Microsoft Sentinel medium experimental kql

Trust Monitor Event

'This query identifies when a new trust monitor event is detected.'

View Source

Detection Logic

let timeframe = ago(5m);
DuoSecurityTrustMonitor_CL
| where TimeGenerated >= timeframe
| extend AccountName = tostring(split(surfaced_auth_user_name_s, "@")[0]), AccountUPNSuffix = tostring(split(surfaced_auth_user_name_s, "@")[1])

Field Validations

Loading…

Comments (0)

Loading comments...