↳ GitHub sourceAnalytics ruleMedium
Quokka - Malicious Results Detected
Description
'Detects if there are any malicious results in the app events coming from organization devices.'
- Rule type
- Scheduled
- Version
- 1.0.0
- Declared status
- Available
- Query frequency
- 1h
- Query period
- 1h
- Trigger
- gt 0
Declared MITRE coverage
Declared sources
Metadata from the source file. No dependencies inferred from KQL.
Connectors
Data types
KQL query
Original query, unchanged.
let timeRange = 1h;
let appEventsWithMaliciousResults = QscoutAppEvents_CL
| extend AccountCustomEntity = tostring(org_id)
| where TimeGenerated >= ago(timeRange)
| where result_type == 'maliciousness'
| where isnotempty(results.entries);
appEventsWithMaliciousResults
| mv-expand entry = results.entries
| project
TimeGenerated,
AccountCustomEntity,
app_id,
mdm_source,
mdm_device_id,
package,
platform,
version,
rule_id = tostring(entry.ruleId),
desription = tostring(entry.description),
threat_level = toint(entry.threatLevel),
threat_types = tostring(entry.threatTypes)
Declared entities
Related content
Links established from declared identifiers and solution manifests.
Source provenance
GitHubDisplayed values come from files in Azure/Azure-Sentinel. They describe the published template, not your workspace configuration.
- Commit
9800e51↗- Source identifier
97ad71ed-e4c0-4f7a-b1a2-683108bece4f
GSTEP / CATALOG TRACKING
Added to catalog : 16 Sept 2026 · 05:49 UTC
Last change observed : 16 Sept 2026 · 05:49 UTC