915
4,418
1,344
1,969
5,344
5,997
9,250
1,637
5,158
1,146
1,285
2,032
1,122
1,884
2,331
2,041
1,607
1,878
2,378
1,999
1,829
3,451
2,460
2,168
11.2K
1,434
3,002
3,564
2,597
4,289
Gary Bushey
in
Ingest Office 365 DLP Events into Azure Sentinel
on
12-05-2019
In the code example where you are searching for "DLPRuleMatch" why do
you do use where Operation contains "DLP" before where Operation ==
"DLPRuleMatch" ? Does that make the query faster?
0 Likes
Ofer_Shezaf
in
Azure Sentinel correlation rules: the join KQL operator
on
12-05-2019
Thanks @Gary Bushey! fixed. I really need to get an exception to run
Grammarly in Chrome. Corporate policy does not allow me which means I am
cutting and pasting parts back and forth, and those are the results :(
0 Likes
Gary Bushey
in
Azure Sentinel correlation rules: the join KQL operator
on
12-05-2019
I think in the line "By setting the If the join and additional
conditions return results, an alert is triggered. ", the first 3 words
should not be there. This is in the 3rd paragraph under the Correlating
using Joins header
0 Likes
Ofer_Shezaf
in
Using Azure Lighthouse and Azure Sentinel to Monitor Across Multiple Tenants
on
12-05-2019
@Thijs Lecomte : you can use ARM. See here and here.
2 Likes
Thijs Lecomte
in
Using Azure Lighthouse and Azure Sentinel to Monitor Across Multiple Tenants
on
12-04-2019
Is there any way to easily deploy playbooks to different tenants at
once? That way you can keep a baseline for all customers
0 Likes