SentinelKQL/AnomalousToken.txt at master · falcon564/SentinelKQL · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
SecurityAlert
| where AlertName == "Anomalous Token"
| extend x = todynamic(Entities)
| parse-where x with * '"SessionId":"' RequestId '"' *
| project AlertTime=TimeGenerated, RequestId, CompromisedEntity, AlertName
| join kind=inner (
    AADUserRiskEvents)
    on $left.CompromisedEntity == $right.UserPrincipalName, RequestId
| project
    RiskTime=TimeGenerated,
    AlertTime,
    AlertName,
    RequestId,
    RiskLevel,
    RiskState,
    DetectionTimingType,
    UserPrincipalName,
    CorrelationId
| join kind=inner (
    SigninLogs
    | where TimeGenerated > ago(14d)
    )
    on CorrelationId
| project
    SigninTime=TimeGenerated,
    RiskTime,
    AlertName,
    AlertTime,
    UserPrincipalName,
    AppDisplayName,
    Location,
    IPAddress,
    RiskLevel,
    RiskState,
    DetectionTimingType,
    UserAgent,
    ResultType