Keystone After Hours Logon - Correlated with Identity Info

Igor Oliveira@Pr0fiLeRR

•updated Feb 28, 2026•1•0•15

Correlates IdentityLogonEvents and IdentityInfo on AccountObjectId to detect after-hours access to Keystone core banking system enriched with user identity. Note: The following logic is NOT expressible in Sigma and must be applied post-conversion in native KQL, SPL or whatever query language you use and want to convert to: - Timezone conversion (UTC to PST) - WeekDay function and day-of-week filtering - Hour-based filtering per department - summarize arg_max with bin(TimeGenerated, 5m) - ManagerEmail construction via mgrSplit - project-reorder