Kusto Detective Agency Season 2 — Case #4 Badge

Walk Through Guide for Kusto Detective Agency Season 2, Case #4 Solution

Cases Solutions: 0 1 2 3 4 5 6 7 8 9 10

Detective save the mayor! 🕵👩‍⚖

The fourth case riddle is:

The key takeaways from the riddle:

1. Mayor is involved in a few incidents stemming from data leaks
2. We got information on companies working with municipality
3. We’re asked to find based on network activity who is behind it all

⚠SPOILER ALERT — THE SOLUTION DESCRIBED BELOW⚠

Note: Solution is mine, and non-official

So let’s delve into the data, by leveraging the | take 10, to see some rows.

The IpInfo table has; IpCidr, Info.

This is useful to know what companies are involved.

So let’s delve into the data, by leveraging the | take 10, to see some rows.

The NetworkMetrics table has; ColumnName Timestamp, ClientIP, TargetIP, BytesSent, BytesReceived, NewConnections.

Hackers would like to minimize their network footprint, so they would most probably connect to a single machine at a time.

Let’s find those:

If we only could detect anomalies where huge amounts of data were sent…

Lucky us! 🍀

KQL has series_decompose_anomalies function that knows to do just that!

Let’s find the companies with the maximal anomaly score:

The most suspicious company is KUANDA.ORG:

Real fishers! 🐟

Enjoyed this article? Feel free to long-press the 👏 button below 😀

Click for Next Case Solution ➡

Click for Previous Case Solution ⬅

Cases Solutions: 0 1 2 3 4 5 6 7 8 9 10