SOLVED
Home

Can't drill into Sign-ins by location

%3CLINGO-SUB%20id%3D%22lingo-sub-437459%22%20slang%3D%22en-US%22%3ECan't%20drill%20into%20Sign-ins%20by%20location%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-437459%22%20slang%3D%22en-US%22%3E%3CP%3EHello%2C%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EI'm%20using%20the%20Sentinel%20preview%20and%20I%20have%20the%20Azure%20AD%20sign-in%20logs%20dashboard%20installed.%26nbsp%3B%20On%20the%20locations%20pane%20of%20that%20dashboard%20it%20shows%20a%20number%20of%20logins%20from%20China%2C%20but%20when%20I%20select%20to%20view%20that%20on%20the%20analytics%20pane%20it%20doesn't%20give%20me%20any%20details%20other%20than%20the%20number%20of%20logins.%26nbsp%3B%20Is%20there%20somewhere%20that%20i%20can%20drill%20into%20it%20to%20see%20which%20accounts%20are%20logging%20in%20from%20China%3F%26nbsp%3B%20I%20have%20MFA%20enabled%20via%20EMS%20and%20nothing%20is%20alerting%20in%20my%20Azure%20AD%20premium%20regarding%20risky%20logins%20so%20not%20sure%20why%20it%20would%20be%20saying%20there%20are%20logins%20from%20China.%3C%2FP%3E%3CP%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-inline%22%20style%3D%22width%3A%20822px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Fgxcuf89792.i.lithium.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F108294i9E0E69EA55EBE443%2Fimage-size%2Flarge%3Fv%3D1.0%26amp%3Bpx%3D999%22%20alt%3D%22china.PNG%22%20title%3D%22china.PNG%22%20%2F%3E%3C%2FSPAN%3E%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-438220%22%20slang%3D%22en-US%22%3ERe%3A%20Can't%20drill%20into%20Sign-ins%20by%20location%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-438220%22%20slang%3D%22en-US%22%3E%3CP%3EThe%20key%20is%20to%20remove%20the%20%22summarize%22%20line%20from%20the%20query.%26nbsp%3B%20Hope%20that%20helps%20someone%20else%20down%20the%20road%3C%2FP%3E%3C%2FLINGO-BODY%3E
Highlighted
New Contributor

Hello,

 

I'm using the Sentinel preview and I have the Azure AD sign-in logs dashboard installed.  On the locations pane of that dashboard it shows a number of logins from China, but when I select to view that on the analytics pane it doesn't give me any details other than the number of logins.  Is there somewhere that i can drill into it to see which accounts are logging in from China?  I have MFA enabled via EMS and nothing is alerting in my Azure AD premium regarding risky logins so not sure why it would be saying there are logins from China.

china.PNG

 

1 Reply
Highlighted
Solution

The key is to remove the "summarize" line from the query.  Hope that helps someone else down the road