Forum Discussion
Airizzo
Jun 14, 2022Copper Contributor
How to pull new resources added to VMs using KQL
I'm having a issue with users creating apps in power apps, so now I want to make a KQL alert in sentinel that alerts me when a resource has been added. I thought about querying AAD, but not really sure where to start with that. Does anybody have any thoughts or can lead me into the next steps?
No RepliesBe the first to reply