Microsoft Sentinel informational experimental kql
New service account gained access to IaaS resource
This policy detects when an application or service account gained new access to your assets. This policy is defined by Authomize and can be edited to change the configuration.
Detection Logic
Authomize_v2_CL
| where ingestion_time() >= ago(30m)
| extend EventID = id_s, Policy = policy_name_s, Severity = severity_s,Description = description_s,Recommendation = recommendation_s,URL = url_s,Tactics = tactics_s
| where Policy has "New service account gained access to IaaS resource"
| project EventID, Policy, Severity, Description, Recommendation, URL, Category, TacticsField Validations
Loading…
Comments (0)
Loading comments...