Forum Discussion
calling AD group in analytical rule in place of watchlist
Hi Team, can it be possible to use AD group in analytical rule in place of watchlist? if possible then how it can be done ?
AD or AAD?
UEBA helps here...the "IdentityInfo" table, holds the GroupMemberShip:
https://techcommunity.microsoft.com/t5/microsoft-sentinel-blog/what-s-new-identityinfo-table-is-now-in-public-preview/ba-p/2571037
UEBA helps here...the "IdentityInfo" table, holds the GroupMemberShip:
https://techcommunity.microsoft.com/t5/microsoft-sentinel-blog/what-s-new-identityinfo-table-is-now-in-public-preview/ba-p/2571037