SentinelAnomalies.md

Hunt for anomalies in Sentinel

Query Information

Description

The anomalies table contains anomalies generated by the active Anomaly analytics rules in Azure Sentinel. Those anomalies do not trigger a incident by default (at the moment of writing). This query lists the anomalies and the reaons why they are anomalies.

References

• https://learn.microsoft.com/en-us/azure/azure-monitor/reference/tables/anomalies

Sentinel

let TimeFrame = 7d;
Anomalies
| where TimeGenerated > ago(TimeFrame)
| project-rename ['Anomaly Reason'] = Description
| project-reorder TimeGenerated, ['Anomaly Reason'], Entities, RuleName, Tactics