Forum Discussion
Terminated User Logons in Sentinel Query
Hello, Looking for a Query that will search within Sentinel for the last logon attempt for ALL terminated users over the past 11 months, please.
Highly suggest using a Watchlist to store the terminated employees. There is a template for it and, with the help of a Logic App that queries the Graph API, you can keep it up to date automatically.
- Are you able to share the template and likely Logic app that queries the Graph API?
Watchlist template is available is Microsoft Sentinel
and here is an example of logic app for watchlist automation
Nice, thank you for the screenshot. I had no idea this was even here!
