Note
Access to this page requires authorization. You can try signing in or changing directories.
Access to this page requires authorization. You can try changing directories.
Use the GetFirstSeenBehaviors() function in advanced hunting to return behaviors that contain at least one FirstSeen insight in the Insights column.
A FirstSeen insight indicates that a behavior, entity, value, or combination of values was observed for the first time.
Syntax
invoke GetFirstSeenBehaviors()
Parameters
This function has no explicit parameters. Invoke it as part of a query on a tabular input that contains an Insights column of type string.
Return value
Returns the rows from the input table that contain at least one FirstSeen insight. All columns from the input table are preserved.
Example
Find recent Microsoft Sentinel behaviors with FirstSeen insights
BehaviorInfo
| where ServiceSource == "Microsoft Sentinel"
| where TimeGenerated > ago(1d)
| invoke GetFirstSeenBehaviors()
| project TimeGenerated, BehaviorId, Title, Insights