Forum Discussion

Airizzo's avatar
Airizzo
Copper Contributor
Jun 14, 2022

How to pull new resources added to VMs using KQL

I'm having a issue with users creating apps in power apps, so now I want to make a KQL alert in sentinel that alerts me when a resource has been added. I thought about querying AAD, but not really sure where to start with that. Does anybody have any thoughts or can lead me into the next steps? 

No RepliesBe the first to reply

Resources