Hey all
Just checking if anyone has gone down this road and has any learnings to share?
My current approach is to build a detection rule and “size” it above any normal activity.
E.g.
Threshold: Only once on match 400
Timeframe: 30 minutes
Group matched data by:
- source_account
Was wondering if there were any tricks to help with the sizing?
I’ve got some low level alerts being created but in the alert its hard to just what the count was.
When I go into evidence it shows me the first and the last log entry.
When I click on “view all log entries” for a sample alert I see just 7 logs.
I’m thinking the way is to use a log query similar to :
where("service" = "o365"AND"action"IN ["FolderModified","FileRenamed","FileModified","FileModifiedExtended"] AND"source_account" != "app@sharepoint") groupby("source_user", "action") timeslice(30m)
So the question is how to make an educated decision on the highwater mark for the alert?
Or is there a better way ?
Thanks!
from(
event_type = "cloud_service_activity"
)
where(
"service" = "o365"
AND
"action"
IN [
"FolderModified",
"FileRenamed",
"FileModified",
"FileModifiedExtended"
]
AND
"source_account" != "app@sharepoint"
)