// Illustrative; not run against live data. Microsoft Sentinel (Log Analytics workspace).
// Indicators from JPCERT/CC alert JPCERT-AT-2026-0030 (8 Oct 2026). Case B: app and API abuse, addresses used around September.
// Case C: Metabase SQL injection (CVE-2026-72898), addresses used early August to early September.
// JPCERT/CC notes the addresses may now be in legitimate use. A match is a lead to investigate, not proof of compromise.
// CommonSecurityLog: web application firewalls, load balancers and proxies sending CEF. DeviceNetworkEvents: servers with Defender for Endpoint.
let Since = datetime(2026-08-01T00:00:00Z);
let CaseB_IP = dynamic(["3.112.252.14", "54.95.112.6", "69.10.51.162", "172.86.91.7", "210.149.87.120"]);
let CaseC_IP = dynamic(["213.163.202.171", "221.216.140.49", "221.216.140.129"]);
// Distinctive User-Agents are searched on their own; common tool strings only add weight to an address match.
let DistinctUA = dynamic(["Metabase-GHSA-vwf4/2.0", "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0 Safari/537.36"]);
let CommonUA = dynamic(["curl/7.88.1", "python-requests/2.34.2", "python-requests/2.33.1"]);
union isfuzzy=true
    (CommonSecurityLog
    | where TimeGenerated >= Since
    | where SourceIP in (CaseB_IP) or SourceIP in (CaseC_IP) or RequestClientApplication in (DistinctUA)
    | project TimeGenerated, Telemetry = strcat(DeviceVendor, " ", DeviceProduct), SourceIP, UserAgent = RequestClientApplication,
        Target = coalesce(RequestURL, DestinationHostName), Action = DeviceAction),
    (DeviceNetworkEvents
    | where TimeGenerated >= Since
    | where ActionType == "InboundConnectionAccepted"
    | where RemoteIP in (CaseB_IP) or RemoteIP in (CaseC_IP)
    | project TimeGenerated, Telemetry = "Defender for Endpoint", SourceIP = RemoteIP, UserAgent = "",
        Target = strcat(DeviceName, ":", tostring(LocalPort)), Action = ActionType)
| extend Case = case(SourceIP in (CaseC_IP) or UserAgent == "Metabase-GHSA-vwf4/2.0", "C (Metabase)",
    SourceIP in (CaseB_IP), "B (app or API)", "User-Agent only")
| extend ToolUA = UserAgent in (CommonUA)
| summarize FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated), Events = count(),
    Targets = make_set(Target, 20), UserAgents = make_set(UserAgent, 5), Actions = make_set(Action, 5), WithToolUA = countif(ToolUA)
    by Case, Telemetry, SourceIP
| order by Case asc, Events desc
| take 200