Forum Discussion
The leaver who never left: tuning a Sentinel detection from 103 rows to one alert
Most account compromise detections look for something odd: a new country, an impossible journey, or a sign-in at 3 AM. I wanted to catch a case where nothing looks odd at all. Someone leaves the ...
Thanks UriShay, great point. I only used the 7-day lookback for the scheduled rule, but you're totally right about the hunting side. If they've been signing in for weeks, the first sign-in after the LeaveDate is definitely the anchor point for figuring out what they touched. I'll add a hunting query to the GitHub repo that uses the LeaveDate as the lower bound instead of ago(7d). Appreciate the suggestion.