List Malicious DNS Name Detected Based On Threat Intelligence Indicators By Fortinet
Description
This KQL query look for malicious DNS names detected by Fortinet based on Sentinel Threat Intelligence indicators.
Risk
Explain what risk this detection tries to cover.
Query
Microsoft Sentinel
Kusto
CommonSecurityLog
| where DeviceVendor == "Fortinet"
| where DeviceAction != "deny" and DeviceAction != "close" and DeviceAction != "blocked" and isnotempty(DeviceAction)
| distinct DestinationHostName
| project DestinationHostName
| join kind = inner (
ThreatIntelligenceIndicator
| where DomainName != ''
) on $left.DestinationHostName == $right.DomainName