Forum Discussion

Itay Argoety's avatar
Itay Argoety
Iron Contributor
Sep 02, 2018

Azure ATP & Your Advanced Audit Policy

A common issue with many security products is the lack of visibility as to the configuration status of your connectors, events and data sources. Without proper configuration, you organization remains...
EliOfek's avatar
EliOfek
Icon for Microsoft rankMicrosoft
Sep 08, 2018

Can you navigate to this path:

\\[DomainDnsName]\sysvol\[DomainDnsName]\Policies\{31B2F340-016D-11D2-945F-00C04FB984F9}\MACHINE\Microsoft\Windows NT\Audit\audit.csv

 

and let us know in each of the cases if the files was existing?

(replace DomainDnsName with your real full dns name...)

Paul_Brock's avatar
Paul_Brock
Brass Contributor
Sep 12, 2018

Any updates on this? Is the ATP team looking in the wrong location for the policy?

  • EliOfek's avatar
    EliOfek
    Icon for Microsoft rankMicrosoft
    Sep 12, 2018

    Yes,  It's a bug, a fix is on its way... not sure when it will be deployed yet, so for now I suggest to suppress the alert.

Resources