Forum Discussion
Self added to privliged groups
Can someone help me with an Sentinel Analytics Rule which alerts when someone adds himself to a privileged role. I found this one and I would like to modify it bit that it only triggers when someone ...
Hi, I want to be alerted only when someone add himself to a PIM role, so not when someone is added to a PIM role
Please, try this:
AuditLogs
| where Category =~ "RoleManagement"
| where AADOperationType in ("ActivateRole")
| where ActivityDisplayName has_any ("Add eligible member to role", "Add member to role")
| extend DisplayName = TargetResources[0].displayName
| where DisplayName contains "Admin"
| extend InitiatorUser = parse_json(tostring(InitiatedBy.user)).userPrincipalName
| extend TargetUser = tostring(TargetResources[2].userPrincipalName)
| extend check = iif(InitiatorUser == TargetUser, "Success", "Fail")
| where check == "Success"
| summarize by bin(TimeGenerated, 1h), OperationName, tostring(DisplayName), TargetUser, tostring(InitiatorUser), Result
Please, note that the query depends on your environment and there can be some changes.
- Yes, you are right, this is activation.
Did you mean "when a user provides himself with an opportunity to activate a role" -> "configure role assignment for himself"?