Microsoft Entra Suite Tech Accelerator
Aug 14 2024, 07:00 AM - 09:30 AM (PDT)
Microsoft Tech Community

Help to write KQL for some of the use case

Copper Contributor

Hi Team, 

 

Please help me to write a KQL for below scenario. Log sources are (Palo alto, checkpoint, F5, Citrix, Akamai, Vectra, oracle, Linux)

 

Use case - Source sending more events than usual
Description - This correlation search identifies source hosts sending more data than usual. The search runs against data from the last 7 days, and compare only the same hour of the last 7 days (this helps avoiding alerts in the beginning of business hours). The threshold is the sum of average events plus the standard deviation of the source times 3.

 

Usecase - Unexpected Host Reporting events
Description - Discovers hosts that are reporting events but are not on the expected reporting host on Sentinel. This rule is used to monitor hosts not
expected.

 

Usecase - New User Account Created on multiple Hosts
Description - Alerts when numerous new accounts are created for a username account on multiple hosts.

 

Note : All above usecase are deployed in Splunk and need to migrate into sentinel.

0 Replies