Forum Discussion
Terminated User Logons in Sentinel Query
Hello,
Looking for a Query that will search within Sentinel for the last logon attempt for ALL terminated users over the past 11 months, please.
6 Replies
Highly suggest using a Watchlist to store the terminated employees. There is a template for it and, with the help of a Logic App that queries the Graph API, you can keep it up to date automatically.
- Are you able to share the template and likely Logic app that queries the Graph API?
Watchlist template is available is Microsoft Sentinel
and here is an example of logic app for watchlist automation
- Brad_Hill - You need to store the list terminated employees and the use the below query let list_of_terminated_employeed = dynamic(['email address removed for privacy reasons','email address removed for privacy reasons']); SigninLogs | where TimeGenerated >ago(365d) | summarize arg_max(TimeGenerated,*) by UserPrincipalName | where UserPrincipalName has_any (list_of_terminated_employeed) And you need to ensure that the Microsoft Sentinel Workspace has the retention for the time period you are looking for,
Thank you Samikroy, my apologies for just now seeing this answer.
