Detection rules › Kusto
Datawiza - massive errors detected
"This rule is designed to identify when the system is experiencing abnormal errors."
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Discovery | T1082 System Information Discovery |
Rule body kusto
id: "ddee1398-cf0b-46af-b583-78c3c29156dc"
name: "Datawiza - massive errors detected"
description: |
"This rule is designed to identify when the system is experiencing abnormal errors."
severity: Medium
requiredDataConnectors:
- connectorId: DatawizaDapSolution
dataTypes:
- datawizaserveraccess_CL
queryFrequency: 10m
queryPeriod: 10m
triggerOperator: GreaterThan
triggerThreshold: 0
tactics:
- Discovery
relevantTechniques:
- T1082
query: |
let timeFrame = 10m;
datawizaserveraccess_CL
| where TimeGenerated between (ago(timeFrame) .. now())
and Status_d >= 500
| summarize Count = count()
| where Count > 100
eventGroupingSettings:
aggregationKind: SingleAlert
alertDetailsOverride:
alertDisplayNameFormat: 'Datawiza Massive Error Detection'
alertDescriptionFormat: >
Detected {{Count}} errors within 10 minutes. Please investigate unauthorized access attempts or misconfigurations.
version: 1.0.0
kind: Scheduled
Stages and Predicates
Parameters
let timeFrame = 10m;
Stage 1: source
datawizaserveraccess_CL
Stage 2: where
| where TimeGenerated between (ago(timeFrame) .. now())
and Status_d >= 500
Stage 3: summarize
| summarize Count = count()
Stage 4: where
| where Count > 100
Indicators
Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.
Output fields
Fields the rule emits when it matches. Chronicle authors list these in the outcome block; they appear on the detection and $risk_score drives alerting. Sentinel / Defender XDR rules build them up through project / summarize / extend stages. Sentinel maps these into alert fields via entityMappings and customDetails; Defender XDR custom detections surface them as alert fields directly.
| Field | Source |
|---|---|
Count | summarize |