Skip to content

Commit 127d229

Browse files
ofirga-msofirga-ms
committed
UEBA Essentials v4.1.0: add new hunting queries (High-Score Triage, Template Distribution, Detection Trend Analysis, User-Centric Investigation, Top Anomalous Source IP) update manifest, remove obsolete AAD Manipulation query, update release notes
1 parent 8a096ce commit 127d229

8 files changed

+126
-60
lines changed

‎Solutions/UEBA Essentials/Data/Solution_UEBA.json‎

Lines changed: 7 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -28,10 +28,15 @@
2828
"Hunting Queries/UEBA Multi-Source Anomalous Activity Overview.yaml",
2929
"Hunting Queries/Anomalous First-Time Device Logon.yaml",
3030
"Hunting Queries/Anomalous Okta First-Time or Uncommon Actions.yaml",
31-
"Hunting Queries/Anomalous GCP IAM Activity.yaml"
31+
"Hunting Queries/Anomalous GCP IAM Activity.yaml",
32+
"Hunting Queries/Anomalous High-Score Activity Triage.yaml",
33+
"Hunting Queries/Anomaly Template Distribution by Tactics and Techniques.yaml",
34+
"Hunting Queries/User-Centric Anomaly Investigation.yaml",
35+
"Hunting Queries/Anomaly Detection Trend Analysis.yaml",
36+
"Hunting Queries/Top Anomalous Source IP Triage.yaml"
3237
],
3338
"Metadata": "SolutionMetadata.json",
3439
"BasePath": "C:\\GitHub\\Azure-Sentinel\\Solutions\\UEBA Essentials",
35-
"Version": "3.0.2",
40+
"Version": "4.1.0",
3641
"TemplateSpec": true
3742
}

‎Solutions/UEBA Essentials/Hunting Queries/Anomalous AAD Account Manipulation.yaml‎

Lines changed: 0 additions & 58 deletions
This file was deleted.

‎Solutions/UEBA Essentials/Hunting Queries/Anomalous High-Score Activity Triage.yaml‎

Lines changed: 25 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,25 @@
1+
id: a7b8c9d0-e1f2-3456-7890-abcdef123456
2+
name: Anomalous High-Score Activity Triage
3+
description: |
4+
'Identify the highest-scoring anomalies for rapid triage using Anomalies Table.'
5+
requiredDataConnectors:
6+
- connectorId: BehaviorAnalytics
7+
dataTypes:
8+
- Anomalies
9+
tactics:
10+
relevantTechniques:
11+
query: |
12+
Anomalies
13+
| where TimeGenerated > ago(7d)
14+
| sort by Score desc
15+
| project TimeGenerated, AnomalyTemplateName, Score, Description, UserName, SourceIpAddress, Tactics, Techniques
16+
entityMappings:
17+
- entityType: Account
18+
fieldMappings:
19+
- identifier: Name
20+
columnName: UserName
21+
- entityType: IP
22+
fieldMappings:
23+
- identifier: Address
24+
columnName: SourceIpAddress
25+
version: 1.0.0

‎Solutions/UEBA Essentials/Hunting Queries/Anomaly Detection Trend Analysis.yaml‎

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,16 @@
1+
id: d0e1f2a3-b4c5-6789-0123-def456789012
2+
name: Anomaly Detection Trend Analysis
3+
description: |
4+
'Visualizes anomaly detection trends over the past 90 days, showing daily counts of triggered anomaly templates. Use this time-series chart to identify patterns, spikes in anomalous behavior, and seasonal trends for baseline establishment and threat hunting prioritization.'
5+
requiredDataConnectors:
6+
- connectorId: BehaviorAnalytics
7+
dataTypes:
8+
- Anomalies
9+
tactics:
10+
relevantTechniques:
11+
query: |
12+
Anomalies
13+
| where TimeGenerated > ago(90d)
14+
| summarize Count = count() by bin(TimeGenerated, 1d), AnomalyTemplateName
15+
| render timechart
16+
version: 1.0.0

‎Solutions/UEBA Essentials/Hunting Queries/Anomaly Template Distribution by Tactics and Techniques.yaml‎

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,16 @@
1+
id: b8c9d0e1-f2a3-4567-8901-bcdef2345678
2+
name: Anomaly Template Distribution by Tactics and Techniques
3+
description: |
4+
'Provides a statistical overview of anomaly detections over the past 30 days, grouped by template name, MITRE ATT&CK tactics, and techniques. Use this query to identify the most frequently triggered anomaly patterns and their associated threat techniques for trend analysis and detection tuning.'
5+
requiredDataConnectors:
6+
- connectorId: BehaviorAnalytics
7+
dataTypes:
8+
- Anomalies
9+
tactics:
10+
relevantTechniques:
11+
query: |
12+
Anomalies
13+
| where TimeGenerated > ago(30d)
14+
| summarize Count = count() by AnomalyTemplateName, Tactics, Techniques
15+
| sort by Count desc
16+
version: 1.0.0

‎Solutions/UEBA Essentials/Hunting Queries/Top Anomalous Source IP Triage.yaml‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
id: e1f2a3b4-c5d6-7890-1234-abcdef567890
2+
name: Top Anomalous Source IP Triage
3+
description: |
4+
'Identifies the top source IP addresses with multiple distinct anomaly templates over the past 30 days (excluding single noisy hits), then surfaces their most recent (last 24h) high-fidelity anomalous activities for focused investigation, including scores, tactics, techniques, and behavioral insights.'
5+
requiredDataConnectors:
6+
- connectorId: BehaviorAnalytics
7+
dataTypes:
8+
- Anomalies
9+
tactics:
10+
relevantTechniques:
11+
query: |
12+
let TopIPs =
13+
Anomalies
14+
| where TimeGenerated > ago(30d)
15+
| where isnotempty(SourceIpAddress)
16+
| summarize TotalAnomalies = count(), DistinctTemplates = dcount(AnomalyTemplateName) by SourceIpAddress
17+
| where TotalAnomalies > 1 and DistinctTemplates > 1
18+
| top 5 by TotalAnomalies desc
19+
| project SourceIpAddress;
20+
Anomalies
21+
| where TimeGenerated > ago(24h)
22+
| where SourceIpAddress in (TopIPs)
23+
| project TimeGenerated, SourceIpAddress, AnomalyTemplateName, Score, Description,
24+
UserPrincipalName, UserName, StartTime, EndTime,
25+
Tactics, Techniques, ActivityInsights, DeviceInsights, UserInsights, AnomalyReasons
26+
| order by SourceIpAddress asc, Score desc, TimeGenerated desc
27+
entityMappings:
28+
- entityType: IP
29+
fieldMappings:
30+
- identifier: Address
31+
columnName: SourceIpAddress
32+
- entityType: Account
33+
fieldMappings:
34+
- identifier: Name
35+
columnName: UserName
36+
version: 1.0.0

‎Solutions/UEBA Essentials/Hunting Queries/User-Centric Anomaly Investigation.yaml‎

Lines changed: 25 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,25 @@
1+
id: c9d0e1f2-a3b4-5678-9012-cdef34567890
2+
name: User-Centric Anomaly Investigation
3+
description: |
4+
'Investigates all anomalous activities associated with a specific user account over the past 30 days, including anomaly scores, behavioral insights, source locations, and MITRE ATT&CK mappings. Customize by replacing "[email protected]" with the target user principal name for focused threat hunting and incident response.'
5+
requiredDataConnectors:
6+
- connectorId: BehaviorAnalytics
7+
dataTypes:
8+
- Anomalies
9+
tactics:
10+
relevantTechniques:
11+
query: |
12+
Anomalies
13+
| where TimeGenerated > ago(30d)
14+
| where UserPrincipalName == "[email protected]"
15+
| project TimeGenerated, UserName, AnomalyTemplateName, Score, Description, ActivityInsights, UserInsights, SourceIpAddress, SourceLocation, Tactics, Techniques
16+
entityMappings:
17+
- entityType: Account
18+
fieldMappings:
19+
- identifier: Name
20+
columnName: UserName
21+
- entityType: IP
22+
fieldMappings:
23+
- identifier: Address
24+
columnName: SourceIpAddress
25+
version: 1.0.0

‎Solutions/UEBA Essentials/ReleaseNotes.md‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -3,3 +3,4 @@
33
| 3.0.2 | 04-11-2025 | Enhance UEBA Essentials with multi-cloud detection capabilities |
44
| 3.0.1 | 23-09-2024 | Updated query logic in **Hunting Query** [Anomalous Sign-in Activity] |
55
| 3.0.0 | 07-11-2023 | Modified text as there is rebranding from Azure Active Directory to Microsoft Entra ID. |
6+
| 4.1.0 | 23-11-2025 | Added new hunting queries: User-Centric Anomaly Investigation, Anomaly Detection Trend Analysis, Anomaly Template Distribution, Anomalous High-Score Activity Triage, Top Anomalous Source IP Triage. Updated solution version. |

0 commit comments

Comments
 (0)