Note
Access to this page requires authorization. You can try signing in or changing directories.
Access to this page requires authorization. You can try changing directories.
Use the GetUncommonValueBehaviors() function in advanced hunting to return behaviors that contain at least one UncommonValue insight in the Insights column.
An UncommonValue insight indicates that a value associated with the behavior, such as a country or internet service provider (ISP), is rarely observed across the organization.
Syntax
invoke GetUncommonValueBehaviors()
Parameters
This function has no explicit parameters. Invoke it as part of a query on a tabular input that contains an Insights column of type string.
Return value
Returns the rows from the input table that contain at least one UncommonValue insight. All columns from the input table are preserved.
Example
Find Microsoft Sentinel behaviors with uncommon values
BehaviorInfo
| where ServiceSource == "Microsoft Sentinel"
| invoke GetUncommonValueBehaviors()
| project TimeGenerated, BehaviorId, Title, Insights
| order by TimeGenerated desc