TH2.3 series_decompose_anomalies()

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30

// Detect anomalous days in per-user sign-in volume
SigninLogs
| where TimeGenerated > ago(30d)
| where ResultType == 0
| make-series SignInCount = count()
    on TimeGenerated
    from ago(30d) to now()
    step 1d
    by UserPrincipalName
| extend (anomalies, score, baseline) =
    series_decompose_anomalies(SignInCount, 1.5)
// anomalies: array of -1 (low anomaly), 0 (normal), 1 (high anomaly)
// score: array of anomaly scores (higher = more anomalous)
// baseline: array of expected values
// 1.5 = sensitivity threshold (lower = more sensitive, more results)
| mv-expand
    TimeGenerated to typeof(datetime),
    SignInCount to typeof(long),
    anomalies to typeof(int),
    score to typeof(double),
    baseline to typeof(double)
| where anomalies != 0
// Only anomalous data points
| project TimeGenerated, UserPrincipalName,
    SignInCount, baseline, score, anomalies
| sort by score desc
// Results: user-day combinations where sign-in volume was
// statistically anomalous relative to the user's own pattern
// score > 0 = unusually high volume
// score < 0 = unusually low volume (also potentially suspicious)

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20

// Compare sensitivity levels
// Same data, different thresholds
let data = SigninLogs
| where TimeGenerated > ago(30d)
| where ResultType == 0
| make-series SignInCount = count()
    on TimeGenerated from ago(30d) to now() step 1d
    by UserPrincipalName;
data | extend (a1, s1, b1) = series_decompose_anomalies(SignInCount, 1.0)
| mv-expand a1 to typeof(int) | where a1 != 0
| summarize Threshold1_Anomalies = count();
// threshold 1.0 = aggressive (more anomalies, more FPs)
data | extend (a2, s2, b2) = series_decompose_anomalies(SignInCount, 1.5)
| mv-expand a2 to typeof(int) | where a2 != 0
| summarize Threshold15_Anomalies = count();
// threshold 1.5 = default (balanced)
data | extend (a3, s3, b3) = series_decompose_anomalies(SignInCount, 3.0)
| mv-expand a3 to typeof(int) | where a3 != 0
| summarize Threshold3_Anomalies = count();
// threshold 3.0 = conservative (fewer anomalies, fewer FPs)

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33

// Hunting application: find users with anomalous authentication bursts
// This is the TH4 authentication anomaly campaign in preview
SigninLogs
| where TimeGenerated > ago(30d)
| where ResultType == 0
| make-series SignInCount = count()
    on TimeGenerated
    from ago(30d) to now()
    step 1h
    by UserPrincipalName
// Hourly bins to catch intra-day bursts
| extend (anomalies, score, baseline) =
    series_decompose_anomalies(SignInCount, 2.0)
| mv-expand
    TimeGenerated to typeof(datetime),
    SignInCount to typeof(long),
    anomalies to typeof(int),
    score to typeof(double),
    baseline to typeof(double)
| where anomalies == 1
| where score > 5
// Only strong positive anomalies (score > 5)
| summarize
    AnomalousHours = count(),
    MaxScore = max(score),
    MaxSignIns = max(SignInCount),
    MaxBaseline = max(baseline)
    by UserPrincipalName
| where AnomalousHours >= 2
// Users with 2+ anomalous hours — sustained spike, not a single outlier
| sort by MaxScore desc
// These users had authentication bursts that significantly exceeded
//   their hourly baseline — AiTM token replay produces this pattern