Forum Discussion
Solved
Some sign-in logs are missing.
Greetings, I have a technical question about log gathering in Sentinel. I am currently setting up an alarm for when there has been attempted more than 5 login attempts for users against the azure...
- Have you written this yourself, or used one of the Github examples, like this one? https://github.com/Azure/Azure-Sentinel/blob/45da87dec250017c0fd45cb55842e6d6cde8f1ee/Detections/SecurityEvent/gte_6_FailedLogons_10m.yaml
If you have 3 rows, its likely the other two rows of data are delayed, or the query needs altering to detect them, can you share the query?
Have you written this yourself, or used one of the Github examples, like this one? https://github.com/Azure/Azure-Sentinel/blob/45da87dec250017c0fd45cb55842e6d6cde8f1ee/Detections/SecurityEvent/gte_6_FailedLogons_10m.yaml
If you have 3 rows, its likely the other two rows of data are delayed, or the query needs altering to detect them, can you share the query?
If you have 3 rows, its likely the other two rows of data are delayed, or the query needs altering to detect them, can you share the query?
- It seems they were, as you said, delayed.
