Event banner
Event details
While there is no immediate correlation for MDI with that specific Sentinel workbook, MDI has various security assessments, including detection of NTLMv1 and LDAP Simple Bind activities that is also used on that workbook, you can find them all in Microsoft Secure Score feature at the Microsoft 365 Defender portal (Filter for Defender for identity)
Does that have a requirement for that requisite auditing to be enabled as with the Sentinel Workbook.. I have a customer who has required to be able to report on things such as PlainText LDAP etc. but is const sensitive especially w.r.t Sentinel
- Yes, a couple of non default audit configurations on the DCs are required, see here https://docs.microsoft.com/en-us/defender-for-identity/configure-windows-event-collection