Sagan informational stable other

[MICROSOFT_INTUNE] Enrollment Operation Log Detected

[MICROSOFT_INTUNE] Enrollment Operation Log Detected

View Source

Detection Logic

alert any $HOME_NET any -> $HOME_NET any (msg:"[MICROSOFT_INTUNE] Enrollment Operation Log Detected"; program:azureEventHub; json_content:".category","OperationalLogs"; json_content:".operationName","Enrollment"; parse_src_ip:1; normalize; reference:url,https://learn.microsoft.com/en-us/graph/api/resources/intune-devices-manageddevice?view=graph-rest-1.0; classtype:system-event; sid:5017039; rev:1; metadata:created_at 2024_01_20, updated_at 2024_01_20;)

Field Validations

Loading…

Comments (0)

Loading comments...