Anomalous Key Vault Modification by High-Privilege User

Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · 📊

Back to Content Index


Shows all Key Vault modification activities performed by high-privilege users. If the activity is performed for the first time (by the user or in the tenant) or if the activity originated from a never seen before country

Attribute Value
Type Hunting Query
Solution UEBA Essentials
ID 202ee40b-e6d8-4968-9a79-cf24c5c09db9
Required Connectors BehaviorAnalytics
Source View on GitHub

Tables Used

This content item queries data from the following tables:

Table Transformations Ingestion API Lake-Only
BehaviorAnalytics ?

Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · 📊

Back to Hunting Queries · Back to UEBA Essentials