Forum Discussion
Terminated User Logons in Sentinel Query
Hello, Looking for a Query that will search within Sentinel for the last logon attempt for ALL terminated users over the past 11 months, please.
Watchlist template is available is Microsoft Sentinel
and here is an example of logic app for watchlist automation
Nice, thank you for the screenshot. I had no idea this was even here!