Note
Access to this page requires authorization. You can try signing in or changing directories.
Access to this page requires authorization. You can try changing directories.
Use the GetHighVolumeAnomalyBehaviors() function in advanced hunting to return behaviors that contain at least one HighVolumeAnomaly insight in the Insights column.
A HighVolumeAnomaly insight indicates that an unusually high volume of activity was detected compared to the established behavioral baseline.
Syntax
invoke GetHighVolumeAnomalyBehaviors()
Parameters
This function has no explicit parameters. Invoke it as part of a query on a tabular input that contains an Insights column of type string.
Return value
Returns the rows from the input table that contain at least one HighVolumeAnomaly insight. All columns from the input table are preserved.
Example
Find recent behaviors with unusually high activity volume
BehaviorInfo
| where ServiceSource == "Microsoft Sentinel"
| where TimeGenerated > ago(7d)
| invoke GetHighVolumeAnomalyBehaviors()
| project TimeGenerated, BehaviorId, Title, Insights
| order by TimeGenerated desc