All Detections

Cross workspace query anomolies

Azure Sentinel@AzureSentinel
updated Jun 17, 20253023

'This hunting query looks for increases in the number of workspaces queried by a user.'

Microsoft Sentinel (KQL)