Forum Discussion

Brass Contributor

Jan 10, 2020

How to find the source IP of 4776 events?

Can Azure ATP help me in identifying the source IP of a 4776 event (The domain controller attempted to validate the credentials for an account)? Now often there is no source (IP/computer) informatio...

EliOfek

Microsoft

Jan 10, 2020

Duncan de Waal Turn on event 8004. this will allow AATP to show you more data.

see https://docs.microsoft.com/en-us/azure-advanced-threat-protection/configure-windows-event-collection