1,506
6,711
1,484
2,160
5,497
6,056
9,616
1,758
5,313
1,248
1,361
2,141
1,186
1,944
2,402
2,102
1,647
1,926
2,429
2,031
1,886
3,493
2,583
2,200
11.4K
1,478
3,091
3,950
2,687
4,334
Ashwin_Patil
in
Hunting for Capital One Breach TTPs in AWS logs using Azure Sentinel - Part I
on
12-10-2019
Thanks @cteodor . the screenshots should show cloudgoat profile as i am
using it, i have edited article with the correct screenshots.
0 Likes
cteodor
in
Hunting for Capital One Breach TTPs in AWS logs using Azure Sentinel - Part I
on
12-10-2019
Uhm, on step 2 you did aws configure --profile cloudgoat but later on
after "verify that config and credential files are correctly populated"
we can see only [default], are you using the profile or the default
settings?
0 Likes
Gary Bushey
in
Ingest Office 365 DLP Events into Azure Sentinel
on
12-05-2019
In the code example where you are searching for "DLPRuleMatch" why do
you do use where Operation contains "DLP" before where Operation ==
"DLPRuleMatch" ? Does that make the query faster?
0 Likes
Ofer_Shezaf
in
Azure Sentinel correlation rules: the join KQL operator
on
12-05-2019
Thanks @Gary Bushey! fixed. I really need to get an exception to run
Grammarly in Chrome. Corporate policy does not allow me which means I am
cutting and pasting parts back and forth, and those are the results :(
0 Likes
Gary Bushey
in
Azure Sentinel correlation rules: the join KQL operator
on
12-05-2019
I think in the line "By setting the If the join and additional
conditions return results, an alert is triggered. ", the first 3 words
should not be there. This is in the 3rd paragraph under the Correlating
using Joins header
0 Likes