Creating custom detections

In the KQL editor, we have a Create detection rule option, which allows us to create our detections tailored to our own environment:

Figure 19.4 – The Create detection rule option in the KQL editor

Say we want to monitor changes to sensitive administrative groups in AD. We would start by constructing a query like this:

let MonitoredGroups = datatable(GroupName:string)
[
"Account Operators",
"Administrators",
"Backup Operators",
"Domain Admins",
"Domain Controllers",
"Enterprise Admins",
];
IdentityDirectoryEvents
| where ActionType == "Group Membership changed"
| extend AdditionalFields = parse_json(AdditionalFields)
| extend FromGroup = AdditionalFields.["FROM.GROUP"]
| extend ToGroup = AdditionalFields.["TO.GROUP"]
// Extract target user or device name
| extend TargetObject =  iff( isnull(AdditionalFields.["TARGET_OBJECT...