Base Module option to disable extra enrichments

briandelmsft / STAT-Function

Azure Function for the Microsoft Sentinel Triage AssistanT (STAT)

https://aka.ms/mstat

MIT License

9 stars 1 forks source link

Base Module option to disable extra enrichments #93

Closed briandelmsft closed 2 months ago

briandelmsft commented 3 months ago

[x] Disable MFA/SSPR registration enrichment
[x] Disable Entra Roles enrichment
[x] Verify if there are any additional optional enrichments

When triaging an incident with a large number of account entities (observed with 100+, but possibly fewer), these optional enrichments can result in the logic app connector timing out