Query User-Specific Anomalies from Microsoft Sentinel

Shadows VMB@Vemorian_Mort

•updated Aug 23, 2026•2•0•28

This rule retrieves security anomaly events generated by Microsoft's identity protection or behavioral analysis systems for a specific user account over a defined time range. It leverages the 'Anomalies' table within Microsoft Sentinel to surface identity-related insights, activity patterns, and flagged risks.