[IA] - Rating Network connections based on ASN
This detection helps to identify if an ASN that typically handles an average of X connection requests per day over a consistent 7-day period suddenly triples—or more—the number of requests. (You can adjust this line to define the exact multiplication threshold). In addition, identify if during the last week, a new ASN has triggered more than 1K connection attempt during a day.
Microsoft Sentinel (KQL)
