+ SECUREFortinetKusto Query LanguageMicrosoft Sentinel

List Malicious DNS Name Detected Based On Threat Intelligence Indicators By Fortinet

Description

This KQL query look for malicious DNS names detected by Fortinet based on Sentinel Threat Intelligence indicators.

Risk

Explain what risk this detection tries to cover.

Query

Microsoft Sentinel
Kusto
CommonSecurityLog
| where DeviceVendor == "Fortinet"
| where DeviceAction != "deny" and DeviceAction != "close" and DeviceAction != "blocked" and isnotempty(DeviceAction)
| distinct DestinationHostName
| project DestinationHostName
| join kind = inner (
    ThreatIntelligenceIndicator
    | where DomainName != ''
) on $left.DestinationHostName == $right.DomainName

References

Leave a Reply

Your email address will not be published. Required fields are marked *