" status. It then extends the query by extracting the detail blade inputs. Finally, it projects various fields such as time generated, rule name, description, query, user principal name, activity insights, device insights, user insights, score, anomaly details, entities, tactics, techniques, and extended links.