Skip to content

Latest commit

 

History

History
23 lines (21 loc) · 703 Bytes

DefenseEvasionAlerts.md

File metadata and controls

23 lines (21 loc) · 703 Bytes
Raw

Defense Evasion Alerts Generated by Defender For Endpoint

Defender For Endpoint

CloudAppEvents
| where ActionType == 'DefenseEvasion'
| extend
     AlertUri = parse_json(RawEventData).AlertUri,
     AlertDisplayName = parse_json(RawEventData).AlertDisplayName,
     AlertSeverity = parse_json(RawEventData).AlertSeverity
| project AlertUri, AlertDisplayName, AlertSeverity

Sentinel

CloudAppEvents
| where ActionType == 'DefenseEvasion'
| extend
     AlertUri = parse_json(RawEventData).AlertUri,
     AlertDisplayName = parse_json(RawEventData).AlertDisplayName,
     AlertSeverity = parse_json(RawEventData).AlertSeverity
| project AlertUri, AlertDisplayName, AlertSeverity