Blog Post

Microsoft Sentinel Blog
6 MIN READ

Azure Sentinel: Performing Additional Security Monitoring of High-Value Accounts

shainw's avatar
shainw
Icon for Microsoft rankMicrosoft
Apr 11, 2019
Introduction   Most if not every environment has high-value accounts. These could be accounts with high privileges needed to perform administrative functions or accounts with access to sensitive ...
Updated Dec 07, 2021
Version 12.0
detection
investigation
threat hunting
shainw's avatar
Icon for Microsoft rankMicrosoft
Joined December 11, 2018
View Profile
Microsoft Sentinel Blog

Microsoft Sentinel is an industry-leading SIEM & AI-first platform powering agentic defense across the entire security ecosystem.

Ciyaresh's avatar
Ciyaresh
Brass Contributor
Sep 17, 2021

shainw I'm trying to do something like this but instead of having a list of users manually, I was hoping to use users within specific AD groups.  Is this somehow doable? The IdentityInfo table contains a lot of information about users, including the group memberships.