Closed erikgruetter closed 3 months ago
Hi, thank you for the request. Can you change the Sentinel query to match the tables available in Sentinel?
@Bert-JanP sorry, I thought the tables were available in Sentinel too from my research. I have now removed the Sentinel Query (at the moment I don't have access to a Sentinel Environment).
No problem at all! I will add the Sentinel table in their with the same logic once I return from the EU Cloud Summit. Thanks for this addition!
Hey there This detection rule would be able to detect if any activity is performed from a cloud break glass account. this helps to monitor any activities performed by these accounts.