• Onboarding: Here
• Challenge 1: Here
• Challenge 2: Here
• Challenge 3: Here
• Challenge 4: This article
• Challenge 5: Here
• Challenge 6: Here
• Challenge 7: Here
• Challenge 8: Here
• Challenge 9: Coming soon
• Challenge 10: Coming soon

Dear Kusto Detective Agent,

It’s me, Gaia Budskott, the mayor of Digitown… I am writing to you because I am in desperate need of your help.

Recently, I have been caught up in not one, not two, but three different police investigations. The police suspect that I am behind a series of crimes that I have nothing to do with. My personal electricity and billing account was apparently undercharged for the past few months, and phishing calls were made from numbers associated with my office. To top it off, secret documents that belong to me were found in a garage where stolen cars were placed.

I am at my wit’s end and I don’t know who to turn to. I can’t ask the police for help because they think I’m the one behind all of this. That’s why I’m turning to you – perhaps you can help me figure out who is really behind all of this.

I suspect that someone has hacked into the Digitown municipality system and stolen these documents. Our system is a known data hub and hosts various information about the town itself, real-time monitoring systems of the city, tax payments, etc. It serves as a real-time data provider to many organizations around the world, so it receives a lot of traffic.

Unfortunately, I don’t have much data to give you. All I have is a 30-day traffic statistics report captured by the Digitown municipality system network routers.

I am hoping that your expertise and knowledge in big data analytics can help shed some light on who is behind these crimes and clear my name.

Please, can you help me?

Sincerely,
Gaia

Understanding what this case wants you to do can be a bit tricky, I found the training to be very useful this time around except for the focus on series_decompose_forecast, none of the solutions I’ve seen make use of this command, so I feel in this instance it is a little misleading. Instead check out these KQL commands make-series and series_decompose_anomalies.

//One of the great things about these challenges is the community collaboration that comes from them. Big thanks to the master Matt Zorich for giving me a hand with this one as my boxing match with the series_decompose_anomalies syntax did not end in my favour.

let cidr=
IpInfo;
let potentials=
NetworkMetrics
| make-series Clients=sum(BytesSent) on Timestamp step 12h by ClientIP
| extend outlier=series_decompose_anomalies(Clients)
| mv-expand outlier
| where outlier == 1
| distinct ClientIP
| evaluate ipv4_lookup(cidr, ClientIP, IpCidr)
| summarize count()by Info
| top 10 by count_
| distinct Info;
NetworkMetrics
| evaluate ipv4_lookup(cidr, ClientIP, IpCidr)
| where Info in (potentials)
| make-series Bytes=sum(BytesSent) default=0 on Timestamp step 12h by Info
| render timechart

//I’d also suggest checking out Lizel Hughs solution for a very elegant approach and bonus use of render anomalychart Season 2 Case 4: Triple trouble! | Liesel’s Tech Ramblings Blog (lieselhughes.com)