• CommunityEnterprisePlans
  • Intel Exchange
    Intel ExchangeDetections
  • Resources
  • About
  • Leaderboard
Join CommunitySign In
    All Detections

    Storage Alerts Correlation with CommonSecurityLogs & AuditLogs

    GlassDiceBearhttps://www.dicebear.comhttps://creativecommons.org/publicdomain/zero/1.0/„Glass” (https://www.dicebear.com) by „DiceBear”, licensed under „CC0 1.0” (https://creativecommons.org/publicdomain/zero/1.0/)
    Azure Sentinel@AzureSentinel
    •updated Jun 17, 2025•1•0•48

    'This query combines different Storage alerts with CommonSecurityLogs and AuditLogs helping analysts investigate any possible storage related attacks faster thus reducing Mean Time To Respond'

    Microsoft Sentinel (KQL)

    Tags

    TA0001 - Initial AccessTA0040 - ImpactT1190 - Exploit Public-Facing ApplicationT1078 - Valid AccountsT1098 - Account ManipulationTA0005 - Defense EvasionTA0003 - PersistenceTA0004 - Privilege EscalationS0183 - TorT1650 - Acquire AccessT1530 - Data from Cloud StorageT1021.001 - Remote Desktop ProtocolTA0042 - Resource DevelopmentTA0009 - CollectionTA0008 - Lateral MovementT1591.004 - Identify RolesTA0043 - ReconnaissanceCloud Storage AccessNetwork ConnectionAdmin ActivitySIEM AlertAzureNetwork GenericAzure SentinelFortinet Fortigate FirewallAzure Activity Logskqltactic:InitialAccesstactic:Impacttechnique:T1190technique:T1078

    Community Inspired.
    AI Enhanced.
    Better Detections.

    Follow Us

    Company

    • About
    • Leaderboard

    Product

    • Community
    • Enterprise
    • Plans

    © 2026 Copyright. All Rights Reserved.

    Privacy PolicyTerms of Service

    Sign up to view this detection

    or

    Already have an account?