Forum Discussion

akshay250692's avatar
akshay250692
Brass Contributor
Mar 02, 2023

calling AD group in analytical rule in place of watchlist

Hi Team,   can it be possible to use AD group in analytical rule in place of watchlist?   if possible then how it can be done ?
KQL
siem
abdul1998's avatar
abdul1998
Copper Contributor
Mar 06, 2023
IdentityInfo
| where GroupMembership in ""
| distinct AccountName, GroupMembership


please check this